NoMachine vulnerabilities

An unspecified server utility in NoMachine before version 5.3.10 on Mac OS X and Linux allows authenticated users to gain privileges by accessing local files.

Vulnerability in NoMachine in the getstat service is due to lack of proper validation of a user-supplied string before using it to execute a system call. A remote authenticated attacker can exploit this flaw to execute arbitrary code in the context of the service account.

An Argument Injection vulnerability was found in NoMachine before versions 9.5.7 and 8.23.2. The flaw is due to improper neutralization of argument delimiters in a command, allowing an attacker to inject malicious arguments.