CVE Vulnerability Catalog

OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when constructing shell commands.

OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction.

The Finger plugin for Rapid7 InsightConnect on Linux contains an OS Command Injection vulnerability. An authenticated attacker can execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.

The Ping plugin for Rapid7 InsightConnect on Linux is vulnerable to OS command injection. Remote attackers can execute arbitrary commands via the host parameter due to insufficient input validation when constructing shell commands.

OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.

OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.

Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter.

Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation.

In the OpenBSD kernel up to version 7.9, a use-after-free vulnerability exists in sys/kern/sysv_sem.c, allowing local privilege escalation to root. The issue occurs after a context switch following the tsleep call in sys_semget().

A vulnerability in Quest NetVault Backup allows remote code execution via command injection in the NVBULogDaemon process. The issue stems from improper validation of user-supplied data before using it in a system call, allowing an attacker to execute code in the SYSTEM context. Authentication is required, but the existing authentication mechanism can be bypassed.

SQL Injection vulnerability in the NVBUDashboard component of Quest NetVault Backup allows remote code execution. The flaw results from improper validation of user-supplied data before using it in SQL queries, enabling an attacker to execute code in the context of the NETWORK SERVICE account. Authentication is required but the existing authentication mechanism can be bypassed.

A vulnerability in Quest NetVault Backup allows remote code execution via SQL injection in the NVBULibrarySlot component. Authentication is required but can be bypassed. The flaw stems from improper validation of user-supplied data used in SQL queries.

A vulnerability in Quest NetVault Backup allows remote code execution via SQL injection in the NVBULibraryPort component. Authentication is required but can be bypassed.

SQL Injection vulnerability in the NVBURemovableMedia component of Quest NetVault Backup allows remote attackers to execute arbitrary code. The flaw stems from improper validation of user-supplied data before using it in SQL queries, and the existing authentication mechanism can be bypassed.

SQL Injection vulnerability in Quest NetVault Backup allows remote code execution. The flaw exists in the NVBUDeviceDrive component during JSON-RPC message processing, where lack of user input validation leads to SQL injection. Authentication is required but can be bypassed.

A vulnerability in Quest NetVault Backup allows remote code execution via SQL injection in the NVBURASDevice component. Authentication is required but can be bypassed.

A vulnerability in Quest NetVault Backup's addclient3 component allows an attacker to bypass authentication via script injection. User interaction is required, as the target must visit a malicious page or open a malicious file.

The RPM plugin for Rapid7 InsightConnect on Linux contains an OS command injection vulnerability. An authenticated attacker can execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization.

The SQLmap plugin for Rapid7 InsightConnect on Linux contains an OS command injection vulnerability. Authenticated attackers can execute arbitrary OS commands via the api_host or api_port parameters during connection configuration due to insufficient input validation.

A vulnerability in Quest NetVault Backup allows remote code execution via SQL injection in the NVBUDashboard component. Authentication is required but can be bypassed. The issue stems from improper validation of user-supplied data before use in SQL queries.