CVE Vulnerability Catalog

A stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote code-execution, via sending a flow-spec update which is selected for re-advertisement.

An improper authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to bypass J-Web authentication and execute CGI content with elevated privileges via a crafted HTTP request.

An integer underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo configured allows an unauthenticated, network-based attacker to cause a denial of service by a kernel crash.

An Improper Authentication vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated remote attacker to execute arbitrary Junos commands with root privileges via the exposed J-Web interface.

A Heap-based Buffer Overflow in the SVR component of Junos OS on SRX Series allows an unauthenticated network attacker to cause denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets.

Dell Terraform Provider for Redfish before version 1.6.2 contains an Improper Certificate Validation vulnerability in the HTTP transport component, allowing an unauthenticated attacker to intercept all Redfish BMC traffic including credentials via man-in-the-middle attack.

Dokku before 0.38.25 allows a user with app-level access and remote SSH to store arbitrary strings via docker-options, which are later concatenated into DOCKER_ARGS and processed by Bash eval, leading to arbitrary command execution with dokku user privileges.

Zulip Server through 12.1 has a vulnerability in GenericOpenIdConnectBackend that does not reject an explicitly false email_verified claim, allowing login to an existing account if a misconfigured trusted identity provider returns an email address not controlled by the user.

Gitea's Org-mode markup renderer processes INCLUDE directives without preventing access to server-side files, allowing an unauthenticated attacker to read files accessible to the Gitea service account and potentially execute commands via Git hook modification.

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() allowing attackers to execute commands by supplying shell metacharacters in file paths, with Python process privileges.

Stills before 25.24.2 contains an OS command injection vulnerability allowing attackers to execute shell commands by supplying crafted media file paths, with Node.js process privileges.

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability allowing attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines, with Node.js process privileges.

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() allowing attackers to execute commands by supplying crafted audio file paths, with Node.js process privileges.

transcribe2texts through 1.0.6 contains an OS command injection vulnerability. Attackers can supply crafted audioPath values to transcribeAudio(), injecting $() or backtick substitution into the unescaped path passed to child_process.exec(), executing commands with Node.js process privileges.

Whisper-node through 1.1.1 contains an OS command injection vulnerability. Attackers can supply crafted filePath or whisperOptions.language values to whisper(), injecting shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec(), executing commands with Node.js process privileges.

@mborne/extract before 0.2.1 contains an OS command injection vulnerability. Attackers can supply shell metacharacters in archivePath or targetDir options passed to extract(), injecting commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

doc-recog through 1.1.6 contains an OS command injection vulnerability. Attackers can supply crafted document paths to recog() or tag(), embedding $(...) or backtick command substitution in the file path that DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.

pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that build shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True, executing OS commands as the Python process.

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

git-diff before 2.0.7 contains an OS command injection vulnerability. Attackers can supply crafted strings to the gitDiff API, embedding $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.