Archive
February 2020
Vulnerabilities first published in this month (UTC), newest first.
63 results · Clear filters · Feed
-
Critical 9.8
OS Command Injection in enpeem
enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization.
-
Critical 9.8
OS Command Injection in giting
giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull()" is executed by the package without any validation.
-
Critical 9.8
push-dir Enables OS Command Injection
push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.js#L139". This could be abused by an attacker to inject arbitrary …
-
Critical 9.8
OS Command Injection in serial-number
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
-
Critical 9.8
OS Command Injection and Command Injection in kill-port-process
The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.
-
Critical 9.8
Improper Input Validation and Code Injection in pdf-image
Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.
-
Critical 9.9
An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Mox…
-
Critical 9.9
An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa A…
-
Critical 9.9
An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131…
-
Critical 9.0
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
-
Critical 9.8
Improper Privilege Management in Tomcat
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…
KEV Mar 3, 2022 -
Critical 9.8
OS Command Injection in compile-sass
compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "dist/index.js" is executed as part of the "rm" command without any sanitization.
-
Critical 9.8
OS Command Injection in rpi
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.
-
Critical 9.8CVE-2020-4222 EPSS 15%
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By u…
-
Critical 9.8CVE-2020-4213 EPSS 15%
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By u…
-
Critical 9.8CVE-2020-4211 EPSS 71%
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By u…
-
Critical 9.8CVE-2020-4212 EPSS 15%
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By u…
-
Critical 9.8CVE-2020-4210 EPSS 15%
IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By u…
-
Critical 9.8
Adobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation coul…
-
Critical 9.8
Ansible Remote Code Execution
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
-
Critical 9.8
Ansible Code Injection Vulnerability
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.
-
Critical 9.8
Cisco Smart Software Manager On-Prem Static Default Credential Vulnerability
A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account…
-
Critical 9.8
Deserialization of Untrusted Data in JYaml
JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
-
Critical 9.8
Deserialization of Untrusted Data in PyYAML
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
-
Critical 9.8
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is ena…
KEV Feb 17, 2026 -
Critical 9.3
phpMyChat-Plus 1.98 is vulnerable to multiple SQL injections against the deluser.php Delete User functionality, as demo…
-
Critical 9.8
promise-probe OS command injection vulnerability
promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization.
-
Critical 9.8
Ansible Arbitrary Code Execution
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2…
-
Critical 9.8
Ansible Arbitrary Code Execution
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 d…
-
Critical 9.8
Zend Framework SQL injection vulnerability
SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.
-
Critical 9.8
Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.
-
Critical 9.8
Code Injection in script-manager
An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library o…
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGe…
-
Critical 9.8
Potential Command Injection in libnotify
libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.
-
Critical 9.8
Potential Command Injection in hubot-scripts
scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands.
-
Critical 9.8
JGit Improper Input Validation vulnerability
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up…
-
Critical 9.8
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles pag…
KEV Sep 18, 2024 -
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll JPEG SOFx parser of the Accusoft ImageGear…
-
Critical 9.8
An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFF tifread parser of the Accusoft ImageG…