#cwe-78

共收录 1627 条相关情报。

漏洞预警2026-09-03 发布INFO

Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 m...

CVE-2026-85012

Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Ama

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布INFO

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the ext...

CVE-2026-84967

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection strin

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布INFO

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a...

CVE-2026-71963

Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布INFO

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability...

CVE-2026-35160

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements use

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布INFO

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative priv...

CVE-2025-12737

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This ov

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布HIGH

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys...

CVE-2026-85168

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node

来源摘录 · NVD

#cve #cwe-78

漏洞预警2026-09-03 发布INFO

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component...

CVE-2026-85040

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval o

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-09-03 发布INFO

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged...

CVE-2026-84832

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow w

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-502

漏洞预警2026-09-03 发布INFO

SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated administrators to execute commands with elevated privileges.

CVE-2026-84830

SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticated adminis

历史摘要 · 未重新核验 · NVD

#cve #cwe-78 #cwe-269

安全公告2026-09-03 发布INFO

n8n before 1.123.73 Remote Code Execution via Git Node

CVE-2026-85168

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

安全公告2026-09-02 发布INFO

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

CVE-2026-73667

### Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlle

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-78 #severity:high

安全公告2026-09-02 发布INFO

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary com

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

安全公告2026-09-02 发布INFO

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename o

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

安全公告2026-09-02 发布INFO

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers...

CVE-2026-84675

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build en

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

漏洞预警2026-09-02 发布INFO

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on...

CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-02 发布INFO

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio local Docker platform, the function namespace is interpolated...

CVE-2026-79755

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio loca

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-09-02 发布INFO

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio controller builds a curl invocation string for each cron trigger...

CVE-2026-52831

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio control

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-09-02 发布INFO

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

CVE-2026-52831

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.4, the Nuclio control

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

安全公告2026-09-02 发布INFO

Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauth

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

安全公告2026-09-02 发布INFO

Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

CVE-2026-79755

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, on the Nuclio loca

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78