#cwe-78

共收录 1612 条相关情报。

漏洞预警2026-10-12 发布INFO

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server.

CVE-2026-105407

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-12 发布INFO

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run_shell in the library libs/agno/agno/tools/coding.py of t...

CVE-2026-108817

A vulnerability was determined in agno-agi agno up to 3.0.9. Affected by this issue is the function agno.CodingTools.run

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-12 发布INFO

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Mana...

CVE-2026-108804

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fw

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-11 发布INFO

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects. Attacke...

CVE-2026-108744

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pb

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-11 发布INFO

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the ar...

CVE-2026-108576

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the compon

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

安全公告2026-10-11 发布INFO

pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

CVE-2026-108744

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pb

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

漏洞预警2026-10-11 发布INFO

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation ca...

CVE-2026-108540

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of

历史摘要 · 未重新核验 · NVD

#cve #cwe-77 #cwe-78

漏洞预警2026-10-10 发布INFO

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with mali...

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote at

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-10 发布INFO

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls ...

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauth

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-10-10 发布INFO

Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration

CVE-2026-108546

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote at

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

安全公告2026-10-10 发布INFO

FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

CVE-2026-108161

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauth

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

漏洞预警2026-10-10 发布INFO

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media pat...

CVE-2026-101947

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

漏洞预警2026-10-09 发布INFO

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to comman...

CVE-2026-55797

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-10-09 发布INFO

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

CVE-2026-55797

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-78

安全公告2026-10-09 发布INFO

Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL

CVE-2026-55797

### Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a p

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-78 #severity:high

安全公告2026-10-09 发布INFO

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary...

CVE-2026-84057

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to imprope

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-78 #severity:high

漏洞预警2026-10-08 发布INFO

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVE-2026-84057

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to imprope

历史摘要 · 未重新核验 · NVD

#cve #cwe-78

安全公告2026-10-08 发布INFO

PraisonAI: Shell command allowlist bypass via find -exec built-in action

CVE-2026-61434

### Summary The shell command execution hardening introduced in PraisonAI npm 1.7.2 / Python 4.6.58 to fix GHSA-5jv7-2m

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-78 #cwe-693 #severity:high

安全公告2026-10-08 发布INFO

PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls

CVE-2026-61445

### Summary The `AICoder` UI component exposes `write_to_file` and `execute_command` tools to the LLM with no path valid

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #cwe-78 #severity:critical

漏洞预警2026-10-08 发布INFO

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can injec...

CVE-2026-84278

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper c

历史摘要 · 未重新核验 · NVD

#cve #cwe-78