Information security
fromScala-lang
4 days agoFixing a Command Injection Vulnerability in sbt
A command injection vulnerability in sbt on Windows has been fixed, affecting versions since sbt 0.9.5.
#command-injection
#command-injection
[ follow ]
#remote-code-execution #vulnerability #security #rondodox #meteobridge #cve-2025-4008 #cisa-kev #sbt
fromThe Hacker News
1 month agoCISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog
A malicious unauthenticated actor may exploit this issue to execute arbitrary commands, which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. The shortcoming was addressed, along with CVE-2026-22720, a stored cross-site scripting vulnerability, and CVE-2026-22721, a privilege escalation vulnerability that could result in administrative access.
Information security
fromSecurityWeek
1 month agoZyxel Patches Critical Vulnerability in Many Device Models
An attacker could exploit the flaw via crafted UPnP SOAP requests to execute OS commands on a vulnerable device. It is important to note that WAN access is disabled by default on these devices, and the attack can be carried out remotely only if both WAN access and the vulnerable UPnP function have been enabled.
Information security
Information security
fromZero Day Initiative
1 month agoZero Day Initiative - CVE-2025-6978: Arbitrary Code Execution in the Arista NG Firewall
Arista NG Firewall's runTroubleshooting() fails to properly validate inputs, enabling command injection by passing unsanitized environment variables to network-troubleshooting.sh.
Information security
fromThe Hacker News
2 months agoCoolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances
Multiple critical command-injection and information-disclosure vulnerabilities in Coolify allow authenticated or low-privileged users to achieve remote code execution, container escape, and root compromise.
Information security
fromThe Hacker News
6 months agoCISA Flags Meteobridge CVE-2025-4008 Flaw as Actively Exploited in the Wild
Meteobridge contains a command-injection vulnerability (CVE-2025-4008) allowing unauthenticated remote attackers to execute arbitrary commands as root; vulnerability is actively exploited and patched in version 6.
Information security
fromThe Hacker News
6 months agoFortra GoAnywhere CVSS 10 Flaw Exploited as 0-Day a Week Before Public Disclosure
An unsafe deserialization flaw (CVE-2025-10035) in Fortra GoAnywhere permits unauthenticated command injection and was actively exploited in the wild by at least September 10, 2025.
Information security
fromSecurityWeek
6 months agoLibraesva Email Security Gateway Vulnerability Exploited by Nation-State Hackers
A command-injection vulnerability in Libraesva ESG allows arbitrary shell command execution via crafted compressed email attachments; patches available for ESG 5.x while 4.x is discontinued.
Information security
fromThe Hacker News
6 months agoChaos Mesh Critical GraphQL Flaws Enable RCE and Full Kubernetes Cluster Takeover
Multiple critical Chaos Mesh vulnerabilities allow minimal in-cluster attackers to execute commands, disrupt services, steal tokens, and potentially achieve cluster-wide takeover.
[ Load more ]