CWE-88

{
  "affected": [],
  "aliases": [
    "CVE-2021-41316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-17T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can inject an extra argument to overwrite arbitrary files as the root user on the Remote Collector.",
  "id": "GHSA-95jv-r6j9-p8xr",
  "modified": "2022-05-24T19:14:58Z",
  "published": "2022-05-24T19:14:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41316"
    },
    {
      "type": "WEB",
      "url": "https://blog.device42.com/2021/09/critical-fixes-in-17-05-01"
    },
    {
      "type": "WEB",
      "url": "https://docs.device42.com/auto-discovery/nmap-autodiscovery"
    },
    {
      "type": "WEB",
      "url": "https://docs.device42.com/auto-discovery/remote-collector-rc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-6453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-18T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).",
  "id": "GHSA-95vj-g5cr-7j53",
  "modified": "2022-05-13T01:22:42Z",
  "published": "2022-05-13T01:22:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6453"
    },
    {
      "type": "WEB",
      "url": "https://github.com/proofofcalc/cve-2019-6453-poc"
    },
    {
      "type": "WEB",
      "url": "https://proofofcalc.com/advisories/20190218.txt"
    },
    {
      "type": "WEB",
      "url": "https://proofofcalc.com/cve-2019-6453-mIRC"
    },
    {
      "type": "WEB",
      "url": "https://twitter.com/proofofcalc/status/1097518413143003136"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46392"
    },
    {
      "type": "WEB",
      "url": "https://www.mirc.com/news.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-20260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-17T17:15:10Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacker could exploit this vulnerability by issuing a command on the CLI with malicious options. A successful exploit could allow the attacker to gain the escalated privileges of the root user on the underlying operating system.",
  "id": "GHSA-96c9-2v9p-9chw",
  "modified": "2024-01-17T18:31:38Z",
  "published": "2024-01-17T18:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20260"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow-providers-odbc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-34395"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-30T20:26:04Z",
    "nvd_published_at": "2023-06-27T12:15:13Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.\nIn OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.\nStarting version 4.0.0 driver can be set only from the hook constructor.\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0.\n\n",
  "id": "GHSA-9766-v29c-4vm7",
  "modified": "2023-07-06T16:02:24Z",
  "published": "2023-06-27T12:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34395"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/31713"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/airflow"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Airflow ODBC Provider Argument Injection vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-31909"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-11T12:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.",
  "id": "GHSA-97gq-9pf7-vwvc",
  "modified": "2022-05-24T19:02:08Z",
  "published": "2022-05-24T19:02:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31909"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com"
    },
    {
      "type": "WEB",
      "url": "https://blog.jetbrains.com/blog/2021/05/07/jetbrains-security-bulletin-q1-2021"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-27129"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-06T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the affected application. An attacker could exploit this vulnerability by sending malicious requests to the affected application. A successful exploit could allow the attacker to inject arbitrary commands and potentially gain elevated privileges.",
  "id": "GHSA-97vg-w35f-v8mj",
  "modified": "2022-05-24T17:33:19Z",
  "published": "2022-05-24T17:33:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27129"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-privilege-zPmMf73k"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-11024"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-10-16T22:29:00Z",
    "severity": "HIGH"
  },
  "details": "kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 1077435789 and cause a kernel crash.",
  "id": "GHSA-98hc-4m3w-636x",
  "modified": "2022-05-14T01:54:10Z",
  "published": "2022-05-14T01:54:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11024"
    },
    {
      "type": "WEB",
      "url": "https://github.com/datadancer/HIAFuzz/blob/master/CVEs.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix-transport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.42.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gix"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.62"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "gitoxide"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32884"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-15T19:33:03Z",
    "nvd_published_at": "2024-04-26T18:15:46Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitrary code execution occurs.\n\n### Details\n\nThis is related to the patched vulnerability https://github.com/advisories/GHSA-rrjw-j4m2-mf34, but appears less severe due to a greater attack complexity. Since https://github.com/Byron/gitoxide/pull/1032, `gix-transport` checks the host and path portions of a URL for text that has a `-` in a position that will cause `ssh` to interpret part of all of the URL as an option argument. But it does not check the non-mandatory username portion of the URL.\n\nAs in Git, when an address is a URL of the form `ssh://username@hostname/path`, or when it takes the special form `username@hostname:dirs/repo`, this is treated as an SSH URL. `gix-transport` will replace some characters in `username` with their `%`-based URL encodings, but otherwise passes `username@hostname` as an argument to the external `ssh` command. This happens even if `username` begins with a hyphen. In that case, `ssh` treats that argument as an option argument, and attempts to interpret and honor it as a sequence of one or more options possibly followed by an operand for the last option.\n\nThis is harder to exploit than GHSA-rrjw-j4m2-mf34, because the possibilities are constrained by:\n\n- The difficulty of forming an option argument `ssh` accepts, given that characters such as `=`, `/`, and `\\`, are URL-encoded, `:` is removed, and the argument passed to `ssh` contains the `@` sign and subsequent host identifier, which in an effective attack must be parseable as a suffix of the operand passed to the last option.\n\n  The inability to include a literal `=` prevents the use of `-oNAME=VALUE` (e.g., `-oProxyCommand=payload`). The inability to include a literal `/` or `\\` prevents smuggling in a path operand residing outside the current working directory, incuding on Windows. (Although a `~` character may be smuggled in, `ssh` does not perform its own tilde expansion, so it does not form an absolute path.)\n\n- The difficulty, or perhaps impossibility, of completing a connection (other than when arbitrary code execution has been achieved). This complicates or altogether prevents the use of options such as `-A` and `-X` together with a connection to a real but malicious server. The reason a connection cannot generally be completed when exploiting this vulnerability is that, because the argument `gix-transport` intends as a URL is treated as an option argument, `ssh` treats the subsequent non-option argument `git-upload-pack` as the host instead of the command, but it is not a valid host name.\n\n  Although `ssh` supports aliases for hosts, even if `git-upload-pack` could be made an alias, that is made difficult by the URL-encoding transformation.\n\nHowever, an attacker who is able to cause a specially named `ssh` configuration file to be placed in the current working directory can smuggle in an `-F` option referencing the file, and this allows arbitrary command execution.\n\nThis scenario is especially plausible because programs that operate on git repositories are often run in untrusted git repositories, sometimes even to operate on another repository. Situations where this is likely, such that an attacker could predict or arrange it, may for some applications include a malicious repository with a malicious submodule configuration.\n\nOther avenues of exploitation exist, but appear to be less severe. For example, the `-E` option can be smuggled to create or append to a file in the current directory (or its target, if it is a symlink). There may also be other significant ways to exploit this that have not yet been discovered, or that would arise with new options in future versions of `ssh`.\n\n### PoC\n\nTo reproduce the known case that facilitates arbitrary code execution, first create a file in the current directory named `configfile@example.com`, of the form\n\n```text\nProxyCommand payload\n```\n\nwhere `payload` is a command with an observable side effect. On Unix-like systems, this could be `date | tee vulnerable` or an `xdg-open`, `open`, or other command command to launch a graphical application. On Windows, this could be the name of a graphical application already in the search path, such as `calc.exe`.\n\n(Although the syntax permitted in the value of `ProxyCommand` may vary by platform, this is not limited to running commands in the current directory. That limitation only applies to paths directly smuggled in the username, not to the contents of a separate malicious configuration file. Arbitrary other settings may be specified in `configfile@example.com` as well.)\n\nThen run:\n\n```sh\ngix clone \u0027ssh://-Fconfigfile@example.com/abc\u0027\n```\n\nOr:\n\n```sh\ngix clone -- \u0027-Fconfigfile@example.com:abc/def\u0027\n```\n\n(The `--` is required to ensure that `gix` is really passing the argument as a URL for use in `gix-transport`, rather than interpreting it as an option itself, which would not necessarily be a vulnerability.)\n\nIn either case, the payload specified in `configfile@example.com` runs, and its side effect can be observed.\n\nOther cases may likewise be produced, in either of the above two forms of SSH addresses. For example, to create or append to the file `errors@example.com`, or to create or append to its target if it is a symlink:\n\n```sh\ngix clone \u0027ssh://-Eerrors@example.com/abc\u0027\n```\n\n```sh\ngix clone -- \u0027-Eerrors@example.com:abc/def\u0027\n```\n\n### Impact\n\nAs in https://github.com/advisories/GHSA-rrjw-j4m2-mf34, this would typically require user interaction to trigger an attempt to clone or otherwise connect using the malicious URL. Furthermore, known means of exploiting this vulnerability to execute arbitrary commands require further preparatory steps to establish a specially named file in the current directory. The impact is therefore expected to be lesser, though it is difficult to predict it with certainty because it is not known exactly what scenarios will arise when using the `gix-transport` library.\n\nUsers who use applications that make use of `gix-transport` are potentially vulnerable, especially:\n\n- On repositories with submodules that are automatically added, depending how the application manages submodules.\n- When operating on other repositories from inside an untrusted repository.\n- When reviewing contributions from untrusted developers by checking out a branch from an untrusted fork and performing clones from that location.\n",
  "id": "GHSA-98p4-xjmm-8mfh",
  "modified": "2024-07-05T18:07:37Z",
  "published": "2024-04-15T19:33:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Byron/gitoxide/security/advisories/GHSA-98p4-xjmm-8mfh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32884"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Byron/gitoxide"
    },
    {
      "type": "WEB",
      "url": "https://rustsec.org/advisories/RUSTSEC-2024-0335.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "gix-transport indirect code execution via malicious username"
}

{
  "affected": [],
  "aliases": [
    "CVE-2006-1865"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-04-21T23:06:00Z",
    "severity": "HIGH"
  },
  "details": "Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.",
  "id": "GHSA-9cg4-j3w9-fwph",
  "modified": "2022-05-01T06:53:37Z",
  "published": "2022-05-01T06:53:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-1865"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189282"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26104"
    },
    {
      "type": "WEB",
      "url": "http://lists.seifried.org/pipermail/security/2006-April/013163.html"
    },
    {
      "type": "WEB",
      "url": "http://scary.beasts.org/security/CESA-2006-002.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/19778"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/19781"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/19897"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/linux/security/advisories/2006_04_28.html"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/24938"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/17611"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2003-0907"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2004-06-01T04:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.",
  "id": "GHSA-9h96-28m7-7h3g",
  "modified": "2025-04-03T03:59:27Z",
  "published": "2022-04-29T01:27:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0907"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15704"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1000"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A904"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:1000"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:904"
    },
    {
      "type": "WEB",
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020065.html"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=108196864221676\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://www.ciac.org/ciac/bulletins/o-114.shtml"
    },
    {
      "type": "WEB",
      "url": "http://www.idefense.com/application/poi/display?id=100\u0026type=vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/260588"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/10119"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA04-104A.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}