OS & kernel CVEs.

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application appends the attacker-controlled Host value to a ping command, serializes the command as a single string, and executes it through sh -c. A local attacker who can create or modify a Watcher service can inject shell syntax and execute arbitrary commands with the PingTools application UID and its granted Android permissions.

Injection OS & kernel

Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.

Code execution OS & kernel Microsoft Windows 10 1607

OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.

Injection OS & kernel

Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.

Code execution OS & kernel Microsoft Windows 10 1607

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.

Injection OS & kernel

The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is caused by a lack of input validation when the service uses network interface names to execute system utilities, resulting in command injection. An unprivileged local user with permissions to modify network interface names can exploit this by renaming a network interface to include a malicious shell payload via System Settings. When the "Log out from your IdP" action is subsequently triggered, the wapptunneld service processes the poisoned interface name, leading to the execution of arbitrary commands with root privileges.

Injection OS & kernel

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.

Injection OS & kernel

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP servers, which execute when index.js passes them unescaped to powershell -EncodedCommand.

Injection OS & kernel

Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.

Injection OS & kernel

Integer underflow (wrap or wraparound) in Windows WLAN Service allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 11 23h2

Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1809

Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1809

Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows Server 2012

Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network.

Other OS & kernel Microsoft Windows 10 1607

Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows DNS allows an authorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows Server 2022

Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.

Disclosure OS & kernel Microsoft Windows 10 1607

Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.

Denial of service OS & kernel Microsoft Windows 10 1607

Improper enforcement of behavioral workflow in Windows DNS allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows Server 2019

Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.

Other OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows Server 2012

Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a network.

Other OS & kernel Microsoft Windows 10 1607

Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service over a network.

Denial of service OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 21h2

Allocation of resources without limits or throttling in OpenSSH for Windows allows an unauthorized attacker to deny service over a network.

Denial of service OS & kernel Microsoft Windows 10 1809

Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.

Denial of service OS & kernel Microsoft Windows 10 1607

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.

Injection OS & kernel

Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607

Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.

Memory safety OS & kernel Microsoft Windows 10 1607