#windows

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation` option set to `true`. The result is that if an attacker is able to include whitespace in their input they can: 1. Invoke shell-specific behaviour through shell-specific special characters inserted directly after whitespace. 2. Invoke shell-specific behaviour through shell-specific special characters inserted or appearing after line terminating characters. 3. Invoke arbitrary commands by inserting a line feed character. 4. Invoke arbitrary commands by inserting a carriage return character. Behaviour number 1 has been patched in [v1.5.7] which you can upgrade to now. No further changes are required. Behaviour number 2, 3, and 4 have been patched in [v1.5.8] which you can upgrade to now. No further changes are required. The best wor...

Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).

Backdoor.Win32.Destrukor.20 malware suffers from an unauthenticated remote command execution vulnerability.

CuteEditor For PHP version 6.6 suffers from a directory traversal vulnerability.

WordPress Duplicator plugin versions 1.4.6 and below suffer from a backup disclosure vulnerability.

WordPress Duplicator plugin versions 1.4.7 and below suffer from an information disclosure vulnerability.

CodeIgniter CMS version 4.2.0 suffers from a remote SQL injection vulnerability.

Easy Chat Server version 3.1 remote stack buffer overflow exploit.

Wavlink WN530HG4 suffers from a password disclosure vulnerability.