CVE-2021-34083

HIGH Year: 2021
CVSS v3 Score
8.1
High
CVSS v2 Score
9.3
Critical
Weakness Type
CWE-78
View all →

Vulnerability Description

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE.

Related Vulnerabilities

CVE-2015-7611

HIGH
CVSS:8.1(High)

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

CWE-782015

CVE-2016-1482

HIGH
CVSS:8.1(High)

Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130.

CWE-782016

CVE-2017-11318

HIGH
CVSS:8.1(High)

Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. In addition, the attacker can execute system commands remotely by abus...

CWE-782017

CVE-2017-12581

HIGH
CVSS:8.1(High)

GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earl...

CWE-782017

CVE-2017-14705

HIGH
CVSS:8.1(High)

DenyAll WAF before 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function in /webserv...

CWE-782017

CVE-2017-2824

HIGH
CVSS:8.1(High)

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote cod...

CWE-782017