Threats tagged 'ghsa-qxm8-6g78-524j'

IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the 'nobody' user. This occurs via multiple unsanitized parameters when creating a Proxy report, which are directly interpolated into a shell command without proper validation.