https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 23:39:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357751 EUVD-2026-357751 https://cve.radiocsirt.org/vuln/euvd-2026-357751 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61400 <p>Improper Neutralization of Special Elements used in a Command (&#39;Command Injection&#39;) vulnerability in Apache CloudStack&#39;s run and get diagnostics functionality for the system VMs and virtual routers.</p> <p>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.</p> <p>The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.</p> <p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> <p>Improper Neutralization of Special Elements used in a Command (&#39;Command Injection&#39;) vulnerability in Apache CloudStack&#39;s run and get diagnostics functionality for the system VMs and virtual routers.</p> <p>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.</p> <p>The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.</p> <p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-61400 https://cve.radiocsirt.org/vuln/ghsa-g382-2jw5-f8xr <p>Improper Neutralization of Special Elements used in a Command (&#39;Command Injection&#39;) vulnerability in Apache CloudStack&#39;s run and get diagnostics functionality for the system VMs and virtual routers.</p> <p>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.</p> <p>The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.</p> <p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> <p>Improper Neutralization of Special Elements used in a Command (&#39;Command Injection&#39;) vulnerability in Apache CloudStack&#39;s run and get diagnostics functionality for the system VMs and virtual routers.</p> <p>An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.</p> <p>The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.</p> <p>This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.</p> <p>Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-g382-2jw5-f8xr https://cve.radiocsirt.org/vuln/ncsc-2026-0332 NCSC-2026-0332 https://cve.radiocsirt.org/vuln/ncsc-2026-0332 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2962 <p>Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Apache CloudStack ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2962