Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in

IPConfigure Orchid VMS, installed as Orchid Recorder, version 26.3.0.

Type: OS command injection (CWE-78, with CWE-20 bearing on it because no

character validation exists anywhere on the path; CWE-250 bears on the

result). The server property package.dnf.repo.gpg_key, the URL or path of

the GPG key signing the vendor RPM repository, is written through the

authenticated...