36194 matches found
PT-2026-65830
Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocal download folder on tar archives returned by remote sessions without validating member paths, allowing a malicious ...
PT-2026-65910
Name of the Vulnerable Software and Affected Versions OliveTin versions 3000.2.0 through 3000.16.0 Description OS command injection is possible because the checkShellArgumentSafety function in service/internal/executor/arguments.go fails to treat regex: custom argument types as unsafe for Shell...
PT-2026-65836
Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerability that allows remote unauthenticated attackers to write past the end of a heap buffer by sending a malformed SSH client identification string. A logic error in the recv loop's termination condition uses ...
CVE-2026-14958
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...
CVE-2026-14959
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...
CVE-2026-14958
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...
CVE-2026-14958 OS command injection in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...
CVE-2026-14958
IBM Aspera Faspex 5 (versions 5.0.0 through 5.0.15.4) is affected by a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation. The issue is a root cause in shell command handling that enables code execution with high impact (confide...
CVE-2026-14959
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...
CVE-2026-14959
CVE-2026-14959 affects IBM Aspera Faspex 5, versioned 5.0.0 through 5.0.15.4. The vulnerability allows a remote authenticated attacker to execute arbitrary code via a shell command injection in Faspex components. Root cause: improper input handling enabling shell command execution. Impact: high w...
EUVD-2026-50055
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...
Malicious code in vtranalytic (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...
MAL-2026-11149 Malicious code in streak-core-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073175f6a0065dc5cc00d30357053432c69fbc7aab8b92bbe4217ad3d54c5d3a index.mjs executes a top-level async IIFE on import that fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip, unzips it into...
MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...
MAL-2026-11126 Malicious code in app-sim-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8470a75b327a72623ec4379302a2fc6ecdbaa302acf4fa1e39f1c688103562be package.json declares a postinstall hook that runs node test.js on npm install; test.js invokes fromstr2 and fromstr1 in index.js. fromstr2 fetches...
MAL-2026-11127 Malicious code in app-sima-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a34ad4e52b9e8255bcfa74cbb6aa18811b0c8d80819a75c6bbfc36d79757b66 The package's postinstall script performs three coordinated attacks against the installer at install time. First, on Linux it fetches an SSH public k...
CVE-2026-66138
A vulnerability was found in Ironic-Python-Agent's IPA time syncing code. The value of the ntpserver configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root...
Security update for apache-sshd
This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the sshd-scp component of Apache MINA SSHD. bsc1272158...