32768 matches found
CVE-2025-50974
The Calamaris log exporter CGI /cgi-bin/logs.cgi/calamaris.dat in IPFire 2.29 does not properly sanitize user-supplied input before incorporating parameter values into a shell command. An unauthenticated remote attacker can inject arbitrary OS commands by embedding shell metacharacters in any of...
Linux Distros Unpatched Vulnerability : CVE-2022-27782
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps...
PT-2025-34764 · Mitrastar · Mitrastar Gpt-2741Gnac-N2
Name of the Vulnerable Software and Affected Versions: Mitrastar GPT-2741GNAC-N2 affected versions not specified Description: Mitrastar GPT-2741GNAC-N2 devices allow access through SSH into a restricted default shell. The deviceinfo show file command, intended for use within the restricted shell ...
PT-2025-34793 · Ubiquiti · Ubiquiti Unifi
Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A non-primary administrator user with admin rights to the web interface, but without shell access permissions, can view the device configuration, including the master admin password. This also allo...
Linux Distros Unpatched Vulnerability : CVE-2020-14947
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mibfile in...
CVE-2025-50974
The CVE-2025-50974 issue affects IPFire 2.29: the Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.dat) does not sanitize user input before embedding parameters into a shell command. This allows an unauthenticated, remote attacker to inject arbitrary OS commands by supplying shell metachar...
SUSE CVE-2025-5372
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success-the function may mistakenl...
GHSA-4GV9-MP8M-592R Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)
This vulnerability was discovered by researchers at Check Point. We are sharing this report as part of a responsible disclosure process and are happy to assist in validation and remediation if needed. Summary A privilege escalation vulnerability exists in Langflow containers where an authenticate...
Cross-site Scripting (XSS)
com.liferay:com.liferay.captcha.impl are vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper captcha validation which allows attackers to bypass verification and execute scripts in the Gogo shell...
Linux Distros Unpatched Vulnerability : CVE-2017-12976
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated...
Linux Distros Unpatched Vulnerability : CVE-2018-7749
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customiz...
Linux Distros Unpatched Vulnerability : CVE-2017-12426
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab Community Edition CE and Enterprise Edition EE before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4...
CVE-2025-55745
UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. Versions 0.3.0 and prior are vulnerable to CSV injection, also known as formula injection, in the Quick Export feature. This vulnerability allows attackers to inject malicious content into exported...
Malicious Go Module Poses as SSH Brute-Force Tool, Steals Credentials via Telegram Bot
Cybersecurity researchers have discovered a malicious Go module that presents itself as a brute-force tool for SSH but actually contains functionality to discreetly exfiltrate credentials to its creator. "On the first successful login, the package sends the target IP address, username, and passwo...
CVE-2025-41451
Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command 'Command Injection' in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system...
Linux Distros Unpatched Vulnerability : CVE-2017-9274
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A shell command injection in the obs-service-sourcevalidator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific...
Linux Distros Unpatched Vulnerability : CVE-2008-3234
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by...
Linux Distros Unpatched Vulnerability : CVE-2016-1235
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privileges via vectors...
Linux Distros Unpatched Vulnerability : CVE-2017-18594
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nselibssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n...