CVE-2025-27027

CVE-2025-27027 concerns Radiflow iSAP Smart Collector. Multiple connected sources describe a scenario where a user with vpuser credentials who opens an SSH connection can escape rbash restrictions and obtain a full-featured Linux shell. The root cause, as stated in PT-2025-28859, involves bypassi...

Remote Code Execution (RCE)

bolt/bolt is vulnerable to remote code execution RCE. The vulnerability is due to unsanitized rendering of user-controlled input PHP code injection in the displayname field in backend templates, followed by abuse of session file manipulation endpoints which allows an attacker to create a web shel...

Radiflow iSAP Smart Collector 安全漏洞

Radiflow iSAP Smart Collector is a remote traffic collection and forwarding appliance designed for industrial networks from Radiflow USA. A security vulnerability exists in the Radiflow iSAP Smart Collector that stems from bypassing the rbash restriction and could lead to obtaining the full Linux...

PT-2025-28859 · Radiflow · Radiflow Isap Smart Collector

Name of the Vulnerable Software and Affected Versions: Radiflow iSAP Smart Collector version 1.20 Description: The issue allows a user with vpuser credentials to bypass restricted shell rbash limitations and access a full-featured Linux shell when connecting to the device via SSH. This is possibl...

GHSA-GJV4-GHM7-Q58Q MCP Server Kubernetes vulnerable to command injection in several tools

Summary A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to...

CVE-2025-49679

Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2025-49679

Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2025-49679 Windows Shell Elevation of Privilege Vulnerability

...

CVE-2025-49679

Technical details about CVE-2025-49679 (affected product/module, root cause, impact, and remediation) are not publicly provided in the supplied documents. Monitor for official updates from Microsoft (KB/SSU) and ENISA EUVD for specifics.

CVE-2025-49679 Windows Shell Elevation of Privilege Vulnerability

...

Windows Shell Elevation of Privilege Vulnerability

Numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2025-24006

A low privileged local attacker can leverage insecure permissions via SSH on the affected devices to escalate privileges to root...

Malicious code in web-shell-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14a8faa45f100dea81a84d75a0d68c5e05035913ff94a69ac46b8cd9429c5a81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5738 Malicious code in web-shell-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14a8faa45f100dea81a84d75a0d68c5e05035913ff94a69ac46b8cd9429c5a81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Google ChromeOS Elevation of Privilege Vulnerability

Google ChromeOS is an operating system from the American company Google. Google ChromeOS suffers from an elevation of privilege vulnerability that originates from debug shell accessibility, which can be exploited by an attacker to access restricted system functions and data via elevation of...

PT-2025-28577 · Microsoft · Windows Shell +1

Name of the Vulnerable Software and Affected Versions: Windows Shell affected versions not specified Description: A numeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no information about a newer version...

Microsoft Windows Shell 安全漏洞

The Microsoft Windows Shell is the graphical user interface for the Windows operating system from Microsoft Corporation USA.Easily recognizable elements of the Windows shell include features such as the desktop, the taskbar, the start menu, the task switcher, and autoplay. On some versions of...

PHOENIX CONTACT CHARX SEC 输入验证错误漏洞

The PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. The PHOENIX CONTACT CHARX SEC suffers from an input validation error vulnerability that originates from a local attacker who can exploit a vulnerable script via SSH and elevate privileges to root due...

CVE-2025-47228

In the Production Environment extension in Netmake ScriptCase through 9.12.006 23, shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests...

The vulnerability of the Konsole terminal emulator in the KDE desktop environment allows a hacker to execute arbitrary code.

The vulnerability of the Konsole terminal emulator in the KDE desktop environment is related to the improper handling of control flows when processing URL schemes like telnet://, rlogin://, and ssh://. Exploiting this vulnerability allows a remote attacker to execute arbitrary code when a user...