205 matches found
CVE-2024-50636
PyMOL 2.5.0 is vulnerable to Remote Command Execution (RCE) due to an improper control of code generation in its "Run Script" function. The software treats .PYM files as Python scripts without providing adequate validation or restrictions on the commands contained within them. An attacker can exp...
CVE-2024-50636
PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can craft a malicious .PYM file containing a Python reverse shell payload and exploit the function to achieve Remote Command Execution RCE...
PT-2024-34371 · Schrödinger · Pymol
Name of the Vulnerable Software and Affected Versions: PyMOL version 2.5.0 Description: The issue arises from the "Run Script" function in PyMOL, which allows the execution of arbitrary Python code embedded within .PYM files. This enables attackers to craft malicious .PYM files containing Python...
CVE-2024-50636: Improper Control of Generation of Code
PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can craft a malicious .PYM file containing a Python reverse shell payload and exploit the function to achieve Remote Command Execution RCE...
PT-2023-32964 · Unknown +3 · Isolated-Vm +3
Name of the Vulnerable Software and Affected Versions: vm2 versions up to 3.9.19 Directus versions prior to 10.6.0 Description: The issue allows attackers to bypass Promise handler sanitization in vm2, enabling them to escape the sandbox and execute arbitrary code. This specifically affects the...
SUSE CVE-2023-26123
Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting XSS such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscriptenrunscript...
Cross site scripting
Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting XSS such that the SetClipboardText API does not properly escape the ' character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via emscriptenrunscript...
raylib 跨站脚本漏洞
raylib is an easy-to-use library for raysan5 personal developers to enjoy video game programming. A security vulnerability exists in raysan5 raylib versions prior to 4.5.0, which stems from a failure of the SetClipboardText API to properly escape characters, which can be exploited by an attacker ...
HCL Technologies HCL BigFix Platform 授权问题漏洞
HCL Technologies HCL BigFix Platform is a suite of endpoint security management platforms from HCL Technologies, USA. The platform supports automated discovery, management and remediation of endpoint security issues. HCL Technologies HCL BigFix Platform has a security vulnerability that stems fro...
Ec-cube 跨站脚本漏洞
Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . Ec-cube suffers from a cross-site scripting vulnerability that can be exploited by an attacker to trick a victim into following a specially crafted link and executing arbitrary HTML and script code in the user's browser...
Hackers Infecting Apple App Developers With Trojanized Xcode Projects
Cybersecurity researchers on Thursday disclosed a new attack wherein threat actors are leveraging Xcode as an attack vector to compromise Apple platform developers with a backdoor, adding to a growing trend that involves targeting developers and researchers with malicious attacks. Dubbed...
CVE-2019-8901
This issue was addressed by verifying host keys when connecting to a previously-known SSH server. This issue is fixed in iOS 13.1 and iPadOS 13.1. An attacker in a privileged network position may be able to intercept SSH traffic from the “Run script over SSH” action...
CVE-2019-8901: Improper Verification of Cryptographic Signature
This issue was addressed by verifying host keys when connecting to a previously-known SSH server. This issue is fixed in iOS 13.1 and iPadOS 13.1. An attacker in a privileged network position may be able to intercept SSH traffic from the “Run script over SSH” action...
PT-2020-11336
Name of the Vulnerable Software and Affected Versions iOS versions prior to 13.1 iPadOS versions prior to 13.1 Description The issue allows an attacker in a privileged network position to intercept SSH traffic from the "Run script over SSH" action. This is addressed by verifying host keys when...
Unspecified Vulnerabilities in eQ-3 Homematic CCU2 and CCU3
The eQ-3 Homematic CCU3 and eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. A security vulnerability exists in eQ-3 Homematic CCU2 version 2.51.6 and earlier and CCU3 version 3.51.6 and earlier, which stems from turning on the default automatic login...
CVE-2020-12834
eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...
Malicious Package
sj-tw-abc is a malicious package that downloads and runs a script that opens a reverse shell in the system...
eQ-3 Homematic CCU3 Remote Code Execution Vulnerability (CNVD-2020-14281)
The eQ-3 Homematic CCU3 is a central control unit for smart home systems from eQ-3 Germany. A remote code execution vulnerability exists in the ReGa.runScript method in the eQ-3 Homematic CCU3 using firmware version 3.41.11, which can be exploited by an attacker to execute code and compromise the...