Node.js-CVE-2024-39943

Node.js HFS 명령어 실행 취약점 CVE-2024-39943 화이트햇 스쿨 3기 – 노정민 @JenmrR 요약 Node.js 기반 HFS 서버 환경에서, 업로드된 파일의 내용을 childprocess.execSync로 실행하는 취약점이 존재한다. 공격자는 파일 업로드 기능을 통해 OS 명령어를 직접 실행할 수 있으며, 서버 내부 명령어 결과를 확인하거나 시스템을 제어할 수 있다. 이는 CVE-2024-39943에 해당하는 취약점으로, 명령어 주입Remote Code Execution과 동일한 수준의 위협을 발생시킨다. ...

ROOT-OS-UBUNTU-2404-CVE-2025-39943 CVE-2025-39943 in linux - Patched by Root

Root has patched CVE-2025-39943 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-39943 CVE-2025-39943 in linux - Patched by Root

Root has patched CVE-2025-39943 in the linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-39943

creationtimestamp| type| source ---|---|--- 2026-04-09 20:36:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3nx5k5gh2i...

CVE-2025-39943

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

DEBIAN-CVE-2025-39943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate dataoffset and datalength field of smbdirectdatatransfer If dataoffset and datalength of smbdirectdatatransfer struct are invalid, out of bounds issue could happen. This patch validate dataoffset and...

CVE-2025-39943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate dataoffset and datalength field of smbdirectdatatransfer If dataoffset and datalength of smbdirectdatatransfer struct are invalid, out of bounds issue could happen. This patch validate dataoffset and...

CVE-2025-39943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate dataoffset and datalength field of smbdirectdatatransfer If dataoffset and datalength of smbdirectdatatransfer struct are invalid, out of bounds issue could happen. This patch validate dataoffset and...

MAL-2025-39943 Malicious code in xray-grape-nngk (npm)

The package xray-grape-nngk was found to contain malicious code...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2023-39943

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the...

CVE-2023-39943 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the...

CVE-2023-39943 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the...

CVE-2023-39943

Ashlar-Vellum Cobalt family (Cobalt, Xenon, Argon, Lithium, and related components) is affected by CVE-2023-39943 due to improper validation of user-supplied XE data, leading to an out-of-bounds write that could allow arbitrary code execution. Affected versions include Cobalt v12 SP0 Build (1204....

CVE-2024-39943

creationtimestamp| type| source ---|---|--- 2024-07-05 01:37:40+00:00| seen| https://t.me/cvedetector/74 2024-07-05 07:12:36+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7871 2024-07-05 22:38:10+00:00| published-proof-of-concept| https://t.me/TheDarkWebInformer/1605 2024-07-06...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2021-39943

creationtimestamp| type| source ---|---|--- 2022-02-10 02:23:41+00:00| seen| https://t.me/cibsecurity/37190...

CVE-2021-39943

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...

CVE-2021-39943

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...

CVE-2021-39943

CVE-2021-39943 describes an authorization logic error in GitLab EE's External Status Check API, allowing a user to update the status of a check via an API call. The issue affects GitLab EE versions: 14.1 up to but not including 14.3.6; 14.4.x up to but not including 14.4.4; and 14.5.x up to but n...