Node.js-CVE-2024-39943

Node.js HFS コマンド実行の脆弱性 CVE-2024-39943 ホワイトハットスクール第3期 – ノ・ジョンミン @JenmrR 概要 Node.jsベースのHFSサーバー環境において、アップロードされたファイルの内容をchildprocess.execSyncで実行する脆弱性が存在する。 攻撃者はファイルアップロード機能を通じてOSコマンドを直接実行でき、サーバー内部のコマンド実行結果を確認したり、システムを制御したりすることができる。 これはCVE-2024-39943に該当する脆弱性であり、コマンドインジェクションRemote Code...

ROOT-OS-UBUNTU-2404-CVE-2025-39943 CVE-2025-39943 in linux - Patched by Root

Root has patched CVE-2025-39943 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-39943 CVE-2025-39943 in linux - Patched by Root

Root has patched CVE-2025-39943 in the linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-39943

creationtimestamp| type| source ---|---|--- 2026-04-09 20:36:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mj3nx5k5gh2i...

CVE-2025-39943

creationtimestamp| type| source ---|---|--- 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260408 2026-05-10 18:00:00+00:00| seen|...

DEBIAN-CVE-2025-39943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate dataoffset and datalength field of smbdirectdatatransfer If dataoffset and datalength of smbdirectdatatransfer struct are invalid, out of bounds issue could happen. This patch validate dataoffset and...

CVE-2025-39943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate dataoffset and datalength field of smbdirectdatatransfer If dataoffset and datalength of smbdirectdatatransfer struct are invalid, out of bounds issue could happen. This patch validate dataoffset and...

CVE-2025-39943

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate dataoffset and datalength field of smbdirectdatatransfer If dataoffset and datalength of smbdirectdatatransfer struct are invalid, out of bounds issue could happen. This patch validate dataoffset and...

MAL-2025-39943 Malicious code in xray-grape-nngk (npm)

The package xray-grape-nngk was found to contain malicious code...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2023-39943

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the...

CVE-2023-39943 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the...

CVE-2023-39943 Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds Write

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the...

CVE-2023-39943

Ashlar-Vellum Cobalt family (Cobalt, Xenon, Argon, Lithium, and related components) is affected by CVE-2023-39943 due to improper validation of user-supplied XE data, leading to an out-of-bounds write that could allow arbitrary code execution. Affected versions include Cobalt v12 SP0 Build (1204....

CVE-2024-39943

creationtimestamp| type| source ---|---|--- 2024-07-05 01:37:40+00:00| seen| https://t.me/cvedetector/74 2024-07-05 07:12:36+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7871 2024-07-05 22:38:10+00:00| published-proof-of-concept| https://t.me/TheDarkWebInformer/1605 2024-07-06...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2021-39943

creationtimestamp| type| source ---|---|--- 2022-02-10 02:23:41+00:00| seen| https://t.me/cibsecurity/37190...

CVE-2021-39943

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...

CVE-2021-39943

An authorization logic error in the External Status Check API in GitLab EE affecting all versions starting from 14.1 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allowed a user to update the status of the check via an API call...

CVE-2021-39943

CVE-2021-39943 describes an authorization logic error in GitLab EE's External Status Check API, allowing a user to update the status of a check via an API call. The issue affects GitLab EE versions: 14.1 up to but not including 14.3.6; 14.4.x up to but not including 14.4.4; and 14.5.x up to but n...