20230 matches found
Edimax IP Camera NTP_serverName command injection
Added: 03/21/2025 CVE: CVE-2025-1316 Background Edimax IP Cameras are a product line of security cameras which send video footage over an IP network. Problem A command injection vulnerability in the NTPserverName POST parameter of an update request allows remote attackers to execute arbitrary...
CVE-2024-56346
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls...
LoLLMS Code Injection vulnerability
A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module...
CVE-2024-8502
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...
CVE-2024-6825
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...
CVE-2024-12215 Remote Code Execution in kedro-org/kedro
In kedro-org/kedro version 0.19.8, the pullpackage API function allows users to download and extract micro packages from the Internet. However, the function projectwheelmetadata within the code path can execute the setup.py file inside the tar file, leading to remote code execution RCE by running...
CVE-2024-6825 Remote Code Execution in BerriAI/litellm
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...
CVE-2024-6825
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...
CVE-2024-6825 Remote Code Execution in BerriAI/litellm
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...
CVE-2024-6825 Remote Code Execution in BerriAI/litellm
BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...
CVE-2024-8156 Command Injection in significant-gravitas/autogpt
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input github.head.ref is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version...
CVE-2024-8156
CVE-2024-8156 describes a command injection in the workflow-checker.yml of significant-gravitas/autogpt. The vulnerability arises from insecure use of untrusted input github.head.ref, allowing an attacker to inject arbitrary commands. Affected: significant-gravitas/autogpt, all versions up to the...
CVE-2024-8156 Command Injection in significant-gravitas/autogpt
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input github.head.ref is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version...
PT-2025-12370
Name of the Vulnerable Software and Affected Versions eTRAKiT.Net version 3.2.1.77 Description A SQL injection issue has been discovered due to improper input validation, allowing a remote unauthenticated attacker to run arbitrary commands as the current MS SQL server account. Recommendations For...
CVE-2025-29980: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.7...
Windows .LNK-file Processing Command Execution
The vulnerability of the .LNK file processing mechanism in Windows operating systems is related to information representation errors in the user interface. Exploiting this vulnerability allows an attacker to secretly execute arbitrary commands on the operating system by sending a specially crafte...
CVE-2024-56346 IBM AIX command execution
IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls...
CVE-2025-30076
Koha vulnerability CVE-2025-30076: affects Koha prior to 24.11.02, where admins can execute arbitrary commands via shell metacharacters in the tools/scheduler.pl report parameter. Root cause is unvalidated shell input allowing command execution. Impact is authenticated admin access leading to pot...
PT-2025-11376
Name of the Vulnerable Software and Affected Versions: Koha versions prior to 24.11.02 Description: The issue allows admins to execute arbitrary commands via shell metacharacters in the report parameter of the tools/scheduler.pl script. Recommendations: For versions prior to 24.11.02, update to...