65 matches found
shellshock
shellshock Shelly는 Bash 환경에서 Shellshock CVE-2014-6271 & CVE-2014-7169 취약점을 식별하고 완화하도록 설계된 가볍고 효율적인 취약점 스캐너입니다. 설치: 리포지토리 클론: git clone https://github.com/ajansha/shellshock.git 디렉토리로 이동: cd shellshock 도구 실행: ./shelly.sh 라이선스: Shelly는 MIT 라이선스 하에 배포됩니다. 면책 조항: 이 도구는 승인된 보안 평가 및 침투 테스트 활동에만 사용하도록...
Shelly
Shelly | Python 기반의 간단한 백도어 관리자 weevely 기반 Shelly는 Python으로 작성된 간단한 도구로, 웹사이트를 원격 제어하는 기능을 합니다. 설치 : $ git clone https://github.com/tegal1337/Shelly $ cd Shelly $ python3 shell.py 요구 사항 : root@kitploit: sudo pip install -r requirements.txt 예제 : root@kitploit: python3 shell.py -g wp-log -p tegal13...
CVE-2026-64823
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...
CVE-2026-64823
CVE-2026-64823 affects Home Assistant Core prior to 2026.5.4 via the Shelly integration’s async_get_media_image(), where a data: URI with text/html can bypass the image-only allowlist. The vulnerability enables an attacker controlling a Shelly device’s thumb field to cause the media proxy endpoin...
CVE-2026-64823 Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...
CVE-2026-64823 Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...
EUVD-2026-46280
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...
CVE-2025-12056
Out-of-bounds Read in Shelly Pro 3EM before v1.4.4 allows Overread Buffers...
CVE-2025-11243
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
EUVD-2025-198138
Out-of-bounds Read in Shelly Pro 3EM before v1.4.4 allows Overread Buffers...
EUVD-2025-198137
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-12056
Out-of-bounds Read in Shelly Pro 3EM before v1.4.4 allows Overread Buffers...
CVE-2025-11243
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-11243 Allocation of Resources Without Limits or Throttling in Shelly Pro 4PM
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-11243 Allocation of Resources Without Limits or Throttling in Shelly Pro 4PM
Allocation of Resources Without Limits or Throttling vulnerability in Shelly Pro 4PM before v1.6 allows Excessive Allocation via network...
CVE-2025-11243
CVE-2025-11243 affects Shelly Pro 4PM prior to v1.6. Root cause is missing input bounds checking on multiple JSON-RPC endpoints, allowing an attacker to cause excessive memory allocation and trigger device reboots via the network. Impact is denial of service through repeated outages; evidence fro...
CVE-2025-12056 Out-of-bounds Read in Shelly Pro 3EM
Out-of-bounds Read in Shelly Pro 3EM before v1.4.4 allows Overread Buffers...
CVE-2025-12056 Out-of-bounds Read in Shelly Pro 3EM
Out-of-bounds Read in Shelly Pro 3EM before v1.4.4 allows Overread Buffers...
CVE-2025-12056
CVE-2025-12056 affects Shelly Pro 3EM (three‑phase energy meter). A specially crafted Modbus request can trigger an illegal data address read, leading to a device reboot and a denial‑of‑service. Vulnerable in versions before 1.4.4; fixed in 1.4.4+. No known public exploitation; CISA notes potenti...
Shelly Pro 4PM 安全漏洞
Shelly Pro 4PM is an energy monitoring device from Shelly USA. A security vulnerability exists in Shelly Pro 4PM versions prior to 1.6, which stems from an unlimited resource allocation that could lead to over-allocation...