100 matches found
CVE-2024-35060
An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file...
CVE-2024-35060
CVE-2024-35060 affects NASA AIT-Core v2.5.2 due to a flaw in the YAML Python library that allows arbitrary command execution via a crafted YAML file. Affected component: YAML Python library; root cause described as an issue in the library. Impact per sources: attacker-executed commands. Remediati...
CVE-2024-35056
NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the querypackets and insert functions...
NASA AIT-Core 安全漏洞
NASA AIT-Core is a Python-based software suite organized by NASA. A security vulnerability exists in NASA AIT-Core version v2.5.2, which stems from a vulnerability that allows an attacker to execute arbitrary code via a crafted packet...
PT-2024-26305
Name of the Vulnerable Software and Affected Versions NASA AIT-Core version 2.5.2 Description The issue allows attackers to execute a man-in-the-middle attack due to the use of unencrypted channels for data exchange over the network. This can lead to unauthenticated, fully remote code execution...
CVE-2024-35058
An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string...
CVE-2024-35057
NASA AIT-Core v2.5.2 is affected by CVE-2024-35057, with the issue allowing arbitrary code execution via a crafted packet. The advisory sources from NVD/Red Hat/GHSA/osv indicate the vulnerability resides in the NASA AIT-Core component and implies a high-impact scenario (base CVSS v3.1: 7.5, high...
CVE-2024-35059
An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands...
CVE-2024-35060
An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file...
CVE-2024-35059
An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands...
CVE-2024-35061
NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, fully remote code execution...
CVE-2024-22894
An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...
Code injection
An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...
CVE-2024-22894
An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later, allows remote attackers to execute arbitrary code via the password component in the shadow file...
CVE-2024-22894
CVE-2024-22894 affects AIT-Deutschland Alpha Innotec Heatpumps (V2.88.3+, V3.89.0+, V4.81.3+) and Novelan Heatpumps (V2.88.3+, V3.89.0+, V4.81.3+). The root cause is hardcoded credentials in the wp2reg-V3.88.0-9015 file, enabling remote attackers to execute arbitrary code via the password compone...
acedit (=1.0.0), ait-core (>=2.0.0 <=2.5.2) +407 more potentially affected by CVE-2023-41419 via gevent (>=1.0.1 <=23.7.0)
gevent PYPI version =1.0.1, =2.0.0, =2.4.0, =0.2.0, =1.2.23.5, =0.4.0, =3.1.0, =0.1.2, =1.0.0, =0.1.0, =1.0.1 - bavera =0.14.0 and more Source cves: CVE-2023-41419 Source advisory: OSV:GHSA-X7M3-JPRG-WC5G...
Joomla Plugin SexyPolling 2.1.7 - SQLi
Exploit Title: Joomla Plugin SexyPolling 2.1.7 - SQLi Google Dork: intext:"Powered by Sexy Polling" Date: 2022-02-08 Exploit Author: Wolfgang Hotwagner Vendor Homepage: https://2glux.com/projects/sexypolling Software Link: https://2glux.com/downloads/files/free/sexypollingpack2.1.72glux.com.zip...
Joomla Sexy Polling 2.1.7 SQL Injection Vulnerability
SexyPolling SQL Injection ==================== | Target: | Sexy Polling Joomla Extension | | Vendor: | 2glux | | Version: | all versions below version 2.1.8 | | CVE: | Not yet | | Accessibility: | Remote | | Severity: | Critical | | Author: | Wolfgang Hotwagner AIT Austrian Institute of Technolog...
QCubed 3.1.1 PHP Object Injection
QCubed PHP Object Injection =========================== | Identifier: | AIT-SA-20210215-01 | | Target: | QCubed Framework | | Vendor: | QCubed | | Version: | all versions including 3.1.1 | | CVE: | CVE-2020-24914 | | Accessibility: | Remote | | Severity: | Critical | | Author: | Wolfgang Hotwagne...
ForkCMS PHP Object Injection
ForkCMS PHP Object Injection ========================= | Identifier: | AIT-SA-20210215-04 | | Target: | ForkCMS | | Vendor: | ForkCMS | | Version: | all versions below version 5.8.3 | | CVE: | CVE-2020-24036 | | Accessibility: | Remote | | Severity: | Medium | | Author: | Wolfgang Hotwagner AIT...