CVE-2024-35222: Improper Access Control

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the dangerousRemoteDomainIpcAccess in v1 and in the capabilities in v2. Valid commands with potentially...

USN-6756-1: less vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that less mishandled newline characters in file names. If a user or automated system were tricked into opening specially crafted files, an...

CVE-2024-31396

Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on...

TOTOLINK X5000R timeout parameter command injection vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R timeout parameter, which originates from the failure of the timeout parameter of /cgi-bin/cstecgi.cgi to properly filter constructed command special characters,...

TOTOLINK X5000R port parameter command injection vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R port parameter, which originates from the port parameter of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special characters, commands, and...

TOTOLINK X5000R pid parameter command injection vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R pid parameter, which originates from the pid parameter of /cgi-bin/cstecgi.cgi failing to properly filter construct command special characters, commands, etc. An...

TOTOLINK X5000R password parameter command injection vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R password parameter, which originates from the password parameter of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special characters,...

CVE-2024-22026: Improper Access Control

A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance...

CVE-2024-31396: Improper Control of Generation of Code

Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an arbitrary command on...

VulnCheck KEV: CVE-2022-35555

A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.94122, which allows attackers to construct cmdinput parameters for arbitrary command execution...

formWlEncrypt Buffer Overflow DoS

The vulnerability of the formWlEncrypt function in Totolink AC1200 router microprogramming software is caused by buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands or cause service failures...

CVE-2024-35060

An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file...

CVE-2024-35060

An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file...

PT-2024-26303

Name of the Vulnerable Software and Affected Versions NASA AIT-Core version 2.5.2 Description An issue in the Pickle Python library allows attackers to execute arbitrary commands. Recommendations For NASA AIT-Core version 2.5.2, at the moment, there is no information about a newer version that...

CVE-2024-35059

An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands...

CVE-2024-35060

The NASA AIT-Core software suite, specifically version v2.5.2 , contains a vulnerability in its YAML Python library . An attacker can exploit this issue by supplying a crafted YAML file to achieve arbitrary command execution . As of the current documentation, there is no information regarding a n...

NASA AIT-Core security vulnerabilities

NASA AIT-Core is a Python-based software suite organized by NASA. A security vulnerability exists in NASA AIT-Core version v2.5.2 that originates from allowing an attacker to execute arbitrary commands...

CVE-2024-35060

An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file...

PT-2024-26304 · Nasa · Nasa Ait-Core

Name of the Vulnerable Software and Affected Versions: NASA AIT-Core version 2.5.2 Description: An issue in the YAML Python library allows attackers to execute arbitrary commands via supplying a crafted YAML file. Recommendations: For NASA AIT-Core version 2.5.2, at the moment, there is no...

CVE-2024-35059

NASA AIT-Core v2.5.2 is vulnerable to Remote Code Execution (RCE) due to the unsafe loading of untrusted Pickle files within its Python library. This flaw allows attackers to execute arbitrary commands on the affected system. Notably, when combined with CVE-2024-35061 (which involves unencrypted ...