Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

PAN-OS Firewall Exploit Script This script is designed to demo...

Command Execution Vulnerability in Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-22513)

Beijing StarNet Ruijie Network Technology Co., Ltd. is an ICT infrastructure and industry solutions provider. A command execution vulnerability exists in the Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network Technology Company Limited, which can be exploited by...

Siemens Scalance W1750D Improper Neutralization of Special Elements used in a Command (CVE-2023-45625)

Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This plugin only works with Tenable.ot. Pleas...

Command Injection

github.com/go-skynet/localai is vulnerable to command injection. The vulnerability is due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command in the audioToWav function, allowing attackers to execute arbitrary commands on the host system...

SUSE SLES12 Security Update : texlive-specs-k (SUSE-SU-2024:1203-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1203-1 advisory. CVE-2016-10243: Fixed arbitrary code execution via mpost during TeX document compilation bsc1028271 Tenable has extracted the preceding...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

CVE-2024-22722

CVE-2024-22722 is a Server-Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1. Affected component is the form-creation workflow, specifically the Group Name field under Add Forms, where SSTI can lead to arbitrary command execution. Publicly available exploit(s) exist: a GitHub proje...

Planet IGS-4215-16T2S 安全漏洞

The Planet IGS-4215-16T2S is an industrial grade switching device. The Planet IGS-4215-16T2S suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the host via the IP address...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

CVE-2024-22719

SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client...

Form Tools SQL注入漏洞

Form Tools is an open source codebase for Form Tools scripts, modules, themes and APIs. A SQL injection vulnerability exists in Form Tools version 3.1.1, which originates from allowing an attacker to run arbitrary SQL commands via keyword while searching for clients...

PT-2024-19538 · Unknown · Form Tools

Name of the Vulnerable Software and Affected Versions: Form Tools version 3.1.1 Description: The issue allows attackers to run arbitrary SQL commands via the keyword when searching for a client. This can be exploited by manipulating the search functionality. Recommendations: For Form Tools versio...

GHSA-WX43-G55G-2JF4 LocalAI Command Injection in audioToWav

A command injection vulnerability exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing the...

CVE-2024-2029

A command injection vulnerability exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing the...

CVE-2024-2029 Command Injection in mudler/localai

A command injection vulnerability exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing the...

CVE-2024-2029

CVE-2024-2029 affects mudler/localai's TranscriptEndpoint.audioToWav. Root cause: unsanitized user filenames passed to ffmpeg via a shell command, enabling arbitrary command execution on the host. Impacts include unauthorized access and data breaches, contingent on process privileges. Connected d...

CVE-2024-2029 Command Injection in mudler/localai

A command injection vulnerability exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing the...

CVE-2024-24809

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2024-24809 Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...