CVE-2024-45482

An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B APROL 4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands...

CVE-2022-29059

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted...

MAL-2025-2209 Malicious code in poc-by-shahwar (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6381347b8b3c6e2f8f2d7aa1b39647e7f7444e10122cd821b80ae6b3d05c5a7e The OpenSSF Package Analysis project identified 'poc-by-shahwar' @ 0.1.0 rubygems as malicious. It is considered malicious because: - The packag...

MAL-2025-2072 Malicious code in ddataflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7e3628188472d3921b31929497ffb10a64fe2632cd81d96c68d5eafa7b7cf18d The OpenSSF Package Analysis project identified 'ddataflow' @ 3.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9026 Malicious code in gui-timbuctoo-emlo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 51bc1fd493706f789fb72e128dba57e378ccd77ed131e6820d8d5cd2dbbb4bc9 The OpenSSF Package Analysis project identified 'gui-timbuctoo-emlo' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-46808

An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user...

CVE-2023-46808

CVE-2023-46808 is an authenticated remote file-write vulnerability in Ivanti Neurons for ITSM (affecting on-premises versions 2023.1–2023.3). Successful exploitation can write files to sensitive directories and lead to code execution in the web app user context. Public advisories indicate patches...

MAL-2024-1111 Malicious code in business-kpi-manager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 273b321944297087263b5b5821cab2c1f54c8c91e75998fe8c8bca26b8ffb0b7 The OpenSSF Package Analysis project identified 'business-kpi-manager' @ 5.9.1 pypi as malicious. It is considered malicious because: - The...

Command injection

An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 2023/06/15 and later...

Input validation

Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users...

MAL-2023-8064 Malicious code in @get-bridge/bridge-string-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e69ac01e87147a835e5ab4045ff640d7fa9d2eb636aeb12eef6e1fc1577d021f The OpenSSF Package Analysis project identified '@get-bridge/bridge-string-utils' @ 99.99.99 npm as malicious. It is considered malicious becaus...

Malicious code in cdp-ops--ts-accesslog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3f91b885ec95bb15b4a6f58f71cccba8ac7528ef5c5bcae18f34f74e27f0f444 The OpenSSF Package Analysis project identified 'cdp-ops--ts-accesslog' @ 1.4.3 npm as malicious. It is considered malicious because: - The...

Command injection

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

CVE-2023-29839

hotel druid 3.0.4 contains a Stored XSS in the Document function, affecting the fields Surname, Name, and Nickname. This is evidenced across multiple CVE records (NVD/Red Hat/OSV/etc.). The vulnerability is described as allowing arbitrary command execution. Practically, the issue is tied to input...

CVE-2022-45639

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user...

CVE-2022-23048

Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/rce.php" from where can be accessed in order to execute commands...

CVE-2020-24140

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

ICSA-19-192-03 Siemens TIA Administrator (TIA Portal)

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION : Low skill level to exploit Vendor : Siemens Equipment : TIA Administrator TIA Portal Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an execution of some commands without proper...