14 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-63278
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server o...
CVE-2026-63278
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...
CVE-2024-23897
CVE-2024-23897 CLIコマンドパーサーのデフォルトオプションの設定ミスにより、攻撃者は任意のファイルを読み取ることができます。 CVEの概要 Jenkins 2.441 以前および LTS 2.426.2 以前では、CLIコマンドパーサーが、引数内の '@' 文字に続くファイルパスをファイルの内容に置き換える機能を無効化していません。これにより、認証されていない攻撃者が Jenkins コントローラのファイルシステム上の任意のファイルを読み取ることができます。 影響を受けるバージョン Jenkins 2.442 Jenkins LTS Edition 2.426.3 異常...
poc-CVE-2024-23897
poc-CVE-2024-23897 CVE-2024-23897: Jenkins 任意ファイル読み取りによる RCE 🎯 影響を受ける製品とバージョン root@kitploit: 製品: Jenkins（継続的インテグレーション/継続的デリバリーサーバー） バージョン: Jenkins 2.441 以前、Jenkins LTS 2.426.2 以前 修正済み: Jenkins 2.442、Jenkins LTS 2.426.3 📝 説明 CVE-2024-23897 は Jenkins における深刻な脆弱性で、認証されていない攻撃者が Jenkins...
openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand
A flaw was found in OpenSSH where control characters in usernames were not properly validated when sourced from untrusted inputs like the command line or configuration expansion. If a ProxyCommand is used, these control characters could modify command behavior, potentially leading to code executi...
EUVD-2016-2866
Malware in sbrugna...
CVE-2025-61984
CVE-2025-61984 affects OpenSSH before 10.1. It allows control characters in usernames originating from untrusted sources (command line or %-sequence expansion in a config file), potentially enabling code execution when a ProxyCommand is used. A config file that provides a complete literal usernam...
CVE-2025-34098: Exposure of Sensitive Information to an Unauthorized Actor
A path traversal vulnerability exists in Riverbed SteelHead VCX appliances confirmed in VCX255U 9.6.0a due to improper input validation in the log filtering functionality exposed via the management web interface. An authenticated attacker can exploit this flaw by submitting crafted filter...
CVE-2024-55909 IBM Concert Software denial of service
IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expansion of archive files without controlling resource consumption...
PT-2025-18730 · Ibm · Ibm Concert
Name of the Vulnerable Software and Affected Versions: IBM Concert Software versions 1.0.0 through 1.0.5 Description: The issue allows an authenticated user to cause a denial of service due to the expansion of archive files without controlling resource consumption. Recommendations: For IBM Concer...
CVE-2024-36116 Path traversal in Reposilite javadoc file expansion
Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, JavadocEndpoints.kt controller allows to expand the...
CVE-2024-23899
Jenkins Git server Plugin 99.va0826abcdfad and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenki...
Arbitrary file read vulnerability through the CLI can lead to RCE
Jenkins has a built-in command line interface CLI to access Jenkins from a script or shell environment. Jenkins uses the https://github.com/kohsuke/args4jargs4j library to parse command arguments and options on the Jenkins controller when processing CLI commands. This command parser has a feature...