FreePBX - API handler system() RCE (CVE-2014-1903)

Exploits CVE-2014-1903 via /admin/config.php handler=api function=system. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX API handler system RCE CVE-2014-1903 — opens execute session.""" import re from urllib.parse import quote from kittysploit import fr...

FreePBX - API handler system() Detection (CVE-2014-1903)

Detects CVE-2014-1903 by calling /admin/config.php handler=api function=system with args=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX admin API handler system RCE CVE-2014-1903.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Malware in getd-handler-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in getd-handler-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83398d27bb84d47296f796b4b2e6e9b5a0efc474add2e57592455e7d5d54eab5 On npm install, postinstall.js collects the installer's hostname, username, platform, current working directory, and CI-related environment variables...

MAL-2026-5467 Malicious code in getd-handler-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83398d27bb84d47296f796b4b2e6e9b5a0efc474add2e57592455e7d5d54eab5 On npm install, postinstall.js collects the installer's hostname, username, platform, current working directory, and CI-related environment variables...

Design/Logic Flaw

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could...

CVE-2022-31078 KubeEdge CloudCore Router memory exhaustion

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could...

Buffer overflow

A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...

CVE-2019-11859

CVE-2019-11859 affects ALEOS and its SMS Handler API. A buffer overflow in the SMS handler prior to versions 4.13.0, 4.9.5, and 4.9.4 may allow code execution as root. Connected sources corroborate the vulnerability in the SMS handling path and list vulnerable version ranges, with patch/stabiliza...

CVE-2019-11859: Buffer Copy without Checking Size of Input

A buffer overflow exists in the SMS handler API of ALEOS before 4.13.0, 4.9.5, 4.9.4 that may allow code execution as root...

PT-2020-9220

Name of the Vulnerable Software and Affected Versions ALEOS versions prior to 4.13.0 ALEOS versions prior to 4.9.5 ALEOS versions 4.9.4 Description A buffer overflow exists in the SMS handler API that may allow code execution as root. Recommendations For versions prior to 4.13.0, update to versio...