RHEL 7 : ansible (RHSA-2019:0590)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0590 advisory. Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH a...

CVE-2024-51008

Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the systemname parameter at wizdyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

AgentScope uses `eval`

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

PT-2024-8275 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a command injection vulnerability in the wan gateway parameter at the "genie fix2.cgi" endpoint. This allows attackers to execute arbitrary OS commands via a crafted request...

PT-2024-8274 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.78 Description: The issue is related to a command injection vulnerability in the system name parameter at the "genie dyn.cgi" endpoint. This vulnerability allows attackers to execute arbitrary OS commands via a...

SUSE: Security Advisory (SUSE-SU-2024:3873-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Tenda AC6 security vulnerabilities

The Tenda AC6 is a wireless router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda AC6 version 15.03.05.19, which stems from the parameter devName failing to properly validate the length of the input data, and can be exploited by a remote attacker to execute...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rubygem-bundler (SUSE-SU-2024:3873-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3873-1 advisory. - CVE-2021-43809: Fixed remote execution via Gemfile argument injection bsc1193578 Tenable has extracted...

Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: CVE-2021-43809: Fixed remote execution via Gemfile argument injection bsc1193578 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...

SUSE-SU-2024:3873-1 Security update for rubygem-bundler

This update for rubygem-bundler fixes the following issues: - CVE-2021-43809: Fixed remote execution via Gemfile argument injection bsc1193578...

Medium: cups-filters

Issue Overview: CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDRANY:631, causing it to trust any packet from any source,...

CVE-2024-48410

Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php...

Exploit for Missing Authentication for Critical Function in Cyberpanel

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python...

CVE-2024-48733

SQL injection vulnerability in /SASStudio/sasexec/sessions/sessionID/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL commands via the POST body request. NOTE: this is disputed by the vendor because SQL statement execution is allowed for authorized users...

CVE-2024-51298

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function...

OpenSSL Elliptic Curve Code Execution

The vulnerabilities of the functions ECGROUPnewcurveGF2m, ECGROUPnewfromparams, and BNGF2m in the Elliptic Curve API of the OpenSSL cryptographic library are exploited due to a buffer overflow in the queue. Exploiting these vulnerabilities could allow a remote attacker to execute arbitrary code...

Code Injection

flairNLP is vulnerable to code injection. The vulnerability is inadequate input validation in the ClusteringModel function of flair\models\clustering.py, allowing malicious code to be injected and executed remotely...

CVE-2024-51181

A Reflected Cross Site Scripting XSS vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0, which allows remote attackers to execute arbitrary code via " searchifsccode" parameter...

Advisory ROSA-SA-2024-2513

Software: python-setuptools 0.9.8 OS: rosa-server79 packageevrstring: python-setuptools-0.9.8-7.0.1.res7 CVE-ID: CVE-2024-6345 BDU-ID: 2024-05843 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the packageindex module of the setuptools project packaging simplification library is related to functions...

Dell OpenManage Enterprise Code Execution

The vulnerability of the Dell OpenManage Enterprise system management console is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...