Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted...
9.8CVSS
9.6AI Score
0.002EPSS
The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files via the ConfigName...
6.5CVSS
6.4AI Score
0.001EPSS
A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid...
6.1CVSS
6AI Score
0.001EPSS
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary...
8.1CVSS
7.9AI Score
0.001EPSS
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary...
8.8CVSS
8.6AI Score
0.001EPSS
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING...
8.8CVSS
8.7AI Score
0.001EPSS
NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this path. Then, when launching the Python interpreter via the "Ghidra Codebrowser > Window > Python" option, Ghidra will try to execute the...
7.8CVSS
7.6AI Score
0.001EPSS
NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working...
7.8CVSS
7.3AI Score
0.001EPSS
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An...
9.8CVSS
9.5AI Score
0.014EPSS
In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis...
7.8CVSS
7.8AI Score
0.006EPSS
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp...
9.1CVSS
7.4AI Score
0.004EPSS