Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,928 results · page 11 of 39
Oct 21, 2024A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell coCVE-2024-40089 · Other software · viloliving · reported by MITRECritical 9.1
A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device.
- Product
- vilo_5_mesh_wifi_system_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component.CVE-2024-48783 · Other software · Ruijie · reported by MITREHigh 7.5
An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component.
- Product
- Nbr3000d-e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update processCVE-2024-48776 · Other software · shelly · reported by MITREHigh 7.5
An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process
- Product
- home_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device wCVE-2024-47495 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 8.4
An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines (REs) are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolved with dual-REs: * All versions before 21.2R3-S8-EVO, * from 21.4-EVO before 21.4R3-S8-EVO, * from 22.2-EVO before 22.2R3-S4-EVO, * from 22.3-EVO before 22.3R3-S4-EVO, * from 22.4-EVO before 22.4R3-S3-EVO, * from 23.2-EVO before 23.2R2-S1-EVO, * from 23.4-EVO before 23.4R2-S1-EVO. This issue does not affect Juniper Networks Junos OS.
- Product
- Junos OS Evolved
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Windows Shell Remote Code Execution VulnerabilityCVE-2024-43552 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Windows Shell Remote Code Execution Vulnerability
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2024A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the undeCVE-2024-20492 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6
A vulnerability in the restricted shell of Cisco Expressway Series could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit this vulnerability, the attacker must have Administrator-level credentials with read-write privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a series of crafted CLI commands. A successful exploit could allow the attacker to escape the restricted shell and gain root privileges on the underlying operating system of the affected device. Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Oct 1, 2024PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters in a Software Update CVE-2024-44610 · Other software · pcan_ethernet · reported by MITREMedium 5.6
PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters in a Software Update to processing.php.
- Product
- gateway_fd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2024Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port.CVE-2024-44540 · Network & remote access · ubiquiti · reported by MITREMedium 6.6
Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port.
- Product
- airmax_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool.CVE-2024-5760 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
The Samsung Universal Print Driver for Windows is potentially vulnerable to escalation of privilege allowing the creation of a reverse shell in the tool. This is only applicable for products in the application released or manufactured before 2018.
- Product
- Samsung Universal Print Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2024A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings.CVE-2024-6091 · Other software · significant-gravitas · reported by security@huntr.devCritical 9.8
A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.
- Product
- significant-gravitas/autogpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.CVE-2024-8504 · Other software · VICIdial · reported by bbf0bd87-ece2-41be-b873-96928ee8fab9High 8.8
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
- Product
- VICIdial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkorelogic.comvicidial.org
Sep 10, 2024PowerShell Elevation of Privilege VulnerabilityCVE-2024-38046 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
PowerShell Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 20246SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell scriptsCVE-2024-8330 · Other software · Gether Technology · reported by twcert@cert.org.twHigh 8.8
6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell scripts and use them to execute arbitrary system commands on the server.
- Product
- 6SHR System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 28, 2024A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-aCVE-2024-20413 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to elevate privileges to network-admin on an affected device. This vulnerability is due to insufficient security restrictions when executing application arguments from the Bash shell. An attacker with privileges to access the Bash shell could exploit this vulnerability by executing crafted commands on the underlying operating system. A successful exploit could allow the attacker to create new users with the privileges of network-admin.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 28, 2024A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as CVE-2024-20411 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.7
A vulnerability in Cisco NX-OS Software could allow an authenticated, local attacker with privileges to access the Bash shell to execute arbitrary code as root on an affected device. This vulnerability is due to insufficient security restrictions when executing commands from the Bash shell. An attacker with privileges to access the Bash shell could exploit this vulnerability by executing a specific crafted command on the underlying operating system. A successful exploit could allow the attacker to execute arbitrary code with the privileges of root.
- Product
- Cisco NX-OS Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Aug 22, 2024Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication.CVE-2024-36445 · Other software · swissphone · reported by MITRECritical 9.8
Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication.
- Product
- dical-red_4009
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2024Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART DebuggiCVE-2024-31800 · Other software · Gncchome · reported by MITREMedium 6.8
Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell via the UART Debugging Port.
- Product
- Gncc C2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgncchome.comnsideattacklogic.de
Aug 13, 2024A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications bCVE-2023-20578 · Other software · AMD · reported by psirt@amd.comHigh 7.5
A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify the communications buffer potentially resulting in arbitrary code execution.
- Product
- AMD EPYC™ 7001 Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltCVE-2023-20518 · Other software · AMD · reported by psirt@amd.comLow 1.9
Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell and a memory exfiltration vulnerability, potentially resulting in loss of confidentiality.
- Product
- AMD EPYC™ 9004 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI CVE-2021-46772 · Other software · AMD · reported by psirt@amd.comLow 3.9
Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the structure headers in SPI ROM causing an out of bounds memory read and write, potentially resulting in memory corruption or denial of service.
- Product
- AMD EPYC™ 7002 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions iCVE-2021-26387 · Other software · AMD · reported by psirt@amd.comLow 3.9
Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity.
- Product
- AMD EPYC™ 7001 Series Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024fish-shop/syntax-check is a GitHub action for syntax checking fish shell files.CVE-2024-42482 · Other software · fish-shop · reported by GitHubMedium 4.8
fish-shop/syntax-check is a GitHub action for syntax checking fish shell files. Improper neutralization of delimiters in the `pattern` input (specifically the command separator `;` and command substitution characters `(` and `)`) mean that arbitrary command injection is possible by modification of the input value used in a workflow. This has the potential for exposure or exfiltration of sensitive information from the workflow runner, such as might be achieved by sending environment variables to an external entity. It is recommended that users update to the patched version `v1.6.12` or the latest release version `v2.0.0`, however remediation may be possible through careful control of workflows and the `pattern` input value used by this action.
- Product
- syntax-check
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2024Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endCVE-2024-3659 · Other software · KAON Group · reported by cvd@cert.plCritical 10
Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints. In order to exploit this vulnerability, one has to have access to the administrative portal of the router.
- Product
- AR2140
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2024In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights.CVE-2024-23464 · Other software · Zscaler · reported by cve@zscaler.comHigh 7.2
In certain cases, Zscaler Internet Access (ZIA) can be disabled by PowerShell commands with admin rights. This affects Zscaler Client Connector on Windows <4.2.1
- Product
- Client Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024Starship is a cross-shell prompt.CVE-2024-41815 · Other software · starship · reported by GitHubHigh 7.4
Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.0 fixes the vulnerability.
- Product
- starship
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2024A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privilegCVE-2024-38510 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.2
A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.
- Product
- XClarity Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jul 26, 2024A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC useCVE-2024-38508 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.2
A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.
- Product
- XClarity Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jul 24, 2024Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or TraceCVE-2024-31977 · Other software · adtran · reported by MITREHigh 8.8
Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.
- Product
- 834-5_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.proton.megithub.com
Jul 22, 2024Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlusCVE-2024-6913 · Other software · PerkinElmer · reported by office@cyberdanube.comCritical 9.3
Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0.
- Product
- ProcessPlus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgcyberdanube.com
Jul 9, 2024.NET and Visual Studio Denial of Service VulnerabilityCVE-2024-38095 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- PowerShell 7.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024PowerShell Elevation of Privilege VulnerabilityCVE-2024-38047 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
PowerShell Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024PowerShell Elevation of Privilege VulnerabilityCVE-2024-38043 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
PowerShell Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 9, 2024PowerShell Elevation of Privilege VulnerabilityCVE-2024-38033 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
PowerShell Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 2, 2024Command go env is documented as outputting a shell script containing the Go environment.CVE-2023-24531 · Other software · Go toolchain · reported by security@golang.orgCritical 9.8
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
- Product
- cmd/go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connectionCVE-2024-6376 · Other software · MongoDB Inc · reported by cna@mongodb.comHigh 7
MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2
- Product
- MongoDB Compass
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mongodb.orgjira.mongodb.org
Jun 24, 2024The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server.CVE-2024-4748 · Other software · CRUDDIY · reported by cvd@cert.plHigh 8.8
The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which would send such a malicious request to the locally launched server.
- Product
- CRUDDIY
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2024In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-striCVE-2024-39331 · Other software · gnu · reported by MITRECritical 9.8
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
- Product
- emacs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.savannah.gnu.orggit.savannah.gnu.org
Jun 21, 2024Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval oCVE-2014-5470 · Other software · actualscripts · reported by MITRECritical 9.8
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation.
- Product
- actualanalyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulmon.comexploit-db.com
Jun 16, 2024htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.CVE-2024-38448 · Other software · gnu · reported by MITRECritical 9.1
htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.
- Product
- global
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcvs.savannah.gnu.orglists.gnu.org
Jun 14, 2024All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs.CVE-2024-27160 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.2
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs.CVE-2024-27159 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.2
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2024In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g.CVE-2024-36472 · Other software · reported by MITREMedium 6.5
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orggitlab.gnome.org
May 22, 2024A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commandsCVE-2024-22026 · Network & remote access · Ivanti · reported by support@hackerone.comMedium 6.7
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
May 21, 2024In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pCVE-2023-52854 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: padata: Fix refcnt handling in padata_free_shell() In a high-load arm64 environment, the pcrypt_aead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcrypt_aead01 function call, I'll describe the problem scenario using a simplified model: Suppose there's a user of padata named `user_function` that adheres to the padata requirement of calling `padata_free_shell` after `serial()` has been invoked, as demonstrated in the following code: ```c struct request { struct padata_priv padata; struct completion *done; }; void parallel(struct padata_priv *padata) { do_something(); } void serial(struct padata_priv *padata) { struct request *request = container_of(padata, struct request, padata); complete(request->done); } void user_function() { DECLARE_COMPLETION(done) padata->parallel = parallel; padata->serial = serial; padata_do_parallel(); wait_for_completion(&done); padata_free_shell(); } ``` In the corresponding padata.c file, there's the following code: ```c static void padata_serial_worker(struct work_struct
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
May 19, 2024In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_dCVE-2024-36053 · Computers, phones & browsers · linuxmint · reported by MITRECritical 9
In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_data_received_cb, and Service.remove. A user can modify a service name in a ~/.linuxmint/mintUpload/services/service file.
- Product
- mintupload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpackages.linuxmint.comgithub.com
Apr 25, 2024The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX).CVE-2024-4163 · Other software · Skylab · reported by cve_disclosure@tech.gov.sgHigh 8
The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX). However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the limited shell file exec and download functions. By replacing the /etc/passwd file with a new root user entry, the attacker was able to breakout from the limited shell and login to a unrestricted shell with root access. With the root access, the attacker will be able take full control of the IIoT Gateway.
- Product
- IIoT Gateway (IGX)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgovtech-csg.github.iogovtech-csg.github.io
Apr 5, 2024u-boot bug that allows for u-boot shell and interrupt over UART CVE-2023-48426 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 10
u-boot bug that allows for u-boot shell and interrupt over UART
- Product
- Chromecast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 4, 2024TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web sCVE-2024-22188 · Other software · typo3 · reported by MITREHigh 7.2
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.
- Product
- typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.CVE-2022-48624 · Other software · Greenwoodsoftware · reported by MITREHigh 7.8
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
- Product
- Less
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2024Unchecked length coming from user input in settings shellCVE-2023-6749 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgHigh 8
Unchecked length coming from user input in settings shell
- Product
- Zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.