CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-30858
https://notcve.org/view.php?id=CVE-2024-30858
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php. netentsec NS-ASG 6.3 es vulnerable a la inyección SQL a través de /admin/edit_fire_wall.php. • https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-edit_fire_wall.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-30868
https://notcve.org/view.php?id=CVE-2024-30868
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php. netentsec NS-ASG 6.3 es vulnerable a la inyección SQL a través de /admin/add_getlogin.php. • https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-add_getlogin.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41724
https://notcve.org/view.php?id=CVE-2023-41724
A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. Una vulnerabilidad de inyección de comandos en Ivanti Sentry anterior a 9.19.0 permite que un actor de amenazas no autenticado ejecute comandos arbitrarios en el sistema operativo subyacente del dispositivo dentro de la misma red física o lógica. • https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29202 – JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
https://notcve.org/view.php?id=CVE-2024-29202
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7. JumpServer es un host bastión de código abierto y un sistema de auditoría de seguridad de operación y mantenimiento. • https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29201 – JumpServer's insecure Ansible playbook validation leads to RCE in Celery
https://notcve.org/view.php?id=CVE-2024-29201
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7. JumpServer es un host bastión de código abierto y un sistema de auditoría de seguridad de operación y mantenimiento. • https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj • CWE-94: Improper Control of Generation of Code ('Code Injection') •