Mufti22

CVE-2025-49844 GITHUB CRITICAL python SCANNER

Redis < 6.2.20 - Use After Free

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.

1 stars

CVSS 9.9

View Code

CVE-2024-6387 NOMISEC HIGH SCANNER

OpenSSH - DoS

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

CVSS 8.1

View Code

CVE-2024-4040 NOMISEC CRITICAL WORKING POC

CrushFTP <10.7.1-11.1.0 - RCE

A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

CVSS 9.8

View Code