yifanzhg

3 exploits Active since Jul 2020
CVE-2023-45158 NOMISEC CRITICAL WORKING POC
web2py < 2.24.1 - OS Command Injection via notifySendHandler Logging
An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
4 stars
CVSS 9.8
CVE-2020-15778 NOMISEC HIGH WORKING POC
OpenSSH <= 8.3p1 - OS Command Injection via scp Destination Argument
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
3 stars
CVSS 7.4
CVE-2023-45158 INTHEWILD CRITICAL WORKING POC
web2py < 2.24.1 - OS Command Injection via notifySendHandler Logging
An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
CVSS 9.8