Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NOAA PMEL Live Access Server (LAS) PyFerret command injection
Vulnerability Description
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
LAS 安全漏洞
Vulnerability Description
LAS是Pacific Marine Environmental Laboratory开源的一个服务器软件。 LAS存在安全漏洞，该漏洞源于特制请求中的PyFerret表达式，可能导致远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A