Refine your search

6 vulnerabilities found for by TÜBİTAK BİLGEM Software Technologies Research Institute

CVE-2026-19702 (GCVE-0-2026-19702)
Vulnerability from cvelistv5
Published
2026-08-31 13:54
Modified
2026-08-31 14:25
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Summary
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8.
References
Impacted products
Vendor Product Version
TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair Version: 1.0.7   < 1.0.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19702",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-31T14:25:40.472879Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-31T14:25:48.846Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Pardus Boot Repair",
          "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
          "versions": [
            {
              "lessThan": "1.0.8",
              "status": "affected",
              "version": "1.0.7",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mert Durum"
        }
      ],
      "datePublic": "2026-08-31T13:31:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\u003cp\u003eThis issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\n\nThis issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T13:54:45.791Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0956"
        }
      ],
      "source": {
        "advisory": "TR-26-0956",
        "defect": [
          "TR-26-0956"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "OS Command Injection in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Pardus Boot Repair",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-19702",
    "datePublished": "2026-08-31T13:54:45.791Z",
    "dateReserved": "2026-08-13T08:07:57.415Z",
    "dateUpdated": "2026-08-31T14:25:48.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19271 (GCVE-0-2026-19271)
Vulnerability from cvelistv5
Published
2026-08-26 13:44
Modified
2026-08-26 15:43
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Summary
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection. This issue affects Liderahenk: from 3.4.0 before 3.5.5.
References
Impacted products
Vendor Product Version
TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk Version: 3.4.0   < 3.5.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19271",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T15:43:25.301919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T15:43:48.093Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Liderahenk",
          "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
          "versions": [
            {
              "lessThan": "3.5.5",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Emre DO\u011eAN"
        }
      ],
      "datePublic": "2026-08-26T13:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.\u003cp\u003eThis issue affects Liderahenk: from 3.4.0 before 3.5.5.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.\n\nThis issue affects Liderahenk: from 3.4.0 before 3.5.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-136",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-136 LDAP Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-90",
              "description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T13:44:57.748Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916"
        }
      ],
      "source": {
        "advisory": "TR-26-0916",
        "defect": [
          "TR-26-0916"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Blind LDAP Injection in Sign-In Endpoint in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Liderahenk",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-19271",
    "datePublished": "2026-08-26T13:44:57.748Z",
    "dateReserved": "2026-08-07T14:23:01.592Z",
    "dateUpdated": "2026-08-26T15:43:48.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75896 (GCVE-0-2026-75896)
Vulnerability from cvelistv5
Published
2026-08-26 13:35
Modified
2026-08-26 17:10
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-798 - Use of Hard-coded Credentials
Summary
Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5.
References
Impacted products
Vendor Product Version
TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk Version: 0   < 3.5.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75896",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T17:10:20.417348Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T17:10:29.246Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Liderahenk",
          "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
          "versions": [
            {
              "lessThan": "3.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ehlullah Albayrak"
        }
      ],
      "datePublic": "2026-08-26T13:28:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Hard-coded Credentials vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords.\u003cp\u003eThis issue affects Liderahenk: before 3.5.5.\u003c/p\u003e"
            }
          ],
          "value": "Use of Hard-coded Credentials vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords.\n\nThis issue affects Liderahenk: before 3.5.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-70",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-70 Try Common or Default Usernames and Passwords"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T13:35:05.852Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916"
        }
      ],
      "source": {
        "advisory": "TR-26-0916",
        "defect": [
          "TR-26-0916"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Use of Hard-coded LDAP Credentials in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Liderahenk",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-75896",
    "datePublished": "2026-08-26T13:35:05.852Z",
    "dateReserved": "2026-08-18T14:06:46.512Z",
    "dateUpdated": "2026-08-26T17:10:29.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15599 (GCVE-0-2026-15599)
Vulnerability from cvelistv5
Published
2026-08-06 12:37
Modified
2026-08-06 14:42
Severity ?
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE
Summary
Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5.
References
Impacted products
Vendor Product Version
TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner Version: 0   < 0.5.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15599",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T14:42:03.910991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T14:42:17.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "pardus-domain-joiner",
          "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
          "versions": [
            {
              "lessThan": "0.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Namiq Ba\u011f\u0131rzad\u0259"
        }
      ],
      "datePublic": "2026-08-06T12:24:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unverified ownership vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse.\u003cp\u003eThis issue affects pardus-domain-joiner: before 0.5.5.\u003c/p\u003e"
            }
          ],
          "value": "Unverified ownership vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse.\n\nThis issue affects pardus-domain-joiner: before 0.5.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-283",
              "description": "CWE-283 Unverified ownership",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T12:37:22.123Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0770"
        }
      ],
      "source": {
        "advisory": "TR-26-0770",
        "defect": [
          "TR-26-0770"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary Process Termination in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-domain-joiner",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-15599",
    "datePublished": "2026-08-06T12:37:22.123Z",
    "dateReserved": "2026-07-13T14:13:50.482Z",
    "dateUpdated": "2026-08-06T14:42:17.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18915 (GCVE-0-2026-18915)
Vulnerability from cvelistv5
Published
2026-08-06 07:33
Modified
2026-08-06 12:32
Severity ?
5.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CWE
  • CWE-214 - Invocation of process using visible sensitive information
Summary
Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4.
References
Impacted products
Vendor Product Version
TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock Version: 0   < 1.0.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18915",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T12:32:46.054101Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T12:32:52.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eta-otp-lock",
          "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
          "versions": [
            {
              "lessThan": "1.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Emirhan Y\u00dcCEL"
        }
      ],
      "datePublic": "2026-08-06T07:28:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Invocation of process using visible sensitive information vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting.\u003cp\u003eThis issue affects eta-otp-lock: before 1.0.4.\u003c/p\u003e"
            }
          ],
          "value": "Invocation of process using visible sensitive information vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting.\n\nThis issue affects eta-otp-lock: before 1.0.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-580",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-580 System Footprinting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-214",
              "description": "CWE-214 Invocation of process using visible sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T07:33:16.330Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0753"
        }
      ],
      "source": {
        "advisory": "TR-26-0753",
        "defect": [
          "TR-26-0753"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Exposure of OTP Secret Through Process Command-Line Arguments in T\u00dcB\u0130TAK B\u0130LGEM\u0027s eta-otp-lock",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-18915",
    "datePublished": "2026-08-06T07:33:16.330Z",
    "dateReserved": "2026-08-05T07:31:21.423Z",
    "dateUpdated": "2026-08-06T12:32:52.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18806 (GCVE-0-2026-18806)
Vulnerability from cvelistv5
Published
2026-08-04 12:38
Modified
2026-08-10 11:33
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE
  • CWE-73 - External control of file name or path
Summary
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0.
References
Impacted products
Vendor Product Version
TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer Version: 0   < 0.9.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T15:37:37.919419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T15:37:47.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "pardus-image-writer",
          "vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
          "versions": [
            {
              "lessThan": "0.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Emirhan Y\u00dcCEL"
        }
      ],
      "datePublic": "2026-08-04T12:26:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "External control of file name or path vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality.\u003cp\u003eThis issue affects pardus-image-writer: before 0.9.0.\u003c/p\u003e"
            }
          ],
          "value": "External control of file name or path vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality.\n\nThis issue affects pardus-image-writer: before 0.9.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-207",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-207 Removing Important Client Functionality"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External control of file name or path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:33:53.118Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0740"
        }
      ],
      "source": {
        "advisory": "TR-26-0740",
        "defect": [
          "TR-26-0740"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary Block Device Write via Missing Validation in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-image-writer",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-18806",
    "datePublished": "2026-08-04T12:38:14.831Z",
    "dateReserved": "2026-08-04T12:12:44.857Z",
    "dateUpdated": "2026-08-10T11:33:53.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}