Bob Shell
Monthly
Arbitrary code injection in IBM Bob Shell 1.0.4 through 2.0.1 allows remote, unauthenticated attackers to execute code on a victim's system when a user opens or processes crafted input (CVSS 3.1 base 8.8, CWE-94). The flaw is network-reachable and low-complexity, but it is not a fully autonomous server-side RCE: successful exploitation hinges on the required user interaction, so the attacker must first get a Bob user to handle the malicious input. No public exploit and no confirmed active exploitation were identified at time of analysis; the practical exposure is limited further by the narrow 1.0.4-2.0.1 version scope.
Arbitrary code injection in IBM Bob Shell 1.0.4 through 2.0.1 allows remote, unauthenticated attackers to execute code on a victim's system when a user opens or processes crafted input (CVSS 3.1 base 8.8, CWE-94). The flaw is network-reachable and low-complexity, but it is not a fully autonomous server-side RCE: successful exploitation hinges on the required user interaction, so the attacker must first get a Bob user to handle the malicious input. No public exploit and no confirmed active exploitation were identified at time of analysis; the practical exposure is limited further by the narrow 1.0.4-2.0.1 version scope.