12831 matches found
Code injection
Yank Note YN 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire'childprocess'...
CVE-2023-31873
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
CVE-2023-31873
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
CVE-2023-31873
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
Security feature bypass
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
CVE-2023-31874
CVE-2023-31874 affects Yank Note (YN) v3.52.1. The vulnerability allows execution of arbitrary code when opening a crafted file, driven by the app’s use of nodeRequire('child_process') in an Electron-based environment. Reported exploits/PoCs exist (e.g., PacketStorm/Exploit-DB materials), confirm...
CVE-2023-31873
CVE-2023-31873 affects Gin 0.7.4 (Electron-based Gin Markdown Editor). A crafted file can trigger arbitrary code execution via require('child_process'), as demonstrated in public PoC/exploit references (e.g., PacketStorm/EDB). Impact is local, with code execution possible when opening a crafted f...
CVE-2023-31874
Yank Note YN 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire'childprocess'...
PT-2023-23501 · Yank Note · Yank Note
Name of the Vulnerable Software and Affected Versions: Yank Note YN version 3.52.1 Description: The issue allows for the execution of arbitrary code when a crafted file is opened. This can be achieved, for example, via nodeRequire'child process'. Recommendations: For Yank Note YN version 3.52.1,...
Fedora 37 : bottles / python-vkbasalt-cli (2023-328397d034)
The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-328397d034 advisory. Update bottles to 51.6 and release final dependency vkbasalt-cli Tenable has extracted the preceding description block directly from the Fedora...
PT-2023-23500 · Gin · Gin
Name of the Vulnerable Software and Affected Versions: Gin version 0.7.4 Description: The issue allows execution of arbitrary code when a crafted file is opened. This can be achieved, for example, via require'child process'. Recommendations: For Gin version 0.7.4, at the moment, there is no...
CVE-2023-31873
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
CVE-2023-31873
Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...
CVE-2023-22970
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...
CVE-2023-22970
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...
Remote code execution
Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...
The vulnerability of the Horner Automation Cscape EnvisionRV remote control access software and the Cscape software arises from reading beyond the buffer in memory, allowing an attacker to execute arbitrary code.
The vulnerability of the Horner Automation Cscape EnvisionRV remote control access software and the Cscape software arises from reading beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by having the user open a specially created CS...
PT-2023-18804 · Bottle · Bottle
Name of the Vulnerable Software and Affected Versions: Bottles versions prior to 51.0 Description: The issue is related to the mishandling of YAML load, which can be exploited for remote code execution via a crafted file. Recommendations: For versions prior to 51.0, update to version 51.0 or late...
Bottle 安全漏洞
Bottle is a simple and lightweight Python-based WSGI micro web framework from the Bottle community. A security vulnerability exists in Bottles prior to version 51.0, which stems from an error handling YAML that allows remote code execution via a crafted file...
