Code injection

Yank Note YN 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire'childprocess'...

CVE-2023-31873

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...

CVE-2023-31873

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...

CVE-2023-31873

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...

Security feature bypass

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...

PT-2023-23500 · Gin · Gin

Name of the Vulnerable Software and Affected Versions: Gin version 0.7.4 Description: The issue allows execution of arbitrary code when a crafted file is opened. This can be achieved, for example, via require'child process'. Recommendations: For Gin version 0.7.4, at the moment, there is no...

CVE-2023-31874

CVE-2023-31874 affects Yank Note (YN) v3.52.1. The vulnerability allows execution of arbitrary code when opening a crafted file, driven by the app’s use of nodeRequire('child_process') in an Electron-based environment. Reported exploits/PoCs exist (e.g., PacketStorm/Exploit-DB materials), confirm...

CVE-2023-31873

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...

CVE-2023-31873

Gin 0.7.4 allows execution of arbitrary code when a crafted file is opened, e.g., via require'childprocess'...

Fedora 37 : bottles / python-vkbasalt-cli (2023-328397d034)

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-328397d034 advisory. Update bottles to 51.6 and release final dependency vkbasalt-cli Tenable has extracted the preceding description block directly from the Fedora...

PT-2023-23501 · Yank Note · Yank Note

Name of the Vulnerable Software and Affected Versions: Yank Note YN version 3.52.1 Description: The issue allows for the execution of arbitrary code when a crafted file is opened. This can be achieved, for example, via nodeRequire'child process'. Recommendations: For Yank Note YN version 3.52.1,...

CVE-2023-31874

Yank Note YN 3.52.1 allows execution of arbitrary code when a crafted file is opened, e.g., via nodeRequire'childprocess'...

CVE-2023-31873

CVE-2023-31873 affects Gin 0.7.4 (Electron-based Gin Markdown Editor). A crafted file can trigger arbitrary code execution via require('child_process'), as demonstrated in public PoC/exploit references (e.g., PacketStorm/EDB). Impact is local, with code execution possible when opening a crafted f...

CVE-2023-22970

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...

CVE-2023-22970

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...

Remote code execution

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...

CVE-2023-22970: Undefined Security Weakness

Bottles before 51.0 mishandles YAML load, which allows remote code execution via a crafted file...

PT-2023-18804 · Bottle · Bottle

Name of the Vulnerable Software and Affected Versions: Bottles versions prior to 51.0 Description: The issue is related to the mishandling of YAML load, which can be exploited for remote code execution via a crafted file. Recommendations: For versions prior to 51.0, update to version 51.0 or late...

Bottle security vulnerabilities

Bottle is a simple and lightweight Python-based WSGI micro web framework from the Bottle community. A security vulnerability exists in Bottles prior to version 51.0, which stems from an error handling YAML that allows remote code execution via a crafted file...

Horner Automation Cscape EnvisionRV Buffer Overflow Code Execution

The vulnerability of the Horner Automation Cscape EnvisionRV remote control access software and the Cscape software arises from reading beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by having the user open a specially created CS...