CVE-2024-48050: Improper Control of Generation of Code

In agentscope =v0.0.4, the file agentscope\web\workstation\workflowutils.py has the function iscallableexpression. Within this function, the line result = evals poses a security risk as it can directly execute user-provided commands...

GHSA-FQ9M-V26V-2M4F lilconfig Code Injection vulnerability

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

CVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

CVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

CVE-2024-21537

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

CVE-2024-21537

CVE-2024-21537 affects lilconfig versions 3.1.0 and earlier (up to 3.1.1). Root cause: insecure use of eval in the dynamicImport function, enabling Arbitrary Code Execution when a malicious input is passed via defaultLoaders. Impact is high (Code Execution) as indicated by multiple sources; explo...

CVE-2024-21537: Improper Control of Generation of Code

Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval in the dynamicImport function. An attacker can exploit this vulnerability by passing a malicious input through the defaultLoaders function...

The vulnerability of the Splunk Enterprise platform’s SplunkD module for operational analysis allows a perpetrator to trigger a service failure.

The vulnerability of the Splunk Enterprise platform’s Splunkd component relates to an uncontrolled resource consumption due to an improperly formatted parameter named INGESTEVAL. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

CVE-2024-8512: Improper Neutralization of Directives in Dynamically Evaluated Code

The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization function. This is due to the plugin passing user supplied input to eval. This makes it possible for authenticated...

GHSA-MPCW-3J5P-P99X Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)

Summary Usage of the Butterfly.prototype.parseJSON or getJSON functions on an attacker-controlled crafted input string allows the attacker to execute arbitrary JavaScript code on the server. Since Butterfly JavaScript code has access to Java classes, it can run arbitrary programs. Details The...

PT-2024-40377 · Butterfly · Butterfly

Name of the Vulnerable Software and Affected Versions: Butterfly affected versions not specified Description: The issue allows an attacker to execute arbitrary JavaScript code on the server by using the Butterfly.prototype.parseJSON or getJSON functions on an attacker-controlled crafted input...

CVE-2024-45736

In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.107, 9.1.2312.204, and 9.1.2312.111, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a search query with an improperly formatted "INGESTEVAL"...

Exploit for Code Injection in Geoserver

CVE-2024-36401 This is a program for checking vulnerabilities...

PT-2024-7417 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise versions prior to 9.2.3 Splunk Enterprise versions prior to 9.1.6 Splunk Cloud Platform versions prior to 9.2.2403.107 Splunk Cloud Platform versions prior to 9.1.2312.204 Splunk Clo...

lldb-eval:lldb_vs_lldb_eval_libfuzzer_test: Heap-buffer-overflow in llvm::DataLayout::getIndexedOffsetInType

Detailed Report: https://oss-fuzz.com/testcase?key=5881405328916480 Project: lldb-eval Fuzzing Engine: libFuzzer Fuzz Target: lldbvslldbevallibfuzzertest Job Type: libfuzzerasanlldb-eval Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x606000058c20 Crash State:...

wt:fuzz-eval: Heap-double-free in basic_string.tcc

Project: https://github.com/emweb/wt.git Detailed Report: https://oss-fuzz.com/testcase?key=4829565027942400 Project: wt Fuzzing Engine: libFuzzer Fuzz Target: fuzz-eval Job Type: libfuzzerasanwt Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x503000000b50 Crash State:...

wt:fuzz-eval: Crash in LLVMFuzzerRunDriver

Detailed Report: https://oss-fuzz.com/testcase?key=4506830829584384 Project: wt Fuzzing Engine: afl Fuzz Target: fuzz-eval Job Type: aflasanwt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5240000c8010 Crash State: LLVMFuzzerRunDriver Sanitizer: address ASAN Recommended Security...

Malicious code in express-eval (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b11cc6d66b7e74be79f7522107db232ad1ead6c66b04f0cc4a564705f5756b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9053 Malicious code in express-eval (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b11cc6d66b7e74be79f7522107db232ad1ead6c66b04f0cc4a564705f5756b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in express-eval

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...