3787 matches found
CVE-2021-26276: Improper Control of Dynamically-Managed Code Resources
scripts/cli.js in the GoDaddy node-config-shield aka Config Shield package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data...
GoDaddy Node-config-shield Security Vulnerability
GoDaddy Node-config-shield is a Javascript-based codebase for checking sensitive information in projects by GoDaddy, Inc. A security vulnerability exists in GoDaddy node-config-shield that stems from a call to eval while processing the set command...
CVE-2021-21278: Improper Neutralization of Special Elements in Output Used by a Downstream Component
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 non-semantic versioning there is a risk of code injection. Some routes use eval or Function constructor, which may be injected by the target site with unsafe code, causing server-side securi...
CVE-2020-35272
Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting XSS in the Admin Portal in the Task and Description fields...
EulerOS 2.0 SP3 : python (EulerOS-SA-2021-1114)
According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Python 3 through 3.9.0, the Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP.CVE-2020-27619 -...
CVE-2020-28707: Improper Neutralization of Input During Web Page Generation
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting XSS via stockdiocharthistorical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage event is not validated. The stockdioeventer function listens for an...
Arbitrary Code Execution
Amendment This was deemed not a vulnerability. Overview static-eval is an evaluates statically-analyzable expressions. Affected versions of this package are vulnerable to Arbitrary Code Execution. This vulnerability was deemed to be not an issue within the library. References - GitHub Additional...
CMS Made Simple 2.2.15 Remote Command Execution
Exploit Title: CMS Made Simple 2.2.15 - RCE Authenticated Author: Andrey Stoykov Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Version: 2.2.15 Tested on: Debian 10 LAMPP Exploit and Detailed Info:...
CMS Made Simple 2.2.15 - RCE (Authenticated)
Exploit Title: CMS Made Simple 2.2.15 - RCE Authenticated Author: Andrey Stoykov Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Version: 2.2.15 Tested on: Debian 10 LAMPP Exploit and Detailed Info:...
MGASA-2020-0477 Updated python3 packages fix security vulnerability
In Python 3 through 3.9.0, the Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP CVE-2020-27619...
zzzphp Eval Injection Vulnerability
zzphp is an open source free website building system. An Eval injection vulnerability exists in the parserCommom method of the ParserTemplate class in zzzztemplate.php in zzzphp 1.7.2. A remote attacker can exploit this vulnerability to execute arbitrary commands...
CVE-2020-20298
Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzztemplate.php in zzzphp 1.7.2 allows remote attackers to execute arbitrary commands...
CVE-2020-20298
CVE-2020-20298 affects zzzphp 1.7.2, specifically the zzz_template.php file within the ParserTemplate class. The vulnerability is described as an eval injection in the parserCommom method, enabling remote attackers to execute arbitrary commands. The connected documents provide this exact descript...
CVE-2020-20298: Improper Control of Generation of Code
Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzztemplate.php in zzzphp 1.7.2 allows remote attackers to execute arbitrary commands...
VulnCheck KEV: CVE-2017-9841
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI...
In Python 3 through 3.9.0 the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
...
Arbitrary Code Execution in blazar-dashboard
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under because the Python eval function is used. This may result in...
Design/Logic Flaw
In Python 3 through 3.9.0, the Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via HTTP...
