CVE-2020-26623

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the AdministrationWidget tab after the login portal...

Vulnerability of the web interface of the operating system PAN-OS, allowing a perpetrator to execute arbitrary code

The vulnerability of the PAN-OS operating system’s web interface is related to the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with limited privileges on the firewall...

Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...

CVE-2023-49299 Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue...

DEBIAN-CVE-2023-50572

An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...

AZL-66918 CVE-2023-50572 affecting package jline 2.14.6-1

An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...

UBUNTU-CVE-2023-50572

An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM OutofMemory error...

PT-2023-31595 · Unknown +1 · Jline-Groovy +1

Name of the Vulnerable Software and Affected Versions: jline-groovy version 3.24.1 Description: An issue in the component GroovyEngine.execute of jline-groovy allows attackers to cause an out of memory OOM error. Recommendations: For version 3.24.1, consider disabling the GroovyEngine.execute...

Cloudflare Wrangle Security Breach

Cloudflare Wrangler is a repository from Cloudflare, Inc. A security vulnerability exists in Cloudflare Wrangler versions prior to 3.19.0 that stems from the presence of an arbitrary code execution vulnerability that allows an attacker on a local network to connect to the inspector and run...

JLine Security Vulnerability

JLine is a Java library for processing console input from the JLine open source. A security vulnerability exists in JLine version v3.24.1, which stems from a security issue in the component GroovyEngine.execute that results in out of memory...

openSUSE 15 Security Update : zabbix (openSUSE-SU-2023:0419-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0419-1 advisory. - An attacker who has the privilege to configure Zabbix items can use function icmpping with additional malicious command inside it to execute arbitrary...

CVE-2023-49469

Reflected Cross Site Scripting XSS vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function...

CVE-2023-43481

Affected software: Shenzhen TCL Browser TV Web BrowseHere (com.tcl.browser) v6.65.022_dab24cc6_231221_gp. Vulnerable component: com.tcl.browser.portal.browse.activity.BrowsePageActivity. Root cause/impact: remote attacker can execute arbitrary JavaScript code, enabling full control over the affec...

TCL BrowseHere Security Breach

Tcl Communication TCL BrowseHere is a video playback browser with a sophisticated interface from TCL Communication China. A security vulnerability exists in TCL BrowseHere version 6.65.022dab24cc6231221gp, which originates from a vulnerability that allows remote attackers to execute arbitrary...

Input validation

IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the...

PT-2023-28692 · Dell · Dell Client Bios

Name of the Vulnerable Software and Affected Versions: Dell Client BIOS affected versions not specified Description: Dell Client BIOS contains a pre-boot direct memory access DMA vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability...

Vulnerability fixed in IBM Informix

IBM has fixed a vulnerability in the JDBC driver of Informix. A malicious person with rights to use the API could can exploit the vulnerability to execute arbitrary code execute code with permissions from the application using the JDBC driver. Because it cannot be estimated with what permissions...

The vulnerability of the `nvmet_tcp_execute_request()` function in the `drivers/nvme/target/tcp.c` file of the Linux NVMe kernel driver allows a attacker to cause a service failure.

The vulnerability of the nvmettcpexecuterequest function in the drivers/nvme/target/tcp.c file of the Linux NVMe kernel driver is related to the assignment of a null pointer. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Lack of receive() inside MoneyMarketHook contract when interacting with WNATIVE.

Lines of code Vulnerability details Impact MoneyMarketHook is expected to work with the native balance when interacting with WNATIVE, especially when params.returnNative is set to true during the execute operation. However, due to the lack of a receive function inside the contract, MoneyMarketHoo...

When the returnNative parameter is set to true in the _params provided to MoneyMarketHook.execute, it is not handled properly and could disrupt user expectations

Lines of code Vulnerability details Impact When param.returnNative is set to true while calling MoneyMarketHook.execute, users expect the returned token from the withdraw operation to be in native form and sent to the caller. However, in the current implementation, this is not considered and coul...