11722 matches found
CVE-2024-22423 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment...
CVE-2024-22423
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment...
CVE-2024-26221
Windows DNS Server Remote Code Execution Vulnerability...
CVE-2024-26257
CVE-2024-26257 affects Microsoft Excel (Office) with a remote code execution vulnerability. Base CVSS v3.1 score 7.8 (HIGH): attack vector LOCAL, requires user interaction, no privileges required, and impacts C/I/A HIGH. Root cause/details are not fully described in the documents, but Microsoft r...
Exploit for Command Injection in Dlink Dns-320L_Firmware
CVE-2024-3273 - D-Link Remote Code Execution RCE :boom: A c...
AVideo WWBNIndex Plugin Unauthenticated RCE
This module exploits an unauthenticated remote code execution RCE vulnerability in the WWBNIndex plugin of the AVideo platform. The vulnerability exists within the submitIndex.php file, where user-supplied input is passed directly to the require function without proper sanitization. By exploiting...
CVE-2024-31808
TOTOLINK EX200 V4.0.3c.7646B20201211 was discovered to contain a remote code execution RCE vulnerability via the webWlanIdx parameter in the setWebWlanIdx function...
CVE-2024-31811
TOTOLINK EX200 V4.0.3c.7646B20201211 was discovered to contain a remote code execution RCE vulnerability via the langType parameter in the setLanguageCfg function...
CVE-2024-31811
TOTOLINK EX200 vulnerable via langType parameter in setLanguageCfg, affecting version 4.0.3c.7646_B20201211. Root cause: langType fails to filter special elements in the constructed snippet, enabling remote code execution. Impact per metrics: high: CVSS 3.1 base score 8.0 (AV Adjacent, AC Low, PR...
CVE-2024-31807
CVE-2024-31807 affects TOTOLINK EX200 (V4.0.3c.7646_B20201211). The NTPSyncWithHost function’s hostTime parameter allows remote code execution via input handling, per multiple sources (NVD/Red Hat/CNVD/CVELIST). Base CVSS v3.1 score is 9.8 (CRITICAL) with network attack vector, no user interactio...
CVE-2024-31808
TOTOLINK EX200 v4.0.3c.7646_B20201211 is affected by CVE-2024-31808, a remote code execution (RCE) via the webWlanIdx parameter in the setWebWlanIdx function. Multiple connected sources confirm an RCE vulnerability in this specific version, enabling arbitrary code execution. The public discussion...
CVE-2024-31808
TOTOLINK EX200 V4.0.3c.7646B20201211 was discovered to contain a remote code execution RCE vulnerability via the webWlanIdx parameter in the setWebWlanIdx function...
CVE-2024-31807
TOTOLINK EX200 V4.0.3c.7646B20201211 was discovered to contain a remote code execution RCE vulnerability via the hostTime parameter in the NTPSyncWithHost function...
CVE-2024-31809
TOTOLINK EX200 v4.0.3c.7646_B20201211 is reported to have a remote code execution vulnerability via the FileName parameter in the setUpgradeFW function. The issue affects the TOTOLINK EX200 device and is described across multiple sources (NVD/Red Hat/CNVD/CVELIST). The root cause is improper hand...
BIT-WORDPRESS-2024-31210 PHP file upload bypass via Plugin installer
WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins - Add New - Upload Plugin screen in WordPress. If FTP credentials are requested for installation in order to move...
BIT-WORDPRESS-MULTISITE-2024-31210 PHP file upload bypass via Plugin installer
WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins - Add New - Upload Plugin screen in WordPress. If FTP credentials are requested for installation in order to move...
CVE-2024-25029 IBM Personal Communications code execution
IBM Personal Communications 14.0.6 through 15.0.1 includes a Windows service that is vulnerable to remote code execution RCE and local privilege escalation LPE. The vulnerability allows any unprivileged user with network access to a target computer to run commands with full privileges in the...
CVE-2024-25029 IBM Personal Communications code execution
IBM Personal Communications 14.0.6 through 15.0.1 includes a Windows service that is vulnerable to remote code execution RCE and local privilege escalation LPE. The vulnerability allows any unprivileged user with network access to a target computer to run commands with full privileges in the...