Api2Cart Bridge Connector < 1.2.0 - Unauthenticated RCE

The plugin does not validate some parameters which could lead to RCE...

Ultimate Member < 2.5.1 - Admin+ RCE

The plugin does not validate user input passed to calluserfunc via the getoptionvaluefromcallback function, which could allow high privilege users to perform RCE even when they are not allowed to for example in multisite setup...

CVE-2022-40876

In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overflow and enable remote code execution RCE...

Remote Code Execution (RCE)

Apache Flume is vulnerable to remote code execution. The vulnerability exists due to improper validations of jms source and provider url where the attacker can use the jms source with an unsafe provider url causing arbitrary code executions...

CVE-2022-40876

The CVE-2022-40876 entry concerns Tenda AX1803 v1.0.0.1, where HTTP requests processed by the fromAdvSetMacMtuWan functions, specifically involving wanSpeed, cloneType, and mac, can trigger a stack overflow and enable remote code execution (RCE). Public references (NVD, Red Hat, CVE listings) cor...

CVE-2022-40876

In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overflow and enable remote code execution RCE...

CVE-2022-39365

CVE-2022-39365 concerns Pimcore before version 10.5.9, where user-controlled twig templates rendered in Pimcore/Mail and ClassDefinition\Layout\Text enable server-side template injection, potentially allowing remote code execution. The issue is fixed in Pimcore 10.5.9; a patch exists (or can be a...

Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution RCE attack when a configuration uses a JMS Source with an unsafe...

GHSA-9W4G-FP9H-3Q2V Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution RCE attack when a configuration uses a JMS Source with an unsafe...

CVE-2022-42468

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

Remote code execution

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution RCE attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol...

CVE-2022-29823

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution RCE with privileges of application...

Remote code execution

Feather-Sequalize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution RCE with privileges of application...

VMware Releases Patch for Critical RCE Flaw in Cloud Foundation Platform

VMware on Tuesday shipped security updates to address a critical security flaw in its VMware Cloud Foundation product. Tracked as CVE-2021-39144, the issue has been rated 9.8 out of 10 on the CVSS vulnerability scoring system, and relates to a remote code execution vulnerability via XStream open...

CVE-2022-39361 Metabase vulnerable to Remote Code Execution via H2

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, H2 Sample Database could allow Remote Code Execution RCE, which can be abused by users able to write SQL queries on H2 databases. This issue is patched in versions 0.44.5...

CVE-2022-39944 The Apache Linkis JDBC EngineConn module has a RCE Vulnerability

In Apache Linkis =1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in...

CVE-2022-39361

Metabase (data visualization platform) contains a CVE-2022-39361 affecting H2 (Sample Database) prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, enabling Remote Code Execution when a user can write SQL queries against H2. The issue is mitigated by disallowing ...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-paramiko (SUSE-SU-2022:3730-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3730-1 advisory. Updated to version 2.4.3: - CVE-2018-1000805: Fixed authentication bypass bsc1111151. Bugfixes: - Fixed...

CVE-2022-42468

Apache Flume (versions 1.4.0–1.10.1) is vulnerable to remote code execution when a JMS Source is configured with an unsafe providerURL, due to JMSSource performing an unvalidated JNDI lookup. The issue is fixed by updating to 1.11.0, which limits JNDI to java protocol or no protocol. Red Hat and ...

CVE-2022-39944 The Apache Linkis JDBC EngineConn module has a RCE Vulnerability

In Apache Linkis =1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in...