CVE-2022-36038

CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution RCE vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Executi...

CVE-2022-36038

CVE-2022-36038 affects CircuitVerse. A remote code execution vulnerability allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. The root cause is linked to Oj.load usage, with a patch available in commit 7b3023a99499a7675f10f2c1d9effdf10c35fb6e. Affected v...

CVE-2022-36038 CircuitVerse potential RCE vulnerability via Oj.load

CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution RCE vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Executi...

CVE-2022-36038 CircuitVerse potential RCE vulnerability via Oj.load

CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution RCE vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Executi...

CVE-2022-36038 CircuitVerse potential RCE vulnerability via Oj.load

CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution RCE vulnerability in CircuitVerse allows authenticated attackers to execute arbitrary code via specially crafted JSON payloads. This issue may lead to Remote Code Executi...

Amazon Linux 2022 : php, php-bcmath, php-cli (ALAS2022-2022-085)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-085 advisory. A flaw was found in PHP. The vulnerability occurs due to the malformed phpfilterfloat function and leads to a use-after-free vulnerability. This flaw allows an attacker to inject a malicious file, leadi...

pfSense plugin pfBlockerNG unauthenticated RCE as root

pfBlockerNG is a popular pfSense plugin that is not installed by default. It's generally used to block inbound connections from whole countries or IP ranges. Versions 2.1.426 and below are affected by an unauthenticated RCE vulnerability that results in root access. Note that version 3.x is...

Desktop APP XSS to RCE

📝 Description Bypass disabled plugins configuration According to its default configuration, drawio desktop disables the use of custom plugin and must be using --enable-plugins to enable it. In addition, draw.io allows you to configure the application mainly the interface using a json file...

Debian: Security Advisory (DLA-3093-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for CVE-2021-3129

CVE-2021-3129 Yet another exploit for CVE-2021-3129! Made to h...

CVE-2022-25813

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SST...

Code injection

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SST...

CVE-2022-25813

Apache OFBiz CVE-2022-25813 affects versions 18.12.05 and earlier. An anonymous user can inject malicious content into the Subject field of the ecommerce plugin’s Contact us page, triggering a Server-Side Template Injection (SSTI) when a party manager lists communications, potentially enabling Re...

CVE-2022-25371

CVE-2022-25371 involves Apache OFBiz with the Birt plugin. A bug in Birt (Eclipse bug 538142) enables a remote code execution (RCE) attack in OFBiz 18.12.05 and earlier. The connected Red Hat/NVD entries confirm the RCE impact and affected version range. No details on a fixed/version upgrade are ...

Remote code execution

InnoSilicon T3T+ t2t+soc20190911151433.swu was discovered to contain a remote code execution RCE vulnerability in the checkUrl function...

CVE-2022-36603

InnoSilicon T3T+ t2t+_soc_20190911_151433.swu contains a remote code execution (RCE) vulnerability in the checkUrl function. The issue is documented as CVE-2022-36603 with a high impact (CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8). The affected component is the t2t+ soc firmwa...

CVE-2022-36602

The CVE-2022-36602 entry concerns InnoSilicon A10, specifically the a10_20200924_120556 build, which contains a remote code execution (RCE) vulnerability in the setPlatformAPI function. The issue enables an attacker to achieve code execution remotely, as indicated by the vulnerability description...

CVE-2022-36602

InnoSilicon A10 a1020200924120556 was discovered to contain a remote code execution RCE vulnerability in the setPlatformAPI function...

RCE flaw resides in the Atlassian Bitbucket Server and Data Center

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Atlassian has patched a significant security hole in Bitbucket Server and Data Center, which could allow attackers to execute arbitrary code on susceptible systems. The vulnerability is identified...

Python < 3.6.14, 3.7.x < 3.7.11, 3.8.x < 3.8.9, 3.9.x < 3.9.3 (bpo-43285) - Mac OS X

Python is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...