PT-2024-22371 · Unknown · Recrystallize Server

Name of the Vulnerable Software and Affected Versions: ReCrystallize Server version 5.10.0.0 Description: The issue allows administrators to upload files to the server without restrictions, leading to the potential upload of malicious files. This could result in Remote Code Execution...

ROS-20240408-06

A vulnerability in the HID Profile Human Interface Device interface of the Bluetooth protocol stack for the Linux BlueZ operating system is related to an access control flaw. Exploitation of the vulnerability could allow an attacker, acting remotely, escalate their privileges and execute arbitrar...

CVE-2024-31022

CandyCMS 1.0.0 is affected by an RCE via the install.php component. A remote attacker can execute arbitrary code (high impact; CVSS 3.1: 9.8) due to the underlying vulnerability described in multiple sources. The issue affects CandyCMS’s install.php handling and does not specify details of the ro...

Exploit for Command Injection in Dlink Dns-320L_Firmware

CVE-2024-3273 Proof of Concept PoC This repository contains...

PT-2024-23590 · Unknown · Ros2 Dashing Diademata

Name of the Vulnerable Software and Affected Versions: ROS2 Dashing Diademata versions 2 Description: A command injection issue has been found, allowing remote attackers to execute arbitrary commands. Recommendations: For ROS2 Dashing Diademata version 2, update to a version that includes a fix f...

DerbyNet 9.0 render-document.php Cross Site Scripting

CVE ID: CVE-2024-30920 Description: A Cross Site Scripting XSS vulnerability has been identified in DerbyNet v9.0, specifically within the render-document.php component. This vulnerability allows a remote attacker to execute arbitrary code via crafted URLs. The root cause of the vulnerability is...

Addactis IBNRS 安全漏洞

Addactis IBNRS is a non-life insurance solution from Addactis. A security vulnerability exists in Addactis IBNRS version v.3.10.3.107, which stems from a vulnerability that allows remote attackers to execute, via a crafted .ibnrs file, the Project Description, Identifiers, Custom Triangle Name, a...

ROS-20240404-13

A vulnerability in the 7z file analyzer component of the 7-Zip archiver is related to integer overflow. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

CVE-2020-25730

Cross Site Scripting XSS vulnerability in ZoneMinder before version 1.34.21, allows remote attackers execute arbitrary code, escalate privileges, and obtain sensitive information via PHPSELF component in classic/views/download.php...

PT-2024-22870 · Addactis · Addactis Ibnrs

Name of the Vulnerable Software and Affected Versions: Addactis IBNRS version 3.10.3.107 Description: The issue allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to the Project Description, Identifiers, Custom Triangle Name inside Input Triangles, and Yield Curve Name...

CVE-2024-30366

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious pa...

ROS-20240403-02

Vulnerability of ntfsnamesfullcollate function of NTFS file system for NTFS-3G FUSE module is related to buffer overflow in dynamic memory. Exploitation of the vulnerability could allow an attacker to execute arbitrary code with elevated privileges using a specially crafted NTFS image file The NT...

CVE-2024-31012

The CVE-2024-31012 entry concerns SEMCMS v4.8, where an issue in upload.php enables remote attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive information. Affected component is the upload.php handling; root cause themes indicate insecure file handling/execution pat...

CVE-2024-31002

Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCache at Ap4Utils.cpp component...

CVE-2024-29276

An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component...

ROS-20240402-14

Vulnerability of a VPN packet based on IPSec strongSwan protocol is caused by a bug in the charon-tkm process with the key exchange IKE protocol implementation based on TKMv2 Trusted Key Manager. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

XZ: Embedded Malicious Code (CVE-2024-3094)

A Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code. This file is then used to modify specific...

The vulnerability of Adobe Experience Manager’s content and media data management system, which exists due to the lack of measures taken to protect the website structure, allows attackers to execute arbitrary JavaScript code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

The vulnerability of the Apache Doris Backend storage and Frontend request processor lies in the fact that code is loaded without checking its integrity, allowing an attacker to execute arbitrary code.

The vulnerability of the Backend storage and Frontend request processor of Apache Doris lies in the fact that code is loaded without any checks for its integrity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2024-2459 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda F1202 version 1.2.0.20408 Description: The issue is related to the formWriteFacMac function, specifically the /goform/WriteFacMac API endpoint, where a command injection vulnerability exists due to inadequate data cleaning at the...