17428 matches found
CVE-2021-45327
Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user execute arbitrary code...
CVE-2022-23340
Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results...
VP9 Video Extensions Remote Code Execution Vulnerability
...
WordPress plugin代码注入漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A code injection vulnerability exists in the Worpress plugin...
PT-2022-1694 · Microsoft · Office Visio
Name of the Vulnerable Software and Affected Versions: Microsoft Office Visio affected versions not specified Description: The issue is related to incorrect code generation management in Microsoft Office Visio, allowing a remote attacker to execute arbitrary code. This can be exploited by a remot...
log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...
CVE-2021-43927
Improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in Security Management functionality in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors...
The vulnerability of the app/admin/routing/edit-bgp-mapping-search.php web application for managing IP addresses in phpipam allows a attacker to execute arbitrary SQL queries.
The vulnerability of the app/admin/routing/edit-bgp-mapping-search.php web application for managing IP addresses in phpipam lies in the lack of measures taken to protect the SQL query structure when processing the “subnet” parameter. Exploiting this vulnerability allows a malicious actor to execu...
The vulnerability of the snapper module in the configuration management system and remote execution of SaltStack Salt allows a perpetrator to gain increased privileges.
The vulnerability of the snapper module in the Configuration Management system and the remote execution of SaltStack Salt is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow attackers to enhance their privileges through a special...
CVE-2022-24262
The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root...
D-Link DIR-878 命令注入漏洞
D-Link DIR-878 is a wireless router from D-Link Taiwan, China. The D-Link DIR-878 is vulnerable to operating system command injection, which can be exploited by attackers to execute arbitrary commands via crafted HNAP1 POST requests...
TotoLink A720R 命令注入漏洞
TOTOLINK A720R is a router device. An input validation vulnerability exists in TOTOLINK A720R Main's handling of QUERYSTRING, which can be exploited by a remote attacker to submit a special request that can be used to execute arbitrary commands in the application context...
log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...
7: Incomplete fix of CVE-2016-4978 in HornetQ library
The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...
Cisco Rv340 Dual Wan Gigabit Vpn Router 缓冲区错误漏洞
The Cisco Rv340 Dual Wan Gigabit Vpn Router is a dual WAN Gigabit Vpn router from Cisco. The Cisco RV340 Dual WAN Gigabit VPN Router suffers from a buffer error vulnerability that originates from a boundary error when processing an HTTP request, which can be exploited by a remote attacker to send...
CVE-2022-23597 Remote program execution with user interaction
Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the...
ROS-20220125-14
Lxml library vulnerability is related to insufficient cleansing of user data in the cleanup program HTML in the lxml.html file. Exploitation of the vulnerability could allow an attacker acting remotely to cause a victim to click on a specially crafted link and execute arbitrary HTML code and scri...
The vulnerability of the JMSSink class implementation in the Log4j logging library allows a perpetrator to execute arbitrary code.
The vulnerability of the JMSSink class implementation in the Log4j Java logging library is related to deficiencies in the data deserialization mechanism. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code by sending specially crafted JNDI requests...
The vulnerability of the vfs_fruit module in the Samba networking communication software allows a hacker to execute arbitrary code.
The vulnerability of the VFS vfsfruit module in the Samba networking software package is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
