CVE-2024-43497

DeepSpeed Remote Code Execution Vulnerability...

MTN Group: CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ci

The DotNetNuke DNN versions between 5.0.0 and 9.3.0 were affected by a deserialization vulnerability that could lead to remote code execution. The vulnerability was caused by the way DNN handled the DNNPersonalization cookie, which was used to store anonymous users' personalization options. The...

PT-2024-38020 · Localai · Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version 2.17.1 Description: The localai backend is susceptible to remote code execution. This occurs because the backend accepts inputs from sources beyond the configuration file, enabling an attacker to upload and execute a...

MGASA-2024-0313 Updated python-astropy packages fix security vulnerability

Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the TranformGraph.todotgraph function. A malicious user can provide a command or a script file as a value to the savelayout argument, which will be placed as the first value in a...

PDF-XChange Editor XPS file parsing out-of-bounds read remote code execution vulnerability (CNVD-2024-40774)

PDF-XChange Editor is a PDF editor software and PDF reader. PDF-XChange Editor XPS file parsing has an out-of-bounds read remote code execution vulnerability that can be exploited by an attacker to execute code in the context of the current process...

CVE-2024-45195

Direct Request ‘Forced Browsing’ vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue. Recent assessments: remmons-r7 at September 25, 2024 3:32pm UTC reported: Apache OFBiz is an open-source...

CVE-2024-42788

A Stored Cross Site Scripting XSS vulnerability was found in "/music/ajax.php?action=savemusic" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields...

PT-2025-28263 · Invt · Invt Vt-Designer

Name of the Vulnerable Software and Affected Versions: INVT VT-Designer affected versions not specified Description: The issue is related to a remote code execution vulnerability due to out-of-bounds write when parsing PM3 files. There is no information provided about the estimated number of...

CVE-2024-38195 Azure CycleCloud Remote Code Execution Vulnerability

...

CVE-2024-6618

CVE-2024-6618 affects Ocean Data Systems Dream Report (and AVEVA Reports for Operations). The root cause is errors in processing relative paths to directories, enabling path traversal that could allow remote code execution via injection of a malicious DLL. Affected products/versions include Dream...

PT-2024-7999 · Symfony +5 · Symfony +5

Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 5.4.46 Symfony versions prior to 6.4.14 Symfony versions prior to 7.1.7 Description: The issue exists due to the lack of measures to neutralize special elements, allowing a remote attacker to execute arbitrary code...

CVE-2024-5651

A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution RCE primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user with developer access, can create a...

PT-2024-8345 · FFmpeg +3 · Ffmpeg +3

Name of the Vulnerable Software and Affected Versions: FFmpeg versions up to 7.0.1 Description: A critical issue has been found in the function pnm decode frame in the /libavcodec/pnmdec.c library, which can lead to a heap-based buffer overflow. This can be exploited remotely, potentially allowin...

PT-2024-28272 · Studio 42 · Elfinder

Name of the Vulnerable Software and Affected Versions: Studio 42 elFinder version 2.1.64 Description: The issue allows an arbitrary attacker to expose secrets and perform remote code execution RCE by copying files with unauthorized extensions between server directories. This is due to incorrect...

Delta Electronics CNCSoft-G2 DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...

PT-2024-28892 · Tenda · Tenda Ax2Pro

Name of the Vulnerable Software and Affected Versions: Tenda AX2pro version V16.03.29.48 cn Description: The issue allows a remote attacker to execute arbitrary code via the Routing functionality. Recommendations: For Tenda AX2pro version V16.03.29.48 cn, consider disabling the Routing...

PT-2024-5237

Name of the Vulnerable Software and Affected Versions: pypa/setuptools versions up to 69.1.1 Description: A vulnerability in the package index module of pypa/setuptools allows for remote code execution via its download functions. These functions, which are used to download packages from URLs...

CVE-2024-38044

DHCP Server Service Remote Code Execution Vulnerability...

CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...