Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability. The specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of...

PT-2024-27979 · Iterm2 · Iterm2

Name of the Vulnerable Software and Affected Versions: iTerm2 versions prior to 3.5.2 Description: The issue arises because the "Terminal may report window title" setting is not honored, potentially leading to remote code execution, although it is noted that exploitation is not trivial...

PT-2024-4139

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The vulnerability allows remote attackers to execute arbitrary code and affect the system. It is related to errors in processing input data in the Windows Wi-Fi driver. An unauthenticated...

GHSA-V9Q6-FM48-RX74 Authentication bypass in dtale

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution RCE due to improper input validation. The vulnerability arises from a hardcoded SECRETKEY in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled...

PT-2024-26399 · Unknown · Audiobookshelf

Name of the Vulnerable Software and Affected Versions: Audiobookshelf versions prior to 2.10.0 Description: Audiobookshelf is a self-hosted audiobook and podcast server. Opening an ebook with malicious scripts inside can lead to code execution inside the browsing context. If a user with high...

Ivanti Endpoint Manager GetDBVulnerabilities SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the GetDBVulnerabilities method. The issue results from th...

PT-2024-4131 · NetGear · Netgear Prosafe Network Management System

Name of the Vulnerable Software and Affected Versions: NETGEAR ProSAFE Network Management System affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is...

CVE-2024-27281

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be...

PT-2025-7547

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 15.10.11 XWiki versions prior to 16.4.1 XWiki versions prior to 16.5.0RC1 Description XWiki Platform is susceptible to a remote code execution RCE vulnerability. An unauthenticated attacker can execute arbitrary code by...

CVE-2023-42033

Visualware MyConnection Server doPostUploadfiles Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Visualware MyConnection Server. Although authentication is required to exploit this...

CVE-2023-42117 Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp...

Remote Code Execution

pyloadng is vulnerable to remote code execution RCE. The vulnerability is due to improper file path handling and template rendering, allowing an authenticated user to upload and execute a crafted template file...

PT-2024-2756

Name of the Vulnerable Software and Affected Versions mysql2 versions prior to 3.9.4 Description The issue is related to the readCodeFor function in the mysql2 package, which is vulnerable to Remote Code Execution RCE due to improper validation of the supportBigNumbers and bigNumberStrings values...

CVE-2024-28909

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability...

Microsoft Defender for IoT Remote Code Execution Vulnerability

...

PT-2024-23718 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 Bento version 1.6.0-641 Description: An issue in Bento4 Bento allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp, AP4 MdhdAtom::AP4 MdhdAtom, mp4fragment. Recommendations: For Bento4 Bento version 1.6.0-641,...

CVE-2024-23119 Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

PT-2024-2423 · Apache · Apache Doris

Name of the Vulnerable Software and Affected Versions: Apache Doris versions 1.2.0 through 2.0.4 Description: The issue is related to the download of code without integrity check in Apache Doris, which may result in remote command execution. An attacker authorized to create a JDBC catalog can use...

EUVD-2024-1162

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, AlertUtil::validateExpression is also called from EventSubscriptionRepository.prepare,...