Input validation

Improper input validation in Dolibarr ERP CRM = v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code...

CVE-2023-29453

Templates do not properly consider backticks as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the contents of the action can be used to...

PT-2023-29458

Name of the Vulnerable Software and Affected Versions SICAM PAS/PQS versions 8.00 through 8.20 Description A security issue has been identified where the application is installed with specific files and folders that have insecure permissions. This could allow an authenticated local attacker to...

Arbitrary Code Injection

pretix is vulnerable to Arbitrary Code Injection. The vulnerability is caused by allowing parsing of EPS Encapsulated PostScript files in various features of the application. An attacker can exploit this to execute arbitrary code by sending a specially crafted EPS file...

Docker Desktop Code Execution

The vulnerability of the Docker Desktop platform for developing and delivering container applications is related to improper code generation management. Exploiting this vulnerability allows a remote attacker to inject arbitrary code into the system...

CVE-2023-40985

An issue was discovered in Webmin 2.100. The File Manager functionality allows an attacker to exploit a Cross-Site Scripting XSS vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file ...

PT-2023-5169

Name of the Vulnerable Software and Affected Versions Spectrum Power 7 versions prior to V23Q3 Description The issue is related to the improper assignment of access rights to a critical resource, specifically the update script. This could allow an authenticated local attacker to inject arbitrary...

Webmin Cross-Site Scripting Vulnerability

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.100. An attacker can exploit this vulnerability to inject arbitrary code...

Arbitrary Code Injection

sketchsvg is vulnerable to Remote Code Execution RCE. The vulnerability exists due to a lack of user input sanitization in when calling the shell.exec method, allowing an attacker to inject and execute malicious code into the system...

Arbitrary Code Injection

org.apache.nifi: is vulnerable to Arbitrary Code Injection. The vulnerability exists in several functions which allows an authenticated attacker to submit a malicious request to configure a location that enables custom code execution...

Arbitrary Code Injection

org.apache.rocketmq, rocketmq-namesrv is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library allows updating the config path at runtime, allowing an attacker to inject and execute malicious code through the update configuration function by forging the RocketMQ...

Arbitrary Code Injection

Apache Ambari is vulnerable to Arbitrary Code Injection. The vulnerability exists in the metrics source which allows an attacker to execute arbitrary code by submitting a malicious SpEL expression...

CVE-2022-42045

Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28...

CVE-2022-42045

Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28...

CVE-2022-42045

Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28...

CVE-2022-42045

Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28...

CVE-2022-42045: Improper Control of Generation of Code

Certain Zemana products are vulnerable to Arbitrary code injection. This affects Watchdog Anti-Malware 4.1.422 and Zemana AntiMalware 3.2.28...

Zemana Anti-Malware security vulnerability

Zemana Anti Malware is an anti-malware program from Zemana. A security vulnerability exists in Zemana Anti Malware version 4.1.422, Zemana AntiMalware version 3.2.28, which stems from vulnerability to arbitrary code injection...

CVE-2022-42045

An Arbitrary code injection vulnerability exists in the Zemana amsdk.sys kernel-mode driver, which is part of the Zemana Antimalware SDK. The flaw allows an attacker to inject and execute arbitrary code with kernel-mode privileges , facilitating local privilege escalation from administrator to ke...

Apache RocketMQ 5.1.0 Arbitrary Code Injection Exploit

RocketMQ versions 5.1.0 and below are vulnerable to arbitrary code injection. Broker component of RocketMQ is leaked on the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that...