4269 matches found
Important: python-pillow
Issue Overview: Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter. CVE-2023-50447 Affected Packages: python-pillow Issue Correction: Run dnf update...
Important: python-pillow
Issue Overview: Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter. CVE-2023-50447 Affected Packages: python-pillow Note: This advisory is applicable to Amaz...
The vulnerability of the eval() function in the ImageMath module of the Pillow library allows a hacker to execute arbitrary code.
The vulnerability of the eval function in the ImageMath module of the Pillow library relates to improper code generation during the processing of the environment parameter. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
SUSE CVE-2023-50447
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter...
Amazon Linux AMI : perl-Spreadsheet-ParseExcel (ALAS-2024-1905)
The version of perl-Spreadsheet-ParseExcel installed on the remote host is prior to 0.5900-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1905 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel i...
DEBIAN-CVE-2023-50447
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter...
CVE-2023-50447
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which was about the expression parameter...
AZL-33913 CVE-2024-0607 affecting package kernel for versions less than 5.15.148.1-1
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nftbyteordereval function, where the code iterates through a loop and writes to the dst array. On each iteration, 8 bytes are written, but dst is an array of u32, so each element only has space for 4 bytes. That...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel has a code issue vulnerability that stems from the fact that in the nftbyteordereval function, the code iteratively loops and writes dst0, dst1, dst2, etc., and...
Arbitrary Code Execution
Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution. The vulnerability due to passing unvalidated input from a file into a string-type “eval”. It allows an attacker spreads malicious code which leads to arbitrary code execution...
CVE-2023-7101
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution ACE vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of...
CVE-2023-7101: Improper Neutralization of Directives in Dynamically Evaluated Code
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution ACE vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of...
CVE-2023-43364
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution...
CVE-2023-43364
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution...
CVE-2023-43364: Improper Neutralization of Special Elements in Output Used by a Downstream Component
main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution...
CVE-2023-43364
CVE-2023-43364 affects Searchor prior to 2.4.2. main.py uses eval on CLI input, enabling potential remote code execution. Multiple sources (Red Hat, OSV, GHSA, and others) corroborate a pre-2.4.2 vulnerability in the Searchor CLI. Impact is described as code execution with high severity; exploit ...
CVE-2023-48699 fastbots Eval Injection vulnerability
fastbots is a library for fast bot and scraper development using selenium and the Page Object Model POM design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability ...
Eval Injection in fastbots
Impact An attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function def locatorself, locatorname: str in page.py. The vulnerable code that load and execute directly from the file...
GHSA-VCCG-F4GP-45X9 Eval Injection in fastbots
Impact An attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability is in the function def locatorself, locatorname: str in page.py. The vulnerable code that load and execute directly from the file...
