CVE-2024-10079

The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajaximportcontent' function. This allows authenticated attackers, with subscriber-level permissions an...

execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

...

Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:16) - Unreliable Remote Version Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-48630

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

Malicious code in direct_access_theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e064b0aa00efc879c6095cc571b4d1359ef3cd9c13e1f02b5497c78d364fabef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

KLA74117 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Parce...

jQuery UI 安全漏洞

jQuery UI is a jQuery open source set of carefully curated user interface interactions, effects, widgets and themes built on jQuery. A security vulnerability exists in jQuery UI version v.1.13.1, which stems from the presence of a cross-site scripting vulnerability that allows remote attackers to...

CVE-2024-27766

CVE-2024-27766 describes an issue in MariaDB 11.1 where a remote attacker may execute arbitrary code via the lib_mysqludf_sys.so function. Multiple connected sources confirm remote code execution potential, but note that the MariaDB Foundation disputes the severity/privilege boundary claim, stati...

Security update for libarchive

This update for libarchive fixes the following issues: CVE-2024-48957: Fixed out-of-bounds access in executefilteraudio in archivereadsupportformatrar.c bsc1231544. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

CVE-2024-20459

The CVE-2024-20459 entry applies to Cisco ATA 190 Multiplatform Series analog telephone adapters. The issue stems from a lack of input sanitization in the web-based management interface, enabling an authenticated, high-privilege attacker to execute arbitrary commands on the underlying OS as root ...

CVE-2024-22033 obs-service-download_url is vulnerable to argument injection

The OBS service obs-service-downloadurl was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps...

CVE-2024-22033

CVE-2024-22033 affects the OBS service obs-service-download_url. The flaw is a command injection vulnerability where a configuration passed to the service can lead to command execution in subsequent steps. Public references confirm this impact and the vulnerable component is the obs-service-downl...

CVE-2024-22033 obs-service-download_url is vulnerable to argument injection

The OBS service obs-service-downloadurl was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps...

CVE-2023-32193 Norman API Cross-site Scripting Vulnerability

A vulnerability has been identified in which unauthenticated cross-site scripting XSS in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely...

openSUSE Leap 操作系统命令注入漏洞

openSUSE Leap is a new openSUSE build and a new hybrid Linux distribution from SUSE Germany. An operating system command injection vulnerability exists in openSUSE Leap that stems from the presence of command injection, where an attacker can provide configuration to a service to allow execution o...

CVE-2024-45274

An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication...

CVE-2024-9985 Ragic Enterprise Cloud Database - Arbitrary File Upload

Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server...

Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow

Detect vulnerabilities First, Use dnslog to detect whether CV...

VulnCheck KEV: CVE-2021-4443

The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compilersave AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code...

CVE-2024-48781

The CVE-2024-48781 entry concerns Wanxing Technology Yitu Project Management Kirin Edition 2.3.6. A remote attacker can trigger arbitrary code execution by supplying a specially crafted file to /opt/EdrawProj-2/plugins/imageformat. The issue is described consistently across multiple sources (NVD/...