15950 matches found
CVE-2024-48630
D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the MacAddress parameter in the SetMACFilters2 function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...
Malicious code in direct_access_theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e064b0aa00efc879c6095cc571b4d1359ef3cd9c13e1f02b5497c78d364fabef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
KLA74117 Multiple vulnerabilities in Microsoft Browser
Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Parce...
CVE-2024-27766
MariaDB v11.1 is vulnerable to Remote Code Execution (RCE) via the lib_mysqludf_sys.so function. An attacker with sufficient database privileges, specifically the FILE privilege and write access to the plugin directory, can register a malicious User-Defined Function (UDF) to execute arbitrary OS ...
jQuery UI 安全漏洞
jQuery UI is a jQuery open source set of carefully curated user interface interactions, effects, widgets and themes built on jQuery. A security vulnerability exists in jQuery UI version v.1.13.1, which stems from the presence of a cross-site scripting vulnerability that allows remote attackers to...
Security update for libarchive
This update for libarchive fixes the following issues: CVE-2024-48957: Fixed out-of-bounds access in executefilteraudio in archivereadsupportformatrar.c bsc1231544. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...
CVE-2024-20459
The CVE-2024-20459 entry applies to Cisco ATA 190 Multiplatform Series analog telephone adapters. The issue stems from a lack of input sanitization in the web-based management interface, enabling an authenticated, high-privilege attacker to execute arbitrary commands on the underlying OS as root ...
CVE-2024-22033 obs-service-download_url is vulnerable to argument injection
The OBS service obs-service-downloadurl was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps...
CVE-2024-22033
CVE-2024-22033 affects the OBS service obs-service-download_url. The flaw is a command injection vulnerability where a configuration passed to the service can lead to command execution in subsequent steps. Public references confirm this impact and the vulnerable component is the obs-service-downl...
CVE-2024-22033 obs-service-download_url is vulnerable to argument injection
The OBS service obs-service-downloadurl was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps...
CVE-2023-32193 Norman API Cross-site Scripting Vulnerability
A vulnerability has been identified in which unauthenticated cross-site scripting XSS in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely...
openSUSE Leap 操作系统命令注入漏洞
openSUSE Leap is a new openSUSE build and a new hybrid Linux distribution from SUSE Germany. An operating system command injection vulnerability exists in openSUSE Leap that stems from the presence of command injection, where an attacker can provide configuration to a service to allow execution o...
CVE-2024-45274
An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication...
CVE-2024-9985 Ragic Enterprise Cloud Database - Arbitrary File Upload
Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server...
Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow
Detect vulnerabilities First, Use dnslog to detect whether CV...
CVE-2024-48781
Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 is vulnerable to remote code execution due to an unrestricted upload of a file with a dangerous type (CWE-434). A remote attacker can execute arbitrary code by providing a specially constructed .so file to the /opt/EdrawProj-2/plugins...
VulnCheck KEV: CVE-2021-4443
The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compilersave AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code...
Malicious code in splunk-docs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3b4cb45a7c61ff4ef92918dc5438c1ae4845121a1c99903638fb56ffdbe8014 The OpenSSF Package Analysis project identified 'splunk-docs' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
Adobe Animate Memory Misreference Vulnerability (CNVD-2024-41261)
Adobe Animate is a set of Flash animation software from the American company Audobee Adobe. Adobe Animate suffers from a memory misreference vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...