SUSE SLED12 / SLES12 Security Update : python-reportlab (SUSE-SU-2023:2688-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2688-1 advisory. - CVE-2023-33733: Fixed arbitrary code execution via supplying a crafted PDF file bsc1212065. Bug fixes: - Add...

CVE-2023-2625

A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user...

FeehiCMS Arbitrary File Upload Vulnerability (CNVD-2023-58819)

FeehiCMS is a Php-based CMS builder. FeehiCMS version 2.0.8 has an arbitrary file upload vulnerability that can be exploited by remote attackers to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component...

New Mockingjay Process Injection Technique Could Let Malware Evade Detection

A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers...

jFinal Server-Side Template Injection vulnerability

Server-Side Template Injection SSTI vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

PT-2023-25496 · Ateme · Ateme Flamingo Xl

Name of the Vulnerable Software and Affected Versions: Ateme Flamingo XL version 3.6.20 Ateme Flamingo XS version 3.6.5 Description: The issue allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via the session expiration function. Recommendations: For...

The vulnerability of My Cloud OS, a network storage operating system, related to bypassing authentication through spoofing, allows attackers to access user data and execute arbitrary code.

The vulnerability of My Cloud OS network storage operating systems involves bypassing authentication through spoofing. Exploiting this vulnerability allows a remote attacker to gain access to user data and execute arbitrary code...

CVE-2023-1722

CVE-2023-1722 concerns the Yoga Class Registration System 1.0, where an administrator can execute commands on the server. The root cause, as described across multiple sources, is improper validation of uploaded class thumbnails by administrators, enabling arbitrary command execution. The vulnerab...

Apple Multiple Products Integer Overflow Vulnerability

Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges...

Liufee CMS File Upload vulnerability

File Upload vulnerability in Liufee CMS, AKA Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component...

CVE-2020-20918

An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page...

PT-2023-5454 · Tp Link · Tp-Link Archer C20

Name of the Vulnerable Software and Affected Versions: TP-Link Archer C20 versions prior to Archer C20JP V1 230616 Description: The issue is related to improper authentication in the TP-Link Archer C20 firmware, which can be exploited by a network-adjacent unauthenticated attacker to execute...

CVE-2020-21246

Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function...

CVE-2020-20697

CVE-2020-20697 affects the NodCMS v3.0 product, with a Cross-Site Scripting vulnerability in the address parameter that can allow an attacker to execute arbitrary code and access sensitive information. Several connected sources (e.g., Red Hat, CNVD, GHSA, OSV) describe the issue as XSS with poten...

CVE-2020-20703

Buffer Overflow vulnerability in VIM v.8.1.2135 allows a remote attacker to execute arbitrary code via the operand parameter...

CVE-2023-1183

A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker...

Remote Code Execution (RCE)

Microsoft.WindowsDesktop.App.Runtime is vulnerable to Remote Code Execution RCE. The vulnerability is due to how WPF applications load and render XPS documents which allows a local attacker to upload and execute malicious code on the system...

CVE-2023-32753 ITPison OMICARD EDM - Arbitrary File Upload

OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service...