CVE-2023-39333: Improper Control of Generation of Code

Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability...

CVE-2024-45390: Improper Control of Generation of Code

@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to redact remote user's original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server...

CVE-2024-42756: Improper Control of Generation of Code

An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page...

CVE-2024-45201: Improper Control of Generation of Code

An issue was discovered in llamaindex before 0.10.38. download/integration.py includes an exec call for import clsname...

CVE-2024-43202: Improper Control of Generation of Code

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue...

CVE-2024-41623: Improper Control of Generation of Code

An issue in D3D Security D3D IP Camera D8801 v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payload...

CVE-2024-22123: Improper Control of Generation of Code

Setting SMS media allows to set GSM modem file. Later this file is used as Linux device. But due everything is a file for Linux, it is possible to set another file, e.g. log file and zabbixserver will try to communicate with it as modem. As a result, log file will be broken with AT commands and...

CVE-2024-7658: Improper Control of Resource Identifiers

A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function getpreview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720...

CVE-2024-7658

ProjectSend (up to r1605) has a vulnerability in the get_preview function of process.php that allows improper control of resource identifiers, potentially exploitable remotely. Multiple sources (NVD, Red Hat, osv.dev, CVE listings, PT Security) consistently describe this as a resource-ID manipula...

CVE-2024-7658 projectsend process.php get_preview resource injection

A vulnerability, which was classified as problematic, has been found in projectsend up to r1605. This issue affects the function getpreview of the file process.php. The manipulation leads to improper control of resource identifiers. The attack may be initiated remotely. Upgrading to version r1720...

CVE-2024-7437

Affected software: SimpleMachines SMF 2.1.4. Vulnerability exists in the Delete User Handler component: /index.php?action=profile;u=2;area=showalerts;do=remove, where manipulation of the aid argument leads to improper control of resource identifiers. It enables remote attack and has publicly disc...

CVE-2024-7437: Improper Control of Resource Identifiers

A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of...

CVE-2024-7438: Improper Control of Resource Identifiers

A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Alert Read Status Handler. The manipulation of the argument...

CVE-2024-6923: Improper Control of Generation of Code

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

CVE-2024-6726: Improper Control of Generation of Code

Versions of Delphix Engine prior to Release 25.0.0.0 contain a flaw which results in Remote Code Execution RCE...

CVE-2024-38944: Improper Control of Generation of Code

An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component...

CVE-2024-25077: Improper Control of Generation of Code

An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored in an unsigned header, allowing its value to be modified without invalidating the signature used for secureboot image verification. Becau...

CVE-2024-39669: Improper Control of Generation of Code

In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly execute arbitrary code in the Sync Server and compromise security...

CVE-2024-37139: Improper Control of a Resource Through its Lifetime

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its Lifetime vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to temporary resource...