CVE-2023-37273: Improper Control of Generation of Code

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing docker compose run auto-gpt in the repo root uses a different docker-compose.yml file from the one suggested i...

CVE-2023-37199

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause remote code execution when an admin user on DCE tampers with backups which are then manually restored...

CVE-2023-38068: Improper Control of Interaction Frequency

In JetBrains YouTrack before 2023.1.16597 captcha was not properly validated for Helpdesk forms...

Improper Control of Generation of Code

Description Kimai Plugin EasyBackupBundle allows admins to edit mysql commands from the configuration tab, an attacker can append arbitrary commands to achieve code execution. This can be also extended to an arbitrary file read while specifying filenames such as /etc/passwd in backup. Proof of...

CVE-2023-35930: Improper Control of Dynamically-Managed Code Resources

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected. For example, using LookupResources...

CVE-2023-2359: Improper Control of Generation of Code

The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload which may be escalated to Remote Code Execution in some server configurations...

Code injection

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause execution of malicious code when an unsuspicious user loads a project file from the local filesystem into the HMI...

CVE-2023-33131: Improper Control of Generation of Code

Microsoft Outlook Remote Code Execution Vulnerability...

CVE-2023-21569: Improper Control of Generation of Code

Azure DevOps Server Spoofing Vulnerability...

CVE-2019-16283: Improper Control of Generation of Code

A potential security vulnerability has been identified with a version of the HP Softpaq installer that can lead to arbitrary code execution...

CVE-2022-35743: Improper Control of Generation of Code

Microsoft Windows Support Diagnostic Tool MSDT Remote Code Execution Vulnerability...

CVE-2023-2980: Improper Control of Resource Identifiers

A vulnerability classified as critical was found in Abstrium Pydio Cells 4.2.0. This vulnerability affects unknown code of the component User Creation Handler. The manipulation leads to improper control of resource identifiers. The attack can be initiated remotely. The exploit has been disclosed ...

CVE-2023-33175: Improper Control of Dynamically-Identified Variables

ToUI is a Python package for creating user interfaces websites and desktop apps from HTML. ToUI is using Flask-Caching SimpleCache to store user variables. Websites that use Website.uservars property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1...

The vulnerability of the Apache InLong data integration platform relates to improper control of resource identifiers, allowing attackers to compromise the integrity and accessibility of protected information.

The vulnerability of the Apache InLong data integration platform is related to improper control of resource identifiers. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of the protected information...

CVE-2023-1178: Improper Control of Generation of Code

An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a...

CVE-2023-29199: Improper Control of Dynamically-Managed Code Resources

There exists a vulnerability in source code transformer exception sanitization logic of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor c...

Code Injection

apache-airflow-providers-apache-hive is vulnerable to Code Injection. The vulnerability exists because of the improper control of the hook parameters in the library, which allows an attacker to inject and execute malicious code...

CVE-2023-27897: Improper Control of Generation of Code

In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform...

GHSA-5CVG-9PP5-MXCJ Apache Airflow Hive Provider vulnerable to code injection

Apache Software Foundation's Apache Airflow Hive Provider before 6.0.0 is vulnerable to improper control of generation of code...

CVE-2023-25261: Improper Control of Generation of Code

Certain Stimulsoft GmbH products are affected by: Remote Code Execution. This affects Stimulsoft Designer Desktop 2023.1.4 and Stimulsoft Designer Web 2023.1.3 and Stimulsoft Viewer Web 2023.1.3. Access to the local file system is not prohibited in any way. Therefore, an attacker may include sour...