68 matches found
Malicious code in @zalastax/nolb-linq (npm)
The package @zalastax/nolb-linq was found to contain malicious code...
CVE-2023-32571
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...
System.Linq.Dynamic.Core 安全漏洞
System.Linq.Dynamic.Core is a .NET Core/Standard port of the Microsoft assembly for .NET 4.0 Dynamic Language Features open-sourced by ZZZ Projects. A security vulnerability exists in System.Linq.Dynamic.Core version 1.4.6, which stems from a vulnerability that allows remote access to properties ...
CVE-2024-2097
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely RCE on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools...
CVE-2024-0400
SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute arbitrary code RCE on the SCM Server...
CVE-2024-2097
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely RCE on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools...
CVE-2024-2097
An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely RCE on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools...
CVE-2024-2097
CVE-2024-2097 affects Hitachi Energy MACH SCM Server. An authenticated malicious client can use the SCM List control to submit a crafted LINQ query and remotely execute arbitrary code on the SCM Server (the host running SCMArchivedEventViewerTool). The vulnerability path relies on authenticated a...
CVE-2024-0400
CVE-2024-0400 affects Hitachi Energy MACH SCM (versions 4.0 to 4.38; advice also references 4.6 to 4.38.0 with 4.38.1 as fix). The vulnerability involves improper generation of code (CWE-94) and improper neutralization of directives in dynamically evaluated code (CWE-95), enabling an authenticate...
CVE-2024-0400
SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute arbitrary code RCE on the SCM Server...
PT-2024-18819 · Unknown · Scm Server
Name of the Vulnerable Software and Affected Versions: SCM Server affected versions not specified Description: The issue allows an authenticated malicious client to send a special LINQ query to execute arbitrary code remotely on the SCM Server, which an attacker would not otherwise have...
Exploit for Incorrect Comparison in Dynamic-Linq Linq
Dynamic Linq injection to RCE - CVE-2023-32571 About Dynami...
Exploit for Incorrect Comparison in Dynamic-Linq Linq
Dynamic Linq injection to RCE - CVE-2023-32571 About Dynami...
The vulnerability of the .NET Dynamic Linq library, related to the use of an incomplete black list, allows attackers to execute arbitrary code.
The vulnerability of the .NET Dynamic Linq library is related to the use of an incomplete black list. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Remote Code Execution (RCE)
system.linq.dynamic.core is vulnerable to Remote Code Execution RCE. The vulnerability is due to Linq queries having access to public methods on classes retrieved via the Where, All, Any and .OrderBy methods which allows an attacker to execute malicious code on the system...
Remote Code Execution (RCE)
Overview Affected versions of this package are vulnerable to Remote Code Execution RCE due to allowing attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed. Remediation Upgrade System.Linq.Dynamic.Core to version 1.3.0 or...
GHSA-W65Q-JCMV-28GJ Dynamic Linq vulnerable to remote code execution
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...
Dynamic Linq vulnerable to remote code execution
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed...
