CVE-2023-5403

Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning...

CVE-2024-30979

CVE-2024-30979 affects Cyber Cafe Management System 1.0. The XSS flaw is in the compname parameter of edit-computer-details.php, enabling a remote attacker to execute arbitrary code. CVSS v3.1 base score 5.9 (MEDIUM); attack vector: network, confidentiality/integrity/availability impact: LOW. Exp...

The vulnerability affects the runtime of procedure calls in Microsoft Windows operating systems, allowing an attacker to execute arbitrary code.

The vulnerability of remote procedure call runtime in Microsoft Windows operating systems is related to access to resources through incompatible types. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-3788

WBSAirback 21.02.04 is affected by an improper neutralization of Server-Side Includes (SSI) via the License endpoint (/admin/CDPUsers). A remote attacker could execute arbitrary code. The PT-Security advisory for PT-2024-27806 confirms the endpoint-based SSI handling issue and notes that, as of t...

CVE-2024-3787 Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback

Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes SSI, through S3 disks /admin/DeviceS3. Exploitation of this vulnerability could allow a remote user to execute arbitrary code...

Deserialization Of Untrusted Data

timber/timber is vulnerable to Deserialization of Untrusted Data. The vulnerability due to a lack of input validation before passing it into the fileexists function. An attacker can execute arbitrary code by uploading files of any type to the server which then gets passed in the phar:// protocol ...

VulnCheck KEV: CVE-2018-16167

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2023-45503

Macrob7 Macs CMS (Macs CMS) 1.1.4f and earlier contains SQL injection vulnerabilities due to improper input handling in several endpoints (e.g., resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole, deleteComment, allowComment, addComment). Root cause is lack of input ...

GHSA-JX7X-9R98-H5XR OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the certmanager.py. component...

ROS-20240412-04

A vulnerability in Salt's configuration management and remote execution system is related to the copying a script along a predictable path. Exploitation of the vulnerability could allow an attacker, acting remotely to run their own script. A vulnerability in the symbolic.py component of the Pytho...

Gibbon School Platform Authenticated PHP Deserialization Exploit

A Remote Code Execution vulnerability in Gibbon online school platform version 26.0.00 and lower allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the endpoint /modules/System%20Admin/importrun.php&type=externalAssessment&step=4. As it...

PT-2024-25255 · Tiagorlampert · Chaos

Name of the Vulnerable Software and Affected Versions: tiagorlampert CHAOS versions before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e tiagorlampert CHAOS version v5.0.1 Description: The issue allows a remote attacker to execute arbitrary code via the...

CVE-2024-30880

Reflected Cross Site Scripting XSS vulnerability in RageFrame2 v2.6.43, allows remote attackers to execute arbitrary web scripts or HTML and obtain sensitive information via a crafted payload injected into the multiple parameter in the image cropping function...

CVE-2024-30883

CVE-2024-30883 affects RageFrame2 v2.6.43 with a Reflected XSS in the aspectRatio parameter of the image cropping function. Exploitation could allow remote attackers to run arbitrary web scripts or HTML and access sensitive information. Public sources from NVD/Red Hat and third-party advisories c...

The vulnerability of the application programming interface for the Rust programming language interpreter on Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Rust programming language-based application programming interface for Windows operating systems relates to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by invoking batch file extensions...

D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution...

Exploit for Command Injection in Dlink Dns-320L_Firmware

D-Link NAS Command Execution Exploit This Python script explo...

CVE-2024-30712

CVE-2024-30712 entry is rejected/not used; this ID does not represent an active vulnerability.

PT-2024-2879 · Tenda · Tenda Ac500

Name of the Vulnerable Software and Affected Versions: Tenda AC500 version 2.0.1.91307 Description: A critical issue affects the R7WebsSecurityHandler function of the /goform/execCommand file, leading to a stack-based buffer overflow when the password argument is manipulated. This can be exploite...

CVE-2023-6999

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2. This makes it possible for authenticated attackers, with contributor level access ...