PT-2024-15905 · Debian · Debian

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Remotely executed SEGV and out of bounds read allows a malicious packet sender to crash or cause an out of bounds read via sending a malformed packet wi...

The vulnerability of the Ruby/Git interpreter’s library allows a hacker to execute arbitrary code.

The vulnerability of the Ruby/Git interpreter’s library is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-2815

CVE-2024-2815 affects Tenda AC15, specifically the R7WebsSecurityHandler in /goform/execCommand. The vulnerability stems from a stack-based buffer overflow caused by manipulating the password argument, enabling remote exploitation. Public exploit information is indicated in the entry. Connected s...

CVE-2024-2808

A vulnerability, which was classified as critical, has been found in Tenda AC15 15.03.05.18/15.03.20multi. This issue affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack may be initiate...

ROS-20240322-05

Vulnerability of REFRESH MATERIALIZED VIEW CONCURRENTLY function of PostgreSQL database management system is related to privilege management errors in processing and checking command line parameters. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary SQ...

VulnCheck KEV: CVE-2024-22320

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM...

CVE-2024-27438

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...

PT-2024-2354 · Advantech · Advantech Webaccess/Scada

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess/SCADA affected versions not specified Description: The issue is related to a lack of protection against SQL query structure attacks, allowing a remote attacker to execute arbitrary SQL queries on the database. This can...

PT-2024-21421 · Codiad · Codiad

Name of the Vulnerable Software and Affected Versions: Codiad version 2.8.4 Description: The issue allows reflected XSS via the type parameter in the "components/market/dialog.php" endpoint. This can lead to remote execution. There is no information about the estimated number of potentially...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection due to the parsing of .rdocoptions as a YAML file without restrictions on the classes that can be restored. An attacker can execute arbitrary code remotely by crafting malicious .rdocoptions files. Remediation Upgrade rdo...

Exploit for Code Injection in Openplcproject Openplc_V3_Firmware

CVE-2021-31630 Exploit CVE-2021-31630 Exploit PoC for OpenPLC...

CVE-2024-28179

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

PT-2024-13006 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions 2.23.4 and prior Description: A path traversal vulnerability requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin...

CVE-2024-28715

Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...

Advisory ROSA-SA-2024-2374

Software: protobuf-c 1.3.0 OS: ROSA Virtualization 2.1 packageevrstring: protobuf-c-1.3.0-8.rv3 CVE-ID: CVE-2022-48468 BDU-ID: 2023-03313 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the parserequiredmember function of the protobuf-c data serialization protocol is related to integer overflow...

CVE-2024-28715

Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 function in the /app/public/apidoc/oas3/wrap-components/markdown.jsx endpoint...

CVE-2024-24042

Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirect in RuntimeResourcePackImpl component...

FitNesse allows execution of arbitrary OS commands

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands...

CVE-2024-28125

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation...

CVE-2024-28125

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation...