17418 matches found
CVE-2024-36268
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick 1 to solve it. 1 ...
PT-2024-6567 · Aruba · Arubaos
Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: An authenticated command injection issue exists in the ArubaOS command line interface, allowing successful exploitation to result in the ability to inject shell commands on the underlying...
PT-2024-28258 · Horizon Business Services Inc. · Caterease
Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary...
CVE-2024-38882
CVE-2024-38882 affects Horizon Business Services Inc. Caterease versions 16.0.1.1663–24.0.1.2405 (and possibly later). The issue is a remote command execution via SQL Injection caused by improper neutralization of special elements used in an OS command. Impact is high (remote, with high confident...
CVE-2024-41630
This CVE affects Tenda AC18 devices (V15.03.3.10_EN). The vulnerability is a stack-based buffer overflow in the ssid parameter handled by the ip/goform/fast_setting_wifi_set endpoint, enabling a remote attacker to execute arbitrary code. The issue is network‑level with low user interaction requir...
ROS-20240731-05
A vulnerability in the SHA-3 cryptographic hash function of the eXtended Keccak Code Package XKCP software package is related to errors in block processing of input data and type conversion. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code during...
ROS-20240730-04
A vulnerability in the document processing, conversion and generation software suite Ghostscript is related to the introduction of a specially crafted pipe command. Exploitation of the vulnerability could Allow an attacker acting remotely to execute arbitrary code...
mySCADA MyPRO Authenticated Command Injection Exploit
An authenticated command injection vulnerability exists in MyPRO versions 8.28.0 and below from mySCADA. The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITY\SYSTEM. class MetasploitModule...
Softnext Mail SQR Expert and Mail Archiving Expert 操作系统命令注入漏洞
Softnext Mail SQR Expert and Mail Archiving Expert is an email management platform from the Chinese company Softnext Mail. Softnext Mail SQR Expert and Mail Archiving Expert suffers from an operating system command injection vulnerability that originates from the web service not properly validati...
The vulnerability of the GetFileWithoutZip method in the network infrastructure monitoring system WhatsUp Gold allows a hacker to execute arbitrary code on the server.
The vulnerability of the GetFileWithoutZip method in the WhatsUp Gold network infrastructure monitoring system is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code ...
ROS-20240729-11
A vulnerability in the Cargo package manager of the Rust programming language involves the injection of arbitrary HTML after including it in a report generated by Cargo. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary code...
Exploit for Improper Validation of Specified Type of Input in Servicenow
CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning CVE-2024-4...
ROS-20240726-07
A vulnerability in the Sign-In component of the Google Chrome browser is related to the ability to bypass navigation restrictions using a specially crafted HTML page. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute cross-site scripted attacks...
PT-2024-10282 · Veritas · Veritas Enterprise Vault
Name of the Vulnerable Software and Affected Versions: Veritas Enterprise Vault versions prior to 15.2 Description: An issue in the server allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized. This is related to shortcomin...
ROS-20240724-01
A vulnerability in the DevTools component of the Google Chrome browser is related to insufficient input validation. Exploitation of the vulnerability could allow an attacker acting remotely, allowing an intruder to execute arbitrary code through a specially crafted HTML page A vulnerability in th...
The vulnerability of the Arfa-CMS content management system lies in the lack of measures taken to protect the SQL query structure, allowing for the execution of arbitrary SQL queries.
The vulnerability of the Arfa-CMS content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
CVE-2024-41661
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-50094. Reason: This candidate is a duplicate of CVE-2023-50094. Notes: All CVE users should reference CVE-2023-50094 instead of this candidate...
CVE-2024-41661
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-50094. Reason: This candidate is a duplicate of CVE-2023-50094. Notes: All CVE users should reference CVE-2023-50094 instead of this candidate...
HPESBNW04672 rev.2 - HPE Aruba Networking EdgeConnect SD-WAN Orchestrator, Multiple Vulnerabilities
Potential Security Impact: Local: Cross-Site Scripting XSS; Remote: Arbitrary Command Execution, Code Execution, Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba EdgeConnect Enterprise Orchestration Software See Vulnerability Summary Affected Products...