[SECURITY] Fedora 38 Update: libssh-0.10.6-2.fc38

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, trans fer files, use a secure and transparent tunnel for your remote...

The vulnerability of the SpringBlade microservice development platform lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary SQL queries.

The vulnerability of the SpringBlade microservice development platform lies in the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

DEBIAN-CVE-2024-21646

Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remo...

PT-2024-1022 · Microsoft · Odbc Driver +1

Name of the Vulnerable Software and Affected Versions: Microsoft ODBC Driver affected versions not specified Description: The issue is related to insufficient input validation in the ODBC driver of Windows operating systems. It allows a remote attacker to execute arbitrary code. Recommendations: ...

Sql injection

SQL Injection vulnerability in ABO.CMS v.5.9.3, allows remote attackers to execute arbitrary code via the d parameter in the Documents module...

The vulnerability of the OTCMS sales application, related to the failure to protect the SQL query structure, allows attackers to execute arbitrary code.

The vulnerability of the OTCMS sales application relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the protected information...

CVE-2023-41288

An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video Station 5.7.2 2023/11/23 and later...

CVE-2023-41288

CVE-2023-41288 is an OS command injection vulnerability affecting QNAP Video Station. Multiple connected sources confirm the flaw allows an attacker to execute commands over the network via Video Station’s interface. Impacted products/versions are Video Station prior to 5.7.2; the issue is addres...

QNAP Systems QcalAgent Operating System Command Injection Vulnerability

QNAP Systems QcalAgent is a time management center from QNAP Systems. It is used to manage personal schedules, share calendars with others, and share each other's schedules. A security vulnerability exists in QNAP Systems QcalAgent prior to version 1.1.8 that stems from the presence of an operati...

Sql injection

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'userid' parameter after the login portal...

CVE-2024-21623 Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets

OTCLient is an alternative tibia client for otserv. Prior to commit db560de0b56476c87a2f967466407939196dd254, the /mehah/otclient "Analysis - SonarCloud" workflow is vulnerable to an expression injection in Actions, allowing an attacker to run commands remotely on the runner, leak secrets, and...

CVE-2023-52262

outdoorbits little-backup-box aka Little Backup Box before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input...

SUSE CVE-2023-50255

Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version...

CVE-2023-23634

SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint...

Code injection

The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code...

The vulnerability in the implementation of extended classes in the Java framework for creating and optimizing Google Web Toolkit (GWT) applications allows a malicious individual to gain access to read, modify, or delete data, execute arbitrary code, or cause a service failure.

The vulnerability of the implementation of extended classes in the Java framework for creating and optimizing Google Web Toolkit GWT browser applications is related to deficiencies in the deserialization mechanism when using the Base64 encoding standard. Exploiting this vulnerability may allow an...

The vulnerability of the web server of the microprogramming software for the universal input/output controller ioLogik, which allows a perpetrator to execute requests on behalf of a legitimate user

The vulnerability of the web server of the microprogramming-based input/output controller ioLogik relates to the of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute requests on behalf of a legitimate user remotely...

[SECURITY] Fedora 39 Update: libssh-0.10.6-1.fc39

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, trans fer files, use a secure and transparent tunnel for your remote...

PT-2023-28217 · Ibm · Ibm Planning Analytics Local

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local version 2.0 Description: The issue allows a remote attacker to upload arbitrary files due to the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit...

Vinchin Backup And Recovery Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in Vinchin Backup & Recovery v5.0., v6.0., v6.7., and v7.0.. Due to insufficient input validation in the checkIpExists API endpoint, an attacker can execute arbitrary commands as the web server user. This module requires Metasploit...