CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1...

CVE-2024-37779

WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution RCE vulnerability via the Apache Ant script functionality...

CVE-2024-37779

WoodWing Elvis DAM version 6.98.1 contains an authenticated remote command execution (RCE) vulnerability. The root cause is linked to the Apache Ant script functionality , which allows an attacker to execute arbitrary commands on the affected system. As of the current documentation, no patched ve...

PT-2024-27747 · Woodwing +1 · Woodwing Elvis Dam +1

Name of the Vulnerable Software and Affected Versions: WoodWing Elvis DAM version 6.98.1 Description: The issue is related to an authenticated remote command execution through the Apache Ant script functionality. This allows for the execution of commands on the affected system. Recommendations: F...

CVE-2024-37779

WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution RCE vulnerability via the Apache Ant script functionality...

PT-2024-15289 · Pure Storage · Flasharray Purity

Name of the Vulnerable Software and Affected Versions: FlashArray Purity affected versions not specified Description: A condition exists in FlashArray Purity whereby a user with an array admin role can execute arbitrary commands remotely to escalate privilege on the array. Recommendations: At the...

CVE-2024-37779: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution RCE vulnerability via the Apache Ant script functionality...

CVE-2024-0004: Improper Control of Generation of Code

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array...

FlashArray security vulnerabilities

Pure Storage FlashArray is an all QLC flash storage array from Pure Storage, Inc. A security vulnerability exists in FlashArray, which can be exploited to remotely execute arbitrary commands to elevate privileges on the array by a user with the role of array administrator...

WoodWing Elvis DAM security vulnerability

WoodWing Elvis DAM is a digital asset management solution from WoodWing, Inc. A security vulnerability exists in WoodWing Elvis DAM version 6.98.1, which stems from a Remote Command Execution RCE vulnerability that includes authentication via the Apache Ant scripting feature...

FlashArray and FlashBlade security vulnerabilities

Pure Storage FlashArray and Pure Storage FlashBlade are both products of Pure Storage, U.S.A. Pure Storage FlashArray is an all QLC flash storage array.Pure Storage FlashBlade is a consolidated storage platform for file and object Pure Storage FlashBlade is a consolidated storage platform for fil...

CVE-2024-0005: Improper Neutralization of Special Elements used in a Command

A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration...

CVE-2024-46997: Improper Neutralization of Special Elements in Output Used by a Downstream Component

DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1...

DataEase injection vulnerability

DataEase is a high-performance, easy-to-use, self-service data visualization and analysis tool that helps users quickly explore, understand and share data insights. DataEase suffers from a remote command execution vulnerability, which can be exploited by an attacker to leverage a code injection...

CVE-2024-9076

A vulnerability was found in DedeCMS up to 5.7.115. It has been rated as critical. This issue affects some unknown processing of the file /dede/articlestringmix.php. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public...

PT-2024-39410 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS versions up to 5.7.115 Description: A critical issue affects some unknown processing of the file article string mix.php, leading to os command injection. The attack may be initiated remotely. The vendor was contacted early about this...

Postjournal Service Arbitrary Command Execution

The vulnerability of the Postjournal Service in the corporate email management system Zimbra Collaboration Suite is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute...

PT-2024-41084 · Iptables · Iptables

Name of the Vulnerable Software and Affected Versions: iptables affected versions not specified Description: The issue is related to insecure privilege management in the iptables utility for configuring and managing packet filtering rules in the Linux operating system. Exploitation of this issue...

CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian

sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...

CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian

sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blackli...