17428 matches found
PT-2023-30561 · Cubecart · Cubecart
Name of the Vulnerable Software and Affected Versions: CubeCart versions prior to 6.5.3 Description: The issue allows a remote authenticated attacker with administrative privileges to execute an arbitrary OS command. Recommendations: For versions prior to 6.5.3, update to version 6.5.3 or later t...
Ray OS Command Injection vulnerability
A command injection exists in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication...
GHSA-H3XG-WV58-5P43 Ray OS Command Injection vulnerability
A command injection exists in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication...
CVE-2023-6019
A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...
Command injection
A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...
SUSE CVE-2023-44441
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page o...
The vulnerability of the WP Fastest Cache plugin of the WordPress content management system allows attackers to execute arbitrary SQL queries.
The vulnerability of the WP Fastest Cache plugin of the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
PT-2023-32479 · H2O · H2O
Name of the Vulnerable Software and Affected Versions: H2O affected versions not specified Description: The issue allows an attacker to gain remote code execution on a server hosting the H2O dashboard. This is achieved through the POJO model import feature. Recommendations: At the moment, there i...
Ubuntu 23.04 / 23.10 : OpenVPN vulnerabilities (USN-6484-1)
The remote Ubuntu 23.04 / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6484-1 advisory. It was discovered that OpenVPN incorrectly handled the --fragment option in certain configurations. A remote attacker could possibly use this issue t...
XWiki < 14.10.6, 15.0-rc-1 < 15.1 Privilege Escalation Vulnerability (GHSA-35j5-m29r-xfq5)
Xwiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...
Improper Control of Generation of Code ('Code Injection')
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...
CVE-2023-47444
An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server...
CVE-2023-46850
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer...
UBUNTU-CVE-2023-46850
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer...
The vulnerability of the utils-banner_message component in NagiosXI software, related to the lack of protective measures for the SQL query structure, allows attackers to execute arbitrary SQL queries.
The vulnerability of the utils-bannermessage component in NagiosXI is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
The vulnerability of the Bulkmodifications component in NagiosXI software, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.
The vulnerability of the Bulkmodifications component in NagiosXI software is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
The vulnerability of the monitoring software for PLK TELLUS and TELLUS Lite lies in the fact that operations are executed outside the buffer in memory, allowing a hacker to execute arbitrary code.
The vulnerability of the monitoring software for TELLUS and TELLUS Lite systems lies in the fact that the execution of operations goes beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially crafted file...
FreeBSD : openvpn -- 2.6.0...2.6.6 --fragment option division by zero crash, and TLS data leak (2fe004f5-83fd-11ee-9f5d-31909fb2f495)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2fe004f5-83fd-11ee-9f5d-31909fb2f495 advisory. - Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6...
Debian DSA-5555-1 : openvpn - security update
The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5555 advisory. Two vulnerabilities were discovered in openvpn, a virtual private network application which could result in memory disclosure or denial of service. The oldstable...
