CWE-94 · Code Injection (page 34)
Page 34 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-31011 | Critical | 9.8 | 2024-04-03 | Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix wa… |
CVE-2024-31005 | High | 8.1 | 2024-04-02 | An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp,AP4_MdhdAtom::AP4_MdhdAtom,mp4fragment |
CVE-2024-31004 | Critical | 9.8 | 2024-04-02 | An issue in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the Ap4StsdAtom.cpp,AP4_StsdAtom::AP4_StsdAtom,mp4fragment. |
CVE-2024-31003 | High | 8.8 | 2024-04-02 | Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4B… |
CVE-2024-29276 | Critical | 9.8 | 2024-04-02 | An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.cla… |
CVE-2024-30858 | Critical | 9.8 | 2024-04-01 | netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php. |
CVE-2024-30868 | Critical | 9.8 | 2024-04-01 | netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php. |
CVE-2023-41724 | High | 8.8 | 2024-03-31 | A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operatin… |
CVE-2024-31032 | Critical | 9.8 | 2024-03-29 | An issue in Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport v.1.1.2 allows a remote attacker to execute arbitrary code via the man… |
CVE-2024-29202 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerabili… |
CVE-2024-29201 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpSe… |
CVE-2024-23727 | High | 8.4 | 2024-03-28 | The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code vi… |
CVE-2024-28005 | Medium | 4.7 | 2024-03-28 | Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165… |
CVE-2024-2097 | High | 7.5 | 2024-03-27 | An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the a… |
CVE-2024-0400 | High | 7.5 | 2024-03-27 | SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An… |
CVE-2024-2209 | Medium | 6.3 | 2024-03-27 | A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (F… |
CVE-2024-0866 | High | 8.1 | 2024-03-26 | The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce func… |
CVE-2024-30202 | High | 7.8 | 2024-03-25 | In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. |
CVE-2024-28386 | Critical | 9.8 | 2024-03-25 | An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component. |
CVE-2024-23755 | High | 8.8 | 2024-03-23 | ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code inject… |
CVE-2024-28593 | Medium | 5.4 | 2024-03-22 | The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance d… |
CVE-2024-28119 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context… |
CVE-2024-28118 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context… |
CVE-2024-28117 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunctio… |
CVE-2024-28116 | High | 8.8 | 2024-03-21 | Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which a… |
CVE-2024-22724 | Medium | 6.6 | 2024-03-21 | An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo… |
CVE-2024-2016 | Medium | 6.3 | 2024-03-21 | A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php… |
CVE-2024-25359 | Medium | 6.6 | 2024-03-21 | An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file. |
CVE-2024-24520 | High | 7.8 | 2024-03-21 | An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place. |
CVE-2024-28396 | High | 7.5 | 2024-03-20 | An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php component. |
CVE-2024-2610 | Medium | 6.1 | 2024-03-19 | Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. This vulnerability a… |
CVE-2024-24230 | High | 7.5 | 2024-03-18 | Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attackers to execute arbitr… |
CVE-2024-28848 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28847 | High | 8.8 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-28253 | Critical | 9.4 | 2024-03-15 | OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team c… |
CVE-2024-2497 | Medium | 4.7 | 2024-03-15 | A vulnerability was found in RaspAP raspap-webgui 3.0.9 and classified as critical. This issue affects some unknown processing of the file includes/provider.ph… |
CVE-2024-27756 | High | 8.8 | 2024-03-15 | GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. |
CVE-2024-28424 | High | 8.8 | 2024-03-14 | zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. This vulnera… |
CVE-2022-46070 | High | 7.5 | 2024-03-11 | GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path. |
CVE-2024-23278 | High | 8.6 | 2024-03-08 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, macOS Ventura 1… |
CVE-2024-0917 | Critical | 9.8 | 2024-03-07 | remote code execution in paddlepaddle/paddle 2.6.0 |
CVE-2023-41503 | Critical | 9.8 | 2024-03-07 | Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function. |
CVE-2024-24278 | High | 7.5 | 2024-03-05 | An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the messa… |
CVE-2024-27627 | Medium | 6.1 | 2024-03-05 | A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to execute arbitrary JavaScript code via the… |
CVE-2024-27622 | High | 7.2 | 2024-03-05 | A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises… |
CVE-2024-22188 | High | 7.2 | 2024-03-05 | TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web… |
CVE-2024-25293 | Critical | 9.3 | 2024-03-01 | mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute. |
CVE-2024-25180 | Critical | 9.8 | 2024-02-29 | An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed becaus… |
CVE-2024-25291 | Critical | 9.8 | 2024-02-29 | Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin. |
CVE-2024-24525 | Critical | 9.8 | 2024-02-29 | An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL. |
CVE-2023-51801 | Critical | 9.8 | 2024-02-29 | SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the id pa… |
CVE-2024-25713 | High | 8.6 | 2024-02-29 | yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of… |
CVE-2024-25350 | Critical | 9.8 | 2024-02-28 | SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters. |
CVE-2024-25202 | Medium | 6.1 | 2024-02-28 | Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary code via the search… |
CVE-2023-50379 | High | 8.8 | 2024-02-27 | Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Oper… |
CVE-2024-1885 | Medium | 6.3 | 2024-02-26 | This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage. |
CVE-2024-22988 | Critical | 9.8 | 2024-02-23 | ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based o… |
CVE-2024-0220 | High | 8.3 | 2024-02-22 | B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A n… |
CVE-2024-26483 | High | 8.8 | 2024-02-22 | An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file. |
CVE-2023-24333 | High | 8.8 | 2024-02-21 | A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted P… |
CVE-2024-25249 | Critical | 9.8 | 2024-02-21 | An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. |
CVE-2024-1706 | Low | 3.5 | 2024-02-21 | A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manip… |
CVE-2024-1705 | Medium | 5.6 | 2024-02-21 | A vulnerability was found in Shopwind up to 4.6. It has been rated as critical. This issue affects the function actionCreate of the file /public/install/contro… |
CVE-2022-45177 | High | 7.5 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isena… |
CVE-2024-21682 | High | 7.2 | 2024-02-20 | This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlas… |
CVE-2023-51770 | High | 7.5 | 2024-02-20 | Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache… |
CVE-2023-49109 | Critical | 9.8 | 2024-02-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache… |
CVE-2024-21892 | High | 7.8 | 2024-02-20 | On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privilege… |
CVE-2023-52381 | Critical | 9.8 | 2024-02-18 | Script injection vulnerability in the email module.Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availabilit… |
CVE-2024-25298 | High | 7.2 | 2024-02-17 | An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php. |
CVE-2024-25415 | High | 7.2 | 2024-02-16 | A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting… |
CVE-2024-25502 | Critical | 9.8 | 2024-02-15 | Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via the download_bac… |
CVE-2022-23088 | Critical | 9.8 | 2024-02-15 | The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-F… |
CVE-2024-25301 | High | 7.2 | 2024-02-14 | Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php. |
CVE-2024-21378 | High | 8.8 | 2024-02-13 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2024-21351 | High | 7.6 | 2024-02-13 | Windows SmartScreen Security Feature Bypass Vulnerability |
CVE-2023-50808 | Medium | 6.1 | 2024-02-13 | Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI. |
CVE-2024-22131 | Critical | 9.1 | 2024-02-13 | In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authori… |
CVE-2023-42374 | Critical | 9.8 | 2024-02-13 | An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a crafted compressed s… |
CVE-2024-25110 | Critical | 9.8 | 2024-02-12 | The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free is… |
CVE-2024-24091 | Critical | 9.8 | 2024-02-08 | Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface. |
CVE-2023-45735 | High | 8.0 | 2024-02-06 | A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device… |
CVE-2024-22514 | High | 8.8 | 2024-02-06 | An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file. |
CVE-2023-6996 | High | 8.8 | 2024-02-05 | The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vg_display_data… |
CVE-2023-6846 | High | 8.8 | 2024-02-05 | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_s… |
CVE-2024-24396 | Medium | 6.1 | 2024-02-05 | Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafte… |
CVE-2024-24469 | High | 8.8 | 2024-02-05 | Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete_post .php. |
CVE-2023-5800 | Medium | 5.4 | 2024-02-05 | Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a po… |
CVE-2023-5677 | Medium | 6.3 | 2024-02-05 | Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input validation allowing… |
CVE-2024-25089 | Critical | 9.8 | 2024-02-04 | Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes. |
CVE-2023-51820 | Medium | 6.8 | 2024-02-02 | An issue in Blurams Lumi Security Camera (A31C) v.2.3.38.12558 allows a physically proximate attackers to execute arbitrary code. |
CVE-2023-50488 | Critical | 9.8 | 2024-02-02 | An issue in Blurams Lumi Security Camera (A31C) v23.0406.435.4120 allows attackers to execute arbitrary code. |
CVE-2021-22282 | High | 8.3 | 2024-02-02 | Improper Control of Generation of Code ('Code Injection') vulnerability in B&R Industrial Automation Automation Studio allows Local Execution of Code.This issu… |
CVE-2024-22533 | Critical | 9.8 | 2024-02-02 | Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be… |
CVE-2024-23746 | Critical | 9.8 | 2024-02-02 | Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCService… |
CVE-2024-22899 | High | 8.8 | 2024-02-02 | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function. |
CVE-2024-0325 | Low | 3.6 | 2024-02-01 | In Helix Sync versions prior to 2024.1, a local command injection was identified. Reported by Bryan Riggins. |
CVE-2023-47257 | High | 8.1 | 2024-02-01 | ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages. |
CVE-2024-1117 | High | 7.3 | 2024-01-31 | A vulnerability was found in openBI up to 1.0.8. It has been declared as critical. Affected by this vulnerability is the function index of the file /applicatio… |
CVE-2024-21649 | High | 8.8 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4… |