CWE-94 · Code Injection (page 35)
Page 35 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37518 | Medium | 6.4 | 2024-01-30 | HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of… |
CVE-2024-1015 | Critical | 9.8 | 2024-01-29 | Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from th… |
CVE-2024-23742 | Critical | 9.8 | 2024-01-28 | An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments set… |
CVE-2024-23741 | Critical | 9.8 | 2024-01-28 | An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments sett… |
CVE-2023-52251 | High | 8.8 | 2024-01-25 | An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topi… |
CVE-2023-24676 | High | 7.2 | 2024-01-24 | An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing… |
CVE-2023-31037 | High | 7.2 | 2024-01-24 | NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful ex… |
CVE-2023-36177 | Critical | 9.8 | 2024-01-23 | An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request… |
CVE-2024-0755 | High | 8.8 | 2024-01-23 | Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-23208 | High | 7.8 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may… |
CVE-2024-23750 | High | 8.8 | 2024-01-22 | MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen. |
CVE-2024-0521 | High | 7.8 | 2024-01-20 | Code Injection in paddlepaddle/paddle |
CVE-2024-0738 | Medium | 6.3 | 2024-01-19 | A vulnerability, which was classified as critical, has been found in 个人开源 mldong 1.0. This issue affects the function ExpressionEngine of the file com/mldong/m… |
CVE-2023-50447 | High | 8.1 | 2024-01-19 | Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which wa… |
CVE-2023-6548 | Medium | 5.5 | 2024-01-17 | Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with mana… |
CVE-2021-4434 | Critical | 10.0 | 2024-01-17 | The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows… |
CVE-2023-22514 | High | 7.8 | 2024-01-16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.14 of Sourcetree for Mac and Sourcetree for Windows. This RCE… |
CVE-2022-1609 | Critical | 9.8 | 2024-01-16 | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, a… |
CVE-2023-6395 | Medium | 6.7 | 2024-01-16 | The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with ro… |
CVE-2024-21674 | High | 7.5 | 2024-01-16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RCE… |
CVE-2024-21673 | High | 8.8 | 2024-01-16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server. Remote Code Execution (RC… |
CVE-2024-21672 | High | 8.8 | 2024-01-16 | This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution (RCE)… |
CVE-2023-22526 | High | 8.8 | 2024-01-16 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center. This RCE (Remote Code Execution) vu… |
CVE-2023-51282 | High | 7.5 | 2024-01-16 | An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter. |
CVE-2023-43449 | High | 8.8 | 2024-01-16 | An issue in HummerRisk HummerRisk v.1.10 thru 1.4.1 allows an authenticated attacker to execute arbitrary code via a crafted request to the service/LicenseServ… |
CVE-2023-46226 | Critical | 9.8 | 2024-01-15 | Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3… |
CVE-2023-51066 | High | 8.8 | 2024-01-13 | An authenticated remote code execution vulnerability in QStar Archive Solutions Release RELEASE_3-0 Build 7 Patch 0 allows attackers to arbitrarily execute com… |
CVE-2023-33472 | High | 8.8 | 2024-01-13 | An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, execut… |
CVE-2024-0252 | High | 8.8 | 2024-01-11 | ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component… |
CVE-2023-42833 | High | 8.8 | 2024-01-10 | A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. Processing web content may lea… |
CVE-2023-32383 | High | 7.8 | 2024-01-10 | This issue was addressed by forcing hardened runtime on the affected binaries at the system level. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur… |
CVE-2024-21643 | High | 7.1 | 2024-01-10 | IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. A… |
CVE-2024-21737 | High | 8.4 | 2024-01-09 | In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execu… |
CVE-2024-21646 | Critical | 9.8 | 2024-01-09 | Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients u… |
CVE-2024-21650 | Critical | 10.0 | 2024-01-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) a… |
CVE-2023-7224 | High | 7.8 | 2024-01-08 | OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environ… |
CVE-2023-6540 | Medium | 6.5 | 2024-01-03 | A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could res… |
CVE-2023-51784 | Critical | 9.8 | 2024-01-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which coul… |
CVE-2023-41783 | Medium | 4.3 | 2024-01-03 | There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the program failed to adequately validate the user's input, an attacker could exploi… |
CVE-2024-0196 | Medium | 6.3 | 2024-01-02 | A vulnerability has been found in Magic-Api up to 2.0.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /res… |
CVE-2024-0195 | Medium | 6.3 | 2024-01-02 | A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. Affected is the function FunctionService.saveFunction of the file src/main/j… |
CVE-2023-39157 | Critical | 9.0 | 2023-12-31 | Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: f… |
CVE-2023-41544 | Critical | 9.8 | 2023-12-30 | SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTable… |
CVE-2023-51420 | Critical | 9.1 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D Publishin… |
CVE-2023-49830 | Critical | 9.9 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Brainstorm Force Astra Pro.This issue affects Astra Pro: from n/a through 4.3.1. |
CVE-2023-47840 | Critical | 9.9 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: fro… |
CVE-2023-46623 | Critical | 9.9 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in TienCOP WP EXtra.This issue affects WP EXtra: from n/a through 6.2. |
CVE-2023-45751 | Critical | 9.1 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in POSIMYTH Nexter Extension.This issue affects Nexter Extension: from n/a through 2.0… |
CVE-2023-40606 | Critical | 9.1 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Kanban for WordPress Kanban Boards for WordPress.This issue affects Kanban Boards fo… |
CVE-2023-32095 | Critical | 9.9 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Milan Dinić Rename Media Files.This issue affects Rename Media Files: from n/a throu… |
CVE-2023-25054 | Critical | 10.0 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in David F. Carr RSVPMaker.This issue affects RSVPMaker: from n/a through 10.6.6. |
CVE-2023-22677 | High | 8.5 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in BinaryStash WP Booklet.This issue affects WP Booklet: from n/a through 2.1.8. |
CVE-2023-31296 | Medium | 5.3 | 2023-12-29 | CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the… |
CVE-2023-7148 | Medium | 5.0 | 2023-12-29 | A vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file src/m… |
CVE-2023-46987 | High | 8.8 | 2023-12-28 | SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php. |
CVE-2023-49001 | Critical | 9.8 | 2023-12-27 | An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrow… |
CVE-2023-49000 | Critical | 9.8 | 2023-12-27 | An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.I… |
CVE-2023-47883 | Critical | 9.8 | 2023-12-27 | The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to… |
CVE-2023-43955 | Critical | 9.8 | 2023-12-27 | The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary… |
CVE-2023-43481 | Critical | 9.8 | 2023-12-27 | An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript c… |
CVE-2023-7101 | High | 7.8 | 2023-12-24 | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE)… |
CVE-2023-51387 | High | 7.2 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be… |
CVE-2023-51018 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface o… |
CVE-2023-51015 | Critical | 9.8 | 2023-12-22 | TOTOLINX EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi |
CVE-2023-51026 | Critical | 9.8 | 2023-12-22 | TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of… |
CVE-2023-49391 | High | 7.5 | 2023-12-22 | An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via cr… |
CVE-2023-7035 | Low | 2.4 | 2023-12-21 | A vulnerability was found in automad up to 1.10.9 and classified as problematic. Affected by this issue is some unknown functionality of the file packages\stan… |
CVE-2023-49032 | Critical | 9.8 | 2023-12-21 | An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via hijack of the SMS… |
CVE-2023-49004 | Critical | 9.8 | 2023-12-19 | An issue in D-Link DIR-850L v.B1_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter. |
CVE-2023-6691 | High | 7.8 | 2023-12-18 | Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and ga… |
CVE-2023-32728 | Medium | 4.6 | 2023-12-18 | The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote… |
CVE-2023-6899 | Medium | 4.3 | 2023-12-17 | A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /s… |
CVE-2023-6886 | Medium | 4.7 | 2023-12-17 | A vulnerability was found in xnx3 wangmarket 6.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component Role Man… |
CVE-2023-6851 | Medium | 6.3 | 2023-12-16 | A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/… |
CVE-2023-50723 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 2.3 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, anyone who can edit an arbitrary wiki page in… |
CVE-2023-50721 | Critical | 9.9 | 2023-12-15 | XWiki Platform is a generic wiki platform. Starting in 4.5-rc-1 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the search administration interface does… |
CVE-2023-6051 | Medium | 5.7 | 2023-12-15 | An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16… |
CVE-2023-5512 | Medium | 4.8 | 2023-12-15 | An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starti… |
CVE-2023-6553 | Critical | 9.8 | 2023-12-15 | The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php… |
CVE-2023-48390 | Critical | 9.8 | 2023-12-15 | Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the sys… |
CVE-2023-50710 | Medium | 4.2 | 2023-12-14 | Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the applicat… |
CVE-2023-48085 | Critical | 9.8 | 2023-12-14 | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. |
CVE-2023-43364 | Critical | 9.8 | 2023-12-12 | main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. |
CVE-2023-42890 | High | 8.8 | 2023-12-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2… |
CVE-2023-5500 | High | 8.8 | 2023-12-11 | This vulnerability allows an remote attacker with low privileges to misuse Improper Control of Generation of Code ('Code Injection') to gain full control of th… |
CVE-2023-43301 | High | 8.2 | 2023-12-07 | An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. |
CVE-2023-6288 | High | 7.8 | 2023-12-06 | Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES environment variable… |
CVE-2023-49070 | Critical | 9.8 | 2023-12-05 | Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are re… |
CVE-2023-5762 | High | 8.8 | 2023-12-04 | The Filr WordPress plugin before 1.2.3.6 is vulnerable from an RCE (Remote Code Execution) vulnerability, which allows the operating system to execute commands… |
CVE-2023-49093 | Critical | 9.8 | 2023-12-04 | HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vu… |
CVE-2023-44382 | Critical | 9.1 | 2023-12-01 | October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `… |
CVE-2023-44381 | Medium | 4.9 | 2023-12-01 | October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `… |
CVE-2023-5226 | Medium | 4.8 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 bef… |
CVE-2022-42541 | Critical | 9.8 | 2023-11-29 | Remote code execution |
CVE-2023-49314 | High | 7.8 | 2023-11-28 | Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings s… |
CVE-2023-49313 | Critical | 9.8 | 2023-11-28 | A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unauthorized code can be injected into the p… |
CVE-2023-46480 | Critical | 9.8 | 2023-11-27 | An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth fun… |
CVE-2023-5604 | Critical | 9.8 | 2023-11-27 | The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration tha… |
CVE-2021-22150 | Medium | 6.6 | 2023-11-22 | It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package… |
CVE-2023-48699 | High | 8.4 | 2023-11-21 | fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could mod… |