CWE-94 · Code Injection (page 36)
Page 36 of 69 — CVEs classified under CWE-94, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6248 | Critical | 10.0 | 2023-11-21 | The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code… |
CVE-2023-48226 | Medium | 6.5 | 2023-11-21 | OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings (for registration looks like valid… |
CVE-2023-48192 | High | 7.8 | 2023-11-20 | An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracerouteCfg function. |
CVE-2023-40809 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number. |
CVE-2023-6188 | Medium | 4.7 | 2023-11-17 | A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edi… |
CVE-2023-6016 | Critical | 9.8 | 2023-11-16 | An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature. |
CVE-2023-47003 | Critical | 9.8 | 2023-11-16 | An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBlock_ItemIsDeleted. |
CVE-2023-47444 | High | 8.8 | 2023-11-15 | An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data… |
CVE-2023-48217 | High | 8.8 | 2023-11-14 | Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like imag… |
CVE-2023-36437 | High | 8.8 | 2023-11-14 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-6131 | High | 8.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6126 | Critical | 9.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6125 | High | 8.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-45560 | High | 7.5 | 2023-11-14 | An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-36014 | High | 7.3 | 2023-11-10 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-5550 | Medium | 6.5 | 2023-11-09 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server… |
CVE-2023-5540 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers. |
CVE-2023-5539 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers. |
CVE-2023-47397 | Critical | 9.8 | 2023-11-08 | WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php. |
CVE-2023-45849 | Critical | 9.0 | 2023-11-08 | An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner. |
CVE-2023-46243 | Critical | 9.9 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execu… |
CVE-2023-46242 | Critical | 9.6 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a conten… |
CVE-2023-46845 | High | 7.2 | 2023-11-07 | EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability… |
CVE-2023-46731 | Critical | 10.0 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL paramete… |
CVE-2023-46980 | Critical | 9.8 | 2023-11-03 | An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID… |
CVE-2023-46404 | Critical | 9.9 | 2023-11-03 | PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing. |
CVE-2023-46947 | High | 8.8 | 2023-11-03 | Subrion 4.2.1 has a remote command execution vulnerability in the backend. |
CVE-2023-36022 | Medium | 6.6 | 2023-11-03 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-46958 | Critical | 9.8 | 2023-11-02 | An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file. |
CVE-2023-20063 | High | 8.2 | 2023-11-01 | A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that ar… |
CVE-2023-42658 | High | 8.8 | 2023-10-31 | Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile. |
CVE-2023-40050 | Critical | 9.9 | 2023-10-31 | Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted… |
CVE-2023-43792 | Critical | 9.8 | 2023-10-30 | baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time… |
CVE-2020-36767 | High | 7.5 | 2023-10-30 | tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles, messages, and other input data. |
CVE-2023-5843 | Critical | 9.0 | 2023-10-30 | The Ads by datafeedr.com plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.1.3 via the 'dfads_ajax_load_ads' func… |
CVE-2023-44141 | High | 7.8 | 2023-10-30 | Inkdrop prior to v5.6.0 allows a local attacker to conduct a code injection attack by having a legitimate user open a specially crafted markdown file. |
CVE-2023-46865 | High | 7.2 | 2023-10-30 | /api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an ima… |
CVE-2021-33636 | High | 8.4 | 2023-10-29 | When the isula load command is used to load malicious images, attackers can execute arbitrary code. |
CVE-2021-33635 | Critical | 9.8 | 2023-10-29 | When malicious images are pulled by isula pull, attackers can execute arbitrary code. |
CVE-2023-46509 | Critical | 9.8 | 2023-10-27 | An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component. |
CVE-2023-46818 | High | 7.2 | 2023-10-27 | An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is ena… |
CVE-2023-46816 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the Gec… |
CVE-2023-43352 | High | 7.8 | 2023-10-26 | An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component. |
CVE-2023-5623 | High | 7.0 | 2023-10-26 | NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM… |
CVE-2023-5044 | High | 7.6 | 2023-10-25 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. |
CVE-2023-46010 | Critical | 9.8 | 2023-10-25 | An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin_safe.php component. |
CVE-2023-37909 | Critical | 9.9 | 2023-10-25 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14… |
CVE-2023-30912 | High | 7.2 | 2023-10-25 | A remote code execution issue exists in HPE OneView. |
CVE-2023-28796 | High | 7.1 | 2023-10-23 | Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Co… |
CVE-2023-28793 | High | 7.8 | 2023-10-23 | Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connect… |
CVE-2023-46055 | High | 8.8 | 2023-10-21 | An issue in ThingNario Photon v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the ping function to the… |
CVE-2023-41898 | High | 8.6 | 2023-10-19 | Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in… |
CVE-2023-30131 | Critical | 9.8 | 2023-10-19 | An issue discovered in IXP EasyInstall 6.6.14884.0 allows attackers to run arbitrary commands, gain escalated privilege, and cause other unspecified impacts vi… |
CVE-2023-46042 | Critical | 9.8 | 2023-10-19 | An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo(). |
CVE-2023-41630 | Critical | 9.8 | 2023-10-17 | eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component. |
CVE-2023-45144 | Critical | 10.0 | 2023-10-16 | com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in vi… |
CVE-2023-29453 | Critical | 9.8 | 2023-10-12 | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS tem… |
CVE-2023-43661 | High | 8.8 | 2023-10-11 | Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any… |
CVE-2023-36789 | High | 7.2 | 2023-10-10 | Skype for Business Remote Code Execution Vulnerability |
CVE-2023-36718 | High | 7.8 | 2023-10-10 | Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability |
CVE-2023-36702 | High | 7.8 | 2023-10-10 | Microsoft DirectMusic Remote Code Execution Vulnerability |
CVE-2023-36592 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36591 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36589 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36575 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36574 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36573 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36572 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36571 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-36570 | High | 7.3 | 2023-10-10 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability |
CVE-2023-43625 | Critical | 9.8 | 2023-10-10 | A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SOAP endpoint that could allow an unauthe… |
CVE-2023-44847 | High | 7.2 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ Weixin.php component. |
CVE-2023-44846 | High | 8.8 | 2023-10-10 | An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin_ notify.php component. |
CVE-2023-44392 | High | 8.2 | 2023-10-09 | Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is… |
CVE-2023-45311 | Critical | 9.8 | 2023-10-06 | fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any… |
CVE-2023-35897 | High | 8.4 | 2023-10-06 | IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the… |
CVE-2023-3665 | Medium | 5.5 | 2023-10-04 | A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment va… |
CVE-2023-3656 | Critical | 9.8 | 2023-10-03 | cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote… |
CVE-2023-44011 | Critical | 9.8 | 2023-10-02 | An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at the Skin management… |
CVE-2023-5201 | Critical | 9.9 | 2023-09-30 | The OpenHook plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.3.0 via the 'php' shortcode. This allows authentic… |
CVE-2023-26145 | High | 7.4 | 2023-09-28 | This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept… |
CVE-2023-38877 | High | 8.8 | 2023-09-28 | A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in… |
CVE-2023-41450 | High | 8.8 | 2023-09-28 | An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter. |
CVE-2023-41444 | High | 7.8 | 2023-09-28 | An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges via the fun_1400084d0 function in I… |
CVE-2023-43651 | High | 8.5 | 2023-09-27 | JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remo… |
CVE-2023-5221 | Medium | 4.7 | 2023-09-27 | A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argumen… |
CVE-2023-43234 | Critical | 9.8 | 2023-09-27 | DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $activepath and $filen… |
CVE-2023-43222 | Critical | 9.8 | 2023-09-27 | SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file. |
CVE-2023-41984 | High | 7.8 | 2023-09-27 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watch… |
CVE-2021-38243 | Critical | 9.8 | 2023-09-27 | xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. This vulnerability allows attackers to execute arbi… |
CVE-2023-0626 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-0625 | High | 8.0 | 2023-09-25 | Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelog. This issue affects Docker Desktop: before 4.12.0. |
CVE-2023-43270 | Critical | 9.8 | 2023-09-22 | dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate. |
CVE-2023-4291 | Critical | 9.8 | 2023-09-21 | Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipula… |
CVE-2023-0462 | High | 8.0 | 2023-09-20 | An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setti… |
CVE-2023-22513 | High | 8.8 | 2023-09-19 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. This RCE (Remote Code Executi… |
CVE-2023-41179 | High | 7.2 | 2023-09-19 | A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Busine… |
CVE-2023-40221 | High | 8.8 | 2023-09-18 | The absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious c… |
CVE-2023-34195 | High | 7.8 | 2023-09-18 | An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrie… |
CVE-2023-34999 | High | 8.4 | 2023-09-18 | A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitra… |