Dotkliwość: Krytyczna

Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.

OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code…

VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.

When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote…

Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.

Wykonanie zdalnego kodu w D-Link DIR-820L umożliwia atak przez HTTP POST.

An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.

Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.

The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API…

A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause…

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.

Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.

A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute…

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute…

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated…

Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code…

Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.