CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3892 – Local code execution vulnerability in Telerik UI for WinForms
https://notcve.org/view.php?id=CVE-2024-3892
A local code execution vulnerability is possible in Telerik UI for WinForms beginning in v2021.1.122 but prior to v2024.2.514. This vulnerability could allow an untrusted theme assembly to execute arbitrary code on the local Windows system. Es posible una vulnerabilidad de ejecución de código local en la interfaz de usuario de Telerik para WinForms a partir de v2021.1.122 pero antes de v2024.2.514. Esta vulnerabilidad podría permitir que un ensamblado de temas que no sea de confianza ejecute código arbitrario en el sistema Windows local. • https://docs.telerik.com/devtools/winforms/knowledge-base/local-code-execution-vulnerability-cve-2024-3892 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5936 – Unsafe temporary data privileges on Unix systems in Arc before v1.6.0
https://notcve.org/view.php?id=CVE-2023-5936
On Unix systems (Linux, MacOS), Arc uses a temporary file with unsafe privileges. By tampering with such file, a malicious local user in the system may be able to trigger arbitrary code execution with root privileges. • https://security.nozominetworks.com/NN-2023:14-01 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5935 – Missing authentication for local web interface in Arc before v1.6.0
https://notcve.org/view.php?id=CVE-2023-5935
This could also lead to arbitrary code execution if a malicious update package is installed. • https://security.nozominetworks.com/NN-2023:13-01 • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35179 – Unprivileged Stalwart Mail Server user can read files as root
https://notcve.org/view.php?id=CVE-2024-35179
This issue affects admins who have set up to run stalwart with `RUN_AS_USER` who handed out admin credentials to the mail server but expect these to only grant access according to the `RUN_AS_USER` and are attacked where the attackers managed to achieve Arbitrary Code Execution using another vulnerability. • https://github.com/stalwartlabs/mail-server/security/advisories/GHSA-5pfx-j27j-4c6h • CWE-271: Privilege Dropping / Lowering Errors •
CVSS: 9.1EPSS: 0%CPEs: -EXPL: 0CVE-2024-3319 – Security implication in SailPoint Identity Security Cloud IdentityProfile API Endpoints
https://notcve.org/view.php?id=CVE-2024-3319
An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms which could allow remote code execution on the host. • https://www.sailpoint.com/security-advisories • CWE-94: Improper Control of Generation of Code ('Code Injection') •