CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4884 – WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-4884
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with iisapppool\nmconsole privileges. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, se detectó una vulnerabilidad de ejecución remota de código no autenticada en WhatsUpGold en curso. Apm.UI.Areas.APM.Controllers.CommunityController permite la ejecución de comandos con privilegios de iisapppool\nmconsole. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-4883 – WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-4883
In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, existe un problema de ejecución remota de código en Progress WhatsUp Gold. Esta vulnerabilidad permite que un atacante no autenticado obtenga RCE como cuenta de servicio a través de NmApi.exe. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. • https://github.com/sinsinology/CVE-2024-4883 https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-6257 – HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation
https://notcve.org/view.php?id=CVE-2024-6257
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. • https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.4EPSS: 0%CPEs: -EXPL: 0CVE-2024-37855
https://notcve.org/view.php?id=CVE-2024-37855
An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute arbitrary code via the router's Telnet port 2345 without requiring authentication credentials. Un problema en Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, la versión de hardware 1.0, firmware 2.0.1, permite a un atacante remoto ejecutar código arbitrario a través del puerto Telnet 2345 del enrutador sin requerir credenciales de autenticación. • https://github.com/sudo-subho/nepstech-xpon-router-rce • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5683 – Remote Code Execution in Next4Biz's BPM
https://notcve.org/view.php?id=CVE-2024-5683
Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process Manangement (BPM) allows Remote Code Inclusion.This issue affects Business Process Manangement (BPM): from 6.6.4.4 before 6.6.4.5. • https://www.usom.gov.tr/bildirim/tr-24-0739 • CWE-94: Improper Control of Generation of Code ('Code Injection') •