CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35680 – WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerability
https://notcve.org/view.php?id=CVE-2024-35680
06 Jun 2024 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Code Injection.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.9.2. La neutralización inadecuada de elementos especiales en la salida utilizados por una vulnerabilidad de componente posterior ("inyección") en YITH YITH WooCommerce Product Add-Ons permite la inyección de código. Este problema afecta a YITH WooCommerce Product ... • https://patchstack.com/database/vulnerability/yith-woocommerce-product-add-ons/wordpress-yith-woocommerce-product-add-ons-plugin-4-9-2-content-injection-vulnerability?_s_id=cve • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4194 – Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution
https://notcve.org/view.php?id=CVE-2024-4194
05 Jun 2024 — The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. El complemento The Album and Image Gallery plus Lightbox para WordPress es vulnerable a la ejecución arbitraria de códigos cortos en tod... • https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-37273
https://notcve.org/view.php?id=CVE-2024-37273
04 Jun 2024 — An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. Una vulnerabilidad de carga de archivos arbitrarios en la interfaz /v1/app/appendFileSync de Jan v0.4.12 permite a los atacantes ejecutar código arbitrario cargando un archivo manipulado. • https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37061
https://notcve.org/view.php?id=CVE-2024-37061
04 Jun 2024 — Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run. La ejecución remota de código puede ocurrir en versiones de la plataforma MLflow que ejecutan la versión 1.11.0 o posterior, lo que permite que un proyecto ML creado con fines malintencionados ejecute código arbitrario en el sistema de un usuario final cuando se ejecuta. • https://hiddenlayer.com/sai-security-advisory/mlflow-june2024 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20881
https://notcve.org/view.php?id=CVE-2024-20881
04 Jun 2024 — Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential arbitrary code execution. • https://security.samsungmobile.com/securityUpdate.smsb?year=2024&month=06 •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 1CVE-2024-31334 – PowerVR DevmemXIntMapPages() Mapping Issue
https://notcve.org/view.php?id=CVE-2024-31334
04 Jun 2024 — In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. • https://packetstorm.news/files/id/178928 • CWE-269: Improper Privilege Management •
CVSS: 8.1EPSS: 0%CPEs: -EXPL: 0CVE-2024-36569
https://notcve.org/view.php?id=CVE-2024-36569
03 Jun 2024 — Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php. • https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/RCE-1.md • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-36568
https://notcve.org/view.php?id=CVE-2024-36568
03 Jun 2024 — Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. Sourcecodester Gas Agency Management System v1.0 es vulnerable a la inyección SQL a través de /gasmark/editbrand.php?id=. • https://github.com/debug601/bug_report/blob/main/vendors/mayuri_k/gas-agency-management-system/SQL-1.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36120 – javascript-deobfuscator crafted payload can lead to code execution
https://notcve.org/view.php?id=CVE-2024-36120
31 May 2024 — javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature. javascript-deobfuscator elimina técnicas comunes de ofuscación de JavaScript. • https://github.com/ben-sb/javascript-deobfuscator/commit/630d3caec83d5f31c5f7a07e6fadf613d06699d6 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5565 – Prompt Injection in "ask" API with visualization leads to RCE
https://notcve.org/view.php?id=CVE-2024-5565
31 May 2024 — The Vanna library uses a prompt function to present the user with visualized results, it is possible to alter the prompt using prompt injection and run arbitrary Python code instead of the intended visualization code. Specifically - allowing external input to the library’s “ask” method with "visualize" set to True (default behavior) leads to remote code execution. La librería Vanna utiliza una función de solicitud para presentar al usuario resultados visualizados; es posible modificar la solicitud mediante ... • https://research.jfrog.com/vulnerabilities/vanna-prompt-injection-rce-jfsa-2024-001034449 • CWE-94: Improper Control of Generation of Code ('Code Injection') •