CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-31032
https://notcve.org/view.php?id=CVE-2024-31032
An issue in Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport v.1.1.2 allows a remote attacker to execute arbitrary code via the manager/ipping.php component. Un problema en Huashi Private Cloud CDN Live Streaming Acceleration Server hgateway-sixport v.1.1.2 permite a un atacante remoto ejecutar código arbitrario a través del componente manager/ipping.php. • https://github.com/walskt/CVE/blob/main/CVE-2024-31032/README.md https://github.com/whgojp/cve-reports/blob/master/Huashi_Private_Cloud_CDN_Live_Streaming_Acceleration_Server_Has_RCE_Vulnerability/report.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1692 – BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.13 - Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Description
https://notcve.org/view.php?id=CVE-2024-1692
The BoldGrid Easy SEO – Simple and Effective SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the meta description field in all versions up to, and including, 1.6.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. El complemento BoldGrid Easy SEO – Simple and Effective SEO para WordPress es vulnerable a cross-site scripting almacenado a través del campo de meta descripción en todas las versiones hasta la 1.6.13 incluida debido a una sanitización de entrada insuficiente y a un escape de salida en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados con permisos de nivel de colaborador y superiores inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada. • sfp_email=&sfph_mail=&reponame=&old=3054618%40boldgrid-easy-seo&new=3054618%40boldgrid-easy-seo&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/0a308fde-1c44-4c34-ace5-6820dc949f53? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-42950
https://notcve.org/view.php?id=CVE-2023-42950
Processing maliciously crafted web content may lead to arbitrary code execution. • http://www.openwall.com/lists/oss-security/2024/03/26/1 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IXLXIOAH5S7J22LJTCIAVFVVJ4TESAX4 https://support.apple.com/en-us/HT214035 https://support.apple.com/en-us/HT214036 https://support.apple.com/en-us/HT214039 https://support.apple.com/en-us/HT214040 https://support.apple.com/en-us/HT214041 https://support.apple.com/kb/HT214039 • CWE-416: Use After Free •
CVSS: 8.4EPSS: 0%CPEs: -EXPL: 1CVE-2024-23727
https://notcve.org/view.php?id=CVE-2024-23727
The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component. La aplicación YI Smart Kami Vision com.kamivision.yismart hasta 1.0.0_20231219 para Android permite a un atacante remoto ejecutar código JavaScript arbitrario a través de una intención implícita en el componente com.ants360.yicamera.activity.WebViewActivity. • https://github.com/actuator/yi https://github.com/actuator/yi/blob/main/com.kamivision.yismart.V1.0.0_20231219.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0980
https://notcve.org/view.php?id=CVE-2024-0980
The Auto-update service for Okta Verify for Windows is vulnerable to two flaws which in combination could be used to execute arbitrary code. El servicio de actualización automática de Okta Verify para Windows es vulnerable a dos fallas que, en combinación, podrían usarse para ejecutar código arbitrario. • https://trust.okta.com/security-advisories/okta-verify-windows-auto-update-arbitrary-code-execution-cve-2024-0980 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-427: Uncontrolled Search Path Element •