CVSS: 6.5EPSS: 0%CPEs: -EXPL: 0CVE-2024-24581 – Arkcompiler runtime has an out-of-bounds write vulnerability
https://notcve.org/view.php?id=CVE-2024-24581
02 Apr 2024 — in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution through out-of-bounds write. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29074 – Telephony has an improper input validation vulnerability
https://notcve.org/view.php?id=CVE-2024-29074
02 Apr 2024 — in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through improper input. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22098 – AVSession has a use after free vulnerability
https://notcve.org/view.php?id=CVE-2024-22098
02 Apr 2024 — in OpenHarmony v3.2.4 and prior versions allow a local attacker arbitrary code execution in any apps through use after free. • https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-04.md • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29276
https://notcve.org/view.php?id=CVE-2024-29276
02 Apr 2024 — An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component. Se descubrió un problema en seeyonOA versión 8, que permite a atacantes remotos ejecutar código arbitrario a través del método importProcess en el componente WorkFlowDesignerController.class. • https://www.cnblogs.com/Rainy-Day/p/18061399 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31003
https://notcve.org/view.php?id=CVE-2024-31003
02 Apr 2024 — Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4_MemoryByteStream::WritePartial at Ap4ByteStream.cpp. Vulnerabilidad de desbordamiento de búfer en Bento4 Bento v.1.6.0-641 permite a un atacante remoto ejecutar código arbitrario a través de AP4_MemoryByteStream::WritePartial en Ap4ByteStream.cpp. • https://github.com/axiomatic-systems/Bento4/issues/939 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30858
https://notcve.org/view.php?id=CVE-2024-30858
01 Apr 2024 — netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php. netentsec NS-ASG 6.3 es vulnerable a la inyección SQL a través de /admin/edit_fire_wall.php. • https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-edit_fire_wall.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30868
https://notcve.org/view.php?id=CVE-2024-30868
01 Apr 2024 — netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/add_getlogin.php. netentsec NS-ASG 6.3 es vulnerable a la inyección SQL a través de /admin/add_getlogin.php. • https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-add_getlogin.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41724
https://notcve.org/view.php?id=CVE-2023-41724
31 Mar 2024 — A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. Una vulnerabilidad de inyección de comandos en Ivanti Sentry anterior a 9.19.0 permite que un actor de amenazas no autenticado ejecute comandos arbitrarios en el sistema operativo subyacente del dispositivo dentro de la misma red física o lógica. • https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29202 – JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
https://notcve.org/view.php?id=CVE-2024-29202
29 Mar 2024 — JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7. JumpServer es un host bastión de código abierto y un sistema de au... • https://github.com/jumpserver/jumpserver/security/advisories/GHSA-2vvr-vmvx-73ch • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29201 – JumpServer's insecure Ansible playbook validation leads to RCE in Celery
https://notcve.org/view.php?id=CVE-2024-29201
29 Mar 2024 — JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7. JumpServer es un host bastión de código abierto y un sistema de auditoría de s... • https://github.com/jumpserver/jumpserver/security/advisories/GHSA-pjpp-cm9x-6rwj • CWE-94: Improper Control of Generation of Code ('Code Injection') •