CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-22857
https://notcve.org/view.php?id=CVE-2024-22857
An attacker can exploit this vulnerability to overwrite the zlog_record_fn record_func function pointer to get arbitrary code execution or potentially cause remote code execution (RCE). zlog 1.2.16 tiene un desbordamiento de búfer de almacenamiento dinámico en la estructura zlog_rule_s mientras crea una nueva regla que ya está definida en el archivo de configuración proporcionado. • https://github.com/HardySimpson/zlog https://github.com/HardySimpson/zlog/blob/1a7b1a6fb956b92a4079ccc91f30da21f34ca063/src/rule.h#L30 https://github.com/HardySimpson/zlog/pull/251 https://www.cybersecurity-help.cz/vdb/SB2024022842 https://www.ebryx.com/blogs/arbitrary-code-execution-in-zlog-cve-2024-22857 • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27934 – *const c_void / ExternalPointer unsoundness leading to use-after-free
https://notcve.org/view.php?id=CVE-2024-27934
Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, which is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. • https://github.com/denoland/deno/security/advisories/GHSA-3j27-563v-28wf • CWE-416: Use After Free •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27933 – Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
https://notcve.org/view.php?id=CVE-2024-27933
This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. • https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L214 https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L220 https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L225 https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L241 https://github.com/denoland/deno/blob/v1.39.0/runtime/permissions/prompter.rs#L256 https://github.com/denoland/deno/blob/v1.39.0/runtime/permission • CWE-863: Incorrect Authorization •
CVSS: 6.6EPSS: 0%CPEs: -EXPL: 0CVE-2024-25359
https://notcve.org/view.php?id=CVE-2024-25359
An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file. Un problema en zuoxingdong lagom v.0.1.2 permite a un atacante local ejecutar código arbitrario a través de la función pickle_load del archivo serialize.py. • https://github.com/bayuncao/vul-cve-10 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21838
https://notcve.org/view.php?id=CVE-2024-21838
Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead to HTML code injection in emails generated by Command Centre. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 (MR2), 8.90 prior to vEL8.90.1751 (MR3), 8.80 prior to vEL8.80.1526 (MR4), 8.70 prior to vEL8.70.2526 (MR6), all version of 8.60 and prior. • https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-21838 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •