CVE-2024-38530 – Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"
https://notcve.org/view.php?id=CVE-2024-38530
This may lead in unrestricted RCE on the backend server, since the upload location is accessible from the internet. • https://github.com/gunet/openeclass/commit/4449cf8bed40fd8fc4b267a5726fab9f9fe5a191 https://github.com/gunet/openeclass/security/advisories/GHSA-88c3-hp7p-grgg • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVE-2024-7094 – JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-7094
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. ... This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added. The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. ... This makes it possible for unauthenticated attackers to execute code on the server. • https://github.com/nastar-id/CVE-2024-7094 https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/css/style.php https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/formhandler.php https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/controller.php https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/model.php https://plugins.trac.wordpress.org/browser/js-s • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVE-2024-5651 – Fence-agents-remediation: fence agent command line options leads to remote code execution
https://notcve.org/view.php?id=CVE-2024-5651
This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user with developer access, can create a specially crafted FenceAgentsRemediation for a fence agent supporting --ssh-path/--telnet-path arguments to execute arbitrary commands on the operator's pod. This RCE leads to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges. ... This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. ... This RCE leads to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges. • https://access.redhat.com/security/cve/CVE-2024-5651 https://bugzilla.redhat.com/show_bug.cgi?id=2290540 https://access.redhat.com/errata/RHSA-2024:5453 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVE-2024-40500
https://notcve.org/view.php?id=CVE-2024-40500
Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the search function in the import component. • https://github.com/nitipoom-jar/CVE-2024-40500 https://nitipoom-jar.github.io/CVE-2024-40500 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVE-2024-43249 – WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Arbitrary File Upload vulnerability
https://notcve.org/view.php?id=CVE-2024-43249
This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. • https://patchstack.com/database/vulnerability/bitformpro/wordpress-bit-form-pro-plugin-2-6-4-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve • CWE-434: Unrestricted Upload of File with Dangerous Type •