CVSS: 8.4EPSS: 0%CPEs: -EXPL: 0CVE-2023-50975
https://notcve.org/view.php?id=CVE-2023-50975
The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). • https://gist.github.com/khronokernel/2598c067d0f49b0f0a4c8b01cf129d34 https://newsroom.ripeda.com/tag/macs-for-business https://www.electronjs.org/blog/statement-run-as-node-cves • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: -EXPL: 0CVE-2023-24333
https://notcve.org/view.php?id=CVE-2023-24333
A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi. Una vulnerabilidad de desbordamiento en la región stack de la memoria en Tenda AC21 con la versión de firmware US_AC21V1.0re_V16.03.08.15_cn_TDC01 permite a los atacantes ejecutar comandos arbitrarios a través de una solicitud POST manipulada para /goform/openSchedWifi. • https://github.com/caoyebo/CVE/tree/main/TENDA%20AC21%20-%20CVE-2023-24333 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2024-21682
https://notcve.org/view.php?id=CVE-2024-21682
This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network. This Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation). This vulnerability was reported via our Penetration Testing program. • https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 https://jira.atlassian.com/browse/JSDSERVER-15067 https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1470 – Elevation of Privilege attack on NetIQ Client login extension
https://notcve.org/view.php?id=CVE-2024-1470
Authorization Bypass Through User-Controlled Key vulnerability in NetIQ (OpenText) Client Login Extension on Windows allows Privilege Escalation, Code Injection.This issue only affects NetIQ Client Login Extension: 4.6. La vulnerabilidad de omisión de autorización a través de clave controlada por el usuario en la extensión de inicio de sesión del cliente NetIQ (OpenText) en Windows permite la escalada de privilegios y la inyección de código. Este problema solo afecta a la extensión de inicio de sesión del cliente NetIQ: 4.6. • https://portal.microfocus.com/s/article/KM000026667?language=en_US • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-22097
https://notcve.org/view.php?id=CVE-2024-22097
A specially crafted .vdhr file can lead to arbitrary code execution. • https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OIRLGNQM33KAWVWP5RPMAPHWNP3IY5YW https://talosintelligence.com/vulnerability_reports/TALOS-2024-1917 • CWE-415: Double Free •