CVSS: 9.3EPSS: 0%CPEs: -EXPL: 0CVE-2024-23346 – pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string
https://notcve.org/view.php?id=CVE-2024-23346
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue. Pymatgen (Python Materials Genomics) es una librería Python de código abierto para análisis de materiales. • https://github.com/materialsproject/pymatgen/blob/master/pymatgen/symmetry/settings.py#L97C1-L111C108 https://github.com/materialsproject/pymatgen/commit/c231cbd3d5147ee920a37b6ee9dd236b376bcf5a https://github.com/materialsproject/pymatgen/security/advisories/GHSA-vgv8-5cpj-qj2f • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45177
https://notcve.org/view.php?id=CVE-2022-45177
An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isenableuser endpoint, the /api/v1/sharedsearch?search={NAME]+{SURNAME] endpoint, and the /login endpoint. The web application provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. Se descubrió un problema en LIVEBOX Collaboration vDesk hasta v031. • https://www.gruppotim.it/it/footer/red-team.html • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-203: Observable Discrepancy •
CVSS: 8.4EPSS: 0%CPEs: -EXPL: 0CVE-2023-50975
https://notcve.org/view.php?id=CVE-2023-50975
The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). • https://gist.github.com/khronokernel/2598c067d0f49b0f0a4c8b01cf129d34 https://newsroom.ripeda.com/tag/macs-for-business https://www.electronjs.org/blog/statement-run-as-node-cves • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: -EXPL: 0CVE-2023-24333
https://notcve.org/view.php?id=CVE-2023-24333
A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi. Una vulnerabilidad de desbordamiento en la región stack de la memoria en Tenda AC21 con la versión de firmware US_AC21V1.0re_V16.03.08.15_cn_TDC01 permite a los atacantes ejecutar comandos arbitrarios a través de una solicitud POST manipulada para /goform/openSchedWifi. • https://github.com/caoyebo/CVE/tree/main/TENDA%20AC21%20-%20CVE-2023-24333 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2024-21682
https://notcve.org/view.php?id=CVE-2024-21682
This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). Assets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network. This Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction. Atlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions See the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation). This vulnerability was reported via our Penetration Testing program. • https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606 https://jira.atlassian.com/browse/JSDSERVER-15067 https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation • CWE-94: Improper Control of Generation of Code ('Code Injection') •