Page 26 of 47242 results (0.156 seconds)

CVSS: 7.5EPSS: %CPEs: -EXPL: 0

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. ... An attacker can leverage this vulnerability to execute code in the context of the current user. ... This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. ... An attacker can leverage this vulnerability to execute code in the context of the current user. • https://www.zerodayinitiative.com/advisories/ZDI-24-1513 • CWE-502: Deserialization of Untrusted Data •

CVSS: 8.8EPSS: %CPEs: -EXPL: 0

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. ... An attacker can leverage this vulnerability to execute code in the context of the current user. ... This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. ... An attacker can leverage this vulnerability to execute code in the context of the current user. • https://www.zerodayinitiative.com/advisories/ZDI-24-1514 • CWE-502: Deserialization of Untrusted Data •

CVSS: 8.8EPSS: %CPEs: -EXPL: 0

Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. ... An attacker can leverage this vulnerability to execute code in the context of the current user. ... This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. ... An attacker can leverage this vulnerability to execute code in the context of the current user. • https://www.zerodayinitiative.com/advisories/ZDI-24-1515 • CWE-502: Deserialization of Untrusted Data •

CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0

The The WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup plugin for WordPress is vulnerable to arbitrary shortcode execution via wpb_pcf_fire_contact_form AJAX action in all versions up to, and including, 1.7.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. • https://gist.github.com/wpbean/1a5abfea883621b4e150eab1362a420f https://plugins.trac.wordpress.org/browser/wpb-popup-for-contact-form-7/tags/1.7.4/includes/class.ajax.php#L34 https://plugins.trac.wordpress.org/changeset/3188864 https://wordpress.org/plugins/wpb-popup-for-contact-form-7/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/a7faa800-3b29-4b79-8b94-1e7985acb50d?source=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0

The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. • https://plugins.trac.wordpress.org/browser/gamipress https://plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.php#L693 https://plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.php#L702 https://wordpress.org/plugins/gamipress/#developers https://www.wordfence.com/threat-intel/vulnerabilities/id/bad0cd3f-88ea-4a1d-b400-0a450b07a546?source=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •