CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47963 – Out-of-bounds Write vulnerability in Delta Electronics CNCSoft-G2
https://notcve.org/view.php?id=CVE-2024-47963
An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. ... An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21 • CWE-787: Out-of-bounds Write •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47962 – Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2
https://notcve.org/view.php?id=CVE-2024-47962
An attacker can manipulate an insider to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current process. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. ... An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/news-events/ics-advisories/icsa-24-284-21 • CWE-121: Stack-based Buffer Overflow •
CVSS: 9.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25581 – Deserialization of untrusted data in InternalAttributeHandler in pac4j
https://notcve.org/view.php?id=CVE-2023-25581
This issue may lead to Remote Code Execution (RCE) in the worst case. • https://github.com/p33d/CVE-2023-25581 https://github.com/frohoff/ysoserial https://github.com/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/InternalAttributeHandler.java#L95 https://portswigger.net/web-security/deserialization https://securitylab.github.com/advisories/GHSL-2022-085_pac4j • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45116 – Adobe Commerce | Cross-site Scripting (XSS) (CWE-79)
https://notcve.org/view.php?id=CVE-2024-45116
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. • https://helpx.adobe.com/security/products/magento/apsb24-73.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9707 – Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
https://notcve.org/view.php?id=CVE-2024-9707
This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. • https://www.wordfence.com/threat-intel/vulnerabilities/id/9c101fca-037c-4bed-9dc7-baa021a8b59c?source=cve https://github.com/WordPressBugBounty/plugins-hunk-companion/blob/5a3cedc7b3d35d407b210e691c53c6cb400e4051/hunk-companion/import/app/app.php#L46 https://wordpress.org/plugins/hunk-companion https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3166501%40hunk-companion&new=3166501%40hunk-companion&sfp_email=&sfph_mail= • CWE-862: Missing Authorization •