CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-26107
https://notcve.org/view.php?id=CVE-2023-26107
06 Mar 2023 — All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string. • https://github.com/eBay/SketchSVG/blob/dd1036648f0f320a3187ef79d506b676b9eb87a6/lib/index.js%23L115 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 3CVE-2022-46395 – Android Arm Mali GPU Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2022-46395
06 Mar 2023 — An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r0p0 through r32p0, Bifrost r0p0 through r41p0 before r42p0, Valhall r19p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0. • https://packetstorm.news/files/id/172855 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22419
https://notcve.org/view.php?id=CVE-2023-22419
05 Mar 2023 — As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution. • https://jvn.jp/en/vu/JVNVU94966432 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22421
https://notcve.org/view.php?id=CVE-2023-22421
05 Mar 2023 — As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution. • https://jvn.jp/en/vu/JVNVU94966432 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22424
https://notcve.org/view.php?id=CVE-2023-22424
05 Mar 2023 — As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution. • https://jvn.jp/en/vu/JVNVU94966432 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-47664 – Gentoo Linux Security Advisory 202408-20
https://notcve.org/view.php?id=CVE-2022-47664
03 Mar 2023 — Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse Multiple vulnerabilities have been discovered in libde265, the worst of which could lead to arbitrary code execution. • https://github.com/strukturag/libde265/issues/368 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-22381 – Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions
https://notcve.org/view.php?id=CVE-2023-22381
02 Mar 2023 — A code injection vulnerability was identified in GitHub Enterprise Server that allowed setting arbitrary environment variables from a single environment variable value in GitHub Actions when using a Windows based runner. • https://docs.github.com/en/enterprise-server@3.4/admin/release-notes#3.4.15 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 2CVE-2023-26477 – org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
https://notcve.org/view.php?id=CVE-2023-26477
02 Mar 2023 — XWiki Platform is a generic wiki platform. Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6. As a workaround, it is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from the patch fixing the issue. • https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-1097 – Unauthenticated Command Injection EG7035-M11 Series
https://notcve.org/view.php?id=CVE-2023-1097
01 Mar 2023 — Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. • https://community.na.baicells.com/t/baice-bm-2-5-26-new-cpe-software-has-been-released/1756 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-24758 – Gentoo Linux Security Advisory 202408-20
https://notcve.org/view.php?id=CVE-2023-24758
01 Mar 2023 — Multiple vulnerabilities have been discovered in libde265, the worst of which could lead to arbitrary code execution. • https://github.com/strukturag/libde265/issues/383 • CWE-476: NULL Pointer Dereference •