CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-26436
https://notcve.org/view.php?id=CVE-2023-26436
Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to local networks by default. Arbitrary code could be injected that is being executed when processing the request. A check has been introduced to restrict processing of legal and expected classes for this API. We now log a warning in case there are attempts to inject illegal classes. • http://packetstormsecurity.com/files/173083/OX-App-Suite-SSRF-Resource-Consumption-Command-Injection.html http://seclists.org/fulldisclosure/2023/Jun/8 https://documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-2023-0002.json https://software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release_6219_7.10.6_2023-03-20.pdf • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34541
https://notcve.org/view.php?id=CVE-2023-34541
Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt. • https://github.com/hwchase17/langchain/issues/4849 •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2020-20918
https://notcve.org/view.php?id=CVE-2020-20918
An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page. • https://github.com/pluck-cms/pluck/issues/80 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 2%CPEs: 9EXPL: 0CVE-2023-32412 – iOS / macOS libIPTelephony.dylib Use-After-Free
https://notcve.org/view.php?id=CVE-2023-32412
A remote attacker may be able to cause unexpected app termination or arbitrary code execution. • https://support.apple.com/en-us/HT213757 https://support.apple.com/en-us/HT213758 https://support.apple.com/en-us/HT213759 https://support.apple.com/en-us/HT213760 https://support.apple.com/en-us/HT213761 https://support.apple.com/en-us/HT213764 https://support.apple.com/en-us/HT213765 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-25136
https://notcve.org/view.php?id=CVE-2019-25136
A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox escape. • https://bugzilla.mozilla.org/show_bug.cgi?id=1530709 https://www.mozilla.org/security/advisories/mfsa2019-34 •