CVSS: 7.8EPSS: 0%CPEs: 294EXPL: 0CVE-2021-26316
https://notcve.org/view.php?id=CVE-2021-26316
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031 https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22853 – Tiki Wiki CMS Groupware 24.0 structlib.php Code Execution
https://notcve.org/view.php?id=CVE-2023-22853
Tiki Wiki CMS Groupware versions 24.0 and below suffer from a PHP code injection vulnerability in structlib.php. • https://karmainsecurity.com/KIS-2023-02 https://tiki.org/articles • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 0CVE-2023-0022 – Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP)
https://notcve.org/view.php?id=CVE-2023-0022
SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application. • https://launchpad.support.sap.com/#/notes/3262810 https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4705 – Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation
https://notcve.org/view.php?id=CVE-2022-4705
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset site configuration templates, which can be chosen and imported via a separate action documented in CVE-2022-4704. WordPress Royal Elementor add-ons versions 1.3.59 and below suffer from cross site request forgery, insufficient access control, cross site scripting vulnerabilities. • rev=2833046 https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons https://www.wordfence.com/threat-intel/vulnerabilities/id/0a941aef-85f6-4719-b6ab-ace77a03e93e • CWE-284: Improper Access Control •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 3CVE-2022-43971 – Arbitrary code execution in Linksys WUMC710
https://notcve.org/view.php?id=CVE-2022-43971
An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious GET or POST request to /setNTP.cgi to execute arbitrary commands on the underlying Linux operating system as root. Existe una vulnerabilidad de ejecución de código arbitrario en Linksys WUMC710 Wireless-AC Universal Media Connector con firmware <= 1.0.02 (build3). La función do_setNTP dentro del binario httpd utiliza entradas de usuario no validadas en la construcción de un comando del sistema. • https://youtu.be/73-1lhvJPNg https://youtu.be/RfWVYCUBNZ0 https://youtu.be/TeWAmZaKQ_w • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •