Page 9 of 57835 results (0.037 seconds)

CVSS: 7.9EPSS: 0%CPEs: 1EXPL: 0

08 Jul 2025 — ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead to arbitrary code execution by a high-privileged attacker. • https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0

08 Jul 2025 — The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. • https://github.com/Flux159/mcp-server-kubernetes/commit/ab165f5a0eea917fef5dbae954506fff6f4bf514 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0

08 Jul 2025 — An attacker could possibly use this issue to create or write to arbitrary files on the system. ... If a user were tricked into cloning a malicious Git repository, an attacker could possibly use this issue to run arbitrary commands. • https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-436: Interpretation Conflict •

CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0

08 Jul 2025 — The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. ... An attacker could possibly use this issue to create or write to arbitrary files on the system. ... If a user were tricked into cloning a malicious Git repository, an attacker could possibly use this issue to run arbitrary commands. • https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655 • CWE-73: External Control of File Name or Path CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

08 Jul 2025 — Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. • https://helpx.adobe.com/security/products/dimension/apsb25-63.html • CWE-787: Out-of-bounds Write •

CVSS: 9.4EPSS: 0%CPEs: 9EXPL: 0

08 Jul 2025 — The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). • https://plugins.trac.wordpress.org/browser/sureforms/trunk/admin/views/entries-list-table.php#L661 • CWE-73: External Control of File Name or Path •

CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0

08 Jul 2025 — In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution. • https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv • CWE-285: Improper Authorization •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

08 Jul 2025 — Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47988 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 10.0EPSS: 0%CPEs: 17EXPL: 0

08 Jul 2025 — Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49729 • CWE-122: Heap-based Buffer Overflow •

CVSS: 10.0EPSS: 0%CPEs: 13EXPL: 0

08 Jul 2025 — Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network. • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49724 • CWE-416: Use After Free •