Filtered by CWE-94
Filtered by vendor Subscriptions
Total 4091 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-3665 1 Trellix 1 Endpoint Security 2024-11-21 5.5 Medium
A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code.
CVE-2023-3656 1 Cashit 1 Cashit\! 2024-11-21 9.8 Critical
cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network.
CVE-2023-3551 1 Teampass 1 Teampass 2024-11-21 7.2 High
Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CVE-2023-3519 1 Citrix 2 Netscaler Application Delivery Controller, Netscaler Gateway 2024-11-21 9.8 Critical
Unauthenticated remote code execution
CVE-2023-3401 1 Gitlab 1 Gitlab 2024-11-21 4.8 Medium
An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.
CVE-2023-3393 1 Fossbilling 1 Fossbilling 2024-11-21 7.2 High
Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.
CVE-2023-39956 1 Electronjs 1 Electron 2024-11-21 6.1 Medium
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron.
CVE-2023-39685 1 Hjson 1 Hjson 2024-11-21 7.5 High
An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.
CVE-2023-39681 1 Cuppacms 1 Cuppacms 2024-11-21 9.8 Critical
Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php. This vulnerability is triggered via a crafted payload.
CVE-2023-39660 1 Gabrieleventuri 1 Pandasai 2024-11-21 9.8 Critical
An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prompt function.
CVE-2023-39631 1 Langchain 1 Langchain 2024-11-21 9.8 Critical
An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
CVE-2023-39469 2024-11-21 N/A
PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists within the External User Lookup functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute Java code. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-21013.
CVE-2023-39445 2 Elecom, Logitec 15 Wrc-1467ghbk-a, Wrc-1467ghbk-a Firmware, Wrc-1467ghbk-s and 12 more 2024-11-21 8.8 High
Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted file to the product's certain management console.
CVE-2023-39333 2 Nodejs, Redhat 2 Nodejs, Enterprise Linux 2024-11-21 5.3 Medium
Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.
CVE-2023-39323 3 Fedoraproject, Golang, Redhat 3 Fedora, Go, Enterprise Linux 2024-11-21 8.1 High
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
CVE-2023-39320 1 Golang 1 Go 2024-11-21 9.8 Critical
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
CVE-2023-39157 1 Crocoblock 1 Jetelements 2024-11-21 9 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.10.
CVE-2023-39059 1 Ansible-semaphore 1 Ansible Semaphore 2024-11-21 8.8 High
An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.
CVE-2023-39023 1 University Compass Project 1 University Compass 2024-11-21 9.8 Critical
university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.DefaultExecutorManager.configure. This vulnerability is exploited via passing an unchecked argument.
CVE-2023-39022 1 Oscore 1 Oscore 2024-11-21 9.8 Critical
oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.