Filtered by CWE-94
Filtered by vendor Subscriptions
Total 4106 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-0462 2 Redhat, Theforeman 3 Satellite, Satellite Capsule, Foreman 2024-11-21 8 High
An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.
CVE-2023-0297 1 Pyload 1 Pyload 2024-11-21 9.8 Critical
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
CVE-2023-0090 1 Proofpoint 1 Enterprise Protection 2024-11-21 9.8 Critical
The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below.
CVE-2023-0089 1 Proofpoint 1 Enterprise Protection 2024-11-21 8.8 High
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects all versions 8.20.0 and below.
CVE-2023-0048 1 Daloradius 1 Daloradius 2024-11-21 8.8 High
Code Injection in GitHub repository lirantal/daloradius prior to master-branch.
CVE-2023-0022 1 Sap 1 Businessobjects Business Intelligence Platform 2024-11-21 9.9 Critical
SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application.
CVE-2022-4300 1 Xjd2020 1 Fastcms 2024-11-21 6.3 Medium
A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability.
CVE-2022-4223 2 Fedoraproject, Postgresql 2 Fedora, Pgadmin 2024-11-21 8.8 High
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.
CVE-2022-4116 2 Quarkus, Redhat 3 Quarkus, Build Of Quarkus, Quarkus 2024-11-21 9.8 Critical
A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.
CVE-2022-48503 2 Apple, Redhat 7 Ipados, Iphone Os, Macos and 4 more 2024-11-21 8.8 High
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
CVE-2022-48175 1 Rukovoditel 1 Rukovoditel 2024-11-21 9.8 Critical
Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.
CVE-2022-48093 1 Seacms 1 Seacms 2024-11-21 7.2 High
Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
CVE-2022-47896 1 Jetbrains 1 Intellij Idea 2024-11-21 5 Medium
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
CVE-2022-47318 4 Debian, Fedoraproject, Redhat and 1 more 4 Debian Linux, Fedora, Satellite and 1 more 2024-11-21 8.0 High
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
CVE-2022-46836 1 Checkmk 1 Checkmk 2024-11-21 9.1 Critical
PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component.
CVE-2022-46742 1 Paddlepaddle 1 Paddlepaddle 2024-11-21 10 Critical
Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.
CVE-2022-46648 3 Debian, Redhat, Ruby-git Project 3 Debian Linux, Satellite, Ruby-git 2024-11-21 8.0 High
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318.
CVE-2022-46333 1 Proofpoint 1 Enterprise Protection 2024-11-21 7.2 High
The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope. This affects all versions 8.19.0 and below.
CVE-2022-46166 1 Codecentric 1 Spring Boot Admin 2024-11-21 8.1 High
Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint.
CVE-2022-46161 1 Pdfmake Project 1 Pdfmake 2024-11-21 10 Critical
pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.