Filtered by CWE-94
Filtered by vendor Subscriptions
Total 4106 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-41763 1 Nokia 1 Access Management System 2024-11-21 8.8 High
An issue was discovered in NOKIA AMS 9.7.05. Remote Code Execution exists via the debugger of the ipAddress variable. A remote user, authenticated to the AMS server, could inject code in the PING function. The privileges of the command executed depend on the user that runs the service.
CVE-2022-41264 1 Sap 1 Basis 2024-11-21 8.8 High
Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authenticated non-administrator attacker to access a system class and execute any of its public methods with parameters provided by the attacker. On successful exploitation the attacker can have full control of the system to which the class belongs, causing a high impact on the integrity of the application.
CVE-2022-41223 1 Mitel 1 Mivoice Connect 2024-11-21 6.8 Medium
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
CVE-2022-41205 2 Microsoft, Sap 2 Windows, Gui 2024-11-21 5.5 Medium
SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which can cause a limited impact on confidentiality and high impact on availability of the application.
CVE-2022-41158 2 Eyoom, Linux 2 Eyoom Builder, Linux Kernel 2024-11-21 7.2 High
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code.
CVE-2022-40871 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 9.8 Critical
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
CVE-2022-40628 1 Tacitine 4 En6200-prime Quad-100, En6200-prime Quad-100 Firmware, En6200-prime Quad-35 and 1 more 2024-11-21 9.8 Critical
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device.
CVE-2022-40486 1 Tp-link 2 Archer Ax10 V1, Archer Ax10 V1 Firmware 2024-11-21 8.8 High
TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
CVE-2022-40127 1 Apache 1 Airflow 2024-11-21 8.8 High
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
CVE-2022-3960 1 Hitachi 1 Vantara Pentaho Business Analytics Server 2024-11-21 6.3 Medium
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. 
CVE-2022-3869 1 Froxlor 1 Froxlor 2024-11-21 6.1 Medium
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
CVE-2022-3721 1 Froxlor 1 Froxlor 2024-11-21 4.6 Medium
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.
CVE-2022-3713 1 Sophos 2 Xg Firewall, Xg Firewall Firmware 2024-11-21 8.8 High
A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA.
CVE-2022-3696 1 Sophos 2 Xg Firewall, Xg Firewall Firmware 2024-11-21 7.2 High
A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA.
CVE-2022-3418 1 Soflyy 1 Wp All Import 2024-11-21 7.2 High
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which could allow administrators in multi-site WordPress installations to upload arbitrary files
CVE-2022-3394 1 Soflyy 1 Wp All Export 2024-11-21 7.2 High
The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any logged in user which has been given privileges to perform exports to execute arbitrary code on the site. By default only administrators can run exports, but the privilege can be delegated to lower privileged users.
CVE-2022-3245 1 Microweber 1 Microweber 2024-11-21 6.1 Medium
HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
CVE-2022-3242 1 Microweber 1 Microweber 2024-11-21 6.1 Medium
Code Injection in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-3236 1 Sophos 1 Firewall 2024-11-21 9.8 Critical
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.
CVE-2022-39424 1 Oracle 1 Vm Virtualbox 2024-11-21 8.1 High
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).