Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. An Authenticated Attacker could exploit it by executing WSAsyncExecuteTasks deserialization of untrusted data.


The \Log alert to a file\ action within action management enables any Orion Platform user with Orion alert management rights to write to any file. An attacker with Orion alert management rights could use this vulnerability to perform an unrestricted file upload causing a remote code execution.


Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.


Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to exploit this vulnerability.


An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. An attacker in the local network is able to achieve Remote Code Execution (with user privileges of the local user) on any device that tries to connect to a WePresent presentation system.


Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has network access to the Orion Patch Manager Web Console could potentially exploit this and compromise the server


** DISPUTED ** A Cross Site Request Forgery (CSRF) vulnerability exists in Backdrop CMS 1.20 which allows Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cookie of a high-privileged authenticated user who is entitled to install arbitrary add-ons.


SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution.


A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by a registered user. As a result a malicious user can extract sensitive data such as usernames and passwords and in some cases use this vulnerability in order to get a remote code execution on the remote web server.


Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.php through the \image\ parameter that can execute a webshell payload.


Stormshield Endpoint Security before 2.1.2 allows remote code execution.


An issue was discovered in PONTON X/P Messenger before 3.11.2. Due to path traversal in private/SchemaSetUpload.do for uploaded ZIP files an executable script can be uploaded by web application administrators giving the attacker remote code execution on the underlying server via an imgs/*.jsp URI.


It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example $${ctx:loginId}) or a Thread Context Map pattern (%X %mdc or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.


SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.


In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.


curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. When libcurl at run-time sets up support for TLS 1.3 session tickets on a connection using OpenSSL it stores pointers to the transfer in-memory object for later retrieval when a session ticket arrives. If the connection is used by multiple transfers (like with a reused HTTP/1.1 connection or multiplexed HTTP/2 connection) that first transfer object might be freed before the new session is established on that connection and then the function will access a memory buffer that might be freed. When using that memory libcurl might even call a function pointer in the object making it possible for a remote code execution if the server could somehow manage to get crafted memory content into the correct place in memory.


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when processing config files.


A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to lack validation of user-supplied input data when a malicious CGF file is imported to IGSS Definition.


A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could lead to remote code execution through a number of paths when an attacker writes arbitrary files to folders in context of the DC module by sending constructed messages on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)


A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)


A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to lack of proper validation of user-supplied data when a malicious CGF file is imported to IGSS Definition.


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a file is saved. Affected Product: C-Bus Toolkit (V1.15.9 and prior) C-Gate Server (V2.11.7 and prior)


A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data or remote code execution due to missing length checks when a malicious CGF file is imported to IGSS Definition.


Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.


A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of sanity checks on user-supplied data when a malicious CGF file is imported to IGSS Definition.


A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.


A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing checks of user-supplied input data when a malicious CGF file is imported to IGSS Definition.


Node.js before 16.6.0 14.17.4 and 12.22.4 is vulnerable to Remote Code Execution XSS Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.


A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to override environment variables leading to code execution on the GitHub Enterprise Server instance. To exploit this vulnerability an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.0.3 and was fixed in 3.0.3 2.22.9 and 2.21.17. This vulnerability was reported via the GitHub Bug Bounty program.


A CWE-269: Improper Privilege Management vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when an unprivileged user modifies a file.


A CWE-416: Use after free vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to use of unchecked input data when a malicious CGF file is imported to IGSS Definition.


Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.


A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user supplied data when a constructed message is received on the network. Affected Product: Interactive Graphical SCADA System Data Collector (dc.exe) (V15.0.0.21243 and prior)


Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could allow remote code execution when unauthorized code is copied to the device.


A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when restoring project files.


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in remote code execution when a malicious CGF or WSP file is being parsed by IGSS Definition.


A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400 PM8000 and ION9000 (All versions prior to V3.0.0) which could cause the meter to reboot or allow for remote code execution.


A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior which could cause remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when restoring a project.


A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior which could result in loss of data or remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause remote code execution when an attacker loads unauthorized code.


A CWE-287: Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded. Affected Product: C-Bus Toolkit (V1.15.9 and prior) C-Gate Server (V2.11.7 and prior)


A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing size checks when a malicious WSP (Workspace) file is being parsed by IGSS Definition.


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in C-Bus Toolkit (V1.15.7 and prior) that could allow a remote code execution when a file is uploaded.


SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potentially leads to Remote Code Execution. This vulnerability impacts Analytics On-Prem 2.5.2518 and earlier.


Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service (zebra or ripd). Subsequent log messages will be appended to the file prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnerability to append to a shell script on the router's filesystem and then awaiting or triggering the execution of that script. A remote unauthenticated root shell can easily be obtained on the device in this fashion.


ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface.


The web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3 firmware version <= 1.24 do not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration potentially gaining remote code execution.


Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device. If an end user inserts a flash drive with a malicious symlink on it that the bittorrent client can write downloads to then a user is able to download arbitrary files to any desired location on the devices filesystem which could lead to remote code execution. Example directories vulnerable to this include \config\ \downloads\ and \torrents\ though it should be noted that \downloads\ is the only vector that allows for arbitrary files to be downloaded to arbitrary locations.


ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Personalization interface.


SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local attacker could result in remote code execution in the target system.


Tenable.sc and Tenable.sc Core versions 5.13.0 through 5.17.0 were found to contain a vulnerability that could allow an authenticated unprivileged user to perform Remote Code Execution (RCE) on the Tenable.sc server via Hypertext Preprocessor unserialization.


** UNSUPPORTED WHEN ASSIGNED ** A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker to Privilege Escalation and Remote Code Execution capability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartijn642's Config Lib servers will send a packet to clients with the server's config values. In order to read `enum` values from the packet data `ObjectInputStream#readObject` is used. `ObjectInputStream#readObject` will instantiate a class based on the input data. Since the packet data is not validated before `ObjectInputStream#readObject` is called an attacker can instantiate any class by sending a malicious packet. If a suitable class is found the vulnerability can lead to a number of exploits including remote code execution. Although the vulnerable packet is typically only send from server to client it can theoretically also be send from client to server. This means both clients and servers running SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are vulnerable. The vulnerability has been patched in SuperMartijn642's Config lib 1.0.9. Both players and server owners should update to 1.0.9 or higher.


Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can upload malicious PHP files by updating their profile image to gain remote code execution.


Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log


In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021 a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service.


Zabbix 4.0 LTS 4.2 4.4 and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the \Zabbix Admin\ role is able to run custom shell script on the application server in the context of the application user.


RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. An authenticated attacker can upload a PHP file and bypass the .htacess configuration to deny execution of .php files in media and files directory by default.


An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing \<?php system($_GET\cmd\); ?>\ gets uploaded it is saved into /uploads/exam_question/ directory and is accessible by all users.


Windows Media MPEG-4 Video Decoder Remote Code Execution Vulnerability


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.


Windows Print Spooler Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-36936 CVE-2021-36947.


Windows WLAN AutoConfig Service Remote Code Execution Vulnerability


Dell VNX2 OE for File versions 8.1.21.266 and earlier contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system.


Windows Print Spooler Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-36947 CVE-2021-36958.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.


OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\\platypus\\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12 5.1.10 5.2.4 7.3.3 and 7.4.3.


Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability in the CoolType library. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Dell VNX2 for file version 8.1.21.266 and earlier contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execute commands on the system.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could make a crafted request to the Adobe Stock API to achieve remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `themepreview_image` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.


Visual Studio Remote Code Execution Vulnerability


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.


Windows Print Spooler Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-36936 CVE-2021-36958.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.


Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.


Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Discord Recon Server is a bot that allows you to do your reconnaissance process from your Discord. Remote code execution in version 0.0.1 would allow remote users to execute commands on the server resulting in serious issues. This flaw is patched in 0.0.2.


VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could upload and execute a specially crafted file leading to remote code execution within the logupload container.


Adobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551 6.7 before ESXi670-202102401-SG 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.


The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.


SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). An attacker can intercept a request to the server inject malicious JSP code in the request and forward to server. When this dashboard is opened by users having at least SAP_XMII Developer role malicious content in the dashboard gets executed leading to remote code execution in the server which allows privilege escalation. The malicious JSP code can contain certain OS commands through which an attacker can read sensitive files in the server modify files or even delete contents in the server thus compromising the confidentiality integrity and availability of the server hosting the SAP MII application. Also an attacker authenticated as a developer can use the application to upload and execute a file which will permit them to execute operating systems commands completely compromising the server hosting the application.


VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point. A malicious actor with network access may exploit this issue causing unauthorised remote code execution on vRealize Business for Cloud Virtual Appliance.


OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized


Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1 if a remote attacker was able to control the `pretty` option of the pug compiler e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including \pug\ \pug-code-gen\. pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option e.g. if you compile templates in advance before applying user input to them you do not need to upgrade.


Prisma VS Code a VSCode extension for Prisma schema files. This is a Remote Code Execution Vulnerability that affects all versions of the Prisma VS Code extension older than 2.20.0. If a custom binary path for the Prisma format binary is set in VS Code Settings for example by downloading a project that has a .vscode/settings.json file that sets a value for \prismaFmtBinPath\. That custom binary is executed when auto-formatting is triggered by VS Code or when validation checks are triggered after each keypress on a *.prisma file. Fixed in versions 2.20.0 and 20.0.27. As a workaround users can either edit or delete the `.vscode/settings.json` file or check if the binary is malicious and delete it.


SAP Commerce Cloud versions - 1808 1811 1905 2005 2011 enables certain users with required privileges to edit drools rules an authenticated attacker with this privilege will be able to inject malicious code in the drools rules which when executed leads to Remote Code Execution vulnerability enabling the attacker to compromise the underlying host enabling him to impair confidentiality integrity and availability of the application.


Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java objects it deserializes from disk resulting in a remote code execution vulnerability.


An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially crafted HTML web page can cause a use-after-free condition resulting in remote code execution. The victim needs to visit a malicious web site to trigger the vulnerability.


OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or authorization checks. This issue may lead to pre-auth remote code execution. This issue was fixed in 4.0.3 by removing AttachmentUploadServlet and not using deserialization


The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).


angular-expressions

is

\angular's

nicest

part

extracted

as

a

standalone

module

for

the

browser

and

node\.

In

angular-expressions

before

version

there

is

a

vulnerability

which

allows

Remote

Code

Execution

if

you

call

\expressions.compile(userControlledInput)\

where

\userControlledInput\

is

text

that

comes

from

user

input.

The

security

of

the

package

could

be

bypassed

by

using

a

more

complex

payload

using

a

\.constructor.constructor\

technique.

In

terms

of

impact:

If

running

angular-expressions

in

the

browser

an

attacker

could

run

any

browser

script

when

the

application

code

calls

expressions.compile(userControlledInput).

If

running

angular-expressions

on

the

server

an

attacker

could

run

any

Javascript

expression

thus

gaining

Remote

Code

Execution.

This

is

fixed

in

version

of

angular-expressions

A

temporary

workaround

might

be

either

to

disable

user-controlled

input

that

will

be

fed

into

angular-expressions

in

your

application

or

allow

only

following

characters

in

the

userControlledInput.


Prisma is an open source ORM for Node.js & TypeScript. As of today we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who are affected by this security vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. It only affects the `getPackedPackage` function and this function is not advertised and only used for tests & building our CLI no malicious code was found after checking our codebase.


Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected one must use Python 3 for one's Zope deployment run Zope 4 below version 4.6.3 or Zope 5 below version 5.3 and have the optional `Products.PythonScripts` add-on package installed. By default one must have the admin-level Zope \Manager\ role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.


Redis is an open source in-memory database that persists on disk. In affected versions specially crafted Lua scripts executing in Redis can cause the heap-based Lua stack to be overflowed due to incomplete checks for this condition. This can result with heap corruption and potentially remote code execution. This problem exists in all versions of Redis with Lua scripting support starting from 2.6. The problem is fixed in versions 6.2.6 6.0.16 and 5.0.14. For users unable to update an additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.


Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023.


Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.


Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a sandbox escape vulnerability may lead to post-authentication Remote Code execution. This vulnerability is known to exist in the latest commit at the time of writing this CVE (commit a1c8dbe). For more details see the referenced GHSL-2021-063.


ZStack is open source IaaS(infrastructure as a service) software aiming to automate datacenters managing resources of compute storage and networking all by APIs. Affected versions of ZStack REST API are vulnerable to post-authentication Remote Code Execution (RCE) via bypass of the Groovy shell sandbox. The REST API exposes the GET zstack/v1/batch-queries?script endpoint which is backed up by the BatchQueryAction class. Messages are represented by the APIBatchQueryMsg dispatched to the QueryFacadeImpl facade and handled by the BatchQuery class. The HTTP request parameter script is mapped to the APIBatchQueryMsg.script property and evaluated as a Groovy script in BatchQuery.query the evaluation of the user-controlled Groovy script is sandboxed by SandboxTransformer which will apply the restrictions defined in the registered (sandbox.register()) GroovyInterceptor. Even though the sandbox heavily restricts the receiver types to a small set of allowed types the sandbox is non effective at controlling any code placed in Java annotations and therefore vulnerable to meta-programming escapes. This issue leads to post-authenticated remote code execution. For more details see the referenced GHSL-2021-065. This issue is patched in versions 3.8.21 3.10.8 and 4.1.0.


DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.


Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Exposed Hazardous Function Remote Code Execution vulnerability which could allow an unprivileged client to manipulate the registry and escalate privileges to SYSTEM on affected installations. Authentication is required to exploit this vulnerability.


SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.


Emissary

is

a

based

data-driven

workflow

engine.

Affected

versions

of

Emissary

are

vulnerable

to

post-authentication

Remote

Code

Execution

(RCE).

The

REST

endpoint

accepts

an

`sppClassName`

parameter

which

is

used

to

load

an

arbitrary

class.

This

class

is

later

instantiated

using

a

constructor

with

the

following

signature:

`<constructor>(String

String

String)`.

An

attacker

may

find

a

gadget

(class)

in

the

application

classpath

that

could

be

used

to

achieve

Remote

Code

Execution

(RCE)

or

disrupt

the

application.

Even

though

the

chances

to

find

a

gadget

(class)

that

allow

arbitrary

code

execution

are

low

an

attacker

can

still

find

gadgets

that

could

potentially

crash

the

application

or

leak

sensitive

data.

As

a

work

around

disable

network

access

to

Emissary

from

untrusted

sources.


fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior 0.10.0 through 0.10.6 and 0.11.0 through 0.11.2 there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command `mail` from mailutils package used in mail actions like `mail-whois` can execute command if unescaped sequences (`\\n~`) are available in \foreign\ input (for instance in whois output). To exploit the vulnerability an attacker would need to insert malicious characters into the response sent by the whois server either via a MITM attack or by taking over a whois server. The issue is patched in versions 0.10.7 and 0.11.3. As a workaround one may avoid the usage of action `mail-whois` or patch the vulnerability manually.


Emissary

is

a

distributed

peer-to-peer

data-driven

workflow

framework.

Emissary

is

vulnerable

to

Unsafe

Deserialization

of

post-authenticated

requests

to

the

REST

endpoint.

This

issue

may

lead

to

post-auth

Remote

Code

Execution.

This

issue

has

been

patched

in

version

As

a

workaround

one

can

disable

network

access

to

Emissary

from

untrusted

sources.


The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database such as the contents of `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe such as Python's `string` module. However full access to the `string` module also allows access to the class `Formatter` which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution. By default you need to have the admin-level Zope \Manager\ role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk. The problem has been fixed in AccessControl 4.3 and 5.2. Only AccessControl versions 4 and 5 are vulnerable and only on Python 3 not Python 2.7. As a workaround a site administrator can restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.


A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate they can proceed to create a new specially crafted Algorithm and subsequently launch remote code execution with their desired result.


A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page.. As a result an attacker can extract sensitive data from the web server and in some cases can use this vulnerability in order to get a remote code execution on the remote web server.


It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \require all denied\ these requests can succeed. If CGI scripts are also enabled for these aliased pathes this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.


A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.


The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers causing remote code execution. This can be exploited through various attack vectors most notably through the H2 Console which leads to unauthenticated remote code execution.


CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability an attacker must use the \File\ parameter to upload a PHP payload to get a reverse shell from the vulnerable host.


Microsoft Defender Remote Code Execution Vulnerability


An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserialization is mishandled.


Microsoft COM for Windows Remote Code Execution Vulnerability


An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.


Remote Code Execution (RCE) vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate they can proceed to create a new organization by which additional users can be added for various collaboration abilities which allows malicious user to create new Zepl Notebooks with various languages contexts and deployment scenarios. Upon creating a new notebook with specially crafted malicious code a user can then launch remote code execution.


Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.


It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) has Remote Code Execution vulnerabilities in multiple instances of the API requests. The affected endpoints do not have any input validation of the user's input that allowed a malicious payload to be injected.


The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution in versions up to and including 5.3.2.


A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. An attacker can leverage this vulnerability in order to manipulate the sql query performed. As a result he can extract sensitive data from the web server and in some cases he can use this vulnerability in order to get a remote code execution on the remote web server.


SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover logger_file_name can refer to an attacker-controlled PHP file under the web root because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.


Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution from the Notebook users can then use that to subsequently escape the running context sandbox and proceed to access internal Zepl assets including cloud metadata services.


Seowon 130-SLC router all versions as of 2021-09-15 is vulnerable to Remote Code Execution via the queriesCnt parameter.


A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php which could let a malicious user extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code execution on the remote web server.


A file extension handling issue was found in core module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.3. An attacker must request the conversion of the crafted file from PPTT into PPTX format. Using the chain of two other bugs related to improper string handling a remote attacker can obtain remote code execution on DocumentServer.


OpenCATS through 0.9.5-3 unsafely deserializes index.php?m=activity requests leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the parametersactivity:ActivityDataGrid parameter. The PHP object injection exploit chain can leverage an __destruct magic method in guzzlehttp.


A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1) SCALANCE X201-3P IRT (All versions < 5.5.1) SCALANCE X201-3P IRT PRO (All versions < 5.5.1) SCALANCE X202-2 IRT (All versions < 5.5.1) SCALANCE X202-2P IRT (incl. SIPLUS NET variant) (All versions < 5.5.1) SCALANCE X202-2P IRT PRO (All versions < 5.5.1) SCALANCE X204 IRT (All versions < 5.5.1) SCALANCE X204 IRT PRO (All versions < 5.5.1) SCALANCE X204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5) SCALANCE X204-2FM (All versions < V5.2.5) SCALANCE X204-2LD (incl. SIPLUS NET variant) (All versions < V5.2.5) SCALANCE X204-2LD TS (All versions < V5.2.5) SCALANCE X204-2TS (All versions < V5.2.5) SCALANCE X206-1 (All versions < V5.2.5) SCALANCE X206-1LD (All versions < V5.2.5) SCALANCE X208 (incl. SIPLUS NET variant) (All versions < V5.2.5) SCALANCE X208PRO (All versions < V5.2.5) SCALANCE X212-2 (incl. SIPLUS NET variant) (All versions < V5.2.5) SCALANCE X212-2LD (All versions < V5.2.5) SCALANCE X216 (All versions < V5.2.5) SCALANCE X224 (All versions < V5.2.5) SCALANCE XF201-3P IRT (All versions < 5.5.1) SCALANCE XF202-2P IRT (All versions < 5.5.1) SCALANCE XF204 (All versions < V5.2.5) SCALANCE XF204 IRT (All versions < 5.5.1) SCALANCE XF204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5) SCALANCE XF204-2BA IRT (All versions < 5.5.1) SCALANCE XF206-1 (All versions < V5.2.5) SCALANCE XF208 (All versions < V5.2.5). Incorrect processing of POST requests in the web server may write out of bounds in stack. An attacker might leverage this to denial-of-service of the device or remote code execution.


A file extension handling issue was found in core module of ONLYOFFICE DocumentServer v4.2.0.236-v5.6.4.13. An attacker must request the conversion of the crafted file from DOCT into DOCX format. Using the chain of two other bugs related to improper string handling an attacker can achieve remote code execution on DocumentServer.


A file extension handling issue was found in server module of ONLYOFFICE DocumentServer v4.2.0.71-v5.6.0.21. The file extension is controlled by an attacker through the request data and leads to arbitrary file overwriting. Using this vulnerability a remote attacker can obtain remote code execution on DocumentServer.


Windows TCP/IP Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24094.


Microsoft Windows Codecs Library Remote Code Execution Vulnerability


Windows Camera Codec Pack Remote Code Execution Vulnerability


The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the \Import Settings\ feature after its extraction. However the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the \Import Settings\ functionality to achieve Remote Code Execution.


Windows TCP/IP Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24074.


The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.


Package Managers Configurations Remote Code Execution Vulnerability


The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality leading to an unauthenticated remote code execution vulnerability.


Windows Local Spooler Remote Code Execution Vulnerability


Due to use of unsafe YAML deserialization logic an attacker with the ability to modify local YAML configuration files could provide malicious input resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.


In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4 attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site.


Windows Fax Service Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1722.


The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure


.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701.


Windows Address Book Remote Code Execution Vulnerability


Microsoft SharePoint Remote Code Execution Vulnerability


The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files resulting in remote code execution.


In the Reponsive Menu (free and Pro) WordPress plugins before 4.0.4 subscribers could upload zip archives containing malicious PHP files that would get extracted to the /rmp-menu/ directory. These files could then be accessed via the front end of the site to trigger remote code execution and ultimately allow an attacker to execute commands to further infect a WordPress site.


The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio> <video> <img> <a> and<button>.This could allow an unauthenticated remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked Javascript code can be executed. The vulnerability is due to insufficient sanitization of the \data-frmverify\ tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind clicks the malicious link PHP code can be edited.


Windows Encrypting File System (EFS) Remote Code Execution Vulnerability


An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL resulting in SSRF. As a result an attacker can download various content from a remote location and save it to a user-controlled filename which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this.


Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution and this issue is patched in version 0.9.8.


Windows Event Tracing Remote Code Execution Vulnerability


Visual Studio Code WSL Extension Remote Code Execution Vulnerability


An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input (received by the server) being passed to system calls.


Microsoft Office app Remote Code Execution Vulnerability


A

Remote

Code

Execution

(RCE)

vulnerability

exists

in

h

laravel

via

an

unserialize

pop

chain

in

in

in

and

in


Sulu

is

an

open-source

PHP

content

management

system

based

on

the

Symfony

framework.

In

affected

versions

an

attacker

can

read

arbitrary

local

files

via

a

PHP

file

include.

In

a

default

configuration

this

also

leads

to

remote

code

execution.

The

problem

is

patched

with

the

Versions

For

users

unable

to

upgrade

overwrite

the

service

`sulu_route.generator.expression_token_provider`

and

wrap

the

translator

before

passing

it

to

the

expression

language.


Web Media Extensions Remote Code Execution Vulnerability


An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible leading to full access to the postgres user account.


Bot Framework SDK Remote Code Execution Vulnerability


3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-43209.


Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result an authenticated malicious user can compromise the databases system and in some cases leverage this vulnerability to get remote code execution on the remote web server.


MSEdgeRedirect is a tool to redirect news search widgets weather and more to a user's default browser. MSEdgeRedirect versions before 0.5.0.1 are vulnerable to Remote Code Execution via specifically crafted URLs. This vulnerability requires user interaction and the acceptance of a prompt. With how MSEdgeRedirect is coded parameters are impossible to pass to any launched file. However there are two possible scenarios in which an attacker can do more than a minor annoyance. In Scenario 1 (confirmed) a user visits an attacker controlled webpage; the user is prompted with and downloads an executable payload; the user is prompted with and accepts the aforementioned crafted URL prompt; and RCE executes the payload the user previously downloaded if the download path is successfully guessed. In Scenario 2 (not yet confirmed) a user visits an attacked controlled webpage; the user is prompted with and accepts the aforementioned crafted URL prompt; and a payload on a remote attacker controlled SMB server is executed. The issue was found in the _DecodeAndRun() function in which I incorrectly assumed _WinAPI_UrlIs() would only accept web resources. Unfortunately file:/// passes the default _WinAPI_UrlIs check(). File paths are now directly checked for and must fail. There is no currently known exploitation of this vulnerability in the wild. A patched version 0.5.0.1 has been released that checks for and denies these crafted URLs. There are no workarounds for this issue. Users are advised not to accept any unexpected prompts from web pages.


CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule


Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability


In uClibc and uClibc-ng before 1.0.39 incorrect handling of special characters in domain names returned by DNS servers via gethostbyname getaddrinfo gethostbyaddr and getnameinfo can lead to output of wrong hostnames (leading to domain hijacking) or injection into applications (leading to remote code execution XSS applications crashes etc.). In other words a validation step which is expected in any stub resolver does not occur.


3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-43208.


Windows Fax Service Remote Code Execution Vulnerability


In the thymeleaf-spring5:3.0.12 component thymeleaf combined with specific scenarios in template injection may lead to remote code execution.


mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file which may make the product vulnerable to a path traversal payload. This vulnerability may allow an attacker to plant files on the file system in arbitrary locations or overwrite existing files resulting in remote code execution.


vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix `!template!` vault-cli interprets the rest of the contents of the secret as a Jinja2 template. Jinja2 is a powerful templating engine and is not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code making this a Remote Code Execution (RCE) risk. If the content of the vault can be completely trusted then this is not a problem. Otherwise if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli then this vulnerability may impact you. In 3.0.0 the code related to interpreting vault templated secrets has been removed entirely. Users are advised to upgrade as soon as possible. For users unable to upgrade a workaround does exist. Using the environment variable `VAULT_CLI_RENDER=false` or the flag `--no-render` (placed between `vault-cli` and the subcommand e.g. `vault-cli --no-render get-all`) or adding `render: false` to the vault-cli configuration yaml file disables rendering and removes the vulnerability. Using the python library you can use: `vault_cli.get_client(render=False)` when creating your client to get a client that will not render templated secrets and thus operates securely.


A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.


The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g. filesystem Memcached Redis etc.) they can construct a crafted payload poison the cache and execute Python code.


In Weidmueller Industrial WLAN devices in multiple versions an exploitable format string vulnerability exists in the iw_console conio_writestr functionality. A specially crafted time server entry can cause an overflow of the time server buffer resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


Windows MSHTML Platform Remote Code Execution Vulnerability


The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when performing an update of the client. This could lead to remote code execution in an elevated privileged context.


Overwolf Client 0.169.0.22 allows XSS with resultant Remote Code Execution via an overwolfstore:// URL.


vmd

through

allows

'div

class=\markdown-body\'

XSS

as

demonstrated

by

Electron

remote

code

execution

via

require('child_process').execSync('calc.exe')

on

Windows

and

a

similar

attack

on

macOS.


Windows DNS Snap-in Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33749 CVE-2021-33750 CVE-2021-33756.


A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80) SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80) SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Specially crafted packets sent to port 4443/tcp could cause a Denial-of-Service condition or potential remote code execution.


Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability integrity or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.


Windows DNS Snap-in Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33749 CVE-2021-33750 CVE-2021-33752.


Windows Media Remote Code Execution Vulnerability


Windows DNS Snap-in Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33749 CVE-2021-33752 CVE-2021-33756.


In

Invoice

Ninja

before

there

is

an

unsafe

call

to

unserialize()

in

that

may

allow

an

attacker

to

deserialize

arbitrary

PHP

classes.

In

certain

contexts

this

can

result

in

remote

code

execution.

The

attacker's

input

must

be

hosted

at

(cleartext

HTTP)

and

thus

a

successful

attack

requires

spoofing

that

site

or

obtaining

control

of

it.


The

RebornCore

library

before

allows

remote

code

execution

because

it

deserializes

untrusted

data

in

ObjectInputStream.readObject

as

part

of

reborncore.common.network.ExtendedPacketBuffer.

An

attacker

can

instantiate

any

class

on

the

classpath

with

any

data.

A

class

usable

for

exploitation

might

or

might

not

be

present

depending

on

what

Minecraft

modifications

are

installed.


Windows DNS Snap-in Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33750 CVE-2021-33752 CVE-2021-33756.


The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of its use of Java serialization.


In Weidmueller Industrial WLAN devices in multiple versions an exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality. A specially crafted user name entry can cause an overflow of an error message buffer resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \require all denied\ these requests can succeed. If CGI scripts are also enabled for these aliased pathes this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete see CVE-2021-42013.


Windows Media Audio Decoder Remote Code Execution Vulnerability


SuiteCRM through 7.11.21 is vulnerable to CSRF with resultant remote code execution via the UpgradeWizard functionality if a PHP file is included in a ZIP archive.


cron-utils is a Java library to define parse validate migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note that only projects using the @Cron annotation to validate untrusted Cron expressions are affected. The issue was patched and a new version was released. Please upgrade to version 9.1.6. There are no known workarounds known.


Windows MSHTML Platform Remote Code Execution Vulnerability


Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code execution. This resulted from a lack of validation in subscribe_url values. This issue is patched in the latest stable beta and tests-passed versions of Discourse. To workaround the issue without updating requests with a path starting /webhooks/aws path could be blocked at an upstream proxy.


In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0) there is potential cache poisoning and remote code execution when running the build cache node with its default configuration. This configuration allows anonymous access to the configuration user interface and anonymous write access to the build cache. If access control to the build cache is not changed from the default open configuration a malicious actor with network access can populate the cache with manipulated entries that may execute malicious code as part of a build process. This applies to the build cache provided with Gradle Enterprise and the separate build cache node service if used. If access control to the user interface is not changed from the default open configuration a malicious actor can undo build cache access control in order to populate the cache with manipulated entries that may execute malicious code as part of a build process. This does not apply to the build cache provided with Gradle Enterprise but does apply to the separate build cache node service if used.


Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.


An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series Aruba 6300 Switch Series Aruba 6400 Switch Series Aruba 8320 Switch Series Aruba 8325 Switch Series Aruba 8400 Switch Series Aruba CX 8360 Switch Series version(s): AOS-CX 10.07.xxxx: 10.07.0050 and below AOS-CX 10.08.xxxx: 10.08.1030 and below AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address this security vulnerability.


The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.


A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21 3.1.13 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program.


Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series Aruba 6300 Switch Series Aruba 6400 Switch Series Aruba 8320 Switch Series Aruba 8325 Switch Series Aruba 8400 Switch Series Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below AOS-CX 10.07.xxxx: 10.07.0050 and below AOS-CX 10.08.xxxx: 10.08.1030 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.


An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installation configuration user interface (available to administrators) allows specifying arbitrary Java Virtual Machine startup options. Some of these options such as -XX:OnOutOfMemoryError allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host should an attacker gain administrative access to the application.


Microsoft Access Remote Code Execution Vulnerability


Windows NTFS Remote Code Execution Vulnerability


A vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions < V4.3.7) RUGGEDCOM ROS M2200 (All versions < V4.3.7) RUGGEDCOM ROS M969 (All versions < V4.3.7) RUGGEDCOM ROS RMC (All versions < V4.3.7) RUGGEDCOM ROS RMC20 (All versions < V4.3.7) RUGGEDCOM ROS RMC30 (All versions < V4.3.7) RUGGEDCOM ROS RMC40 (All versions < V4.3.7) RUGGEDCOM ROS RMC41 (All versions < V4.3.7) RUGGEDCOM ROS RMC8388 V4.X (All versions < V4.3.7) RUGGEDCOM ROS RMC8388 V5.X (All versions < V5.5.4) RUGGEDCOM ROS RP110 (All versions < V4.3.7) RUGGEDCOM ROS RS400 (All versions < V4.3.7) RUGGEDCOM ROS RS401 (All versions < V4.3.7) RUGGEDCOM ROS RS416 (All versions < V4.3.7) RUGGEDCOM ROS RS416v2 V4.X (All versions < V4.3.7) RUGGEDCOM ROS RS416v2 V5.X (All versions < 5.5.4) RUGGEDCOM ROS RS8000 (All versions < V4.3.7) RUGGEDCOM ROS RS8000A (All versions < V4.3.7) RUGGEDCOM ROS RS8000H (All versions < V4.3.7) RUGGEDCOM ROS RS8000T (All versions < V4.3.7) RUGGEDCOM ROS RS900 (32M) V4.X (All versions < V4.3.7) RUGGEDCOM ROS RS900 (32M) V5.X (All versions < V5.5.4) RUGGEDCOM ROS RS900G (All versions < V4.3.7) RUGGEDCOM ROS RS900G (32M) V4.X (All versions < V4.3.7) RUGGEDCOM ROS RS900G (32M) V5.X (All versions < V5.5.4) RUGGEDCOM ROS RS900GP (All versions < V4.3.7) RUGGEDCOM ROS RS900L (All versions < V4.3.7) RUGGEDCOM ROS RS900W (All versions < V4.3.7) RUGGEDCOM ROS RS910 (All versions < V4.3.7) RUGGEDCOM ROS RS910L (All versions < V4.3.7) RUGGEDCOM ROS RS910W (All versions < V4.3.7) RUGGEDCOM ROS RS920L (All versions < V4.3.7) RUGGEDCOM ROS RS920W (All versions < V4.3.7) RUGGEDCOM ROS RS930L (All versions < V4.3.7) RUGGEDCOM ROS RS930W (All versions < V4.3.7) RUGGEDCOM ROS RS940G (All versions < V4.3.7) RUGGEDCOM ROS RS969 (All versions < V4.3.7) RUGGEDCOM ROS RSG2100 (32M) V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG2100 (32M) V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG2100 V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG2100P (All versions < V4.3.7) RUGGEDCOM ROS RSG2100P (32M) V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG2100P (32M) V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG2200 (All versions < V4.3.7) RUGGEDCOM ROS RSG2288 V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG2288 V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG2300 V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG2300 V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG2300P V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG2300P V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG2488 V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG2488 V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG900 V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG900 V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG900C (All versions < V5.5.4) RUGGEDCOM ROS RSG900G V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG900G V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSG900R (All versions < V5.5.4) RUGGEDCOM ROS RSG920P V4.X (All versions < V4.3.7) RUGGEDCOM ROS RSG920P V5.X (All versions < V5.5.4) RUGGEDCOM ROS RSL910 (All versions < V5.5.4) RUGGEDCOM ROS RST2228 (All versions < V5.5.4) RUGGEDCOM ROS RST916C (All versions < V5.5.4) RUGGEDCOM ROS RST916P (All versions < V5.5.4) RUGGEDCOM ROS i800 (All versions < V4.3.7) RUGGEDCOM ROS i801 (All versions < V4.3.7) RUGGEDCOM ROS i802 (All versions < V4.3.7) RUGGEDCOM ROS i803 (All versions < V4.3.7). The DHCP client in affected devices fails to properly sanitize incoming DHCP packets. This could allow an unauthenticated remote attacker to cause memory to be overwritten potentially allowing remote code execution.


SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.


The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configuration.


Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31945 CVE-2021-31946.


emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php.


3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31942.


OLE Automation Remote Code Execution Vulnerability


Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31945 CVE-2021-31983.


3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31943.


MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in the %PROGRAMFILES%\\MyQ\\PHP\\Sessions directory. The \Select server file\ feature is only intended for administrators but actually does not require authorization. An attacker can inject arbitrary OS commands (such as commands to create new .php files) via the Task Scheduler component.


Microsoft SharePoint Remote Code Execution Vulnerability


Common Utilities Remote Code Execution Vulnerability


Power BI Remote Code Execution Vulnerability


Microsoft Intune Management Extension Remote Code Execution Vulnerability


HTTP Protocol Stack Remote Code Execution Vulnerability


In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.


In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8 2.8.0 through 2.16.0 3.0.0 through 3.7.20 3.8.0 through 3.11.8 and 4.0.1 through 4.2.2 mishandling of memory management can lead to remote code execution.


Microsoft Outlook Remote Code Execution Vulnerability


Microsoft Defender Remote Code Execution Vulnerability


Windows Media Foundation Core Remote Code Execution Vulnerability


The server in npupnp before 4.1.4 is affected by DNS rebinding in the embedded web server (including UPnP SOAP and GENA endpoints) leading to remote code execution.


Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31946 CVE-2021-31983.


An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NAC. Remote attackers are able to execute arbitrary malicious code with SYSTEM privileges on all connected nodes in NAC through this vulnerability.


.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.


Skype for Business and Lync Remote Code Execution Vulnerability


Visual Studio Code npm-script Extension Remote Code Execution Vulnerability


OpenType Font Parsing Remote Code Execution Vulnerability


Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command leading to remote code execution.


Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.


Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability


ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.


Application Virtualization Remote Code Execution Vulnerability


Windows TCP/IP Remote Code Execution Vulnerability


An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur via Arbitrary File Upload in the web service when using a myspeed/sf?filename= URI. This application is written in Java and is thus cross-platform. The Windows installation runs as SYSTEM which means that exploitation gives one Administrator privileges on the target system.


Quantum Development Kit for Visual Studio Code Remote Code Execution Vulnerability


Microsoft PowerPoint Remote Code Execution Vulnerability


An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.


A

critical

unauthenticated

remote

code

execution

vulnerability

was

found

all

recent

versions

of

Apache

Tapestry.

The

affected

versions

include

and

The

vulnerability

I

have

found

is

a

bypass

of

the

fix

for

Recap:

Before

the

fix

of

it

was

possible

to

download

arbitrary

class

files

from

the

classpath

by

providing

a

crafted

asset

file

URL.

An

attacker

was

able

to

download

the

file

`AppModule.class`

by

requesting

the

URL

which

contains

a

HMAC

secret

key.

The

fix

for

that

bug

was

a

blacklist

filter

that

checks

if

the

URL

ends

with

`.class`

`.properties`

or

`.xml`.

Bypass:

Unfortunately

the

blacklist

solution

can

simply

be

bypassed

by

appending

a

at

the

end

of

the

URL:

The

slash

is

stripped

after

the

blacklist

check

and

the

file

`AppModule.class`

is

loaded

into

the

response.

This

class

usually

contains

the

HMAC

secret

key

which

is

used

to

sign

serialized

Java

objects.

With

the

knowledge

of

that

key

an

attacker

can

sign

a

Java

gadget

chain

that

leads

to

RCE

(e.g.

from

ysoserial).

Solution

for

this

vulnerability:

For

Apache

Tapestry

to

upgrade

to

or

later.

For

Apache

Tapestry

upgrade

to

or

later.


LightCMS

contains

a

remote

code

execution

vulnerability

in

during

the

downloading

of

external

images.


Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability


Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text.


A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37 10.3 before 10.3.28 10.4 before 10.4.18 and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.


Windows Media Video Decoder Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28315.


Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that if opened by a local user in Connected Components Workbench may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.


Microsoft Internet Messaging API Remote Code Execution Vulnerability


Internet Explorer Remote Code Execution Vulnerability


An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary File Write vulnerability. An attacker is able to create new files in any location of the filesystem or he may be able to modify existing files. This vulnerability may directly lead to Remote Code Execution.


An issue was discovered in Craft CMS before 3.6.7. In some circumstances a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).


Visual Studio Remote Code Execution Vulnerability


Visual Studio Code ESLint Extension Remote Code Execution Vulnerability


KollectApps before 4.8.16c is affected by insecure Java deserialization leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter.


Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability


An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion which can be leveraged to achieve Remote Code Execution.


Microsoft Office ClickToRun Remote Code Execution Vulnerability


SAP Commerce versions - 1808 1811 1905 2005 2011 Backoffice application allows certain authorized users to create source rules which are translated to drools rule when published to certain modules within the application. An attacker with this authorization can inject malicious code in the source rules and perform remote code execution enabling them to compromise the confidentiality integrity and availability of the application.


The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath in the workspace configuration.


The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code allows remote code execution via a crafted workspace configuration with replCommand.


There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section leading to remote code execution. This occurs because the U.S. state is not validated to be two letters and the OrderBy field is not validated to be one of LASTNAME CITY or STATE.


Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary method invocation when AMF messages are deserialized on an Adobe Connect server. An attacker can leverage this to execute remote code execution on the server.


Microsoft MSHTML Remote Code Execution Vulnerability


An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution.


An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


Windows Text Shaping Remote Code Execution Vulnerability


An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution.


Sketch before 75 allows library feeds to be used to bypass file quarantine. Files are automatically downloaded and opened without the com.apple.quarantine extended attribute. This results in remote code execution as demonstrated by CommandString in a terminal profile to Terminal.app.


A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN WAN or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.


Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution.


The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers the Circle update daemon circled is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted compressed database file the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. This affects R6400v2 1.0.4.106 R6700 1.0.2.16 R6700v3 1.0.4.106 R6900 1.0.2.16 R6900P 1.3.2.134 R7000 1.0.11.123 R7000P 1.3.2.134 R7850 1.0.5.68 R7900 1.0.4.38 R8000 1.0.4.68 and RS400 1.5.0.68.


Rittal CMC PU III Web management Version affected: V3.11.00_2. Version fixed: V3.17.10 is affected by a remote code execution vulnerablity. It is possible to introduce shell code to create a reverse shell in the PU-Hostname field of the TCP/IP Configuration dialog. Web application fails to sanitize user input on Network TCP/IP configuration page. This allows the attacker to inject commands as root on the device which will be executed once the data is received.


The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by default) which allows embedded php code. As a result remote code execution is achieved. Successful exploitation requires access to the web management interface either with valid credentials or with a hijacked session by a user with the role of administrator.


Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.


Windows Media Foundation Dolby Digital Atmos Decoders Remote Code Execution Vulnerability


A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page which is activated by administrators viewing the \Error Log\ page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the \Cron Jobs\ functionality of Webuzo.


Cobbler before 3.3.0 allows log poisoning and resultant Remote Code Execution via an XMLRPC method that logs to the logfile for template injection.


An exploitable use-after-free vulnerability exists in WPS Spreadsheets ( ET ) as part of WPS Office version 11.2.0.10351. A specially-crafted XLS file can cause a use-after-free condition resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution via uploaded PHP code related to the bFilename parameter.


The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uploading of \.mkp\ files which are Extension Packages making remote code execution possible. Successful exploitation requires access to the web management interface either with valid credentials or with a hijacked session of a user with administrator role.


An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4


inc_newuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permissions of directories named (1) db (2) www (3) Special and (4) log at arbitrary locations under the web root via a modified Dirroot parameter in an AddUser action to accounts/AccountActions.asp. NOTE: this can be leveraged for remote code execution by changing the permissions of \\Forum\\db which is configured for execution of ASP scripts with administrative privileges and then uploading a script to \\Forum\\db.


Unspecified vulnerability in NetWin Webmail 3.1s-1 in SurgeMail before 3.8i2 has unknown impact and remote attack vectors possibly a format string vulnerability that allows remote code execution.


eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data


BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload


DOMPDF before 0.6.2 allows remote code execution a related issue to CVE-2014-2383.


The memory-management implementation in the Virtual Machine Monitor (aka VMM or hypervisor) in Microsoft Virtual PC 2007 Gold and SP1 Virtual Server 2005 Gold and R2 SP1 and Windows Virtual PC does not properly restrict access from the guest OS to memory locations in the VMM work area which allows context-dependent attackers to bypass certain anti-exploitation protection mechanisms on the guest OS via crafted input to a vulnerable application. NOTE: the vendor reportedly found that only systems with an otherwise vulnerable application are affected because \the memory areas accessible from the guest cannot be leveraged to achieve either remote code execution or elevation of privilege and ... no data from the host is exposed to the guest OS.\


ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.


Visual Studio Remote Code Execution Vulnerability.


Windows Fax Service Remote Code Execution Vulnerability.


The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100 SA 400 and Virtual SA.


USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product.


Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.


The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution in versions up to and including 3.3.0


Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation.


It was discovered that redis a persistent key-value database due to a packaging issue is prone to a (Debian-specific) Lua sandbox escape which could result in remote code execution.


The

Elementor

Website

Builder

plugin

for

WordPress

is

vulnerable

to

unauthorized

execution

of

several

AJAX

actions

due

to

a

missing

capability

check

in

the

file

that

make

it

possible

for

attackers

to

modify

site

data

in

addition

to

uploading

malicious

files

that

can

be

used

to

obtain

remote

code

execution

in

versions

to


Apifox through 2.1.6 is vulnerable to Cross Site Scripting (XSS) which can lead to remote code execution.


Apostrophe v3.16.1 was discovered to contain a remote code execution (RCE) vulnerability via the component uploadfs.


Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.


An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticated attacker could abuse improperly secured access to arbitrary files on the server leading to cleartext credential disclosure. Afterwards the authenticated attacker is able to upload a file that overwrites a 3CX service binary leading to Remote Code Execution as NT AUTHORITY\\SYSTEM on Windows installations. Versions prior to version 18 Hotfix 1 Build 18.0.3.461 March 2022 are prone to an additional unauthenticated file system access to C:\\Windows\\System32.


Skycaiji

was

discovered

to

contain

a

remote

code

execution

(RCE)

vulnerability

via


Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=user.


RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root thus leading to a full compromise of the underlying system and all its components. Versions after `2.31.25.20180428` and prior to `3.63.8.20220330` are affected. Users are advised to update to version `3.63.8.20220330` or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.


MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update making it possible to add settings of supported type `php` with PHP code executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module which allows administrators to add edit and delete non-default settings stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options separated by a new line character (\\n). In MyBB 1.2.0 support for setting type php was added for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds.


Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side and because not all executable content (e.g. .phtml or .php.bak) is blocked.


Win32 Stream Enumeration Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21983.


OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints leading to arbitrary file read/write and potential remote code execution. There are no known workarounds. This issue has been patched and users are recommended to upgrade.


StarWind SAN and NAS before 0.2 build 1685 allows remote code execution via a virtual disk management command.


ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability a user must trigger an update of an affected installation of KeyMouse.


Windows Direct Show - Remote Code Execution Vulnerability.


Windows SMB Remote Code Execution Vulnerability.


Win32 File Enumeration Remote Code Execution Vulnerability.


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)


Windows Upgrade Assistant Remote Code Execution Vulnerability.