Vulnerabilities (CVE)

Filtered by CWE-502
Total 1486 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-38181 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.8 HIGH
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-38177 1 Microsoft 2 Sharepoint Enterprise Server, Sharepoint Server 2024-11-21 N/A 6.1 MEDIUM
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2023-38155 1 Microsoft 1 Azure Devops Server 2024-11-21 N/A 7.0 HIGH
Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-37941 1 Apache 1 Superset 2024-11-21 N/A 6.6 MEDIUM
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
CVE-2023-37895 1 Apache 1 Jackrabbit 2024-11-21 N/A 9.8 CRITICAL
Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2.20.10 (stable branch) and 2.21.17 (unstable branch) use the component "commons-beanutils", which contains a class that can be used for remote code execution over RMI. Users are advised to immediately update to versions 2.20.11 or 2.21.18. Note that earlier stable branches (1.0.x .. 2.18.x) have been EOLd already and do not receive updates anymore. In general, RMI support can expose vulnerabilities by the mere presence of an exploitable class on the classpath. Even if Jackrabbit itself does not contain any code known to be exploitable anymore, adding other components to your server can expose the same type of problem. We therefore recommend to disable RMI access altogether (see further below), and will discuss deprecating RMI support in future Jackrabbit releases. How to check whether RMI support is enabledRMI support can be over an RMI-specific TCP port, and over an HTTP binding. Both are by default enabled in Jackrabbit webapp/standalone. The native RMI protocol by default uses port 1099. To check whether it is enabled, tools like "netstat" can be used to check. RMI-over-HTTP in Jackrabbit by default uses the path "/rmi". So when running standalone on port 8080, check whether an HTTP GET request on localhost:8080/rmi returns 404 (not enabled) or 200 (enabled). Note that the HTTP path may be different when the webapp is deployed in a container as non-root context, in which case the prefix is under the user's control. Turning off RMIFind web.xml (either in JAR/WAR file or in unpacked web application folder), and remove the declaration and the mapping definition for the RemoteBindingServlet:         <servlet>             <servlet-name>RMI</servlet-name>             <servlet-class>org.apache.jackrabbit.servlet.remote.RemoteBindingServlet</servlet-class>         </servlet>         <servlet-mapping>             <servlet-name>RMI</servlet-name>             <url-pattern>/rmi</url-pattern>         </servlet-mapping> Find the bootstrap.properties file (in $REPOSITORY_HOME), and set         rmi.enabled=false     and also remove         rmi.host         rmi.port         rmi.url-pattern  If there is no file named bootstrap.properties in $REPOSITORY_HOME, it is located somewhere in the classpath. In this case, place a copy in $REPOSITORY_HOME and modify it as explained.  
CVE-2023-37390 1 Themesflat 1 Themesflat Addons For Elementor 2024-11-21 N/A 8.3 HIGH
Deserialization of Untrusted Data vulnerability in Themesflat Themesflat Addons For Elementor.This issue affects Themesflat Addons For Elementor: from n/a through 2.0.0.
CVE-2023-36825 1 Orchid 1 Platform 2024-11-21 N/A 9.6 CRITICAL
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards. A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.
CVE-2023-36777 1 Microsoft 1 Exchange Server 2024-11-21 N/A 5.7 MEDIUM
Microsoft Exchange Server Information Disclosure Vulnerability
CVE-2023-36757 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36756 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36745 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36744 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36736 1 Microsoft 1 Identity Linux Broker 2024-11-21 N/A 4.4 MEDIUM
Microsoft Identity Linux Broker Remote Code Execution Vulnerability
CVE-2023-36480 1 Aerospike 1 Aerospike Java Client 2024-11-21 N/A 9.8 CRITICAL
The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects that the client deserializes when it encounters them without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running on. Versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 contain a patch for this issue.
CVE-2023-36439 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-36381 1 Gesundheit-bewegt 1 Zippy 2024-11-21 N/A 6.6 MEDIUM
Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5.
CVE-2023-36050 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36039 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-36035 1 Microsoft 1 Exchange Server 2024-11-21 N/A 8.0 HIGH
Microsoft Exchange Server Spoofing Vulnerability
CVE-2023-35839 1 Solon 1 Solon 2024-11-21 N/A 9.8 CRITICAL
A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.