Total
3677 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-0598 | 1 Ge | 1 Ifix | 2024-11-21 | N/A | 7.8 HIGH |
| GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software. | |||||
| CVE-2023-0462 | 2 Redhat, Theforeman | 2 Satellite, Foreman | 2024-11-21 | N/A | 8.0 HIGH |
| An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload. | |||||
| CVE-2023-0297 | 1 Pyload | 1 Pyload | 2024-11-21 | N/A | 9.8 CRITICAL |
| Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. | |||||
| CVE-2023-0090 | 1 Proofpoint | 1 Enterprise Protection | 2024-11-21 | N/A | 9.8 CRITICAL |
| The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-standard configuration. This affects all versions 8.20.0 and below. | |||||
| CVE-2023-0089 | 1 Proofpoint | 1 Enterprise Protection | 2024-11-21 | N/A | 8.8 HIGH |
| The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects all versions 8.20.0 and below. | |||||
| CVE-2023-0048 | 1 Daloradius | 1 Daloradius | 2024-11-21 | N/A | 8.8 HIGH |
| Code Injection in GitHub repository lirantal/daloradius prior to master-branch. | |||||
| CVE-2023-0022 | 1 Sap | 1 Businessobjects Business Intelligence Platform | 2024-11-21 | N/A | 9.9 CRITICAL |
| SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application causing a high impact on the confidentiality, integrity, and availability of the application. | |||||
| CVE-2022-4300 | 1 Xjd2020 | 1 Fastcms | 2024-11-21 | N/A | 6.3 MEDIUM |
| A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability. | |||||
| CVE-2022-48175 | 1 Rukovoditel | 1 Rukovoditel | 2024-11-21 | N/A | 9.8 CRITICAL |
| Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request. | |||||
| CVE-2022-48093 | 1 Seacms | 1 Seacms | 2024-11-21 | N/A | 7.2 HIGH |
| Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php. | |||||
| CVE-2022-47896 | 1 Jetbrains | 1 Intellij Idea | 2024-11-21 | N/A | 5.0 MEDIUM |
| In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. | |||||
| CVE-2022-46836 | 1 Checkmk | 1 Checkmk | 2024-11-21 | N/A | 9.1 CRITICAL |
| PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component. | |||||
| CVE-2022-46742 | 1 Paddlepaddle | 1 Paddlepaddle | 2024-11-21 | N/A | 10.0 CRITICAL |
| Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. | |||||
| CVE-2022-46648 | 2 Debian, Ruby-git Project | 2 Debian Linux, Ruby-git | 2024-11-21 | N/A | 8.0 HIGH |
| ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-47318. | |||||
| CVE-2022-46333 | 1 Proofpoint | 1 Enterprise Protection | 2024-11-21 | N/A | 7.2 HIGH |
| The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands beyond their allowed scope. This affects all versions 8.19.0 and below. | |||||
| CVE-2022-46166 | 1 Codecentric | 1 Spring Boot Admin | 2024-11-21 | N/A | 8.0 HIGH |
| Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are affected. Users are advised to upgrade to the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 to resolve this issue. Users unable to upgrade may disable any notifier or disable write access (POST request) on `/env` actuator endpoint. | |||||
| CVE-2022-46157 | 1 Akeneo | 1 Product Information Management | 2024-11-21 | N/A | 8.8 HIGH |
| Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image. Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability. Community Edition users must change their Apache HTTP server configuration accordingly to be protected. The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. Users are advised to upgrade. Users unable to upgrade may Replace any reference to `<FilesMatch \.php$>` in their apache httpd configurations with: `<Location "/index.php">`. | |||||
| CVE-2022-46101 | 1 Ayacms Project | 1 Ayacms | 2024-11-21 | N/A | 8.8 HIGH |
| AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting malicious code. | |||||
| CVE-2022-46070 | 2024-11-21 | N/A | 7.5 HIGH | ||
| GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path. | |||||
| CVE-2022-45908 | 1 Paddlepaddle | 1 Paddlepaddle | 2024-11-21 | N/A | 9.8 CRITICAL |
| In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution. | |||||