Base de CVEs

CVE-2023-41179 Alta · 7.2 KEV Alta · 55 CWE-94 19/09/2023

Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

CVE-2023-3519 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware CWE-94 19/07/2023

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Unauthenticated remote code execution

CVE-2023-37466 Crítica · 10.0 CWE-94 13/07/2023

vm2 Sandbox Escape vulnerability

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.

CVE-2023-38198 Crítica · 9.8 CWE-94 13/07/2023

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the...

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023.

CVE-2023-33246 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 24/05/2023

Vulnerabilidade de Execução de Comandos no Apache RocketMQ

Para o RocketMQ nas versões 5.1.0 e anteriores, sob certas condições, existe risco de execução remota de comandos. Vários componentes do RocketMQ, incluindo NameServer, Broker e Controller, estão expostos na extranet e não possuem verificação de permissão; um atacante pode explorar esta vulnerabilidade usando a função de atualização de configuração para executar comandos como os usuários do sistema sob os quais o RocketMQ está em execução. Adicionalmente, um atacante pode obter o mesmo efeito forjando o conteúdo do protocolo RocketMQ. Para prevenir esses ataques, recomenda-se que os usuários atualizem para a versão 5.1.1 ou superior, caso utilizem o RocketMQ da linha 5, ou para a versão 4.9.6 ou superior, caso utilizem o RocketMQ da linha 4.

CVE-2023-24955 Alta · 7.2 KEV Urgente · 84 Exploit público Ransomware CWE-94 09/05/2023

Microsoft SharePoint Server Code Injection Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2023-2017 Alta · 8.8 CWE-94 17/04/2023

Improper Control of Generation of Code in Twig Rendered Views in Shopware

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.

CVE-2023-29492 Crítica · 9.8 KEV Alta · 61 CWE-94 11/04/2023

Novi Survey Insecure Deserialization Vulnerability

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

CVE-2022-43769 Alta · 7.2 KEV Urgente · 76 Exploit público CWE-94 03/04/2023

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

CVE-2023-26119 Crítica · 9.8 CWE-94 03/04/2023

Code Injection em Htmlunit

Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.

CVE-2023-25717 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-94 13/02/2023

Multiple Ruckus Wireless Products CSRF and RCE Vulnerability

Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.

CVE-2022-25860 Crítica · 9.8 CWE-94 26/01/2023

Remote code execution in simple-git

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221).

CVE-2023-22731 Alta · 8.8 CWE-94 17/01/2023

Improper Control of Generation of Code in Twig rendered views in shopware

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished. Users are advised to upgrade. Users of major versions 6.1, 6.2, and 6.3 may also receive this fix via a plugin.

CVE-2022-41223 Média · 6.8 KEV Alta · 62 Ransomware CWE-94 21/11/2022

Mitel MiVoice Connect Code Injection Vulnerability

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CVE-2022-3236 Crítica · 9.8 KEV Alta · 64 Exploit público CWE-94 23/09/2022

Sophos Firewall Code Injection Vulnerability

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

CVE-2022-24816 Crítica · 10.0 KEV Urgente · 73 Exploit público CWE-94 13/04/2022

OSGeo GeoServer JAI-EXT Code Injection Vulnerability

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

CVE-2022-22954 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 11/04/2022

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

CVE-2022-22965 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 01/04/2022

Execução remota de código por data binding no Spring Framework (CVE-2022-22965)

Uma aplicação Spring MVC ou Spring WebFlux executando em JDK 9+ pode estar vulnerável a execução remota de código (RCE) por meio de data binding. A exploração específica exige que a aplicação seja executada no Tomcat como implantação WAR. Se a aplicação for implantada como um jar executável do Spring Boot, que é o padrão, ela não é vulnerável a essa exploração específica. Contudo, a natureza da vulnerabilidade é mais geral, e pode haver outras formas de explorá-la.

CVE-2021-44529 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 08/12/2021

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

CVE-2021-22205 Crítica · 10.0 KEV Urgente · 93 Exploit público Ransomware CWE-94 23/04/2021

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

CVE-2021-22204 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-94 23/04/2021

ExifTool Remote Code Execution Vulnerability

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CVE-2021-24112 Alta · 8.1 CWE-94 25/02/2021

.NET Core Remote Code Execution Vulnerability

CVE-2021-23337 Alta · 7.2 Exploit público CWE-94 15/02/2021

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVE-2020-8243 Alta · 7.2 KEV Alta · 56 CWE-94 30/09/2020

Ivanti Pulse Connect Secure Code Execution Vulnerability

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.

CVE-2019-20920 Alta · 8.1 CWE-94 30/09/2020

Code Injection em Handlebarsjs Handlebars

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).