CVE Database

CVE-2023-22731 High · 8.8 CWE-94 Jan 17, 2023

Improper Control of Generation of Code in Twig rendered views in shopware

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows a template to call any global PHP function and thus execute arbitrary code. The attacker must have access to a Twig environment in order to exploit this vulnerability. This problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished. Users are advised to upgrade. Users of major versions 6.1, 6.2, and 6.3 may also receive this fix via a plugin.

CVE-2022-41223 Medium · 6.8 KEV High · 62 Ransomware CWE-94 Nov 21, 2022

Mitel MiVoice Connect Code Injection Vulnerability

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CVE-2022-3236 Critical · 9.8 KEV High · 64 Public exploit CWE-94 Sep 23, 2022

Sophos Firewall Code Injection Vulnerability

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

CVE-2022-24816 Critical · 10.0 KEV Urgent · 73 Public exploit CWE-94 Apr 13, 2022

OSGeo GeoServer JAI-EXT Code Injection Vulnerability

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

CVE-2022-22954 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Apr 11, 2022

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

CVE-2022-22965 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-94 Apr 1, 2022

Spring Framework JDK 9+ Remote Code Execution Vulnerability

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CVE-2021-44529 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Dec 8, 2021

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

CVE-2021-22205 Critical · 10.0 KEV Urgent · 93 Public exploit Ransomware CWE-94 Apr 23, 2021

GitLab Community and Enterprise Editions Remote Code Execution Vulnerability

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

CVE-2021-22204 High · 7.8 KEV Urgent · 76 Public exploit CWE-94 Apr 23, 2021

ExifTool Remote Code Execution Vulnerability

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CVE-2021-24112 High · 8.1 CWE-94 Feb 25, 2021

.NET Core Remote Code Execution Vulnerability

CVE-2021-23337 High · 7.2 Public exploit CWE-94 Feb 15, 2021

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVE-2020-8243 High · 7.2 KEV High · 56 CWE-94 Sep 30, 2020

Ivanti Pulse Connect Secure Code Execution Vulnerability

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.

CVE-2019-20920 High · 8.1 CWE-94 Sep 30, 2020

Code Injection in Handlebarsjs Handlebars

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

CVE-2020-8218 High · 7.2 KEV High · 62 Public exploit CWE-94 Jul 30, 2020

Pulse Connect Secure Code Injection Vulnerability

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

CVE-2020-8644 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-94 Feb 5, 2020

PlaySMS Server-Side Template Injection Vulnerability

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

CVE-2019-10758 Critical · 9.9 KEV Urgent · 70 Public exploit CWE-94 Dec 24, 2019

MongoDB mongo-express Remote Code Execution Vulnerability

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.

CVE-2019-4716 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-94 Dec 18, 2019

IBM Planning Analytics Remote Code Execution Vulnerability

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.

CVE-2019-16759 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-94 Sep 24, 2019

vBulletin PHP Module Remote Code Execution Vulnerability

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.

CVE-2019-0193 High · 7.2 KEV High · 66 Public exploit CWE-94 Aug 1, 2019

Apache Solr DataImportHandler Code Injection Vulnerability

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.

CVE-2019-7609 Critical · 10.0 KEV Urgent · 83 Public exploit CWE-94 Mar 25, 2019

Kibana Arbitrary Code Execution

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.

CVE-2019-9082 High · 8.8 KEV Urgent · 76 Public exploit CWE-94 Feb 24, 2019

ThinkPHP Remote Code Execution Vulnerability

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

CVE-2018-14667 Critical · 9.8 KEV High · 69 Public exploit CWE-94 Nov 6, 2018

Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

CVE-2018-7602 Critical · 9.8 KEV Urgent · 88 Public exploit Ransomware CWE-94 Jul 19, 2018

Drupal Core Remote Code Execution Vulnerability

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.

CVE-2018-1273 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-94 Apr 11, 2018

VMware Tanzu Spring Data Commons Property Binder Vulnerability

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.

CVE-2018-1270 Critical · 9.8 CWE-94 Apr 6, 2018

Code Injection in Vmware Spring Framework

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.