CWE-95 Archives - CVE Vulnerability

CVE-2008-5305

Sun, 26 Feb 2023 09:10:57 +0000

Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable.

The post CVE-2008-5305 appeared first on CVE Vulnerability.

CVE-2008-5071

Sun, 26 Feb 2023 09:10:51 +0000

Multiple eval injection vulnerabilities in itpm_estimate.php in Yoxel 1.23beta and earlier allow remote authenticated users to execute arbitrary PHP code via the proj_id parameter.

The post CVE-2008-5071 appeared first on CVE Vulnerability.

CVE-2007-2713

Sun, 26 Feb 2023 09:06:25 +0000

ifdate 2.x sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request for the admin/ URI.

The post CVE-2007-2713 appeared first on CVE Vulnerability.

CVE-2007-1253

Sun, 26 Feb 2023 09:05:48 +0000

Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.

The post CVE-2007-1253 appeared first on CVE Vulnerability.

CVE-2021-33678

Thu, 23 Feb 2023 14:10:03 +0000

A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions – 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable.

The post CVE-2021-33678 appeared first on CVE Vulnerability.

CVE-2021-22204

Thu, 23 Feb 2023 14:07:13 +0000

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

The post CVE-2021-22204 appeared first on CVE Vulnerability.

CVE-2021-22205

Thu, 23 Feb 2023 14:07:13 +0000

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

The post CVE-2021-22205 appeared first on CVE Vulnerability.

CVE-2022-41928

godfreyd94 — Thu, 23 Feb 2023 05:20:53 +0000

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) in AttachmentSelector.xml. The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties. This has been patched in versions 13.10.7, 14.4.2, and 14.5. The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below: – 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 – 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23 – 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23

The post CVE-2022-41928 appeared first on CVE Vulnerability.

CVE-2022-41931

godfreyd94 — Thu, 23 Feb 2023 05:20:53 +0000

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’). Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro. The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2. Workarounds: The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.

The post CVE-2022-41931 appeared first on CVE Vulnerability.

CVE-2022-2054

Thu, 23 Feb 2023 05:02:21 +0000

Command Injection in GitHub repository nuitka/nuitka prior to 0.9.

The post CVE-2022-2054 appeared first on CVE Vulnerability.