CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2024-28893"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-01T16:15:07Z",
    "severity": "HIGH"
  },
  "details": "Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extraction. HP has released updated software packages (SoftPaqs).",
  "id": "GHSA-989m-gr7j-mv6g",
  "modified": "2024-07-03T18:38:11Z",
  "published": "2024-05-01T18:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28893"
    },
    {
      "type": "WEB",
      "url": "https://support.hp.com/us-en/document/ish_10502451-10502508-16/hpsbhf03931"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-5199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-11-21T17:30:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in include.php in PHPOutsourcing IdeaBox (aka IdeBox) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the gorumDir parameter.",
  "id": "GHSA-989m-j6wq-cwp7",
  "modified": "2022-05-17T02:18:00Z",
  "published": "2022-05-17T02:18:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5199"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43374"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=121441106806293\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/4642"
    },
    {
      "type": "WEB",
      "url": "http://securityvulns.ru/Ndocument286.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/493666"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/29944"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-39424"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-18T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows unauthenticated attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-989p-fg49-9347",
  "modified": "2022-10-19T12:00:23Z",
  "published": "2022-10-19T12:00:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39424"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202212-03"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2022.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-5089"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-09-26T20:17:00Z",
    "severity": "HIGH"
  },
  "details": "PHP remote file inclusion vulnerability in php-inc/log.inc.php in sk.log 0.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SKIN_URL parameter.",
  "id": "GHSA-98cm-68r8-4m8h",
  "modified": "2022-05-01T18:29:51Z",
  "published": "2022-05-01T18:29:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5089"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36765"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/4454"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/38574"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/3168"
    },
    {
      "type": "WEB",
      "url": "http://www.attrition.org/pipermail/vim/2007-September/001803.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/480484/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/25791"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2007/3256"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8:kubernetes-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta-1"
            },
            {
              "fixed": "5.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8:kubernetes-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8:kubernetes-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8:kubernetes-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "5.7.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8:kubernetes-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.8.0"
            },
            {
              "fixed": "5.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8:kubernetes-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.9.0"
            },
            {
              "fixed": "5.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.fabric8:kubernetes-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-4178"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-15T05:17:35Z",
    "nvd_published_at": "2022-08-24T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "fabric8 Kubernetes client had an arbitrary code execution flaw in versions 5.0.0-beta-1 and higher. Attackers could potentially insert malicious YAMLs due to misconfigured YAML parsing.",
  "id": "GHSA-98g7-rxmf-rrxm",
  "modified": "2022-09-08T14:19:24Z",
  "published": "2022-07-15T05:17:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4178"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fabric8io/kubernetes-client/issues/3653"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fabric8io/kubernetes-client/commit/445103004d1ed3153d5abb272473451d05891e39"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/cve-2021-4178"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034388"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fabric8io/kubernetes-client"
    },
    {
      "type": "WEB",
      "url": "https://www.mend.io/vulnerability-database/CVE-2021-4178"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fabric8 kubernetes-client vulnerable "
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "diffusers"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.38.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T05:31:17Z",
    "nvd_published_at": "2026-05-14T17:16:22Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA `trust_remote_code` bypass in `DiffusionPipeline.from_pretrained` allows arbitrary remote code execution despite the user passing `trust_remote_code=False` (or omitting it, which is the default). The vulnerability has three variants, all sharing the same root cause \u2014 the `trust_remote_code` gate was implemented inside `DiffusionPipeline.download()` rather than at the actual dynamic-module load site, so any code path that bypassed or short-circuited `download()` also bypassed the security check:\n\n1. **Cross-repo `custom_pipeline`.** `DiffusionPipeline.from_pretrained(\u0027repoA\u0027, custom_pipeline=\u0027attacker/repoB\u0027, trust_remote_code=False)` \u2014 the gate evaluated against `repoA`\u0027s file list rather than `repoB`\u0027s, so `repoB`\u0027s `pipeline.py` was loaded and executed.\n2. **Local snapshot + Hub `custom_pipeline`.** `DiffusionPipeline.from_pretrained(\u0027/local/snapshot\u0027, custom_pipeline=\u0027attacker/repoB\u0027, trust_remote_code=False)` \u2014 the local-path branch never invoked `download()`, so the gate was never reached and remote code from `repoB` executed.\n3. **Local snapshot with custom components.** `DiffusionPipeline.from_pretrained(\u0027/local/snapshot\u0027, trust_remote_code=False)` where the snapshot contains custom component files (e.g. `unet/my_unet_model.py`) referenced from `model_index.json` \u2014 same root cause; the local path skipped `download()` and custom component code executed.\n\nSilent remote code execution on the victim\u0027s machine. Anyone calling `DiffusionPipeline.from_pretrained` with custom pipelines is impacted.\n\n### Patches\n\nYes. Fixed in **diffusers 0.38.0** via [PR #13448](https://github.com/huggingface/diffusers/pull/13448). All users on versions `\u003c 0.38.0` should upgrade:\n\n```bash\npip install --upgrade \"diffusers\u003e=0.38.0\"\n```\n\nThe fix moves the `trust_remote_code` gate out of `DiffusionPipeline.download()` and into `get_cached_module_file` in `src/diffusers/utils/dynamic_modules_utils.py`, which is the actual chokepoint for every dynamic module load (local, Hub, or community mirror). All three variants now raise `ValueError` instead of executing untrusted code.\n\n### Workarounds\n\nIf upgrading immediately is not possible:\n\n- Only call `from_pretrained` with `pretrained_model_name_or_path`, `custom_pipeline`, and local snapshot directories from fully trusted sources that have been audited.\n- Do not pass `custom_pipeline=` pointing at a Hub repository different from the primary `pretrained_model_name_or_path` before reading its `pipeline.py`.\n- Before calling `from_pretrained` on a local snapshot, inspect the snapshot for unexpected `*.py` files, especially under component subdirectories (`unet/`, `scheduler/`, etc.) and at the snapshot root.\n\nThese are mitigations, not fixes \u2014 the only complete remediation is upgrading to 0.38.0.\n\n### Resources\n\n- **Fix:** https://github.com/huggingface/diffusers/pull/13448\n- **Original issue:** https://github.com/huggingface/diffusers/issues/13446\n- **Release notes:** https://github.com/huggingface/diffusers/releases/tag/v0.38.0\n- **CWE-94:** https://cwe.mitre.org/data/definitions/94.html",
  "id": "GHSA-98h9-4798-4q5v",
  "modified": "2026-06-05T17:53:10Z",
  "published": "2026-05-07T05:31:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/diffusers/security/advisories/GHSA-98h9-4798-4q5v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44513"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/diffusers/issues/13446"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/diffusers/pull/13448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/diffusers/commit/a37f6f8394ac2a7ee8360c3abea811efe54512b1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/huggingface/diffusers"
    },
    {
      "type": "WEB",
      "url": "https://github.com/huggingface/diffusers/releases/tag/v0.38.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/diffusers/PYSEC-2026-40.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components"
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-2390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-05-21T13:24:00Z",
    "severity": "MODERATE"
  },
  "details": "Hpufunction.dll 4.0.0.1 in HP Software Update exposes the unsafe (1) ExecuteAsync and (2) Execute methods, which allows remote attackers to execute arbitrary code via an absolute pathname in the first argument.",
  "id": "GHSA-98hp-ghmq-p35c",
  "modified": "2022-05-01T23:49:36Z",
  "published": "2022-05-01T23:49:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2390"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42249"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/5511"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13420"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-02T04:15:46Z",
    "severity": "MODERATE"
  },
  "details": "Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like \u0027gsf_reset_section_options\u0027, \u0027gsf_reset_section_options\u0027, \u0027gsf_create_preset_options\u0027 and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.",
  "id": "GHSA-98r7-98px-p4mx",
  "modified": "2025-05-02T06:31:24Z",
  "published": "2025-05-02T06:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13420"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d484422-4adf-4370-b228-61496d5ad78a?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-14729"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-15T23:15:53Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.",
  "id": "GHSA-98vq-2fp5-cc8q",
  "modified": "2025-12-16T00:30:29Z",
  "published": "2025-12-16T00:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14729"
    },
    {
      "type": "WEB",
      "url": "https://note-hxlab.wetolink.com/share/R3y6uiOuuYbA"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.336486"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.336486"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.707104"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-9147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-18T13:17:06Z",
    "severity": "HIGH"
  },
  "details": "uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (for example, streamer element names) are interpolated into the generated Python source without safe quoting via repr() or the !r format specifier. An attacker who can supply a crafted ROOT file can place Python expression-breaking content into a streamer metadata field. When uproot generates and invokes the corresponding reader method, the injected Python expression is evaluated in the context of the process opening the file, resulting in arbitrary Python code execution in applications that open or process attacker-controlled ROOT files with affected uproot code paths.",
  "id": "GHSA-98vv-9pqj-g87v",
  "modified": "2026-07-18T15:31:48Z",
  "published": "2026-07-18T15:31:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/scikit-hep/uproot5/security/advisories/GHSA-6946-mq52-g438"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9147"
    },
    {
      "type": "WEB",
      "url": "https://github.com/scikit-hep/uproot5/commit/c045c2824295d907d2e705f31110c742928e50e7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/scikit-hep/uproot5"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/uproot-and-before-code-injection-via-tstreamerinfo-metadata"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}