CWE-94

{
  "affected": [],
  "aliases": [
    "CVE-2024-25077"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-10T20:15:03Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored in an unsigned header, allowing its value to be modified without invalidating the signature used for secureboot image verification. Because the encryption engine for on-the-fly decryption uses AES in CTR mode without authentication, an attacker-modified Nonce can result in execution of arbitrary code.",
  "id": "GHSA-hg8f-ghpp-qpmq",
  "modified": "2024-08-08T15:31:27Z",
  "published": "2024-07-10T21:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25077"
    },
    {
      "type": "WEB",
      "url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2024-0001.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-41783"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-03T02:15:43Z",
    "severity": "MODERATE"
  },
  "details": "There is a command injection vulnerability of ZTE\u0027s ZXCLOUD iRAI. Due to the \u00a0program \u00a0failed to adequately validate the user\u0027s input, an attacker could exploit this vulnerability \u00a0to escalate local privileges.\n\n\n",
  "id": "GHSA-hg8w-h7xj-9m5w",
  "modified": "2024-01-09T21:30:34Z",
  "published": "2024-01-03T03:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41783"
    },
    {
      "type": "WEB",
      "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034404"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2009-1452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-04-28T16:30:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execute arbitrary PHP code via a URL in the (1) _page_css and (2) _page_javascript parameters. NOTE: the _page_content vector is already is covered by CVE-2009-1450.",
  "id": "GHSA-hg8w-jwvh-65j2",
  "modified": "2022-05-02T03:25:19Z",
  "published": "2022-05-02T03:25:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1452"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49928"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/8460"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/34569"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "safer-eval"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10760"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-10-16T15:10:50Z",
    "nvd_published_at": "2019-10-15T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Versions of `safer-eval` before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.\n\n\n## Recommendation\n\nUpgrade to version 1.3.2.",
  "id": "GHSA-hgch-jjmr-gp7w",
  "modified": "2021-07-27T22:20:29Z",
  "published": "2019-10-17T18:27:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10760"
    },
    {
      "type": "WEB",
      "url": "https://github.com/commenthol/safer-eval/commit/1c29f6a6e304fb650c05056e217e457a0d2cc3c5"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-SAFEREVAL-473029"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/787"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sandbox Breakout / Arbitrary Code Execution in safer-eval"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-15195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-09T18:16:51Z",
    "severity": "LOW"
  },
  "details": "A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component.",
  "id": "GHSA-hghm-9vcp-cxvv",
  "modified": "2026-07-09T18:31:53Z",
  "published": "2026-07-09T18:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15195"
    },
    {
      "type": "WEB",
      "url": "https://github.com/APIDevTools/json-schema-ref-parser/issues/421"
    },
    {
      "type": "WEB",
      "url": "https://github.com/APIDevTools/json-schema-ref-parser/commit/a786bc6afc3674f650496472ee93d5cf74c4bd84"
    },
    {
      "type": "WEB",
      "url": "https://github.com/APIDevTools/json-schema-ref-parser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-15195"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/851809"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377123"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/377123/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2007-4955"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-09-18T20:17:00Z",
    "severity": "MODERATE"
  },
  "details": "PHP remote file inclusion vulnerability in admin.joomlaflashfun.php in the Flash Fun! (com_joomlaflashfun) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.",
  "id": "GHSA-hgjp-wv7w-gjj9",
  "modified": "2022-05-01T18:28:38Z",
  "published": "2022-05-01T18:28:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4955"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36638"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/4415"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/26799"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/25680"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-59302"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-27T12:15:47Z",
    "severity": "MODERATE"
  },
  "details": "In  Apache CloudStack improper control of generation of code (\u0027Code Injection\u0027) vulnerability is found in the following APIs which are accessible only to admins.\n\n  *  quotaTariffCreate\n  *  quotaTariffUpdate\n  *  createSecondaryStorageSelector\n  *  updateSecondaryStorageSelector\n  *  updateHost\n  *  updateStorage\n\n\nThis issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0.\u00a0Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.\n\nThe fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.",
  "id": "GHSA-hgmv-qpw9-xrfq",
  "modified": "2025-11-28T15:30:30Z",
  "published": "2025-11-27T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59302"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2025/11/27/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-1594"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-04-11T10:39:00Z",
    "severity": "LOW"
  },
  "details": "epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.",
  "id": "GHSA-hgpm-26x5-62f5",
  "modified": "2022-05-14T04:02:46Z",
  "published": "2022-05-14T04:02:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1594"
    },
    {
      "type": "WEB",
      "url": "https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6809"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74362"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15244"
    },
    {
      "type": "WEB",
      "url": "http://anonsvn.wireshark.org/viewvc?view=revision\u0026revision=40967"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078770.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/48548"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2012/03/28/13"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/52738"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1026874"
    },
    {
      "type": "WEB",
      "url": "http://www.wireshark.org/security/wnpa-sec-2012-05.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-oldcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0"
            },
            {
              "fixed": "14.10.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-oldcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.0"
            },
            {
              "fixed": "15.2-rc-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-46242"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-07T22:35:24Z",
    "nvd_published_at": "2023-11-07T19:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nIn XWiki Platform, it\u0027s possible to execute content with the right of any user if you can make this user follow a crafted URL. This is possible because edit action sets and thereby executes the page content without checking for a cross-site request forgert (CSRF) token.\n\nTo reproduce:\nGet a user with programming rights to visit the URL `\u003cxwiki-host\u003e/xwiki/bin/edit/Main/?content=%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+Groovy%21%22%29%7B%7B%2Fgroovy%7D%7D\u0026xpage=view`, where `\u003cxwiki-host\u003e` is the URL of your XWiki installation. This can be done by embedding an image with this URL.\n\nThe text \"Hello from Groovy!\" is displayed in the page content, showing that the Groovy macro has been executed. \n\n### Patches\n\nThis has been patched in XWiki 14.10.7 and 15.2-RC-1.\n\n### Workarounds\nThere are no known workarounds for it.\n\n### References\n\n* https://jira.xwiki.org/browse/XWIKI-20386\n* https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)",
  "id": "GHSA-hgpw-6p4h-j6h5",
  "modified": "2023-11-07T22:53:08Z",
  "published": "2023-11-07T22:35:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-hgpw-6p4h-j6h5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46242"
    },
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/commit/cf8eb861998ea423c3645d2e5e974420b0e882be"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-20386"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "zetacomponents/mail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-15806"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-23T23:01:34Z",
    "nvd_published_at": "2017-11-15T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing \"-X/path/to/wwwroot/file.php.\"",
  "id": "GHSA-hgr8-g756-vmg9",
  "modified": "2024-04-23T23:01:34Z",
  "published": "2022-05-17T00:18:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15806"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zetacomponents/Mail/issues/58"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zetacomponents/mail/CVE-2017-15806.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zetacomponents/Mail"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zetacomponents/Mail/releases/tag/1.8.2"
    },
    {
      "type": "WEB",
      "url": "https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/43155"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/101866"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zeta Components Mail Arbitrary code execution via a crafted email address"
}