CWE-749.

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

• CWE-749

>=3.12.2, <3.15.3 · fixed in 3.15.3

ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape

• Memory corruption
• CWE-749

<1.0.6 · fixed in 1.0.6

ASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape

• Race condition
• CWE-749

<1.0.6 · fixed in 1.0.6

TYPO3 DB Check Module vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)
• CWE-749

>=11.0.0, <11.5.42 · fixed in 11.5.42

TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)
• CWE-749

>=11.0.0, <11.5.42 · fixed in 11.5.42

TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)
• CWE-749

>=10.0.0, <10.4.48 || >=11.0.0, <11.5.42 || >=12.0.0, <12.4.25 || >=13.0.0, <13.4.3 · fixed in 10.4.48, 11.5.42, 12.4.25, 13.4.3

TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)
• CWE-749

>=10.0.0, <10.4.48 || >=11.0.0, <11.5.42 || >=12.0.0, <12.4.25 || >=13.0.0, <13.4.3 · fixed in 10.4.48, 11.5.42, 12.4.25, 13.4.3

TYPO3 Extension Manager Module vulnerable to Cross-Site Request Forgery

• Cross-site request forgery (CSRF)
• CWE-749

>=10.0.0, <10.4.48 || >=11.0.0, <11.5.42 || >=12.0.0, <12.4.25 || >=13.0.0, <13.4.3 · fixed in 10.4.48, 11.5.42, 12.4.25, 13.4.3

TYPO3 Cross-Site Request Forgery in Dashboard Module

• Cross-site request forgery (CSRF)
• CWE-749

>=10.0.0, <10.4.48 || >=11.0.0, <11.5.42 || >=12.0.0, <12.4.25 || >=13.0.0, <13.4.3 · fixed in 10.4.48, 11.5.42, 12.4.25, 13.4.3

TYPO3 Cross-Site Request Forgery in Backend User Module

• Cross-site request forgery (CSRF)
• CWE-749

>=10.0.0, <10.4.48 || >=11.0.0, <11.5.42 || >=12.0.0, <12.4.25 || >=13.0.0, <13.4.3 · fixed in 10.4.48, 11.5.42, 12.4.25, 13.4.3

TYPO3 Cross-Site Request Forgery in Log Module

• Cross-site request forgery (CSRF)
• CWE-749

>=10.0.0, <10.4.48 || >=11.0.0, <11.5.42 || >=12.0.0, <12.4.25 || >=13.0.0, <13.4.3 · fixed in 10.4.48, 11.5.42, 12.4.25, 13.4.3

Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

• Drupal Swift Mailer (abandoned)
• CWE-749

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability

• PaperCut NG
• CWE-749

Orchid Platform has Method Exposure Vulnerability in Modals

• CWE-749

>=8.0, <14.43.0 · fixed in 14.43.0

Sharp and Toshiba Tec MFPs provide configuration related APIs.

• Sharp Corporation Sharp Digital Full-color MFPs and Monochrome MFPs
• Toshiba Tec Corporation e-STUDIO 908
• CWE-749

MXsecurity License Generation Function Disclosure

• Moxa MXsecurity Series
• CWE-749

Local privilege escalation vulnerability in AVG Internet Security

• AVG Internet Security
• Broken access control
• CWE-427

Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information in github.com/grafana/synthetic-monitoring-agent

• CWE-489
• CWE-749

<0.12.0 · fixed in 0.12.0

Local privilege escalation vulnerability in baramundi Management Agent via MSI Installer

• baramundi Management Agent
• CWE-749

Siemens SINEC Traffic Analyzer: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All…

• Siemens SINEC Traffic Analyzer
• CWE-749

D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability

• D-Link D-View
• CWE-749

D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability

• D-Link D-View
• CWE-749

Voltronic Power ViewPower USBCommEx shutdown Exposed Dangerous Method Remote Code Execution Vulnerability

• Voltronic Power ViewPower
• CWE-749

Voltronic Power ViewPower UpsScheduler Exposed Dangerous Method Remote Code Execution Vulnerability

• Voltronic Power ViewPower
• CWE-749

Voltronic Power ViewPower LinuxMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability

• Voltronic Power ViewPower
• CWE-749

Voltronic Power ViewPower MacMonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability

• Voltronic Power ViewPower
• CWE-749

Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability

• Voltronic Power ViewPower
• CWE-749

Voltronic Power ViewPower setShutdown Exposed Dangerous Method Local Privilege Escalation Vulnerability

• Voltronic Power ViewPower
• CWE-749

Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Remote Code Execution Vulnerability

• Voltronic Power ViewPower
• CWE-749

Voltronic Power ViewPower updateManagerPassword Exposed Dangerous Method Authentication Bypass Vulnerability

• Voltronic Power ViewPower
• CWE-749

D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability

• D-Link D-View
• CWE-749

Visualware MyConnection Server doRTAAccessUPass Exposed Dangerous Method Information Disclosure Vulnerability

• Visualware MyConnection Server
• CWE-749

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability

• LG Simple Editor
• CWE-749

LG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability

• LG Simple Editor
• CWE-749

PDF-XChange Editor Net.HTTP.requests Exposed Dangerous Function Information Disclosure Vulnerability

• PDF-XChange Editor
• CWE-749

PDF-XChange Editor readFileIntoStream Exposed Dangerous Function Information Disclosure Vulnerability

• PDF-XChange Editor
• CWE-749

PDF-XChange Editor exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability

• PDF-XChange Editor
• CWE-749

Triangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution Vulnerability

• Triangle MicroWorks SCADA Data Gateway
• CWE-749

Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability

• Inductive Automation Ignition
• CWE-749

NETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution Vulnerability

• NETGEAR ProSAFE Network Management System
• CWE-749

NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability

• NETGEAR ProSAFE Network Management System
• CWE-749

Kofax Power PDF exportAsText Exposed Dangerous Method Remote Code Execution Vulnerability

• Kofax Power PDF
• CWE-749

Foxit PDF Editor DOC File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability

• Foxit PDF Editor
• CWE-749

Foxit PDF Editor XLS File Parsing Exposed Dangerous Method Remote Code Execution Vulnerability

• Foxit PDF Editor
• CWE-749

Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability

• Foxit PDF Reader
• CWE-749

myQNAPcloud Link

• QNAP Systems Inc. myQNAPcloud Link
• Authentication bypass
• CWE-346

IBM Storage Defender - Resiliency Service privilege escalation

• IBM Storage Defender
• CWE-749

Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point…: A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350…

• Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)
• CWE-749

Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability

• Voltronic Power ViewPower Pro
• CWE-749

JetBrains TeamCity: In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain…

• JetBrains TeamCity
• CWE-749

LangChain Experimental vulnerable to arbitrary code execution

• CWE-749

<0.0.52 · fixed in 0.0.52

An issue was discovered in MISP before 2.4.184.

• CWE-749

Honeywell ControlEdge UOC: An attacker could potentially exploit this vulnerability…

• Honeywell ControlEdge UOC
• CWE-749

Improper Privilege Management in sap-xssec

• Privilege escalation
• CWE-749

<4.1.0 · fixed in 4.1.0

Improper JWT Signature Validation in SAP Security Services Library

• Privilege escalation
• CWE-749

<2.17.0 || >=3.0.0, <3.3.0 · fixed in 2.17.0, 3.3.0

Duplicate Advisory: Privilege escalation in sap-xssec

• Privilege escalation
• Broken access control

<4.1.0 · fixed in 4.1.0

Escalation of privileges in @sap/xssec

• Privilege escalation
• Broken access control

<3.6.0 · fixed in 3.6.0

Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library

• Privilege escalation
• Broken access control

<2.17.0 || >=3.0.0, <3.3.0 · fixed in 2.17.0, 3.3.0

Delta Electronics InfraSuite Device Master Exposed Dangerous Method Or Function

• Delta Electronics InfraSuite Device Master
• CWE-749

Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function

• Red Lion Controls ST-IPm-8460
• Red Lion Controls ST-IPm-6350
• CWE-749