Jang

This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. The specific flaw exists within the `downloadLaunchClientJar` function, which lacks validation of a remote JAR file prior to loading it. An attacker can leverage this vulnerability to execute code in the context of the current user. User interaction is required to exploit this vulnerability, as the target must connect to a malicious server.

An elevation of privilege issue exists in Microsoft SharePoint Server due to improper access control. Specifically, the `ValidateTokenIssuer()` function fails to properly verify cryptographic signatures, which can lead to an authentication bypass. This flaw allows an unauthenticated remote attacker to elevate their privileges on the system and potentially achieve remote code execution. There are approximately 2,500 internet-connected SharePoint servers globally that may be affected, with about 650 located in the RuNet region. This issue has been exploited in real-world scenarios, including during the Pwn2Own Vancouver 2023 competition.

An issue exists due to insufficient input validation, allowing a remote attacker to perform code injection and execute arbitrary code. The flaw is specifically linked to the `GenerateProxyAssembly` function and the ability to overwrite the `/BusinessDataMetadataCatalog/BDCMetadata.bdcm` file in the root directory, which is subsequently executed by the server. Successful exploitation can grant the attacker control over the server to access private information and maintain persistence. This issue can be combined with other flaws to bypass authentication and utilize the SharePoint API with administrator privileges. There are over 372,000 potentially affected devices worldwide, and the flaw has been exploited in real-world attacks.

The issue is related to incorrect code generation management in Microsoft Exchange Server, allowing a remote attacker to execute arbitrary code by sending a specially crafted request. This can affect the system.

The issue is related to the Core component of Oracle WebLogic Server and is caused by inadequate access control. It allows an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. The vulnerability is easily exploitable and has been exploited in the wild. It is estimated that over 300 vulnerable servers could be exploited, leading to severe security threats.

The issue is related to insufficient access control in the Core component of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via IIOP, T3 protocols to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server.