Critical vulnerability archive — page 390

ProjectSend1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-11680 · ProjectSend ProjectSend

ProjectSend Unauthenticated Configuration Modification

KEV · due 24 Dec EPSS 92%public exploit SSVC act CVSS 9.8

Zyxel1 vulnerability on this pageMax CVSS 9.8Priority 97KEV 1

CVE-2024-11667 · Zyxel ATP series firmware

Zyxel Multiple Firewalls Path Traversal Vulnerability

KEV · due 24 Dec ransomware use EPSS 3%public exploit SSVC act CVSS 9.8

Microsoft3 vulnerabilities on this pageMax CVSS 9.8Priority 94KEV 1

CVE-2024-49035 · Microsoft Microsoft Partner Center

Partner.Microsoft.Com Elevation of Privilege Vulnerability

KEV · due 18 Mar EPSS 1%public exploit SSVC act CVSS 9.8

CVE-2024-49038 · Microsoft Microsoft Copilot Studio

Microsoft Copilot Studio Elevation Of Privilege Vulnerability

EPSS 1%CVSS 9.6

CVE-2024-49052 · Microsoft Microsoft Azure Functions

Microsoft Azure PolicyWatch Elevation of Privilege Vulnerability

EPSS 0.7%CVSS 9.8

Hewlett Packard Enterprise (HPE)2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-53676 · Hewlett Packard Enterprise (HPE) HPE Insight Remote Support

A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.

EPSS 56%public exploit CVSS 9.8

CVE-2024-53673 · Hewlett Packard Enterprise (HPE) Insight Remote Support

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.

EPSS 0.7%CVSS 9.8

enms1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2024-11664 · enms enms

eNMS TGZ File controller.py multiselect_filtering path traversal

EPSS 2%public exploit CVSS 9.8

Tenda1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-11745 · Tenda AC8

Tenda AC8 SetStaticRouteCfg route_static_check stack-based overflow

EPSS 1%public exploit CVSS 9.8

phpgurukul3 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-53604 · phpgurukul covid19_testing_management_system

A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which…

EPSS 1%public exploit CVSS 9.8

CVE-2024-11818 · PHPGurukul User Registration & Login and User Management System

PHPGurukul User Registration & Login and User Management System signup.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-11817 · PHPGurukul User Registration & Login and User Management System

PHPGurukul User Registration & Login and User Management System index.php sql injection

EPSS 0.6%public exploit CVSS 9.8

Valor Apps1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-11145 · Valor Apps Easy Folder Listing Pro

Easy Folder Listing Pro deserialization vulnerability

EPSS 1%public exploit CVSS 9.8

code-projects1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-11962 · code-projects Simple Car Rental System

code-projects Simple Car Rental System login.php sql injection

EPSS 0.9%public exploit CVSS 9.8

1000 Projects2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-11744 · 1000 Projects Portfolio Management System MCA

1000 Projects Portfolio Management System MCA register.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-11819 · 1000 Projects Portfolio Management System MCA

1000 Projects Portfolio Management System MCA forgot_password_process.php sql injection

EPSS 0.6%public exploit CVSS 9.8

marketingfire1 vulnerability on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2024-8672 · marketingfire Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets

Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

EPSS 45%CVSS 9.9

Zabbix2 vulnerabilities on this pageMax CVSS 9.9Priority 50KEV 0

CVE-2024-42327 · Zabbix Zabbix

SQL injection in user.get API

EPSS 79%CVSS 9.9

CVE-2024-42330 · Zabbix Zabbix

JS - Internal strings in HTTP headers

EPSS 0.9%CVSS 9.1

cleantalk1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10542 · cleantalk Spam protection, Honeypot, Anti-Spam by CleanTalk

Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation

EPSS 15%CVSS 9.8

qiwenshare1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-50942 · qiwenshare qiwen-file

qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml.

EPSS 0.5%public exploit CVSS 9.8

Sharp Corporation4 vulnerabilities on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2024-33610 · Sharp Corporation Multiple MFPs (multifunction printers)

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.

EPSS 50%CVSS 9.1

CVE-2024-28038 · Sharp Corporation Multiple MFPs (multifunction printers)

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow.

EPSS 3%CVSS 9.0

CVE-2024-35244 · Sharp Corporation Multiple MFPs (multifunction printers)

There are several hidden accounts.

EPSS 1%CVSS 9.1

CVE-2024-36248 · Sharp Corporation Multiple MFPs (multifunction printers)

API keys for some cloud services are hardcoded in the "main" binary.

EPSS 1%CVSS 9.1

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-52338 · Apache Software Foundation Apache Arrow R package

Apache Arrow R package: Arbitrary code execution when loading a malicious data file

EPSS 2%CVSS 9.8

Information Technology1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2024-52475 · Information Technology Wawp

WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability

EPSS 2%CVSS 9.8

Advantech6 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-50370 · Advantech EKI-6333AC-2G

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the follow…

EPSS 1%CVSS 9.8

CVE-2024-50374 · Advantech EKI-6333AC-2G

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the follow…

EPSS 1%CVSS 9.8

CVE-2024-50371 · Advantech EKI-6333AC-2G

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the follow…

EPSS 1%CVSS 9.8

CVE-2024-50372 · Advantech EKI-6333AC-2G

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the follow…

EPSS 1%CVSS 9.8

CVE-2024-50373 · Advantech EKI-6333AC-2G

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the follow…

EPSS 1%CVSS 9.8

CVE-2024-50375 · Advantech EKI-6333AC-2G

A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-63…

EPSS 1%CVSS 9.8

tumultinc1 vulnerability on this pageMax CVSS 9.9Priority 43KEV 0

CVE-2024-11082 · tumultinc Tumult Hype Animations

Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function

EPSS 1%CVSS 9.9

Mozilla4 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-11704 · Mozilla Firefox

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path.

EPSS 0.9%CVSS 9.8

CVE-2024-11693 · Mozilla Firefox

The executable file warning was not presented when downloading .library-ms files.

EPSS 0.8%CVSS 9.8

CVE-2024-11698 · Mozilla Firefox

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal d…

EPSS 0.7%CVSS 9.8

CVE-2024-11705 · Mozilla Firefox

`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL.

EPSS 0.7%CVSS 9.1

contest-gallery1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-11103 · contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover

EPSS 0.8%CVSS 9.8

openvidreview_project1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-46054 · openvidreview_project openvidreview

OpenVidReview 1.0 is vulnerable to Incorrect Access Control.

EPSS 0.8%CVSS 9.8

eyecix1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-11925 · eyecix JobSearch WP Job Board

WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation

EPSS 0.7%CVSS 9.8

Google1 vulnerability on this pageMax CVSS 9.6Priority 40KEV 0

CVE-2024-9369 · Google Chrome

Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer p…

EPSS 0.7%CVSS 9.6

libjxl1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-11403 · libjxl libjxl

Out of Bounds Memory Read/Write in libjxl

EPSS 0.6%CVSS 9.8

pathomation1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2024-52490 · pathomation Pathomation

WordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerability

EPSS 0.6%CVSS 10.0

scottopolis1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-11024 · scottopolis AppPresser – Mobile App Framework

AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset

EPSS 0.7%CVSS 9.8

Galaxy Software Services Corporation2 vulnerabilities on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2024-52959 · Galaxy Software Services Corporation iota C.ai Conversational Platform

iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')

EPSS 0.6%CVSS 9.3

CVE-2024-52958 · Galaxy Software Services Corporation iota C.ai Conversational Platform

iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature

EPSS 0.3%CVSS 9.3

Сервис “Экспресс Платежи”1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2024-52474 · Сервис “Экспресс Платежи” Express Payments Module

WordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.3

contiki-ng2 vulnerabilities on this pageMax CVSS 9.6Priority 33KEV 0

CVE-2024-41125 · contiki-ng contiki-ng

Out-of-bounds read in SNMP when decoding a string in Contiki-NG

EPSS 0.3%CVSS 9.6

CVE-2024-41126 · contiki-ng contiki-ng

Out-of-bounds read when decoding SNMP messages in Contiki-NG

EPSS 0.3%CVSS 9.6

The archive.