Critical vulnerability archive — page 392

h3c1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-52765 · h3c gr-1800ax

H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.

EPSS 12%public exploit CVSS 9.8

GoCast3 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-28892 · GoCast GoCast

An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3.

EPSS 6%public exploit CVSS 9.8

CVE-2024-29224 · GoCast GoCast

An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3.

EPSS 6%public exploit CVSS 9.8

CVE-2024-21855 · GoCast GoCast

A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3.

EPSS 2%public exploit CVSS 9.8

hiyouga1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2024-52803 · hiyouga LLaMA-Factory

LLama Factory Remote OS Command Injection Vulnerability

EPSS 2%public exploit CVSS 9.8

influxdata1 vulnerability on this pageMax CVSS 9.1Priority 56KEV 0

CVE-2024-30896 · influxdata influxdb

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users wit…

EPSS 5%public exploit CVSS 9.1

1000 Projects3 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-11591 · 1000 Projects Beauty Parlour Management System

1000 Projects Beauty Parlour Management System add-services.php sql injection

EPSS 1.0%public exploit CVSS 9.8

CVE-2024-11592 · 1000 Projects Beauty Parlour Management System

1000 Projects Beauty Parlour Management System about-us.php sql injection

EPSS 0.9%public exploit CVSS 9.8

CVE-2024-11590 · 1000 Projects Bookstore Management System

1000 Projects Bookstore Management System forget_password_process.php sql injection

EPSS 0.9%public exploit CVSS 9.8

dedebiz2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-52770 · dedebiz dedebiz

An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrar…

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-52771 · dedebiz dedebiz

DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.

EPSS 0.7%public exploit CVSS 9.1

omegat1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-51366 · omegat omegat

An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via up…

EPSS 0.7%public exploit CVSS 9.8

dlink1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-51151 · dlink di-8200_firmware

D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.

EPSS 31%CVSS 9.8

Pandora FMS1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-11320 · Pandora FMS Pandora FMS

Command Injection leading to RCE via LDAP Misconfiguration

EPSS 91%CVSS 9.8

tenda1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-52714 · tenda ac6v2.0_firmware

Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime.

EPSS 0.6%public exploit CVSS 9.8

mitre1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-52759 · mitre

D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ip_position_asp function.

EPSS 6%CVSS 9.8

sourcecodester1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-52675 · sourcecodester sentiment_based_movie_rating_system

SourceCodester Sentiment Based Movie Rating System 1.0 is vulnerable to SQL Injection in /msrps/movies.php.

EPSS 0.5%public exploit CVSS 9.8

userplus1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-52442 · userplus UserPlus

WordPress UserPlus plugin <= 2.0 - Privilege Escalation vulnerability

EPSS 0.5%public exploit CVSS 9.8

Automated Logic, a Carrier company1 vulnerability on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2024-8525 · Automated Logic, a Carrier company WebCTRL

Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload

EPSS 1%CVSS 10.0

goauthentik1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-52289 · goauthentik authentik

authentik has an insecure default configuration for OAuth2 Redirect URIs

EPSS 1%CVSS 9.8

gladinet1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-37782 · gladinet centrestack

An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or…

EPSS 1%CVSS 9.8

totolink1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-52723 · totolink x6000r_firmware

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering.

EPSS 1%CVSS 9.8

gunghoinc1 vulnerability on this pageMax CVSS 9.6Priority 41KEV 0

CVE-2024-52402 · gunghoinc Exclusive Content Password Protect

WordPress Exclusive Content Password Protect plugin <= 1.1.0 - CSRF to Arbitrary File Upload vulnerability

EPSS 0.8%CVSS 9.6

husrev1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-51367 · husrev blackboard

An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arb…

EPSS 0.8%CVSS 9.8

hkcms1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-52677 · hkcms hkcms

HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php.

EPSS 0.6%CVSS 9.8

kasda2 vulnerabilities on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2024-29292 · kasda kw6512_firmware

Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to…

EPSS 1%CVSS 9.1

CVE-2024-33439 · kasda kw5515_firmware

An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cg…

EPSS 0.6%CVSS 9.1

Linux7 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-50276 · Linux Linux

net: vertexcom: mse102x: Fix possible double free of TX skb

EPSS 0.7%CVSS 9.8

CVE-2024-50283 · Linux Linux

ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp

EPSS 0.6%CVSS 9.8

CVE-2024-50286 · Linux Linux

ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create

EPSS 0.7%CVSS 9.8

CVE-2024-53066 · Linux Linux

nfs: Fix KMSAN warning in decode_getfattr_attrs()

EPSS 0.7%CVSS 9.8

CVE-2024-53094 · Linux Linux

RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES

EPSS 0.6%CVSS 9.8

CVE-2024-53095 · Linux Linux

smb: client: Fix use-after-free of network namespace.

EPSS 0.6%CVSS 9.8

CVE-2024-53058 · Linux Linux

net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data

EPSS 0.6%CVSS 9.4

rubengc1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-11036 · rubengc GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings

EPSS 0.7%CVSS 9.8

Versa1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2024-42450 · Versa Director

The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data.

EPSS 0.6%CVSS 10.0

Wowza2 vulnerabilities on this pageMax CVSS 9.6Priority 40KEV 0

CVE-2024-52053 · Wowza Streaming Engine

Stored Cross-Site Scripting in Wowza Streaming Engine

EPSS 0.7%CVSS 9.6

CVE-2024-52052 · Wowza Streaming Engine

Stream Target Remote Code Execution in Wowza Streaming Engine

EPSS 0.5%CVSS 9.4

M-Files Corporation1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-10127 · M-Files Corporation M-Files Server

Support for authentication bypass condition in M-Files LDAP authentication

EPSS 0.6%CVSS 9.8

Mark O'Donnell1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-52439 · Mark O'Donnell Team Rosters

WordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

masikonis1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-52443 · masikonis Geolocator

WordPress Geolocator plugin <= 1.1 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

mbed1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-48984 · mbed mbed

An issue was discovered in MBed OS 6.16.0.

EPSS 0.5%CVSS 9.8

Rajesh Thanoch1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-52441 · Rajesh Thanoch Quick Learn

WordPress Quick Learn plugin <= 1.0.1 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

xpresslane1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-52440 · xpresslane Xpresslane Fast Checkout

WordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

Pegasystems1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-10094 · Pegasystems Pega Infinity

Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code

EPSS 0.5%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-52360 · IBM Concert Software

IBM Concert Software SQL injection

EPSS 0.4%CVSS 9.8

upKeeper Solutions2 vulnerabilities on this pageMax CVSS 10.0Priority 37KEV 0

CVE-2024-9478 · upKeeper Solutions upKeeper Instant Privilege Access

Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issu…

EPSS 0.4%CVSS 10.0

CVE-2024-9479 · upKeeper Solutions upKeeper Instant Privilege Access

Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issu…

EPSS 0.4%CVSS 10.0

welaunch1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2024-11069 · welaunch WordPress GDPR

WordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion

EPSS 0.4%CVSS 9.1

HuangYe WuDeng1 vulnerability on this pageMax CVSS 9.6Priority 33KEV 0

CVE-2024-52401 · HuangYe WuDeng Hacklog DownloadManager

WordPress Hacklog DownloadManager plugin <=2.1.4 - CSRF to Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.6

The archive.