Critical vulnerability archive — page 394

GeoVision1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-11120 · GeoVision GV-VS12

GeoVision EOL devices - OS Command Injection

KEV · due 28 May EPSS 28%public exploit SSVC act CVSS 9.8

TP-Link1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-11237 · TP-Link VN020 F3v(T)

TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow

EPSS 5%public exploit CVSS 9.8

imartinez1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-4343 · imartinez imartinez/privategpt

Python Command Injection in imartinez/privategpt

EPSS 3%public exploit CVSS 9.8

gogs1 vulnerability on this pageMax CVSS 10.0Priority 56KEV 0

CVE-2022-1884 · gogs gogs/gogs

Remote Command Execution in gogs/gogs

EPSS 2%public exploit CVSS 10.0

dompdf2 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2021-3838 · dompdf dompdf/dompdf

PHAR Deserialization in dompdf/dompdf

EPSS 1%public exploit CVSS 9.8

CVE-2021-3902 · dompdf dompdf/dompdf

Improper Restriction of XML External Entity Reference in dompdf/dompdf

EPSS 1.0%public exploit CVSS 9.8

laurent221 vulnerability on this pageMax CVSS 9.6Priority 52KEV 0

CVE-2024-49362 · laurent22 joplin

Remote Code Execution on click of <a> Link in markdown preview

EPSS 1%public exploit CVSS 9.6

python_book1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-50649 · python_book python_book

The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.

EPSS 1.0%public exploit CVSS 9.8

yshopmall1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-50648 · yshopmall yshopmall

yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured t…

EPSS 1%public exploit CVSS 9.8

code-projects2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-11244 · code-projects Farmacia

code-projects Farmacia editar-cliente.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-11250 · code-projects Inventory Management

code-projects Inventory Management editProduct.php sql injection

EPSS 0.7%public exploit CVSS 9.8

Apereo1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-11209 · Apereo CAS

Apereo CAS 2FA login improper authentication

EPSS 0.6%public exploit CVSS 9.8

Cisco2 vulnerabilities on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2023-20036 · Cisco Cisco Industrial Network Director

Cisco Industrial Network Director Command Injection Vulnerability

EPSS 14%CVSS 9.9

CVE-2023-20154 · Cisco Cisco Modeling Labs

Cisco Modeling Labs External Authentication Bypass Vulnerability

EPSS 0.9%CVSS 9.1

Really Simple Plugins1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10924 · Really Simple Plugins Really Simple Security Pro multisite

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

EPSS 82%CVSS 9.8

Synology1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-10443 · Synology BeePhotos

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Syn…

EPSS 29%CVSS 9.8

usememos1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2023-0109 · usememos usememos/memos

Stored XSS in usememos/memos

EPSS 0.5%public exploit CVSS 9.8

kaso1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-50724 · kaso kaso

KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp.

EPSS 0.4%public exploit CVSS 9.8

lunary-ai3 vulnerabilities on this pageMax CVSS 9.6Priority 46KEV 0

CVE-2024-3379 · lunary-ai lunary-ai/lunary

Incorrect Authorization in lunary-ai/lunary

EPSS 0.4%public exploit CVSS 9.6

CVE-2024-3501 · lunary-ai lunary-ai/lunary

Exposure of Sensitive Information in lunary-ai/lunary

EPSS 0.4%public exploit CVSS 9.1

CVE-2024-3502 · lunary-ai lunary-ai/lunary

Exposure of Sensitive Information in lunary-ai/lunary

EPSS 0.4%public exploit CVSS 9.1

Arttia Creative1 vulnerability on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2024-52375 · Arttia Creative Datasets Manager by Arttia Creative

WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability

EPSS 1%CVSS 10.0

softpulseinfotech1 vulnerability on this pageMax CVSS 10.0Priority 45KEV 0

CVE-2024-52380 · softpulseinfotech Picsmize

WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability

EPSS 2%CVSS 10.0

medmatech1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-52382 · medmatech Matix Popup Builder

WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerability

EPSS 1.0%CVSS 9.8

Baxter8 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2024-48966 · Baxter Life2000 Ventilation System

Life2000 service tools for test and calibration do not support user authentication

EPSS 0.7%CVSS 10.0

CVE-2024-48967 · Baxter Life2000 Ventilation System

Life2000 ventilator and Service PC lack sufficient audit logging capabilities

EPSS 0.6%CVSS 10.0

CVE-2024-48970 · Baxter Life2000 Ventilation System

Life2000 Ventilator microcontroller lacks memory protection

EPSS 0.2%CVSS 9.3

CVE-2024-48971 · Baxter Life2000 Ventilation System

Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator

EPSS 0.2%CVSS 9.3

CVE-2024-48973 · Baxter Life2000 Ventilation System

Debug port on Life2000 Ventilator serial interface is enabled by default

EPSS 0.2%CVSS 9.3

CVE-2024-48974 · Baxter Life2000 Ventilation System

Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates

EPSS 0.2%CVSS 9.3

CVE-2024-9832 · Baxter Life2000 Ventilation System

No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator

EPSS 0.2%CVSS 9.3

CVE-2024-9834 · Baxter Life2000 Ventilation System

Improper data protection on Life2000 ventilator serial interface

EPSS 0.1%CVSS 9.3

cli1 vulnerability on this pageMax CVSS 9.6Priority 41KEV 0

CVE-2024-52308 · cli cli

Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer

EPSS 0.9%CVSS 9.6

Elastic1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2024-37285 · Elastic Kibana

Kibana arbitrary code execution via YAML deserialization

EPSS 1%CVSS 9.1

erp1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-44758 · erp management_software

An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers…

EPSS 0.7%CVSS 9.8

bdthemes1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-52377 · bdthemes Instant Image Generator

WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin <= 1.5.2 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

cmsMinds1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-52376 · cmsMinds Boat Rental Plugin for WordPress

WordPress Boat Rental Plugin for WordPress plugin <= 1.0.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

DoThatTask1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-52374 · DoThatTask Do That Task

WordPress Do That Task plugin <= 1.5.5 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

faizalbahasan1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-52379 · faizalbahasan kineticPay for WooCommerce

WordPress kineticPay for WooCommerce plugin <= 2.0.8 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

mz-automation2 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-45970 · mz-automation lib60870

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a m…

EPSS 0.6%CVSS 9.8

CVE-2024-45971 · mz-automation lib60870

Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a m…

EPSS 0.6%CVSS 9.8

Team Devexhub1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-52373 · Team Devexhub Devexhub Gallery

WordPress Devexhub Gallery plugin <= 2.0.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

WebTechGlobal1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-52372 · WebTechGlobal Easy CSV Importer BETA

WordPress Easy CSV Importer plugin <= 7.0.0 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

BudgetControl1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2024-52528 · BudgetControl Gateway

Auth Token can be passed dummy or wrong the middleware response is 200 OK

EPSS 0.6%CVSS 9.3

Hive Support1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52370 · Hive Support Hive Support

WordPress Hive Support – WordPress Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin <= 1.1.1 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

jepaas1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2024-51164 · jepaas jepaas

Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user t…

EPSS 0.7%CVSS 9.1

Optimal Access1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52369 · Optimal Access KBucket

WordPress KBucket plugin <= 4.2.2 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

wpmonks1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52384 · wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation

WordPress Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation plugin <= 2.4.9 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Dataprom Informatics1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-10534 · Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS)

Improper Access Control in Dataprom Informatics' PACS-ACSS

EPSS 0.4%CVSS 9.8

Eric Teubert1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-52393 · Eric Teubert Podlove Podcast Publisher

WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability

EPSS 0.5%CVSS 9.1

The archive.