Critical vulnerability archive — page 395

dedecms1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-11138 · dedecms dedecms

DedeCMS friendlink_add.php unrestricted upload

EPSS 3%public exploit CVSS 9.8

dom-iterator1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-21541 · dom-iterator dom-iterator

Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor witho…

EPSS 1%public exploit CVSS 9.8

dataease1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-52295 · dataease dataease

DataEase has a forged JWT token vulnerability

EPSS 0.9%public exploit CVSS 9.8

kashipara2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-50833 · kashipara e_learning_management_system_project

A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password…

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-50823 · kashipara e_learning_management_system_project

A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and pa…

EPSS 0.5%public exploit CVSS 9.8

Ivanti9 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-50330 · Ivanti Endpoint Manager

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauth…

EPSS 40%CVSS 9.8

CVE-2024-11005 · Ivanti Connect Secure

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7…

EPSS 2%CVSS 9.1

CVE-2024-11006 · Ivanti Connect Secure

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7…

EPSS 2%CVSS 9.1

CVE-2024-11007 · Ivanti Connect Secure

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7…

EPSS 2%CVSS 9.1

CVE-2024-38655 · Ivanti Connect Secure

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1…

EPSS 2%CVSS 9.1

CVE-2024-38656 · Ivanti Connect Secure

Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows…

EPSS 2%CVSS 9.1

CVE-2024-39710 · Ivanti Connect Secure

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows…

EPSS 2%CVSS 9.1

CVE-2024-39711 · Ivanti Connect Secure

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows…

EPSS 2%CVSS 9.1

CVE-2024-39712 · Ivanti Connect Secure

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows…

EPSS 2%CVSS 9.1

Microsoft3 vulnerabilities on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2024-43639 · Microsoft Windows Server 2025

Windows KDC Proxy Remote Code Execution Vulnerability

EPSS 9%CVSS 9.8

CVE-2024-43498 · Microsoft PowerShell 7.5

.NET and Visual Studio Remote Code Execution Vulnerability

EPSS 4%CVSS 9.8

CVE-2024-43602 · Microsoft Azure CycleCloud

Azure CycleCloud Remote Code Execution Vulnerability

EPSS 2%CVSS 9.9

上海灵当信息科技有限公司2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-11121 · 上海灵当信息科技有限公司 Lingdang CRM

上海灵当信息科技有限公司 Lingdang CRM index.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-11122 · 上海灵当信息科技有限公司 Lingdang CRM

上海灵当信息科技有限公司 Lingdang CRM index.php unrestricted upload

EPSS 0.6%public exploit CVSS 9.8

1000 Projects1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-11101 · 1000 Projects Beauty Parlour Management System

1000 Projects Beauty Parlour Management System search-invoices.php sql injection

EPSS 0.5%public exploit CVSS 9.8

ays-pro1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-10571 · ays-pro Chartify – WordPress Chart Plugin

Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source

EPSS 5%CVSS 9.8

Icinga1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-49369 · Icinga icinga2

Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections

EPSS 3%CVSS 9.8

OpenSSL1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-4741 · OpenSSL OpenSSL

Use After Free with SSL_free_buffers

EPSS 3%CVSS 9.8

nuget1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-48510 · nuget dotnetzip

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Sha…

EPSS 2%CVSS 9.8

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.9Priority 45KEV 0

CVE-2024-50386 · Apache Software Foundation Apache CloudStack

Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure

EPSS 1%CVSS 9.9

CVE-2024-50306 · Apache Software Foundation Apache Traffic Server

Apache Traffic Server: Server process can fail to drop privilege

EPSS 2%CVSS 9.1

xwikisas1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2024-52300 · xwikisas macro-pdfviewer

macro-pdfviewer has a XSS through the width parameter

EPSS 0.5%public exploit CVSS 9.1

algolplus1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-10828 · algolplus Advanced Order Export For WooCommerce

Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details

EPSS 1%CVSS 9.8

icdsoft1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-11028 · icdsoft MultiManager WP – Manage All Your WordPress Sites Easily

MultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation

EPSS 1%CVSS 9.8

vanquish1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-11150 · vanquish WordPress User Extra Fields

WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion

EPSS 1%CVSS 9.8

mobisoft9741 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-10245 · mobisoft974 Relais 2FA

Relais 2FA <= 1.0 - Authentication Bypass

EPSS 1%CVSS 9.8

Siemens4 vulnerabilities on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-44102 · Siemens PP TeleControl Server Basic 1000 to 5000 V3.1

A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with r…

EPSS 1.0%CVSS 10.0

CVE-2024-46888 · Siemens SINEC INS

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3).

EPSS 0.9%CVSS 9.9

CVE-2024-50557 · Siemens RUGGEDCOM RM1224 LTE(4G) EU

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) N…

EPSS 0.9%CVSS 9.8

CVE-2024-46890 · Siemens SINEC INS

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3).

EPSS 0.7%CVSS 9.4

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-10820 · Unknown WooCommerce Upload Files

WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload

EPSS 1%CVSS 9.8

binance1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-31695 · binance btc

A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authe…

EPSS 0.7%CVSS 9.8

Google1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-43091 · Google Android

In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow.

EPSS 0.7%CVSS 9.8

Laravel-Backpack1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-52306 · Laravel-Backpack FileManager

FileManager Deserialization of Untrusted Data

EPSS 0.6%CVSS 9.8

Schneider Electric2 vulnerabilities on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2024-10575 · Schneider Electric EcoStruxure IT Gateway

CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impa…

EPSS 0.6%CVSS 10.0

CVE-2024-8938 · Schneider Electric Modicon M340 CPU (part numbers BMXP34*)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitr…

EPSS 0.5%CVSS 9.2

Fortinet1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-26011 · Fortinet FortiManager

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2…

EPSS 0.6%CVSS 9.8

tolgee1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-52297 · tolgee tolgee-platform

Tolgee's configuration all configuration properties leaked in public configuration DTO

EPSS 0.6%CVSS 9.8

decidim-ice1 vulnerability on this pageMax CVSS 9.0Priority 38KEV 0

CVE-2024-43415 · decidim-ice decidim-module-decidim_awesome

Decidim-Awesome: SQL injection in AdminAccountability

EPSS 0.7%CVSS 9.0

cybelesoft1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-40404 · cybelesoft thinfinity_workspace

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web So…

EPSS 0.5%CVSS 9.8

TIBCO Software Inc2 vulnerabilities on this pageMax CVSS 9.2Priority 37KEV 0

CVE-2024-10217 · TIBCO Software Inc TIBCO Hawk

TIBCO Hawk Stored-XSS Vulnerability

EPSS 0.5%CVSS 9.2

CVE-2024-10218 · TIBCO Software Inc TIBCO Hawk

TIBCO Hawk Stored-XEE Vulnerability

EPSS 0.5%CVSS 9.2

Rockwell Automation1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-10943 · Rockwell Automation FactoryTalk Updater

FactoryTalk® Updater Authentication Bypass

EPSS 0.5%CVSS 9.1

Nomysoft Informatics1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2024-8074 · Nomysoft Informatics Nomysem

Sensetive Data Exposure in Nomysoft Informatics' Nomysem

EPSS 0.4%CVSS 9.3

SUSE1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2022-45157 · SUSE rancher

Exposure of vSphere's CPI and CSI credentials in Rancher

EPSS 0.4%CVSS 9.1

The archive.