Critical vulnerability archive — page 397

D-Link2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-10914 · D-Link DNS-320

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

EPSS 98%public exploit CVSS 9.8

CVE-2024-10915 · D-Link DNS-320

D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

EPSS 83%public exploit CVSS 9.8

didi1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-10919 · didi Super-Jacoco

didi Super-Jacoco triggerUnitCover os command injection

EPSS 5%public exploit CVSS 9.8

os4ed1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2024-51211 · os4ed opensis-classic

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.

EPSS 2%public exploit CVSS 9.8

sunniwell1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-48073 · sunniwell ht3300_firmware

sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions.

EPSS 1%public exploit CVSS 9.8

1000 Projects5 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-10968 · 1000 Projects Bookstore Management System

1000 Projects Bookstore Management System contact_process.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-10969 · 1000 Projects Bookstore Management System

1000 Projects Bookstore Management System Login login_process.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-10996 · 1000 Projects Bookstore Management System

1000 Projects Bookstore Management System process_category_edit.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-10998 · 1000 Projects Bookstore Management System

1000 Projects Bookstore Management System process_category_add.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-10997 · 1000 Projects Bookstore Management System

1000 Projects Bookstore Management System book_list.php sql injection

EPSS 0.6%public exploit CVSS 9.8

Codezips2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-10991 · Codezips Hospital Appointment System

Codezips Hospital Appointment System editBranchResult.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-10995 · Codezips Hospital Appointment System

Codezips Hospital Appointment System removeDoctorResult.php sql injection

EPSS 0.7%public exploit CVSS 9.8

emqx1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-10964 · emqx neuron

emqx neuron plugin_handle.c handle_add_plugin buffer overflow

EPSS 0.7%public exploit CVSS 9.8

Ericsson2 vulnerabilities on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2024-10081 · Ericsson CodeChecker

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

EPSS 40%CVSS 10.0

CVE-2024-10082 · Ericsson CodeChecker

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

EPSS 0.5%CVSS 9.0

HASOMED1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-50588 · HASOMED Elefant

Unprotected Exposed Firebird Database with default credentials

EPSS 0.7%public exploit CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.6Priority 50KEV 0

CVE-2024-7982 · Unknown Registrations for the Events Calendar

Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS

EPSS 0.7%public exploit CVSS 9.6

capricorn861 vulnerability on this pageMax CVSS 9.3Priority 49KEV 0

CVE-2024-51757 · capricorn86 happy-dom

Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

EPSS 0.8%public exploit CVSS 9.3

sourcecodester1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-50766 · sourcecodester survey_application_system

SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter.

EPSS 0.5%public exploit CVSS 9.8

vmir1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-35426 · vmir vmir

vmir e8117 was discovered to contain a stack overflow via the init_local_vars function at /src/vmir_wasm_parser.c.

EPSS 0.6%public exploit CVSS 9.8

Cisco1 vulnerability on this pageMax CVSS 10.0Priority 48KEV 0

CVE-2024-20418 · Cisco Cisco Aironet Access Point Software (IOS XE Controller)

Cisco Ultra-Reliable Wireless Backhaul Software Command Injection Vulnerability

EPSS 3%CVSS 10.0

martinvonz1 vulnerability on this pageMax CVSS 9.3Priority 48KEV 0

CVE-2024-51990 · martinvonz jj

Path traversal via crafted Git repositories in jj

EPSS 0.6%public exploit CVSS 9.3

code-projects1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2024-10988 · code-projects E-Health Care System

code-projects E-Health Care System doctor_login.php sql injection

EPSS 0.6%public exploit CVSS 9.1

Hewlett Packard Enterprise (HPE)2 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-42509 · Hewlett Packard Enterprise (HPE) HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10

Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol

EPSS 2%CVSS 9.8

CVE-2024-47460 · Hewlett Packard Enterprise (HPE) HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10

Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol

EPSS 1%CVSS 9.0

pwrstudio1 vulnerability on this pageMax CVSS 9.8Priority 45KEV 0

CVE-2020-8007 · pwrstudio ev_charger

The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via…

EPSS 2%CVSS 9.8

tendcode1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2024-50811 · tendcode izone

hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\…

EPSS 0.4%public exploit CVSS 9.1

bytecodealliance1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2024-51745 · bytecodealliance wasmtime

Wasmtime doesn't fully sandbox all the Windows device filenames

EPSS 0.8%CVSS 10.0

dataease1 vulnerability on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2024-47073 · dataease dataease

Dataease arbitrary interface access vulnerability

EPSS 1%CVSS 9.3

Dell3 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-45763 · Dell Enterprise SONiC OS

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS C…

EPSS 1%CVSS 9.1

CVE-2024-45765 · Dell Enterprise SONiC OS

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS C…

EPSS 1%CVSS 9.1

CVE-2024-45764 · Dell Enterprise SONiC OS

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability.

EPSS 0.5%CVSS 9.8

eyecix2 vulnerabilities on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2024-8615 · eyecix JobSearch WP Job Board

WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload

EPSS 0.9%CVSS 10.0

CVE-2024-8614 · eyecix JobSearch WP Job Board

WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload

EPSS 0.8%CVSS 9.9

themelooks1 vulnerability on this pageMax CVSS 9.9Priority 42KEV 0

CVE-2024-9307 · themelooks mFolio Lite

mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files

EPSS 1.0%CVSS 9.9

trimble1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2023-27195 · trimble tm4web

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registrati…

EPSS 1%CVSS 9.8

runatlantis1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-52009 · runatlantis atlantis

Git credentials are exposed in atlantis logs

EPSS 0.7%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2024-51504 · Apache Software Foundation Apache ZooKeeper

Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server

EPSS 0.9%CVSS 9.1

GitHub1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2024-10007 · GitHub Enterprise Server

Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

EPSS 0.8%CVSS 9.1

Linux5 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

symfony1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-51736 · symfony symfony

Command execution hijack on Windows with Process class in symfony/process

EPSS 0.4%CVSS 9.8

Enel X4 vulnerabilities on this pageMax CVSS 9.6Priority 34KEV 0

CVE-2023-29119 · Enel X JuiceBox Pro 3.0 22kW Cellular

Unauthorized SQLite Injection

EPSS 0.3%CVSS 9.6

CVE-2023-29120 · Enel X JuiceBox Pro 3.0 22kW Cellular

Unauthorized Remote Command Execution in Enel X Juicebox

EPSS 0.3%CVSS 9.6

CVE-2023-29121 · Enel X JuiceBox Pro 3.0 22kW Cellular

Exposed TCF agent service in Enel X Juicebox

EPSS 0.3%CVSS 9.6

CVE-2023-29125 · Enel X JuiceBox Pro 3.0 22kW Cellular

Heap overflow in CM_main.exe binary in Enel X JuiceBox

EPSS 0.3%CVSS 9.0

dingfanzu1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2024-50966 · dingfanzu cms

dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin.

EPSS 0.3%CVSS 9.3

The archive.