Critical vulnerability archive — page 402

cyberpanel2 vulnerabilities on this pageMax CVSS 10.0Priority 100KEV 2

CVE-2024-51378 · cyberpanel cyberpanel

CyberPanel Incorrect Default Permissions Vulnerability

KEV · due 25 Dec ransomware use EPSS 95%public exploit SSVC act CVSS 10.0

CVE-2024-51567 · cyberpanel cyberpanel

CyberPanel Incorrect Default Permissions Vulnerability

KEV · due 28 Nov ransomware use EPSS 84%public exploit SSVC act CVSS 10.0

gaizhenbiao2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-5982 · gaizhenbiao gaizhenbiao/chuanhuchatgpt

Path Traversal in gaizhenbiao/chuanhuchatgpt

EPSS 31%public exploit CVSS 9.8

CVE-2024-5823 · gaizhenbiao gaizhenbiao/chuanhuchatgpt

File Overwrite Vulnerability in gaizhenbiao/chuanhuchatgpt

EPSS 0.5%public exploit CVSS 9.1

langchain-ai3 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-8309 · langchain-ai langchain-ai/langchain

SQL Injection in langchain-ai/langchain

EPSS 14%public exploit CVSS 9.8

CVE-2024-7774 · langchain-ai langchain-ai/langchainjs

Path Traversal in langchain-ai/langchainjs

EPSS 0.6%public exploit CVSS 9.1

CVE-2024-7042 · langchain-ai langchain-ai/langchainjs

Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection

EPSS 0.3%public exploit CVSS 9.8

mudler1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-6868 · mudler mudler/localai

Arbitrary File Write in mudler/LocalAI

EPSS 2%public exploit CVSS 9.8

pytorch1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-48063 · pytorch pytorch

In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.

EPSS 2%public exploit CVSS 9.8

chainer1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-48206 · chainer chainer

A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.

EPSS 0.8%public exploit CVSS 9.8

Codezips2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-10507 · Codezips Free Exam Hall Seating Management System

Codezips Free Exam Hall Seating Management System login.php sql injection

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-10509 · Codezips Online Institute Management System

Codezips Online Institute Management System login.php sql injection

EPSS 0.8%public exploit CVSS 9.8

pluxml1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-48138 · pluxml pluxml

A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows…

EPSS 0.9%public exploit CVSS 9.8

thinkphp1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-48112 · thinkphp thinkphp

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary…

EPSS 0.9%public exploit CVSS 9.8

cyber_panel1 vulnerability on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2024-51568 · cyber_panel cyber_panel

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.

EPSS 48%CVSS 10.0

ethereum2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-51427 · ethereum ethereum

An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impa…

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-51424 · ethereum ethereum

An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impa…

EPSS 0.6%CVSS 9.8

thecosy1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-48202 · thecosy icecms

icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.

EPSS 0.6%public exploit CVSS 9.8

draytek1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-51298 · draytek vigor3900

In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the…

EPSS 0.6%public exploit CVSS 9.8

lunary-ai2 vulnerabilities on this pageMax CVSS 9.1Priority 48KEV 0

CVE-2024-7475 · lunary-ai lunary-ai/lunary

Improper Access Control in lunary-ai/lunary

EPSS 0.7%public exploit CVSS 9.1

CVE-2024-7474 · lunary-ai lunary-ai/lunary

IDOR in lunary-ai/lunary

EPSS 0.6%CVSS 9.1

odude2 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-9989 · odude Crypto Tool

Crypto <= 2.18 - Authentication Bypass via log_in

EPSS 7%CVSS 9.8

CVE-2024-9988 · odude Crypto Tool

Crypto <= 2.19 - Authentication Bypass via register

EPSS 1%CVSS 9.8

parisneo1 vulnerability on this pageMax CVSS 9.0Priority 47KEV 0

CVE-2024-6581 · parisneo parisneo/lollms

Remote Code Execution due to Stored XSS in parisneo/lollms

EPSS 0.7%public exploit CVSS 9.0

Ajar Productions1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-50473 · Ajar Productions Ajar in5 Embed

WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability

EPSS 1%CVSS 10.0

Chetan Khandla1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-50482 · Chetan Khandla Woocommerce Product Design

WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

EPSS 1%CVSS 10.0

devsoftbaltic1 vulnerability on this pageMax CVSS 9.9Priority 43KEV 0

CVE-2024-50427 · devsoftbaltic SurveyJS

WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability

EPSS 1%CVSS 9.9

GRÜN Software Group GmbH1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-50476 · GRÜN Software Group GmbH GRÜN spendino Spendenformular

WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability

EPSS 1%CVSS 9.8

masterhomepage1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-50493 · masterhomepage Automatic Translation

WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability

EPSS 1%CVSS 10.0

Scott Gamon1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-50475 · Scott Gamon Signup Page

WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability

EPSS 1%CVSS 9.8

ServiceNow1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-8923 · ServiceNow Now Platform

Sandbox Escape in Now Platform

EPSS 1%CVSS 10.0

aquila1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-48573 · aquila cms

A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account…

EPSS 1%CVSS 9.8

Daschmi1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-50507 · Daschmi DS.DownloadList

WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerability

EPSS 1%CVSS 9.8

lowcage1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-50490 · lowcage PegaPoll

WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability

EPSS 1.0%CVSS 9.8

Udit Rawat1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-50485 · Udit Rawat Exam Matrix

WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability

EPSS 1.0%CVSS 9.8

LiteSpeed Technologies1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-50550 · LiteSpeed Technologies LiteSpeed Cache

WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerability

EPSS 0.9%CVSS 9.8

Mozilla3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-10467 · Mozilla Firefox

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3.

EPSS 0.6%CVSS 9.8

CVE-2024-10468 · Mozilla Firefox

Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash.

EPSS 0.4%CVSS 9.8

CVE-2024-10474 · Mozilla Focus for iOS

Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially cir…

EPSS 0.3%CVSS 9.1

aDirectory1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-50420 · aDirectory aDirectory

WordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

Amin Omer1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-50494 · Amin Omer Sudan Payment Gateway for WooCommerce

WordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

Lindeni Mahlalela1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-50484 · Lindeni Mahlalela Multi Purpose Mail Form

WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 10.0

azexo1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-50480 · azexo Marketing Automation by AZEXO

WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Deryck1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-50503 · Deryck User Toolkit

WordPress User Toolkit plugin <= 1.2.3 - Account Takeover vulnerability

EPSS 0.5%CVSS 9.8

Linux2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-50085 · Linux Linux

mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow

EPSS 0.5%CVSS 9.8

CVE-2024-50086 · Linux Linux

ksmbd: fix user-after-free from session log off

EPSS 0.5%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-45656 · IBM Flexible Service Processor

IBM Flexible Service Processor hard coded credentials

EPSS 0.4%CVSS 9.8

Hossni Mubarak1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-50459 · Hossni Mubarak AidWP

WordPress AidWP plugin <= 3.2.3 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.8

Pylons1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-49768 · Pylons waitress

Waitress has request processing race condition in HTTP pipelining with invalid first request

EPSS 0.5%CVSS 9.1

mondula20161 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2024-50428 · mondula2016 Multi Step Form

WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerability

EPSS 0.3%CVSS 9.8

The archive.