Critical vulnerability archive — page 409

Palo Alto Networks3 vulnerabilities on this pageMax CVSS 9.9Priority 100KEV 2

CVE-2024-9463 · Palo Alto Networks Expedition

Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

KEV · due 5 Dec EPSS 99%public exploit SSVC act CVSS 9.9

CVE-2024-9465 · Palo Alto Networks Expedition

Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

KEV · due 5 Dec EPSS 100%public exploit SSVC act CVSS 9.2

CVE-2024-9464 · Palo Alto Networks Expedition

Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

EPSS 83%public exploit CVSS 9.3

Microsoft4 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-43468 · Microsoft Microsoft Configuration Manager

Microsoft Configuration Manager Remote Code Execution Vulnerability

KEV · due 5 Mar EPSS 81%public exploit SSVC act CVSS 9.8

CVE-2024-43488 · Microsoft Visual Studio Code

Visual Studio Code extension for Arduino Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

CVE-2024-43591 · Microsoft Azure CLI

Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability

EPSS 2%CVSS 9.1

CVE-2024-38124 · Microsoft Windows Server 2008 Service Pack 2

Windows Netlogon Elevation of Privilege Vulnerability

EPSS 1%CVSS 9.0

Mozilla1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-9680 · Mozilla Firefox

Mozilla Firefox Use-After-Free Vulnerability

KEV · due 5 Nov ransomware use EPSS 23%public exploit SSVC act CVSS 9.8

angular-base64-upload-project1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-42640 · angular-base64-upload-project angular-base64-upload

angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php.

EPSS 40%public exploit CVSS 9.8

jsonpath-plus1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-21534 · jsonpath-plus jsonpath

All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.

EPSS 9%public exploit CVSS 9.8

Tenda1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-9793 · Tenda AC1206

Tenda AC1206 ate ate_ifconfig_set command injection

EPSS 23%public exploit CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-9796 · Unknown WP-Advanced-Search

WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection

EPSS 3%public exploit CVSS 9.8

pac4j1 vulnerability on this pageMax CVSS 9.2Priority 54KEV 0

CVE-2023-25581 · pac4j pac4j

Deserialization of untrusted data in InternalAttributeHandler in pac4j

EPSS 2%public exploit CVSS 9.2

kancloud1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-46532 · kancloud openhis

SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.cl…

EPSS 1.0%public exploit CVSS 9.8

livewire1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-47823 · livewire livewire

Livewire Remote Code Execution (RCE) on File Uploads

EPSS 0.8%public exploit CVSS 9.8

code-projects2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-9811 · code-projects Restaurant Reservation System

code-projects Restaurant Reservation System filter3.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-9812 · code-projects Crud Operation System

code-projects Crud Operation System delete.php sql injection

EPSS 0.7%public exploit CVSS 9.8

Codezips3 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-9794 · Codezips Online Shopping Portal

Codezips Online Shopping Portal update-image1.php unrestricted upload

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-9813 · Codezips Pharmacy Management System

Codezips Pharmacy Management System register.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-9814 · Codezips Pharmacy Management System

Codezips Pharmacy Management System update.php sql injection

EPSS 0.7%public exploit CVSS 9.8

SourceCodester1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-9818 · SourceCodester Online Veterinary Appointment System

SourceCodester Online Veterinary Appointment System manage_category.php sql injection

EPSS 0.6%public exploit CVSS 9.8

ataurr1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-9234 · ataurr GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

EPSS 10%CVSS 9.8

themehunk1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-9707 · themehunk Hunk Companion

Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

EPSS 9%CVSS 9.8

zhejiang_university1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-46088 · zhejiang_university entersoft_customer_resource_management

An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Managem…

EPSS 0.6%public exploit CVSS 9.8

GitHub1 vulnerability on this pageMax CVSS 9.5Priority 48KEV 0

CVE-2024-9487 · GitHub Enterprise Server

An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled

EPSS 26%CVSS 9.5

sampmax1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-48784 · sampmax sampmax_firmware

An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the…

EPSS 0.5%public exploit CVSS 9.8

revic_optics1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2024-48787 · revic_optics revic_ops_firmware

An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware u…

EPSS 0.5%public exploit CVSS 9.1

switchbot1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2024-48786 · switchbot switchbot_firmware

An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the f…

EPSS 0.5%public exploit CVSS 9.1

burg-wchter_kg1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2024-48769 · burg-wchter_kg burg-wchter_kg_firmware

An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware updat…

EPSS 0.4%public exploit CVSS 9.1

c-chip1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2024-48772 · c-chip c-chip_firmware

An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process.

EPSS 0.4%public exploit CVSS 9.1

giant_manufacturing1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2024-48778 · giant_manufacturing ridelink_firmware

An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via…

EPSS 0.4%public exploit CVSS 9.1

Adobe1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-45115 · Adobe Adobe Commerce

Adobe Commerce | Improper Authentication (CWE-287)

EPSS 1%CVSS 9.8

pedaloagency1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-9822 · pedaloagency Pedalo Connector

Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator

EPSS 0.9%CVSS 9.8

trustedfirmware1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-45746 · trustedfirmware trusted_firmware-m

An issue was discovered in Trusted Firmware-M through 2.1.0.

EPSS 0.8%CVSS 9.8

mitre2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-32608 · mitre

HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer and causing denial…

EPSS 0.7%CVSS 9.8

CVE-2024-48949 · mitre

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n)…

EPSS 0.5%CVSS 9.1

eyecix1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-47636 · eyecix JobSearch

WordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerability

EPSS 0.6%CVSS 9.8

fydeos1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-25825 · fydeos fydeos

FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with t…

EPSS 0.5%CVSS 9.8

Linux1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2024-47659 · Linux Linux

smack: tcp: ipv4, fix incorrect labeling

EPSS 0.8%CVSS 9.1

Progress Software1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2024-8015 · Progress Software Telerik Reporting

Telerik Report Server Insecure Type Resolution

EPSS 0.8%CVSS 9.1

gradio-app2 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-47167 · gradio-app gradio

SSRF in the path parameter of /queue/join in Gradio

EPSS 0.5%CVSS 9.8

CVE-2024-47871 · gradio-app gradio

Insecure communication between the FRP client and server in Gradio

EPSS 0.2%CVSS 9.1

SEUR1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-9201 · SEUR SEUR plugin

SQL injection vulnerability in SEUR plugin

EPSS 0.5%CVSS 9.8

userplus1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-9518 · userplus User registration & user profile – UserPlus

UserPlus <= 2.0 - Unauthenticated Privilege Escalation

EPSS 0.5%CVSS 9.8

weborf_project1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2023-46586 · weborf_project weborf

cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.

EPSS 0.6%CVSS 9.1

lemonldap-ng1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-45160 · lemonldap-ng lemonldap-ng

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication…

EPSS 0.5%CVSS 9.1

ssoready1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-47832 · ssoready ssoready

XML Signature Bypass via differential XML parsing in ssoready

EPSS 0.4%CVSS 9.8

mirotalk1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2024-44730 · mirotalk mirotalk_p2p

Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge ch…

EPSS 0.4%CVSS 9.1

syracom2 vulnerabilities on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2024-48942 · syracom secure_login

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force t…

EPSS 0.5%CVSS 9.1

CVE-2024-48941 · syracom secure_login

The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by intera…

EPSS 0.3%CVSS 9.1

The archive.