Critical vulnerability archive — page 412

Riello2 vulnerabilities on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2024-8877 · Riello Netman 204

SQL Injection

EPSS 77%public exploit CVSS 9.8

CVE-2024-8878 · Riello Netman 204

Unauthenticated Password Reset

EPSS 1%public exploit CVSS 10.0

tenda1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-46628 · tenda g3_firmware

Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName para…

EPSS 12%public exploit CVSS 9.8

becn1 vulnerability on this pageMax CVSS 9.1Priority 56KEV 0

CVE-2024-46627 · becn datagerry

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.

EPSS 4%public exploit CVSS 9.1

lobehub1 vulnerability on this pageMax CVSS 9.0Priority 56KEV 0

CVE-2024-47066 · lobehub lobe-chat

Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

EPSS 12%public exploit CVSS 9.0

cs-cart2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2023-26686 · cs-cart cs-cart_multivendor

File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when c…

EPSS 0.7%public exploit CVSS 9.8

CVE-2023-26689 · cs-cart cs-cart_multivendor

An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.

EPSS 0.6%public exploit CVSS 9.8

icecms_project1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-46612 · icecms_project icecms

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.

EPSS 0.6%public exploit CVSS 9.8

kashipara1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-42797 · kashipara music_management_system

An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0.

EPSS 0.6%public exploit CVSS 9.8

pgadmin.org1 vulnerability on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2024-9014 · pgadmin.org pgAdmin 4

OAuth2 client id and secret exposed through the web browser in pgAdmin 4

EPSS 10%CVSS 9.9

stellarwp1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-8275 · stellarwp The Events Calendar

The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection

EPSS 50%CVSS 9.8

FlowiseAI1 vulnerability on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2024-9148 · FlowiseAI FlowiseChatEmbed

Flowise Stored Cross-Site Scripting

EPSS 0.6%public exploit CVSS 9.6

NVIDIA1 vulnerability on this pageMax CVSS 9.0Priority 47KEV 0

CVE-2024-0132 · NVIDIA Container Toolkit

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configurati…

EPSS 41%CVSS 9.0

Google1 vulnerability on this pageMax CVSS 9.6Priority 45KEV 0

CVE-2024-7024 · Google Chrome

Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox esc…

EPSS 0.3%public exploit CVSS 9.6

sqlite1 vulnerability on this pageMax CVSS 9.1Priority 45KEV 0

CVE-2024-46488 · sqlite sqlite-vec

sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function.

EPSS 0.4%public exploit CVSS 9.1

artbees2 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-7772 · artbees Jupiter X Core

Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload

EPSS 2%CVSS 9.8

CVE-2024-7781 · artbees Jupiter X Core

Jupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover

EPSS 1.0%CVSS 9.8

dataease1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-46997 · dataease dataease

DataEase's H2 datasource has a remote command execution risk

EPSS 1%CVSS 9.8

Hewlett Packard Enterprise (HPE)3 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-42505 · Hewlett Packard Enterprise (HPE) Aruba OS

Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol

EPSS 1%CVSS 9.8

CVE-2024-42506 · Hewlett Packard Enterprise (HPE) Aruba OS

Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol

EPSS 1%CVSS 9.8

CVE-2024-42507 · Hewlett Packard Enterprise (HPE) Aruba OS

Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol

EPSS 1%CVSS 9.8

ashishajani1 vulnerability on this pageMax CVSS 9.1Priority 42KEV 0

CVE-2024-7385 · ashishajani WP Simple HTML Sitemap

WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection

EPSS 1%CVSS 9.1

Pure Storage1 vulnerability on this pageMax CVSS 10.0Priority 42KEV 0

CVE-2024-0001 · Pure Storage FlashArray

A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allow…

EPSS 0.9%CVSS 10.0

WatchGuard2 vulnerabilities on this pageMax CVSS 9.3Priority 42KEV 0

CVE-2024-6592 · WatchGuard SSO Client

WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass

EPSS 1%CVSS 9.3

CVE-2024-6593 · WatchGuard SSO Agent

WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass

EPSS 0.6%CVSS 9.3

Dover Fueling Solutions (DFS)4 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2024-43693 · Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection

EPSS 0.8%CVSS 10.0

CVE-2024-45066 · Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection

EPSS 0.8%CVSS 10.0

CVE-2024-43423 · Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded Password

EPSS 0.7%CVSS 9.8

CVE-2024-43692 · Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE

Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel

EPSS 0.5%CVSS 9.8

Ex-Themes1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2024-8671 · Ex-Themes WooEvents - Calendar and Event Booking

WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite

EPSS 1%CVSS 9.1

prisna1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2024-8514 · prisna Prisna GWT – Google Website Translator

Prisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object Injection

EPSS 1.0%CVSS 9.1

Progress Software2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-7575 · Progress Software Telerik UI for WPF

Improper neutralization special element in hyperlinks

EPSS 0.7%CVSS 9.8

CVE-2024-7576 · Progress Software Telerik UI for WPF

Progress UI for WPF format provider unsafe deserialization vulnerability

EPSS 0.5%CVSS 9.8

PureStorage4 vulnerabilities on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2024-0002 · PureStorage FlashArray

A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.

EPSS 0.6%CVSS 10.0

CVE-2024-0004 · PureStorage FlashArray

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privile…

EPSS 0.6%CVSS 9.1

CVE-2024-0005 · PureStorage FlashArray

A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a speci…

EPSS 0.6%CVSS 9.1

CVE-2024-0003 · PureStorage FlashArray

A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the ar…

EPSS 0.5%CVSS 9.1

smub1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-8791 · smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation

EPSS 0.7%CVSS 9.8

mellium1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-46957 · mellium xmpp

Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type…

EPSS 0.6%CVSS 9.8

mmrs1511 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2024-8621 · mmrs151 Daily Prayer Time

Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection

EPSS 0.5%CVSS 9.9

Scriptcase1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-8940 · Scriptcase Scriptcase

Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase

EPSS 0.5%CVSS 10.0

xjb1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-8485 · xjb REST API TO MiniProgram

REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover

EPSS 0.6%CVSS 9.8

hahncgdev1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-8436 · hahncgdev WP Easy Gallery – WordPress Gallery Plugin

WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection

EPSS 0.5%CVSS 9.9

meshtastic1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-47078 · meshtastic firmware

Meshtastic firmware Authentication/Authorization Bypass via MQTT

EPSS 0.5%CVSS 9.8

realmag7771 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-8624 · realmag777 MDTF – Meta Data and Taxonomies Filter

MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection

EPSS 0.5%CVSS 9.9

Olgu Computer Systems1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-9142 · Olgu Computer Systems e-Belediye

Local File Inclusion (LFI) in Olgu Computer Systems' e-Belediye

EPSS 0.4%CVSS 9.8

Talent Software1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2024-4657 · Talent Software BAP Automation

Strored XSS in Talent Software's BAP Automation

EPSS 0.4%CVSS 9.3

Exnet Informatics Software1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2024-7735 · Exnet Informatics Software Ferry Reservation System

SQLi in Exnet Informatics Software's Ferry Reservation System

EPSS 0.4%CVSS 9.3

National Keep Cyber Security Services1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2024-7108 · National Keep Cyber Security Services CyberMath

Incorrect Authorization in National Keep's CyberMath

EPSS 0.3%CVSS 9.8

Cisco1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2024-20510 · Cisco Cisco IOS XE Software

A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthen…

EPSS 0.3%CVSS 9.3

The archive.