Critical vulnerability archive — page 417

Veeam5 vulnerabilities on this pageMax CVSS 9.9Priority 99KEV 1

CVE-2024-40711 · Veeam Backup and Recovery

Veeam Backup and Replication Deserialization Vulnerability

KEV · due 7 Nov ransomware use EPSS 90%public exploit SSVC act CVSS 9.8

CVE-2024-39714 · Veeam Veeam Service Provider Console

A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code executi…

EPSS 1%CVSS 9.9

CVE-2024-38650 · Veeam Veeam Service Provider Console

An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.

EPSS 0.9%CVSS 9.9

CVE-2024-42024 · Veeam One

A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution…

EPSS 1%CVSS 9.1

CVE-2024-42019 · Veeam One

A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account.

EPSS 0.5%CVSS 9.0

qualitor1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-44849 · qualitor qalitor

Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

EPSS 46%public exploit CVSS 9.8

SPIP1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-8517 · SPIP SPIP

SPIP Bigup Multipart File Upload OS Command Injection

EPSS 95%public exploit CVSS 9.8

thinkphp1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-44902 · thinkphp thinkphp

A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

EPSS 4%public exploit CVSS 9.8

d-link4 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-44402 · d-link di-8100g

D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.

EPSS 3%public exploit CVSS 9.8

CVE-2024-44410 · d-link di-8300

D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.

EPSS 3%public exploit CVSS 9.8

CVE-2024-44411 · d-link di-8300

D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.

EPSS 4%public exploit CVSS 9.8

CVE-2024-44401 · d-link di-8100

D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file

EPSS 3%CVSS 9.8

Unknown2 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-6924 · Unknown TrueBooker

TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi

EPSS 3%public exploit CVSS 9.8

CVE-2024-6928 · Unknown Opti Marketing

Opti Marketing <= 2.0.9 - Unauthenticated SQLi

EPSS 3%public exploit CVSS 9.8

mindsdb1 vulnerability on this pageMax CVSS 9.3Priority 56KEV 0

CVE-2024-24759 · mindsdb mindsdb

MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

EPSS 5%public exploit CVSS 9.3

TOTOLINK2 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-8579 · TOTOLINK AC1200 T8

TOTOLINK AC1200 T8 cstecgi.cgi setWiFiRepeaterCfg buffer overflow

EPSS 1%public exploit CVSS 9.8

CVE-2024-8580 · TOTOLINK AC1200 T8

TOTOLINK AC1200 T8 shadow.sample hard-coded password

EPSS 1%public exploit CVSS 9.2

code-projects1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-8569 · code-projects Hospital Management System

code-projects Hospital Management System user-login.php sql injection

EPSS 0.8%public exploit CVSS 9.8

laurent221 vulnerability on this pageMax CVSS 9.7Priority 51KEV 0

CVE-2024-40643 · laurent22 joplin

Joplin has a parsing error leading to Cross-site Scripting (XSS)

EPSS 0.8%public exploit CVSS 9.7

itsourcecode2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-8567 · itsourcecode Payroll Management System

itsourcecode Payroll Management System ajax.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-8570 · itsourcecode Tailoring Management System

itsourcecode Tailoring Management System inccatadd.php sql injection

EPSS 0.6%public exploit CVSS 9.8

Progress1 vulnerability on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2024-7591 · Progress LoadMaster

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection

EPSS 39%CVSS 10.0

SourceCodesters1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-8565 · SourceCodesters Clinics Patient Management System

SourceCodesters Clinics Patient Management System print_diseases.php sql injection

EPSS 0.7%public exploit CVSS 9.8

h2oai1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2024-45758 · h2oai h2o-3

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command…

EPSS 0.9%public exploit CVSS 9.1

seacms1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-44721 · seacms seacms

SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.

EPSS 0.6%public exploit CVSS 9.8

mini1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-8568 · mini mini-tmall

Mini-Tmall 1 rewardMapper.select sql injection

EPSS 0.5%public exploit CVSS 9.8

openrapid3 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-44838 · openrapid rapidcms

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php.

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-44839 · openrapid rapidcms

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php.

EPSS 0.5%CVSS 9.8

CVE-2024-45771 · openrapid rapidcms

RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php.

EPSS 0.5%CVSS 9.8

Elastic1 vulnerability on this pageMax CVSS 9.9Priority 43KEV 0

CVE-2024-37288 · Elastic Kibana

A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted…

EPSS 1%CVSS 9.9

FreeBSD2 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2024-43102 · FreeBSD FreeBSD

umtx Kernel panic or Use-After-Free

EPSS 0.7%CVSS 10.0

CVE-2024-45063 · FreeBSD FreeBSD

Multiple issues in ctl(4) CAM Target Layer

EPSS 0.5%CVSS 9.8

Baxter1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2024-6795 · Baxter Connex Health Portal

Vulnerability in Baxter Connex Health Portal

EPSS 0.6%CVSS 10.0

DataFlowX Technology1 vulnerability on this pageMax CVSS 10.0Priority 40KEV 0

CVE-2024-6445 · DataFlowX Technology DataDiodeX

Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX

EPSS 0.6%CVSS 10.0

FlyCASS1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-8395 · FlyCASS Cockpit Access Security System (CASS)

FlyCASS Cockpit Access Security System (CASS) SQL Injection

EPSS 0.7%CVSS 9.8

LEARNING DIGITAL1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-8584 · LEARNING DIGITAL Orca HCM

LEARNING DIGITAL Orca HCM - Missing Authentication

EPSS 0.7%CVSS 9.8

PHPGurukul8 vulnerabilities on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2024-8463 · PHPGurukul Job Portal

File upload restriction bypass vulnerability in Job Portal

EPSS 0.5%CVSS 9.9

CVE-2024-8464 · PHPGurukul Job Portal

SQL injection vulnerability in Job Portal

EPSS 0.5%CVSS 9.8

CVE-2024-8465 · PHPGurukul Job Portal

SQL injection vulnerability in Job Portal

EPSS 0.5%CVSS 9.8

CVE-2024-8466 · PHPGurukul Job Portal

SQL injection vulnerability in Job Portal

EPSS 0.5%CVSS 9.8

CVE-2024-8467 · PHPGurukul Job Portal

SQL injection vulnerability in Job Portal

EPSS 0.5%CVSS 9.8

CVE-2024-8468 · PHPGurukul Job Portal

SQL injection vulnerability in Job Portal

EPSS 0.5%CVSS 9.8

CVE-2024-8469 · PHPGurukul Job Portal

SQL injection vulnerability in Job Portal

EPSS 0.5%CVSS 9.8

CVE-2024-8470 · PHPGurukul Job Portal

SQL injection vulnerability in Job Portal

EPSS 0.5%CVSS 9.8

whyun1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-7493 · whyun WPCOM Member

WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta

EPSS 0.6%CVSS 9.8

wppost1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-8292 · wppost WP-Recall – Registration, Profile, Commerce & More

WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update

EPSS 0.6%CVSS 9.8

Profelis Informatics and Consulting1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-7015 · Profelis Informatics and Consulting PassBox

Improper Authentication in Profelis Informatics and Consulting's PassBOX

EPSS 0.4%CVSS 9.8

SourceCodester1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-8561 · SourceCodester PHP CRUD

SourceCodester PHP CRUD Delete Person delete.php sql injection

EPSS 0.4%CVSS 9.8

Hewlett Packard Enterprise (HPE)1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2024-42500 · Hewlett Packard Enterprise (HPE) HPE HP-UX ONCplus

HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.

EPSS 0.4%CVSS 9.3

Ariva Computer1 vulnerability on this pageMax CVSS 9.2Priority 34KEV 0

CVE-2024-1744 · Ariva Computer Accord ORS

IDOR in Ariva Computer's Accord ORS

EPSS 0.4%CVSS 9.2

The archive.