Critical vulnerability archive — page 429

Apache Software Foundation3 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-38856 · Apache Software Foundation Apache OFBiz

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

KEV · due 17 Sep EPSS 99%public exploit SSVC act CVSS 9.8

CVE-2024-36268 · Apache Software Foundation Apache InLong TubeMQ Client

Apache InLong TubeMQ Client: Remote Code Execution vulnerability

EPSS 1%CVSS 9.8

CVE-2024-42447 · Apache Software Foundation Apache Airflow Providers FAB

Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow

EPSS 0.9%CVSS 9.8

Roundcube1 vulnerability on this pageMax CVSS 9.3Priority 98KEV 1

CVE-2024-42009 · Roundcube Webmail

RoundCube Webmail Cross-Site Scripting Vulnerability

KEV · due 30 Jun EPSS 83%public exploit SSVC act CVSS 9.3

anji-plus1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-7314 · anji-plus AJ-Report

anji-plus AJ-Report Authentication Bypass

EPSS 52%public exploit CVSS 9.8

TOTOLINK4 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

Korenix2 vulnerabilities on this pageMax CVSS 9.3Priority 52KEV 0

CVE-2024-7397 · Korenix JetPort 5601v3

Unauthenticated Command Injection

EPSS 1%public exploit CVSS 9.3

CVE-2024-7395 · Korenix JetPort 5601v3

Insufficient Authentication

EPSS 0.9%CVSS 9.3

puneethreddyhc1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-40498 · puneethreddyhc online_shopping_system_advanced

SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the…

EPSS 1%public exploit CVSS 9.8

elunez1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-7458 · elunez eladmin

elunez eladmin Database Management/Deployment Management upload path traversal

EPSS 0.8%public exploit CVSS 9.8

monkeytypegame1 vulnerability on this pageMax CVSS 9.6Priority 51KEV 0

CVE-2024-41127 · monkeytypegame monkeytype

Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.

EPSS 0.9%public exploit CVSS 9.6

itsourcecode5 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-7444 · itsourcecode Ticket Reservation System

itsourcecode Ticket Reservation System Login Page login.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7449 · itsourcecode Placement Management System

itsourcecode Placement Management System login.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-7451 · itsourcecode Placement Management System

itsourcecode Placement Management System apply_now.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7452 · itsourcecode Placement Management System

itsourcecode Placement Management System view_company.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7455 · itsourcecode Tailoring Management System

itsourcecode Tailoring Management System partedit.php sql injection

EPSS 0.5%public exploit CVSS 9.8

AVTech1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-7029 · AVTech AVM1203 (IP Camera)

Command Injection in AVTech AVM1203 (IP Camera)

EPSS 43%CVSS 9.8

Raisecom4 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-7467 · Raisecom MSG1200

Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injection

EPSS 23%CVSS 9.8

CVE-2024-7468 · Raisecom MSG1200

Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injection

EPSS 25%CVSS 9.8

CVE-2024-7469 · Raisecom MSG1200

Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injection

EPSS 25%CVSS 9.8

CVE-2024-7470 · Raisecom MSG1200

Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface vpn_template_style.php sslvpn_config_mod os command injection

EPSS 25%CVSS 9.8

SourceCodester7 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-7374 · SourceCodester Simple Realtime Quiz System

SourceCodester Simple Realtime Quiz System manage_user.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7375 · SourceCodester Simple Realtime Quiz System

SourceCodester Simple Realtime Quiz System my_quiz_result.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7376 · SourceCodester Simple Realtime Quiz System

SourceCodester Simple Realtime Quiz System print_quiz_records.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7377 · SourceCodester Simple Realtime Quiz System

SourceCodester Simple Realtime Quiz System view_result.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7378 · SourceCodester Simple Realtime Quiz System

SourceCodester Simple Realtime Quiz System manage_question.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-7454 · SourceCodester Clinics Patient Management System

SourceCodester Clinics Patient Management System patients.php patient_name sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-7494 · SourceCodester Clinics Patient Management System

SourceCodester Clinics Patient Management System new_prescription.php sql injection

EPSS 0.6%public exploit CVSS 9.8

FOGProject1 vulnerability on this pageMax CVSS 9.3Priority 48KEV 0

CVE-2024-42348 · FOGProject fogproject

FOG leaks sensitive information (AD domain, username and password)

EPSS 0.6%public exploit CVSS 9.3

mitre1 vulnerability on this pageMax CVSS 9.3Priority 48KEV 0

CVE-2024-42008 · mitre

A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote…

EPSS 34%CVSS 9.3

Vivotek5 vulnerabilities on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-7441 · Vivotek SD9364

Vivotek SD9364 httpd read stack-based overflow

EPSS 8%CVSS 9.8

CVE-2024-7440 · Vivotek CC8160

Vivotek CC8160 upload_file.cgi getenv command injection

EPSS 3%CVSS 9.8

CVE-2024-7442 · Vivotek SD9364

Vivotek SD9364 upload_file.cgi getenv command injection

EPSS 3%CVSS 9.8

CVE-2024-7443 · Vivotek IB8367A

Vivotek IB8367A upload_file.cgi getenv command injection

EPSS 3%CVSS 9.8

CVE-2024-7439 · Vivotek CC8160

Vivotek CC8160 httpd read stack-based overflow

EPSS 1%CVSS 9.8

yaycommerce1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-7257 · yaycommerce YayExtra – WooCommerce Extra Product Options

YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function

EPSS 1%CVSS 9.8

any11 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-42458 · any1 neatvnc

server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.

EPSS 0.8%CVSS 9.8

horizoncloud2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-38889 · horizoncloud caterease

An issue in Horizon Business Services Inc.

EPSS 0.8%CVSS 9.8

CVE-2024-38891 · horizoncloud caterease

An issue in Horizon Business Services Inc.

EPSS 0.4%CVSS 9.1

Siemens1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-38879 · Siemens Omnivise T3000 Application Server R9.2

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omn…

EPSS 0.8%CVSS 9.8

Pimax1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-41889 · Pimax Pimax Play

Multiple Pimax products accept WebSocket connections from unintended endpoints.

EPSS 0.7%CVSS 9.8

ForIP Tecnologia1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-7461 · ForIP Tecnologia Administração PABX

ForIP Tecnologia Administração PABX monitcallcenter authMonitCallcenter sql injection

EPSS 0.5%CVSS 9.8

JFrog1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2024-6915 · JFrog Artifactory

JFrog Artifactory Cache Poisoning

EPSS 0.6%CVSS 9.3

elliptic_project1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2024-42461 · elliptic_project elliptic

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

EPSS 0.6%CVSS 9.1

Hamastar Technology2 vulnerabilities on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2024-6117 · Hamastar Technology MeetingHub Paperless Meetings

Hamastar MeetingHub Paperless Meetings - Unrestricted Upload of File with Dangerous Type

EPSS 0.5%CVSS 9.3

CVE-2024-6118 · Hamastar Technology MeetingHub Paperless Meetings

Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password

EPSS 0.5%CVSS 9.3

IBM1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2024-35143 · IBM Planning Analytics Local

IBM Planning Analytics Local missing authentication

EPSS 0.4%CVSS 9.1

The archive.