Critical vulnerability archive — page 435

Palo Alto Networks1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-5910 · Palo Alto Networks Expedition

Expedition: Missing Authentication Leads to Admin Account Takeover

KEV · due 28 Nov EPSS 92%public exploit SSVC act CVSS 9.8

aimhubio1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-6396 · aimhubio aimhubio/aim

Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim

EPSS 53%public exploit CVSS 9.8

FOGProject1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-39914 · FOGProject fogproject

FOG has a command injection in /fog/management/export.php?filename=

EPSS 23%public exploit CVSS 9.8

NetScaler1 vulnerability on this pageMax CVSS 9.4Priority 58KEV 0

CVE-2024-6235 · NetScaler NetScaler Console

Sensitive information disclosure

EPSS 21%public exploit CVSS 9.4

gaizhenbiao2 vulnerabilities on this pageMax CVSS 9.1Priority 57KEV 0

CVE-2024-6036 · gaizhenbiao gaizhenbiao/chuanhuchatgpt

Denial of Service in gaizhenbiao/chuanhuchatgpt

EPSS 11%public exploit CVSS 9.1

CVE-2024-6037 · gaizhenbiao gaizhenbiao/chuanhuchatgpt

Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt

EPSS 11%public exploit CVSS 9.1

poultry_farm_management_system_project1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-40110 · poultry_farm_management_system_project poultry_farm_management_system

Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the producti…

EPSS 2%public exploit CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.1Priority 55KEV 0

CVE-2024-5450 · Unknown Bug Library

Bug Library < 2.1.1 - Unauthenticated RCE

EPSS 3%public exploit CVSS 9.1

torrentpier1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-40624 · torrentpier torrentpier

Deserialization of untrusted data in torrentpier/torrentpier

EPSS 1.0%public exploit CVSS 9.8

code-projects2 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-6653 · code-projects Simple Task List

code-projects Simple Task List Login loginForm.php sql injection

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-6745 · code-projects Simple Ticket Booking

code-projects Simple Ticket Booking Login adminauthenticate.php sql injection

EPSS 0.7%public exploit CVSS 9.8

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-6728 · itsourcecode Tailoring Management System

itsourcecode Tailoring Management System typeedit.php sql injection

EPSS 0.6%public exploit CVSS 9.8

sni1 vulnerability on this pageMax CVSS 10.0Priority 49KEV 0

CVE-2024-39915 · sni Thruk

Authenticated remote code execution in Thruk

EPSS 0.6%public exploit CVSS 10.0

tenda3 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-40416 · tenda ax1806_firmware

A vulnerability in /goform/SetVirtualServerCfg in the sub_6320C function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer ove…

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-40414 · tenda ax1806_firmware

A vulnerability in /goform/SetNetControlList in the sub_656BC function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overf…

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-40415 · tenda ax1806

A vulnerability in /goform/SetStaticRouteCfg in the sub_519F4 function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overf…

EPSS 0.5%public exploit CVSS 9.8

witmy6 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-6679 · witmy my-springsecurity-plus

witmy my-springsecurity-plus role sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-40539 · witmy my-springsecurity-plus

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user.

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-6680 · witmy my-springsecurity-plus

witmy my-springsecurity-plus build sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-6681 · witmy my-springsecurity-plus

witmy my-springsecurity-plus dept sql injection

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-40541 · witmy my-springsecurity-plus

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dep…

EPSS 0.4%public exploit CVSS 9.8

CVE-2024-40542 · witmy my-springsecurity-plus

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/rol…

EPSS 0.4%public exploit CVSS 9.8

EVerest1 vulnerability on this pageMax CVSS 9.1Priority 48KEV 0

CVE-2024-37310 · EVerest everest-core

EVerest has an integer overflow in the "v2g_incoming_v2gtp" function

EPSS 0.7%public exploit CVSS 9.1

GitLab1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-6385 · GitLab GitLab

Improper Access Control in GitLab

EPSS 7%CVSS 9.8

codermy1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-40540 · codermy my-springsecurity-plus

my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/dept.

EPSS 0.5%public exploit CVSS 9.8

parorrey1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-6624 · parorrey JSON API User

JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

EPSS 3%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-36522 · Apache Software Foundation Apache Wicket

Apache Wicket: Remote code execution via XSLT injection

EPSS 2%CVSS 9.8

anhvnit1 vulnerability on this pageMax CVSS 9.3Priority 45KEV 0

CVE-2024-37933 · anhvnit Woocommerce OpenPos

WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated SQL Injection vulnerability

EPSS 0.4%public exploit CVSS 9.3

supermicro1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-36435 · supermicro x13swa-tf_firmware

An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules).

EPSS 1%CVSS 9.8

yuque1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-40524 · yuque xmind2testcase

Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.…

EPSS 1%CVSS 9.8

Broadcom3 vulnerabilities on this pageMax CVSS 9.4Priority 41KEV 0

CVE-2024-36456 · Broadcom Symantec Privileged Access Management

Symantec Privileged Access Manager Remote Command Execution vulnerability

EPSS 0.9%CVSS 9.4

CVE-2024-38492 · Broadcom Symantec Privileged Access Management

Symantec Privileged Access Manager Remote Command Execution vulnerability

EPSS 0.9%CVSS 9.4

CVE-2024-36455 · Broadcom Symantec Privileged Access Management

Symantec Privileged Access Manager Remote Command Execution vulnerability

EPSS 0.5%CVSS 9.4

Cellopoint1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-6744 · Cellopoint Secure Email Gateway

The SMTP Listener of Secure Email Gateway from Cellopoint does not properly validate user input, leading to a Buffer Overflow vulnerability.

EPSS 0.8%CVSS 9.8

Linux5 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

AguardNet1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-6743 · AguardNet Space Management System

AguardNet Space Management System - SQL injection

EPSS 0.7%CVSS 9.8

inspireui1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-6328 · inspireui MStore API – Create Native Android & iOS Apps On The Cloud

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass

EPSS 0.7%CVSS 9.8

instawp1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-6397 · instawp InstaWP Connect – 1-click WP Staging & Migration

InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin

EPSS 0.7%CVSS 9.8

HP Inc.1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-4143 · HP Inc. Certain HP PC Products

Certain HP PC products using AMI BIOS – Buffer Overflow

EPSS 0.6%CVSS 9.8

neutrinolabs1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-39917 · neutrinolabs xrdp

xrdp allows an ininite number of login attempts

EPSS 0.6%CVSS 9.8

NooTheme1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-37927 · NooTheme Jobmonster

WordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerability

EPSS 0.5%CVSS 9.8

Schneider Electric1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-6407 · Schneider Electric Wiser Home Controller WHC-5918A

CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to…

EPSS 0.4%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-39736 · IBM Datacap Navigator

IBM Datacap Navigator HTTP HOST header injection

EPSS 0.4%CVSS 9.8

Realtyna1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-38736 · Realtyna Realtyna Organic IDX plugin

WordPress Realtyna Organic IDX plugin <= 4.14.13 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.1

SpreadsheetConverter1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-38734 · SpreadsheetConverter Import Spreadsheets from Microsoft Excel

WordPress Import Spreadsheets from Microsoft Excel plugin <= 10.1.4 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.1

NAVER1 vulnerability on this pageMax CVSS 9.6Priority 35KEV 0

CVE-2024-40618 · NAVER NAVER Whale browser

Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-…

EPSS 0.4%CVSS 9.6

The archive.