Critical vulnerability archive — page 436

ServiceNow2 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 2

CVE-2024-4879 · ServiceNow Now Platform

Jelly Template Injection Vulnerability in ServiceNow UI Macros

KEV · due 19 Aug EPSS 100%public exploit SSVC act CVSS 9.8

CVE-2024-5217 · ServiceNow Now Platform

Incomplete Input Validation in GlideExpression Script

KEV · due 19 Aug EPSS 100%public exploit SSVC act CVSS 9.8

phpvibe1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-39171 · phpvibe phpvibe

Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via wri…

EPSS 1%public exploit CVSS 9.8

b1ackc4t1 vulnerability on this pageMax CVSS 9.1Priority 52KEV 0

CVE-2024-37770 · b1ackc4t 14finger

14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function.

EPSS 2%public exploit CVSS 9.1

LevelOne1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2023-46685 · LevelOne WBR-6013

A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623.

EPSS 1%public exploit CVSS 9.8

zkteco1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-36526 · zkteco zkbio_cvsecurity

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.

EPSS 0.9%public exploit CVSS 9.8

payroll_management_system_project1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-37873 · payroll_management_system_project payroll_management_system

SQL injection vulnerability in view_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remo…

EPSS 0.7%public exploit CVSS 9.8

tenda1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2023-48194 · tenda ac8_firmware

Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \x0.

EPSS 0.6%public exploit CVSS 9.8

magiclen1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2024-21524 · magiclen node-stringbuilder

All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by callin…

EPSS 0.9%public exploit CVSS 9.1

Microsoft4 vulnerabilities on this pageMax CVSS 9.9Priority 49KEV 0

CVE-2024-38077 · Microsoft Windows Server 2019

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

EPSS 84%CVSS 9.8

CVE-2024-38074 · Microsoft Windows Server 2019

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8

CVE-2024-38076 · Microsoft Windows Server 2019

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

EPSS 2%CVSS 9.8

CVE-2024-38089 · Microsoft Microsoft Defender for IoT

Microsoft Defender for IoT Elevation of Privilege Vulnerability

EPSS 1%CVSS 9.9

OpenVPN1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-1305 · OpenVPN tap-windows6

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can…

EPSS 15%CVSS 9.8

itsourcecode1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-37870 · itsourcecode learning_management_system_project_in_php

SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to exe…

EPSS 0.5%public exploit CVSS 9.8

renesas1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-25077 · renesas smartbond_da14695

An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices.

EPSS 0.4%public exploit CVSS 9.8

Unknown1 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-5488 · Unknown SEOPress

SEOPress < 7.9 - Unauthenticated Object Injection

EPSS 4%CVSS 9.8

IETF1 vulnerability on this pageMax CVSS 9.0Priority 46KEV 0

CVE-2024-3596 · IETF RFC

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

EPSS 15%CVSS 9.0

nikolaystrikhar1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-6313 · nikolaystrikhar Gutenberg Forms – WordPress Form Builder Plugin

Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload

EPSS 1%CVSS 9.8

woobewoo1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-6365 · woobewoo Product Table for WooCommerce by WBW

Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution

EPSS 1%CVSS 9.8

Mozilla2 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-6602 · Mozilla Firefox

Memory corruption in NSS

EPSS 1.0%CVSS 9.8

CVE-2024-6611 · Mozilla Firefox

Incorrect handling of SameSite cookies

EPSS 0.7%CVSS 9.8

rmac00011 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-6314 · rmac0001 IQ Testimonials

IQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload

EPSS 0.9%CVSS 9.8

fujiankelixun1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-39071 · fujiankelixun command_and_dispatch_platform

Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.

EPSS 0.8%CVSS 9.8

IBM1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-39742 · IBM MQ Operator

IBM MQ Container authentication bypass

EPSS 0.8%CVSS 9.8

Fortinet1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-27782 · Fortinet FortiAIOps

Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use…

EPSS 0.7%CVSS 9.8

ifm2 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-28747 · ifm Smart PLC AC14xx Firmware

ifm: Use of Hard-coded Credentials

EPSS 0.7%CVSS 9.8

CVE-2024-28751 · ifm Smart PLC AC14xx Firmware

ifm: Hardcoded telnet credentials in Smart PLC

EPSS 0.6%CVSS 9.1

andy_moyle1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2024-37418 · andy_moyle Church Admin

WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Automattic1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2024-37424 · Automattic Newspack Blocks

WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability

EPSS 0.6%CVSS 9.9

Membership Software2 vulnerabilities on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-37112 · Membership Software WishList Member X

WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerability

EPSS 0.5%CVSS 10.0

CVE-2024-37113 · Membership Software WishList Member X

WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Database Backup Download vulnerability

EPSS 0.5%CVSS 9.8

nhibernate1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-39677 · nhibernate nhibernate-core

NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities

EPSS 0.6%CVSS 9.8

Pepperl+Fuchs1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-6422 · Pepperl+Fuchs OIT1500-F113-B12-CB

Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access

EPSS 0.6%CVSS 9.8

photoweblog1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2024-3604 · photoweblog OSM – OpenStreetMap

OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection

EPSS 0.5%CVSS 9.9

ZealousWeb1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-37555 · ZealousWeb Generate PDF using Contact Form 7

WordPress Generate PDF using Contact Form 7 plugin <= 4.1.2 - CSRF to Arbitrary File Upload vulnerability

EPSS 0.6%CVSS 9.8

Checkmk GmbH1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-6163 · Checkmk GmbH Checkmk

local IP restriction of internal HTTP endpoints

EPSS 0.5%CVSS 9.8

Jan Syski1 vulnerability on this pageMax CVSS 9.3Priority 38KEV 0

CVE-2024-6527 · Jan Syski MegaBIP

SQL Injection in MegaBIP

EPSS 0.6%CVSS 9.3

Saturday Drive1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-37934 · Saturday Drive Ninja Forms

WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability

EPSS 0.5%CVSS 9.8

Siemens1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-39872 · Siemens SINEMA Remote Connect Server

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).

EPSS 0.5%CVSS 9.9

WPZita1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-37420 · WPZita Zita Elementor Site Library

WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability

EPSS 0.5%CVSS 9.9

alextselegidis2 vulnerabilities on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2023-38049 · alextselegidis easyappointments

A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.9

CVE-2023-38054 · alextselegidis easyappointments

A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.9

easyappointments6 vulnerabilities on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2023-3287 · easyappointments easyappointments

A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.9

CVE-2023-38048 · easyappointments easyappointments

A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.9

CVE-2023-38051 · easyappointments easyappointments

A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.9

CVE-2023-38052 · easyappointments easyappointments

A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.9

CVE-2023-38053 · easyappointments easyappointments

A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.9

CVE-2023-38055 · easyappointments easyappointments

A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.6

palo_alto1 vulnerability on this pageMax CVSS 9.1Priority 33KEV 0

CVE-2023-38050 · palo_alto

A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0

EPSS 0.4%CVSS 9.1

The archive.