Critical vulnerability archive — page 437

CocoaPods3 vulnerabilities on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2024-38366 · CocoaPods CocoaPods

CoacoaPods trunk RCE in email verification system rfc-822

EPSS 18%public exploit CVSS 10.0

CVE-2024-38367 · CocoaPods CocoaPods

CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking

EPSS 11%public exploit CVSS 9.6

CVE-2024-38368 · CocoaPods CocoaPods

Trunk's 'Claim your pod' could be used to obtain un-used pods

EPSS 15%CVSS 9.3

gogs3 vulnerabilities on this pageMax CVSS 9.9Priority 59KEV 0

CVE-2024-39930 · gogs gogs

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.

EPSS 8%public exploit CVSS 9.9

CVE-2024-39932 · gogs gogs

Gogs through 0.13.0 allows argument injection during the previewing of changes.

EPSS 16%public exploit CVSS 9.9

CVE-2024-39931 · gogs gogs

Gogs through 0.13.0 allows deletion of internal files.

EPSS 53%CVSS 9.9

rejetto1 vulnerability on this pageMax CVSS 9.9Priority 59KEV 0

CVE-2024-39943 · rejetto http_file_server

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (…

EPSS 39%public exploit CVSS 9.9

seacms1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-39028 · seacms seacms

An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.

EPSS 1%public exploit CVSS 9.8

ABB2 vulnerabilities on this pageMax CVSS 10.0Priority 50KEV 0

CVE-2024-6298 · ABB ASPECT-Enterprise

remote code execution

EPSS 19%CVSS 10.0

CVE-2024-6209 · ABB ASPECT-Enterprise

unauthorized file access

EPSS 17%CVSS 10.0

eskooly2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-27709 · eskooly web_product

SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of…

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-27710 · eskooly free_online_school_management_software

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authe…

EPSS 0.6%public exploit CVSS 9.8

goanother1 vulnerability on this pageMax CVSS 9.6Priority 50KEV 0

CVE-2024-23998 · goanother another_redis_desktop_manager

goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.

EPSS 0.7%public exploit CVSS 9.6

lukasbach1 vulnerability on this pageMax CVSS 9.6Priority 50KEV 0

CVE-2024-23997 · lukasbach yana

Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.

EPSS 0.7%public exploit CVSS 9.6

mitre4 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-40614 · mitre

EGroupware before 23.1.20240624 mishandles an ORDER BY clause.

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-39165 · mitre

QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP paylo…

EPSS 0.8%CVSS 9.8

CVE-2024-27712 · mitre

An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User…

EPSS 0.6%CVSS 9.8

CVE-2024-37768 · mitre

14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.

EPSS 0.6%CVSS 9.1

SourceCodester2 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-6439 · SourceCodester Home Owners Collection Management System

SourceCodester Home Owners Collection Management System unrestricted upload

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-6440 · SourceCodester Home Owners Collection Management System

SourceCodester Home Owners Collection Management System sql injection

EPSS 0.5%public exploit CVSS 9.8

geotools1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-36404 · geotools geotools

GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

EPSS 76%CVSS 9.8

Grandstream1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-32937 · Grandstream GXP2135

An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 an…

EPSS 27%CVSS 9.8

OpenVPN1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-27903 · OpenVPN OpenVPN 2

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitr…

EPSS 9%CVSS 9.8

parse-community1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-39309 · parse-community parse-server

ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

EPSS 20%CVSS 9.8

znc1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-39844 · znc znc

In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.

EPSS 4%CVSS 9.8

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-38346 · Apache Software Foundation Apache CloudStack

Apache CloudStack: Unauthenticated cluster service port leads to remote execution

EPSS 3%CVSS 9.8

CVE-2024-39864 · Apache Software Foundation Apache CloudStack

Apache CloudStack: Integration API service uses dynamic port when disabled

EPSS 2%CVSS 9.8

N-able2 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-28200 · N-able N-central

N-central Authentication Bypass

EPSS 2%CVSS 9.8

CVE-2024-5322 · N-able N-central

N-central Authentication Bypass via Session Rebinding

EPSS 0.4%CVSS 9.1

volmarg1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-29319 · volmarg personal_management_system

Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file.

EPSS 0.4%public exploit CVSS 9.8

ethyca1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-38537 · ethyca fides

Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

EPSS 1%CVSS 9.8

icegram1 vulnerability on this pageMax CVSS 9.8Priority 43KEV 0

CVE-2024-6172 · icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe

EPSS 1%CVSS 9.8

mySCADA1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-4708 · mySCADA myPRO

mySCADA myPRO Use of Hard-coded Password

EPSS 1.0%CVSS 9.8

Go toolchain1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2023-24531 · Go toolchain cmd/go

Output of "go env" does not sanitize values in cmd/go

EPSS 0.8%CVSS 9.8

gofiber1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2024-38513 · gofiber fiber

Fiber Session Middleware Token Injection Vulnerability

EPSS 0.7%CVSS 10.0

Kiloview5 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

ginuerzh1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-39223 · ginuerzh gost

An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback…

EPSS 0.7%CVSS 9.8

OpenHarmony5 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-36243 · OpenHarmony OpenHarmony

Arkcompiler Ets Runtime has an out-of-bounds read vulnerability

EPSS 0.6%CVSS 9.8

CVE-2024-36260 · OpenHarmony OpenHarmony

Arkcompiler Ets Runtime has an out-of-bounds write vulnerability

EPSS 0.6%CVSS 9.8

CVE-2024-37030 · OpenHarmony OpenHarmony

Arkcompiler Ets Runtime has a use after free vulnerability

EPSS 0.6%CVSS 9.8

CVE-2024-37077 · OpenHarmony OpenHarmony

Arkcompiler Ets Runtime has an out-of-bounds write vulnerability

EPSS 0.6%CVSS 9.8

CVE-2024-37185 · OpenHarmony OpenHarmony

Arkcompiler Ets Runtime has an out-of-bounds write vulnerability

EPSS 0.6%CVSS 9.8

envoyproxy1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2024-39305 · envoyproxy envoy

Envoy Proxy use after free when route hash policy is configured with cookie attributes

EPSS 0.6%CVSS 9.1

Cloud Foundry1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2024-37082 · Cloud Foundry haproxy-boshrelease

When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft H…

EPSS 0.5%CVSS 9.1

Johnson Controls1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-32755 · Johnson Controls American Dynamics Illustra Essentials Gen 4

American Dynamics Illustra Essentials Gen 4 - Log Filter Input Validation

EPSS 0.5%CVSS 9.1

Theme-Ruby1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2024-37260 · Theme-Ruby Foxiz

WordPress Foxiz Theme theme <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

EPSS 0.3%CVSS 9.3

The archive.