Critical vulnerability archive — page 439

Progress Software Corporation3 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-4885 · Progress Software Corporation WhatsUp Gold

WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

KEV · due 24 Mar EPSS 99%public exploit SSVC act CVSS 9.8

CVE-2024-4883 · Progress Software Corporation WhatsUp Gold

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

EPSS 65%public exploit CVSS 9.8

CVE-2024-4884 · Progress Software Corporation WhatsUp Gold

WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

EPSS 24%CVSS 9.8

craftcms1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-37843 · craftcms craft_cms

Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

EPSS 53%public exploit CVSS 9.8

Fortra1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-5276 · Fortra FileCatalyst Workflow

SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

EPSS 90%public exploit CVSS 9.8

Progress2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-5806 · Progress MOVEit Transfer

MOVEit Transfer Authentication Bypass Vulnerability

EPSS 81%public exploit CVSS 9.8

CVE-2024-5805 · Progress MOVEit Gateway

MOVEit Gateway Authentication Bypass Vulnerability

EPSS 7%CVSS 9.1

mudler1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-5181 · mudler mudler/localai

Command Injection in mudler/localai

EPSS 3%public exploit CVSS 9.8

marKoni4 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-39373 · marKoni Markoni-D (Compact) FM Transmitters

Improper Neutralization of Special Elements used in a Command in TELSAT marKoni FM Transmitter

EPSS 1%public exploit CVSS 9.3

CVE-2024-39375 · marKoni Markoni-D (Compact) FM Transmitters

Use of Client-Side Authentication in TELSAT marKoni FM Transmitter

EPSS 0.6%CVSS 9.8

CVE-2024-39374 · marKoni Markoni-D (Compact) FM Transmitters

Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter

EPSS 0.5%CVSS 9.8

CVE-2024-39376 · marKoni Markoni-D (Compact) FM Transmitters

Improper Access Control In TELSAT MarKoni FM Transmitter

EPSS 0.5%CVSS 9.8

itsourcecode4 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-6373 · itsourcecode Online Food Ordering System

itsourcecode Online Food Ordering System addproduct.php unrestricted upload

EPSS 0.9%public exploit CVSS 9.8

CVE-2024-6308 · itsourcecode Simple Online Hotel Reservation System

itsourcecode Simple Online Hotel Reservation System index.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-6371 · itsourcecode Pool of Bethesda Online Reservation System

itsourcecode Pool of Bethesda Online Reservation System controller.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-6372 · itsourcecode Tailoring Management System

itsourcecode Tailoring Management System customeradd.php sql injection

EPSS 0.6%public exploit CVSS 9.8

openemr1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-37734 · openemr openemr

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.

EPSS 0.8%public exploit CVSS 9.8

farcry1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-35527 · farcry farcry

An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attacke…

EPSS 0.7%public exploit CVSS 9.8

ays-pro1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-6028 · ays-pro Quiz Maker

Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter

EPSS 12%CVSS 9.8

luciapplucky1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-39208 · luciapplucky luci-app-lucky

luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.

EPSS 0.6%public exploit CVSS 9.8

GitLab1 vulnerability on this pageMax CVSS 9.6Priority 48KEV 0

CVE-2024-5655 · GitLab GitLab

Improper Access Control in GitLab

EPSS 7%CVSS 9.6

Rockwell Automation2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-5988 · Rockwell Automation ThinManager® ThinServer™

Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability

EPSS 3%CVSS 9.8

CVE-2024-5989 · Rockwell Automation ThinManager® ThinServer™

Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability

EPSS 2%CVSS 9.8

OpenSSL1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2024-5535 · OpenSSL OpenSSL

SSL_select_next_proto buffer overread

EPSS 6%CVSS 9.1

nltk1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-39705 · nltk nltk

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download…

EPSS 1%CVSS 9.8

warfareplugins1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-6297 · warfareplugins Social Sharing Plugin – Social Warfare

Several WordPress.org Plugins <= Various Versions - Injected Backdoor

EPSS 1%CVSS 10.0

netwrix1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-36072 · netwrix cososys_endpoint_protector

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the log…

EPSS 1%CVSS 9.8

Avaya2 vulnerabilities on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2024-4197 · Avaya IP Office

Avaya IP Office One-X Portal File Upload Vulnerability

EPSS 0.8%CVSS 9.9

CVE-2024-4196 · Avaya IP Office

Avaya IP Office Web Control RCE Vulnerability

EPSS 0.6%CVSS 10.0

Linux2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-39462 · Linux Linux

clk: bcm: dvp: Assign ->num before accessing ->hws

EPSS 0.8%CVSS 9.8

CVE-2024-39293 · Linux Linux

Revert "xsk: Support redirect to any socket bound to the same umem"

EPSS 0.3%CVSS 9.8

soffid1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-39669 · soffid iam

In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects.

EPSS 0.8%CVSS 9.8

FreeRTOS1 vulnerability on this pageMax CVSS 9.6Priority 39KEV 0

CVE-2024-38373 · FreeRTOS FreeRTOS-Plus-TCP

FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser

EPSS 0.6%CVSS 9.6

Intrado1 vulnerability on this pageMax CVSS 10.0Priority 39KEV 0

CVE-2024-1839 · Intrado 911 Emergency Gateway (EGW)

Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthent…

EPSS 0.5%CVSS 10.0

kalkitech1 vulnerability on this pageMax CVSS 9.4Priority 39KEV 0

CVE-2024-36059 · kalkitech ase61850_iedsmart

Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbi…

EPSS 0.7%CVSS 9.4

Magarsus Consultancy1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-4228 · Magarsus Consultancy SSO (Single Sign On)

SQLi in Magarsus Consultancy's SSO

EPSS 0.5%CVSS 9.8

skycaiji1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-39243 · skycaiji skycaiji

An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor…

EPSS 0.5%CVSS 9.8

Talya Informatics3 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-0947 · Talya Informatics Elektraweb

Cookies Manipulation in Talya Informatics' Elektraweb

EPSS 0.5%CVSS 9.8

CVE-2024-0949 · Talya Informatics Elektraweb

Improper Access Control in Talya Informatics' Elektraweb

EPSS 0.5%CVSS 9.8

CVE-2024-1107 · Talya Informatics Travel APPS

IDOR in Talya Informatics' Travel APPS

EPSS 0.5%CVSS 9.8

The Document Foundation1 vulnerability on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2024-5261 · The Document Foundation LibreOffice

TLS certificate are not properly verified when utilizing LibreOfficeKit

EPSS 0.4%CVSS 10.0

gigadevice1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2024-21741 · gigadevice gd32e103c8t6

GigaDevice GD32E103C8T6 devices have Incorrect Access Control.

EPSS 0.4%CVSS 9.8

Icegram1 vulnerability on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2024-37252 · Icegram Email Subscribers & Newsletters

WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability

EPSS 0.5%CVSS 9.3

Salon Booking System1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2024-37231 · Salon Booking System Salon booking system

WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerability

EPSS 0.6%CVSS 9.1

The Conduit Contributors1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2024-6303 · The Conduit Contributors Conduit

Missing Authorization in Conduit

EPSS 0.4%CVSS 9.9

xwiki1 vulnerability on this pageMax CVSS 10.0Priority 36KEV 0

CVE-2024-38369 · xwiki xwiki-platform

XWiki programming rights may be inherited by inclusion

EPSS 0.3%CVSS 10.0

Moxa1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2024-4641 · Moxa OnCell G3150A-LTE Series

OnCell G3470A-LTE Series: Authenticated Format String Errors

EPSS 0.3%CVSS 9.8

Baicells1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2023-6198 · Baicells Snap Router

Hard Coded Credential

EPSS 0.4%CVSS 9.3

Blossom Themes1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2024-37098 · Blossom Themes BlossomThemes Email Newsletter

WordPress BlossomThemes Email Newsletter plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

EPSS 0.3%CVSS 9.8

Phloc1 vulnerability on this pageMax CVSS 9.3Priority 30KEV 0

CVE-2024-6060 · Phloc Webscopes

An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP…

EPSS 0.2%CVSS 9.3

The archive.