Critical vulnerability archive — page 450

GitHub1 vulnerability on this pageMax CVSS 10.0Priority 57KEV 0

CVE-2024-4985 · GitHub Enterprise Server

An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authenticati…

EPSS 3%public exploit CVSS 10.0

argoproj1 vulnerability on this pageMax CVSS 9.1Priority 52KEV 0

CVE-2024-31989 · argoproj argo-cd

ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

EPSS 1%public exploit CVSS 9.1

blackprint1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-24294 · blackprint blackprint_engine

A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepP…

EPSS 0.8%public exploit CVSS 9.8

SourceCodester7 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-5116 · SourceCodester Online Examination System

SourceCodester Online Examination System save.php sql injection

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-5118 · SourceCodester Event Registration System

SourceCodester Event Registration System login.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-5122 · SourceCodester Event Registration System

SourceCodester Event Registration System sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-5120 · SourceCodester Event Registration System

SourceCodester Event Registration System sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-5117 · SourceCodester Event Registration System

SourceCodester Event Registration System portal.php sql injection

EPSS 0.7%CVSS 9.8

CVE-2024-5119 · SourceCodester Event Registration System

SourceCodester Event Registration System sql injection

EPSS 0.6%CVSS 9.8

CVE-2024-5134 · SourceCodester Electricity Consumption Monitoring Tool

SourceCodester Electricity Consumption Monitoring Tool delete-bill.php sql injection

EPSS 0.6%CVSS 9.8

linuxmint1 vulnerability on this pageMax CVSS 9.0Priority 50KEV 0

CVE-2024-36053 · linuxmint mintupload

In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in c…

EPSS 1%public exploit CVSS 9.0

PHPGurukul1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-5135 · PHPGurukul Directory Management System

PHPGurukul Directory Management System index.php sql injection

EPSS 0.7%public exploit CVSS 9.8

Fluent Bit1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-4323 · Fluent Bit Fluent Bit

Fluent Bit Memory Corruption Vulnerability

EPSS 27%CVSS 9.8

Linux19 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2023-52755 · Linux Linux

ksmbd: fix slab out of bounds write in smb_inherit_dacl()

EPSS 28%CVSS 9.8

CVE-2021-47378 · Linux Linux

nvme-rdma: destroy cm id before destroy qp to avoid use after free

EPSS 1%CVSS 9.8

CVE-2024-35960 · Linux Linux

net/mlx5: Properly link new fs rules into the tree

EPSS 1%CVSS 9.1

CVE-2021-47274 · Linux Linux

tracing: Correct the length check which causes memory corruption

EPSS 0.8%CVSS 9.8

CVE-2021-47328 · Linux Linux

scsi: iscsi: Fix conn use after free during resets

EPSS 0.8%CVSS 9.8

CVE-2023-52735 · Linux Linux

bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

EPSS 1%CVSS 9.1

CVE-2023-52832 · Linux Linux

wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

EPSS 1%CVSS 9.1

CVE-2021-47232 · Linux Linux

can: j1939: fix Use-after-Free, hold skb ref while in use

EPSS 0.6%CVSS 9.8

CVE-2021-47348 · Linux Linux

drm/amd/display: Avoid HDCP over-read and corruption

EPSS 1.0%CVSS 9.1

CVE-2023-52741 · Linux Linux

cifs: Fix use-after-free in rdata->read_into_pages()

EPSS 0.7%CVSS 9.8

CVE-2024-35884 · Linux Linux

udp: do not accept non-tunnel GSO skbs landing in a tunnel

EPSS 0.7%CVSS 9.8

CVE-2024-35870 · Linux Linux

smb: client: fix UAF in smb2_reconnect_server()

EPSS 0.6%CVSS 9.8

CVE-2021-47354 · Linux Linux

drm/sched: Avoid data corruptions

EPSS 0.7%CVSS 9.1

CVE-2021-47427 · Linux Linux

scsi: iscsi: Fix iscsi_task use after free

EPSS 0.5%CVSS 9.8

CVE-2021-47478 · Linux Linux

isofs: Fix out of bound access for corrupted isofs image

EPSS 0.7%CVSS 9.1

CVE-2021-47496 · Linux Linux

net/tls: Fix flipped sign in tls_err_abort() calls

EPSS 0.5%CVSS 9.8

CVE-2023-52732 · Linux Linux

ceph: blocklist the kclient when receiving corrupted snap trace

EPSS 0.5%CVSS 9.8

CVE-2023-52801 · Linux Linux

iommufd: Fix missing update of domains_itree after splitting iopt_area

EPSS 0.6%CVSS 9.1

CVE-2024-35939 · Linux Linux

dma-direct: Leak pages on dma_set_decrypted() failure

EPSS 0.2%CVSS 9.3

strategy11team1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-4443 · strategy11team Business Directory Plugin – Easy Listing Directories for WordPress

Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter

EPSS 10%CVSS 9.8

tenda2 vulnerabilities on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-35571 · tenda ax1806_firmware

Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-35580 · tenda ax1806_firmware

Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.

EPSS 0.6%public exploit CVSS 9.8

trustyplugins1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-3495 · trustyplugins Country State City Dropdown CF7

Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection

EPSS 14%CVSS 9.8

mtab1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-35361 · mtab bookmark

MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon.

EPSS 0.5%public exploit CVSS 9.8

webidsupport1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-35409 · webidsupport webid

WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php.

EPSS 0.5%public exploit CVSS 9.8

wistron1 vulnerability on this pageMax CVSS 9.9Priority 47KEV 0

CVE-2024-33226 · wistron tbt_force_power_cpntrol

An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges an…

EPSS 0.4%public exploit CVSS 9.9

ZkTeco3 vulnerabilities on this pageMax CVSS 10.0Priority 44KEV 0

CVE-2023-3939 · ZkTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0

Multiple command injection in ZkTeco-based OEM devices

EPSS 1%CVSS 10.0

CVE-2023-3941 · ZkTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0

Multiple arbitrary file writes in ZkTeco-based OEM devices

EPSS 0.9%CVSS 10.0

CVE-2023-3943 · ZkTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0

Multiple buffer overflow in ZkTeco-based OEM devices

EPSS 0.9%CVSS 10.0

wpzoom1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-5147 · wpzoom WPZOOM Addons for Elementor – Starter Templates & Widgets

WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion

EPSS 1%CVSS 9.8

wordpresschef1 vulnerability on this pageMax CVSS 9.1Priority 41KEV 0

CVE-2024-4442 · wordpresschef Salon Booking System – Free Version

Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion

EPSS 1%CVSS 9.1

nasa1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-35056 · nasa ait-core

NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions.

EPSS 0.6%CVSS 9.8

westermo1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-36081 · westermo edw-100

Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password.

EPSS 0.6%CVSS 9.8

westernmo1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-36080 · westernmo edw_100

Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed.

EPSS 0.6%CVSS 9.8

openlibraryfoundation1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2024-25738 · openlibraryfoundation vufind

A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 befo…

EPSS 0.7%CVSS 9.1

lunary-ai1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2024-3761 · lunary-ai lunary-ai/lunary

Missing Authorization on Delete Datasets in lunary-ai/lunary

EPSS 0.5%CVSS 9.1

mitre1 vulnerability on this pageMax CVSS 9.4Priority 35KEV 0

CVE-2024-34947 · mitre

Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redir…

EPSS 0.4%CVSS 9.4

The archive.