The archive.

CVE-2024-34365 · Apache Software Foundation Apache Karaf Cave

Apache Karaf Cave: Cave SSRF and arbitrary file access

EPSS 1%CVSS 9.1

CyberPower1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-32735 · CyberPower CyberPower PowerPanel Enterprise

CyberPower PowerPanel Enterprise Missing Authentication

EPSS 7%public exploit CVSS 9.8

totolink2 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-34257 · totolink ex1800t_firmware

TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbit…

EPSS 4%public exploit CVSS 9.8

CVE-2024-34204 · totolink cp450_firmware

TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW functio…

EPSS 2%public exploit CVSS 9.8

BlueNet Technology1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-4654 · BlueNet Technology Clinical Browsing System

BlueNet Technology Clinical Browsing System cloudInterface.php sql injection

EPSS 0.8%public exploit CVSS 9.8

guangzhou_luhua_information_technology3 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-25517 · guangzhou_luhua_information_technology ruvaroa

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx.

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-25519 · guangzhou_luhua_information_technology ruvaroa

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx.

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-25529 · guangzhou_luhua_information_technology ruvaroa

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_histor…

ruvar12 vulnerabilities on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-25520 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new…

CVE-2024-25523 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx.

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-25525 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownl…

CVE-2024-25530 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condic…

CVE-2024-25531 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondictio…

CVE-2024-25533 · ruvar ruvarOA

Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx).

EPSS 0.7%public exploit CVSS 9.4

CVE-2024-25518 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_field…

CVE-2024-25521 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx.

CVE-2024-25522 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_wor…

CVE-2024-25524 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/Work…

CVE-2024-25532 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx.

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-25527 · ruvar ruvarOA

RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_templat…

EPSS 0.5%public exploit CVSS 9.4

SolarWinds2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-28075 · SolarWinds Access Rights Manager

SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution

EPSS 78%CVSS 9.0

CVE-2024-23473 · SolarWinds Access Rights Manager

SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability

fermyon1 vulnerability on this pageMax CVSS 9.1Priority 46KEV 0

CVE-2024-32980 · fermyon spin

Spin contains a potential network sandbox escape for specifically configured Spin applications

EPSS 0.5%public exploit CVSS 9.1

ruby-lang1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-27280 · ruby-lang ruby

A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.

EPSS 2%CVSS 9.8

Google3 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-4558 · Google Chrome

Use after free in ANGLE in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a c…

EPSS 2%CVSS 9.6

CVE-2024-23708 · Google Android

In multiple functions of NotificationManagerService.java, there is a possible way to not show a toast message when a clipboard message ha…

EPSS 0.3%CVSS 9.8

CVE-2024-23705 · Google Android

In multiple locations, there is a possible failure to persist or enforce user restrictions due to improper input validation.

EPSS 0.3%CVSS 9.8

tiagorlampert1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-33434 · tiagorlampert chaos

An issue in tiagorlampert CHAOS v5.0.1 before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allow…

wshberlin2 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-4345 · wshberlin Startklar Elementor Addons

Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Upload

CVE-2024-4346 · wshberlin Startklar Elementor Addons

Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion

EPSS 2%CVSS 9.1

hdfgroup3 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-29159 · hdfgroup hdf5

HDF5 through 1.14.3 contains a buffer overflow in H5Z__filter_scaleoffset, resulting in the corruption of the instruction pointer and cau…

CVE-2024-29157 · hdfgroup hdf5

HDF5 through 1.14.3 contains a heap buffer overflow in H5HG_read, resulting in the corruption of the instruction pointer and causing deni…

CVE-2024-29164 · hdfgroup hdf5

HDF5 through 1.14.3 contains a stack buffer overflow in H5R__decode_heap, resulting in the corruption of the instruction pointer and caus…

hsc1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-32370 · hsc mailinspector

An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a remote attacker to obtain sensitive information via a cra…

roothub_project1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-33120 · roothub_project roothub

Roothub v2.5 was discovered to contain an arbitrary file upload vulnerability via the customPath parameter in the upload() function.

EPSS 0.8%CVSS 9.8

thenbrent1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-4393 · thenbrent Social Connect

Social Connect <= 1.2 - Authentication Bypass

EPSS 0.8%CVSS 9.8

wisdmlabs1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-4186 · wisdmlabs Edwiser Bridge – WordPress Moodle Integration

Edwiser Bridge <= 3.0.5 - Authentication Bypass due to Missing Empty Value Check

dromara1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-33153 · dromara j2eefast

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the commentList() function.

j2eefast3 vulnerabilities on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-33155 · j2eefast j2eefast

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the getDeptList() function.

CVE-2024-33164 · j2eefast j2eefast

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the authUserList() function.

CVE-2024-33146 · j2eefast j2eefast

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the sql_filter parameter in the export function.

EPSS 0.5%CVSS 9.1

mitre1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2024-26517 · mitre

SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload t…

EPSS 0.8%CVSS 9.1

scable1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-31961 · scable shopfloor_guide

A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands…