Critical vulnerability archive — page 460

CrushFTP1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2024-4040 · CrushFTP CrushFTP

Unauthenticated arbitrary file read and remote code execution in CrushFTP

KEV · due 1 May EPSS 100%public exploit SSVC act CVSS 10.0

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-27348 · Apache Software Foundation Apache HugeGraph-Server

Apache HugeGraph-Server: Command execution in gremlin

KEV · due 9 Oct EPSS 99%public exploit SSVC act CVSS 9.8

CVE-2024-27349 · Apache Software Foundation Apache HugeGraph-Server

Apache HugeGraph-Server: Bypass whitelist in Auth mode

EPSS 1%CVSS 9.1

f-logic1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-31750 · f-logic datacube3

SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the req_id parameter.

EPSS 19%public exploit CVSS 9.8

judge03 vulnerabilities on this pageMax CVSS 10.0Priority 59KEV 0

CVE-2024-28189 · judge0 judge0

Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link

EPSS 7%public exploit CVSS 10.0

CVE-2024-28185 · judge0 judge0

Judge0 vulnerable to Sandbox Escape via Symbolic Link

EPSS 7%CVSS 10.0

CVE-2024-29021 · judge0 judge0

SSRF into Sandbox Escape through Unsafe Default Configuration

EPSS 20%CVSS 9.1

Ivanti3 vulnerabilities on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-29204 · Ivanti Avalanche

A Heap Overflow vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker t…

EPSS 4%public exploit CVSS 9.8

CVE-2024-24996 · Ivanti Avalanche

A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker t…

EPSS 32%CVSS 9.8

CVE-2024-22061 · Ivanti Avalanche

A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to…

EPSS 4%CVSS 9.8

Tenda4 vulnerabilities on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-3907 · Tenda AC500

Tenda AC500 setcfm formSetCfm stack-based overflow

EPSS 2%public exploit CVSS 9.8

CVE-2024-3908 · Tenda AC500

Tenda AC500 WriteFacMac formWriteFacMac command injection

EPSS 9%CVSS 9.8

CVE-2024-3909 · Tenda AC500

Tenda AC500 execCommand formexeCommand stack-based overflow

EPSS 2%CVSS 9.8

CVE-2024-32318 · tenda ac500_firmware

Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability via the vlan parameter in the formSetVlanInfo function.

EPSS 0.8%CVSS 9.8

andrei-tatar1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-30564 · andrei-tatar nora-firebase-common

An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a craft…

EPSS 1%public exploit CVSS 9.8

flusity1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-32418 · flusity flusity

An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component.

EPSS 1%public exploit CVSS 9.8

sem-cms1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-30938 · sem-cms semcms

SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to obtain sensitive information via the ID parameter in the SEMCMS_U…

EPSS 0.8%public exploit CVSS 9.8

sourcecodester3 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-3948 · SourceCodester Home Clean Service System

SourceCodester Home Clean Service System Photo student.add.php unrestricted upload

EPSS 0.9%public exploit CVSS 9.8

CVE-2024-31546 · sourcecodester computer_laboratory_management_system

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/damage/view_damage.php.

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-31545 · sourcecodester computer_laboratory_management_system

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/?page=user/manage_user&id=6.

EPSS 0.6%CVSS 9.4

dedecms1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-29661 · dedecms dedecms

A File Upload vulnerability in DedeCMS v5.7 allows a local attacker to execute arbitrary code via a crafted payload.

EPSS 0.7%public exploit CVSS 9.8

hexo1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2023-47435 · hexo hexo_themes

An issue in the verifyPassword function of hexo-theme-matery v2.0.0 allows attackers to bypass authentication and access password protect…

EPSS 0.6%public exploit CVSS 9.8

wondercms1 vulnerability on this pageMax CVSS 9.6Priority 50KEV 0

CVE-2024-32340 · wondercms wondercms

A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts…

EPSS 0.7%public exploit CVSS 9.6

h3c1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-32238 · h3c er8300g2-x

H3C ER8300G2-X is vulnerable to Incorrect Access Control.

EPSS 53%CVSS 9.8

mitre2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-31547 · mitre

Computer Laboratory Management System v1.0 is vulnerable to SQL Injection via the "id" parameter of /admin/item/view_item.php.

EPSS 0.6%public exploit CVSS 9.1

CVE-2024-31666 · mitre

An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via a crafted script to the edit_addon_post.php component.

EPSS 2%CVSS 9.8

Peplink2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2023-39367 · Peplink Smart Reader

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU).

EPSS 38%CVSS 9.1

CVE-2023-40146 · Peplink Smart Reader

A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU).

EPSS 1%CVSS 9.8

trainme_acadamy1 vulnerability on this pageMax CVSS 9.1Priority 47KEV 0

CVE-2024-27574 · trainme_acadamy ichin

SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the inf…

EPSS 0.6%public exploit CVSS 9.1

FreeRDP4 vulnerabilities on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-32039 · FreeRDP FreeRDP

FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_data

EPSS 2%CVSS 9.8

CVE-2024-32041 · FreeRDP FreeRDP

FreeRDP OutOfBound Read in zgfx_decompress_segment

EPSS 2%CVSS 9.8

CVE-2024-32458 · FreeRDP FreeRDP

FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle

EPSS 2%CVSS 9.8

CVE-2024-32040 · FreeRDP FreeRDP

FreeRDP vulnerable to integer underflow in nsc_rle_decode

EPSS 2%CVSS 9.8

DerbyNet2 vulnerabilities on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-30922 · derbynet derbynet

SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Re…

EPSS 1%CVSS 9.8

CVE-2024-30923 · DerbyNet DerbyNet

SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer D…

EPSS 1%CVSS 9.8

HashiCorp1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-3817 · HashiCorp Shared library

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

EPSS 1%CVSS 9.8

wazuh1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-32038 · wazuh wazuh

Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8

Deepak anand1 vulnerability on this pageMax CVSS 10.0Priority 41KEV 0

CVE-2024-32599 · Deepak anand WP Dummy Content Generator

WordPress WP Dummy Content Generator plugin <= 3.2.1 - Arbitrary Code Execution vulnerability

EPSS 0.7%CVSS 10.0

Google2 vulnerabilities on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-3845 · Google Chrome

Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy…

EPSS 0.9%CVSS 9.8

CVE-2024-3847 · Google Chrome

Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security pol…

EPSS 0.9%CVSS 9.8

Support Genix1 vulnerability on this pageMax CVSS 9.9Priority 41KEV 0

CVE-2023-49742 · Support Genix Support Genix

WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability

EPSS 0.8%CVSS 9.9

Brocade1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-29966 · Brocade Brocade SANnav

hard-coded credentials in the documentation that appear as the appliance root password

EPSS 0.7%CVSS 9.8

evmos1 vulnerability on this pageMax CVSS 9.1Priority 40KEV 0

CVE-2024-32644 · evmos evmos

Evmos' transaction execution not accounting for all state transition after interaction with precompiles

EPSS 0.9%CVSS 9.1

Linux3 vulnerabilities on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-26853 · Linux Linux

igc: avoid returning frame twice in XDP_REDIRECT

EPSS 0.6%CVSS 9.8

CVE-2024-26877 · Linux Linux

crypto: xilinx - call finalize with bh disabled

EPSS 0.7%CVSS 9.8

CVE-2024-26828 · Linux Linux

cifs: fix underflow in parse_server_interfaces()

EPSS 0.8%CVSS 9.4

Poll Maker & Voting Plugin Team (InfoTheme)1 vulnerability on this pageMax CVSS 9.9Priority 40KEV 0

CVE-2024-32514 · Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker

WordPress WP Poll Maker plugin <= 3.4 - Authenticated Arbitrary File Upload vulnerability

EPSS 0.7%CVSS 9.9

Averta1 vulnerability on this pageMax CVSS 9.6Priority 37KEV 0

CVE-2024-32600 · Averta Master Slider

WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability

EPSS 0.5%CVSS 9.6

Akana1 vulnerability on this pageMax CVSS 9.3Priority 36KEV 0

CVE-2024-2796 · Akana Akana API Platform

SSRF in Akana API Platform

EPSS 0.4%CVSS 9.3

NetApp1 vulnerability on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2024-21990 · NetApp ONTAP Select Deploy administration utility

Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility

EPSS 0.3%CVSS 9.8

The archive.