Critical vulnerability archive — page 462

Palo Alto Networks2 vulnerabilities on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2024-3400 · Palo Alto Networks PAN-OS

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

KEV · due 19 Apr ransomware use EPSS 100%public exploit SSVC act CVSS 10.0

CVE-2024-3383 · Palo Alto Networks PAN-OS

PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)

EPSS 0.6%CVSS 9.1

Jordy Meow1 vulnerability on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2023-51409 · Jordy Meow AI Engine: ChatGPT Chatbot

WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability

EPSS 63%public exploit CVSS 10.0

xwiki10 vulnerabilities on this pageMax CVSS 10.0Priority 60KEV 0

CVE-2024-31982 · xwiki xwiki-platform

XWiki Platform: Remote code execution as guest via DatabaseSearch

EPSS 35%public exploit CVSS 10.0

CVE-2024-31984 · xwiki xwiki-platform

XWiki Platform: Remote code execution through space title and Solr space facet

EPSS 83%public exploit CVSS 10.0

CVE-2024-31996 · xwiki xwiki-commons

XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution

EPSS 2%public exploit CVSS 10.0

CVE-2024-31983 · xwiki xwiki-platform

XWiki Platform: Remote code execution from edit in multilingual wikis via translations

EPSS 1%public exploit CVSS 10.0

CVE-2024-31987 · xwiki xwiki-platform

XWiki Platform remote code execution from account via custom skins support

EPSS 1%public exploit CVSS 10.0

CVE-2024-31465 · xwiki xwiki-platform

XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

EPSS 76%CVSS 10.0

CVE-2024-31988 · xwiki xwiki-platform

XWiki Platform CSRF remote code execution through the realtime HTML Converter API

EPSS 0.7%public exploit CVSS 9.7

CVE-2024-31997 · xwiki xwiki-platform

XWiki Platform remote code execution from account through UIExtension parameters

EPSS 74%CVSS 10.0

CVE-2024-31986 · xwiki xwiki-platform

XWiki Platform CSRF remote code execution through scheduler job's document reference

EPSS 0.5%public exploit CVSS 9.1

CVE-2024-31981 · xwiki xwiki-platform

XWiki Platform: Privilege escalation (PR) from user registration through PDFClass

EPSS 1%CVSS 10.0

parisneo3 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-1520 · parisneo parisneo/lollms-webui

OS Command Injection in parisneo/lollms-webui

EPSS 48%public exploit CVSS 9.8

CVE-2024-1600 · parisneo parisneo/lollms-webui

Local File Inclusion in parisneo/lollms-webui

EPSS 33%public exploit CVSS 9.3

CVE-2024-1511 · parisneo parisneo/lollms-webui

Path Traversal Vulnerability in parisneo/lollms-webui

EPSS 1.0%public exploit CVSS 9.8

traccar1 vulnerability on this pageMax CVSS 9.7Priority 59KEV 0

CVE-2024-31214 · traccar traccar

Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution

EPSS 18%public exploit CVSS 9.7

wwbn1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-31819 · wwbn avideo

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the…

EPSS 16%public exploit CVSS 9.8

Node.js1 vulnerability on this pageMax CVSS 9.8Priority 58KEV 0

CVE-2024-3566 · Node.js Node.js

Command injection vulnerability in programing languages on Microsoft Windows operating system.

EPSS 7%public exploit CVSS 9.8

mudler1 vulnerability on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-2029 · mudler mudler/localai

Command Injection in mudler/localai

EPSS 3%public exploit CVSS 9.8

derbynet1 vulnerability on this pageMax CVSS 9.8Priority 56KEV 0

CVE-2024-31818 · derbynet derbynet

Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kios…

EPSS 2%public exploit CVSS 9.8

aimhubio1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-2195 · aimhubio aimhubio/aim

Remote Code Execution in aimhubio/aim

EPSS 2%public exploit CVSS 9.8

qdrant1 vulnerability on this pageMax CVSS 9.8Priority 55KEV 0

CVE-2024-2221 · qdrant qdrant/qdrant

Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant

EPSS 2%public exploit CVSS 9.8

berriai1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-2952 · berriai berriai/litellm

Server-Side Template Injection in BerriAI/litellm

EPSS 1%public exploit CVSS 9.8

Campcodes2 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-3534 · Campcodes Church Management System

Campcodes Church Management System login.php sql injection

EPSS 1%public exploit CVSS 9.8

CVE-2024-3535 · Campcodes Church Management System

Campcodes Church Management System index.php sql injection

EPSS 1%public exploit CVSS 9.8

mintplex-labs1 vulnerability on this pageMax CVSS 9.9Priority 52KEV 0

CVE-2024-3025 · mintplex-labs mintplex-labs/anything-llm

Path Traversal in mintplex-labs/anything-llm

EPSS 1%public exploit CVSS 9.9

PHPGurukul1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-3691 · PHPGurukul Small CRM

PHPGurukul Small CRM Registration Page sql injection

EPSS 0.9%public exploit CVSS 9.8

run-llama1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-3098 · run-llama run-llama/llama_index

Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index

EPSS 1.0%public exploit CVSS 9.8

cym11024 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-3740 · cym1102 nginxWebUI

cym1102 nginxWebUI reload exec deserialization

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-3738 · cym1102 nginxWebUI

cym1102 nginxWebUI saveCmd handlePath certificate validation

EPSS 0.5%public exploit CVSS 9.8

CVE-2024-3739 · cym1102 nginxWebUI

cym1102 nginxWebUI upload os command injection

EPSS 3%CVSS 9.8

CVE-2024-3737 · cym1102 nginxWebUI

cym1102 nginxWebUI addOver findCountByQuery path traversal

EPSS 0.9%CVSS 9.8

dedecms1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-3685 · dedecms dedecms

DedeCMS stepselect_main.php sql injection

EPSS 0.6%public exploit CVSS 9.8

lunary-ai3 vulnerabilities on this pageMax CVSS 9.1Priority 48KEV 0

CVE-2024-1643 · lunary-ai lunary-ai/lunary

Unauthorized Organization Access in lunary-ai/lunary

EPSS 0.7%public exploit CVSS 9.1

CVE-2024-1741 · lunary-ai lunary-ai/lunary

Improper Authorization in lunary-ai/lunary

EPSS 0.6%public exploit CVSS 9.1

CVE-2024-1740 · lunary-ai lunary-ai/lunary

Incorrect Authorization in lunary-ai/lunary

EPSS 0.6%CVSS 9.1

mysql21 vulnerability on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-21508 · mysql2 mysql2

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper va…

EPSS 3%CVSS 9.8

huggingface1 vulnerability on this pageMax CVSS 9.6Priority 45KEV 0

CVE-2024-3568 · huggingface huggingface/transformers

Arbitrary Code Execution via Deserialization in huggingface/transformers

EPSS 2%CVSS 9.6

Adobe1 vulnerability on this pageMax CVSS 9.0Priority 42KEV 0

CVE-2024-20758 · Adobe Adobe Commerce

Adobe Commerce | Improper Input Validation (CWE-20)

EPSS 1%CVSS 9.0

openstack1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-28718 · openstack magnum-yoga-eom

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py.

EPSS 1%CVSS 9.8

Google1 vulnerability on this pageMax CVSS 9.6Priority 41KEV 0

CVE-2024-3157 · Google Chrome

Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had compromised the GPU…

EPSS 0.8%CVSS 9.6

OpenGnsys1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-3704 · OpenGnsys OpenGnsys

SQL Injection vulnerability in OpenGnsys

EPSS 0.7%CVSS 9.8

HCL Software1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2023-50347 · HCL Software DRYiCE MyXalytics

Insecure SQL Interface affects HCL DRYiCE MyXalytics

EPSS 0.6%CVSS 9.8

loan_management_system_project1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-31678 · loan_management_system_project loan_management_system

Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file.

EPSS 0.6%CVSS 9.8

mitre1 vulnerability on this pageMax CVSS 9.6Priority 39KEV 0

CVE-2024-22718 · mitre

Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the ap…

EPSS 0.7%CVSS 9.6

Juniper Networks, Inc.1 vulnerability on this pageMax CVSS 9.2Priority 38KEV 0

CVE-2024-30407 · Juniper Networks, Inc. cRPD

[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks

EPSS 0.7%CVSS 9.2

Linux1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2021-47215 · Linux Linux

net/mlx5e: kTLS, Fix crash in RX resync flow

EPSS 0.5%CVSS 9.8

makeplane1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2024-31461 · makeplane plane

Plane Server-Side Request Forgery (SSRF) Vulnerability

EPSS 0.7%CVSS 9.1

IOSiX1 vulnerability on this pageMax CVSS 9.6Priority 33KEV 0

CVE-2024-28878 · IOSiX IO-1020 Micro ELD

IOSIX IO-1020 Micro ELD Download of Code Without Integrity Check

EPSS 0.3%CVSS 9.6

The archive.