Critical vulnerability archive — page 476

Progress Software1 vulnerability on this pageMax CVSS 10.0Priority 100KEV 1

CVE-2024-1212 · Progress Software LoadMaster

LoadMaster Pre-Authenticated OS Command Injection

KEV · due 9 Dec EPSS 95%public exploit SSVC act CVSS 10.0

nagios2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-24401 · nagios nagios_xi

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monito…

EPSS 46%public exploit CVSS 9.8

CVE-2024-24402 · nagios nagios_xi

An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd co…

EPSS 3%CVSS 9.8

netis-systems1 vulnerability on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-25850 · netis-systems wf2780_firmware

Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter

EPSS 19%public exploit CVSS 9.8

Totolink2 vulnerabilities on this pageMax CVSS 9.8Priority 59KEV 0

CVE-2024-1781 · Totolink X6000R AX3000

Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection

EPSS 15%public exploit CVSS 9.8

CVE-2024-1783 · Totolink LR1200GB

Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow

EPSS 2%CVSS 9.8

materialsproject1 vulnerability on this pageMax CVSS 9.4Priority 56KEV 0

CVE-2024-23346 · materialsproject pymatgen

pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

EPSS 4%public exploit CVSS 9.4

dromara3 vulnerabilities on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2023-51388 · dromara hertzbeat

HertzBeat AviatorScript Inject RCE

EPSS 1%public exploit CVSS 9.8

CVE-2023-51389 · dromara hertzbeat

HertzBeat SnakeYAML Deser RCE

EPSS 1%public exploit CVSS 9.8

CVE-2023-51653 · dromara hertzbeat

Hertzbeat JMX JNDI RCE

EPSS 2%CVSS 9.8

dompdf1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-25117 · dompdf php-svg-lib

php-svg-lib lacks path validation on font through SVG inline styles

EPSS 0.9%public exploit CVSS 9.8

SourceCodester4 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-1833 · SourceCodester Employee Management System

SourceCodester Employee Management System login.php sql injection

EPSS 0.9%public exploit CVSS 9.8

CVE-2024-1876 · SourceCodester Employee Management System

SourceCodester Employee Management System psubmit.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-1832 · SourceCodester Complete File Management System

SourceCodester Complete File Management System Admin Login Form sql injection

EPSS 0.9%CVSS 9.8

CVE-2024-1831 · SourceCodester Complete File Management System

SourceCodester Complete File Management System Login Form index.php sql injection

EPSS 0.7%CVSS 9.8

tenda1 vulnerability on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-25751 · tenda ac9_firmware

A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to exec…

EPSS 1.0%public exploit CVSS 9.8

code-projects6 vulnerabilities on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-1830 · code-projects Library System

code-projects Library System lost-password.php sql injection

EPSS 0.8%public exploit CVSS 9.8

CVE-2024-1827 · code-projects Library System

code-projects Library System login.php sql injection

EPSS 0.7%public exploit CVSS 9.8

CVE-2024-1820 · code-projects Crime Reporting System

code-projects Crime Reporting System inchargelogin.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-1826 · code-projects Library System

code-projects Library System login.php sql injection

EPSS 0.6%public exploit CVSS 9.8

CVE-2024-1829 · code-projects Library System

code-projects Library System registration.php sql injection

EPSS 0.8%CVSS 9.8

CVE-2024-1828 · code-projects Library System

code-projects Library System registration.php sql injection

EPSS 0.7%CVSS 9.8

lfprojects2 vulnerabilities on this pageMax CVSS 9.6Priority 51KEV 0

CVE-2024-27132 · lfprojects mlflow

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

EPSS 0.9%public exploit CVSS 9.6

CVE-2024-27133 · lfprojects mlflow

Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.

EPSS 0.7%public exploit CVSS 9.6

mintplex-labs2 vulnerabilities on this pageMax CVSS 9.9Priority 51KEV 0

CVE-2024-0455 · mintplex-labs mintplex-labs/anything-llm

SSRF on AWS deployed instances of AnythingLLM via /metadata

EPSS 0.8%public exploit CVSS 9.9

CVE-2024-0440 · mintplex-labs mintplex-labs/anything-llm

SSRF - file:// unsanitized access to underlying host files

EPSS 0.6%public exploit CVSS 9.6

gofiber1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-25124 · gofiber fiber

Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

EPSS 0.7%public exploit CVSS 9.8

niushop1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-25247 · niushop b2b2c_multi-business

SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latit…

EPSS 0.6%public exploit CVSS 9.8

Linux2 vulnerabilities on this pageMax CVSS 9.8Priority 47KEV 0

CVE-2024-26594 · Linux Linux

ksmbd: validate mech token in session setup

EPSS 51%CVSS 9.1

CVE-2024-26592 · Linux Linux

ksmbd: fix UAF issue in ksmbd_tcp_new_connection()

EPSS 1.0%CVSS 9.8

Apache Software Foundation1 vulnerability on this pageMax CVSS 9.1Priority 44KEV 0

CVE-2024-22393 · Apache Software Foundation Apache Answer

Apache Answer: Pixel Flood Attack by uploading the large pixel file

EPSS 2%CVSS 9.1

indo_sol1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2023-49959 · indo_sol profinet_inspektor_nt

In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remo…

EPSS 1%CVSS 9.8

LG Electronics1 vulnerability on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-1885 · LG Electronics LG Signage

Remote Code Execution attack on LG Signage

EPSS 0.9%CVSS 9.8

mitre2 vulnerabilities on this pageMax CVSS 9.8Priority 42KEV 0

CVE-2024-24681 · mitre

An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2).

EPSS 1%CVSS 9.8

CVE-2024-25248 · mitre

SQL Injection vulnerability in the orderGoodsDelivery() function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via t…

EPSS 0.6%CVSS 9.8

Demososo1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-1817 · Demososo DM Enterprise Website Building System

Demososo DM Enterprise Website Building System Cookie indexDM_load.php dmlogin improper authentication

EPSS 0.8%CVSS 9.8

hitrontech1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-25730 · hitrontech coda-4582u_firmware

Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substrin…

EPSS 0.9%CVSS 9.8

langchain1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-27444 · langchain langchain_experimental

langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and exe…

EPSS 0.8%CVSS 9.8

rami1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-27447 · rami pretix

pretix before 2024.1.1 mishandles file validation.

EPSS 0.8%CVSS 9.8

zkteco1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-22988 · zkteco zkbio_wdms

ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because t…

EPSS 0.8%CVSS 9.8

keerti19241 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-1702 · keerti1924 PHP-MYSQL-User-Login-System

keerti1924 PHP-MYSQL-User-Login-System edit.php sql injection

EPSS 0.7%CVSS 9.8

CodeAstro1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-1824 · CodeAstro House Rental Management System

CodeAstro House Rental Management System signing.php sql injection

EPSS 0.6%CVSS 9.8

LINE Corporation1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2024-1735 · LINE Corporation Armeria

A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass auth…

EPSS 0.8%CVSS 9.1

rack-cors_project1 vulnerability on this pageMax CVSS 9.1Priority 39KEV 0

CVE-2024-27456 · rack-cors_project rack-cors

rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.

EPSS 0.8%CVSS 9.1

skinsoft1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-25802 · skinsoft s-museum

SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function.

EPSS 0.6%CVSS 9.8

bentley1 vulnerability on this pageMax CVSS 9.1Priority 38KEV 0

CVE-2024-27455 · bentley assetwise_alim_web

In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attem…

EPSS 0.6%CVSS 9.1

onnx1 vulnerability on this pageMax CVSS 9.1Priority 37KEV 0

CVE-2024-27319 · onnx onnx

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functio…

EPSS 0.6%CVSS 9.1

IBM1 vulnerability on this pageMax CVSS 9.1Priority 36KEV 0

CVE-2022-43842 · IBM Aspera Console

IBM Aspera Console SQL injection

EPSS 0.5%CVSS 9.1

Sitepact1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2024-25928 · Sitepact Sitepact

WordPress Sitepact's Contact Form 7 Extension For Klaviyo Plugin <= 1.0.5 is vulnerable to SQL Injection

EPSS 0.4%CVSS 9.8

silabs.com1 vulnerability on this pageMax CVSS 9.8Priority 33KEV 0

CVE-2023-51392 · silabs.com Ember ZNet SDK

Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM

EPSS 0.2%CVSS 9.8

The archive.