5 February 2024

13 results · Clear filters · Feed

• Critical 9.8
  CVE-2024-0709

  The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coi…

  Narinder Singh Cryptocurrency Widgets – Price Ticker & Coins List Web / CMS
  Feb 5, 2024
• Critical 9.1
  CVE-2024-0221

  Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename

  The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.8.19 via the rename_item function. This makes it possible for authenticated attackers to rename arbitr…

  10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery Web / CMS
  Feb 5, 2024
• Critical 9.8
  CVE-2023-6989 Scanner template EPSS 57%

  Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion

  The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticat…

  paultgoodchild Shield: Blocks Bots, Protects Users, and Prevents Security Breaches Web / CMS
  Feb 5, 2024
• Critical 9.8
  CVE-2024-0323

  FTP uses unsecure encryption mechanisms

  The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affecte…

  B&R Industrial Automation Automation Runtime
  Feb 5, 2024
• Critical 9.7
  CVE-2024-23108 Public exploit Scanner template EPSS 80%

  An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet…

  Fortinet FortiSIEM Network devices
  Feb 5, 2024
• Critical 9.7
  CVE-2024-23109

  An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet…

  Fortinet FortiSIEM Network devices
  Feb 5, 2024
• Critical 9.8
  CVE-2021-4436 Scanner template

  3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

  The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .ht…

  Web / CMS
  Feb 5, 2024
• Critical 9.8
  CVE-2023-7077

  Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, …

  Sharp Display Solutions P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981
  Feb 5, 2024
• Critical 9.8
  CVE-2024-20011

  In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote…

  MediaTek MT6985, MT8127, MT8135, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8176, MT8183, MT8185, MT8188, MT8188T, MT8195, MT8195Z, MT8312C, MT8312D
  Feb 5, 2024
• Critical 9.8
  CVE-2023-51951

  SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the i…

  Feb 5, 2024
• Critical 9.8
  CVE-2024-24543

  Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi all…

  Feb 5, 2024
• Critical 9.8
  CVE-2024-23049

  An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

  Feb 5, 2024
• Critical 9.8
  CVE-2024-23054

  An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution d…

  Feb 5, 2024