Archive
8 February 2024
Vulnerabilities first published on this day (UTC), newest first.
30 results · Clear filters · Feed
-
Critical 9.1
TokenManager not checking permissions on cached tokens in DIRAC
DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advis…
-
Critical 10.0
OpenObserve Privilege Escalation Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular…
-
Critical 9.1
OpenObserve Unauthorized Access Vulnerability in Users API
OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any a…
-
Critical 9.8
Booking Calendar <= 9.9 - Unauthenticated SQL Injection
The WP Booking Calendar plugin for WordPress is vulnerable to SQL Injection via the 'calendar_request_params[dates_ddmmyy_csv]' parameter in all versions up to, and including, 9.9 due to insufficient escaping on the user supplied parameter and lack of suffici…
-
Critical 9.8
An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific co…
-
Critical 9.8
PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookAction…
-
Critical 9.6CVE-2023-48974 Public exploit
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges…
-
Critical 9.8
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path tr…
-
Critical 9.8
NPM IP package incorrectly identifies some private IP addresses as public
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
-
Critical 9.8
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API…
-
Critical 9.8
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/qu…
-
Critical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, …
-
Critical 9.8
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 p…
-
Critical 9.8
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileC…
-
Critical 9.8
An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.Fil…
-
Critical 9.8
Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file u…
-
Critical 9.8
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php…
-
Critical 9.8
An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.control…
-
Critical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset,…
-
Critical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. An attacker can pass specially crafted offset,…
-
Critical 9.8
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offse…
-
Critical 9.8
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection me…
-
Critical 9.8
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseRespo…
-
Critical 9.8CVE-2024-24495 Public exploit
SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbi…
-
Critical 9.8
File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted …
-
Critical 9.8
An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, an…
-
Critical 9.8
libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authen…
-
Critical 9.8
l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authen…
-
Critical 9.8
php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authen…
-
Critical 9.8
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company lo…