Skip to content
OpenAdvisories

Archive

13 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /13 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

182 results · Feed

  • Medium 5.3
    CVE-2024-24740

    Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel)

    SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.93, KERNEL 7.94, KRNL64UC 7.53, under certain conditions, allows an attacker to access information which could otherwise be restricted…

    SAP SAP NetWeaver Application Server ABAP (SAP Kernel)
  • Medium 6.3
    CVE-2024-24739

    Missing authorization check in SAP BAM (Bank Account Management)

    SAP Bank Account Management (BAM) allows an authenticated user with restricted access to use functions which can result in escalation of privileges with low impact on confidentiality, integrity and availability of the application.

    SAP SAP BAM (Bank Account Management)
  • High 7.4
    CVE-2024-22132

    Code Injection vulnerability in SAP IDES Systems

    SAP IDES ECC-systems contain code that permits the execution of arbitrary program code of user's choice.An attacker can therefore control the behaviour of the system by executing malicious code which can potentially escalate privileges with low impact on conf…

    SAP SAP IDES Systems
  • Critical 9.1
    CVE-2024-22131

    Code Injection vulnerability in SAP ABA (Application Basis)

    In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an ap…

    SAP SAP ABA (Application Basis)
  • High 7.6
    CVE-2024-22130

    Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

    Print preview option in SAP CRM WebClient UI - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, S4FND 108, WEBCUIF 700, WEBCUIF 701, WEBCUIF 730, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not …

    SAP SAP CRM (WebClient UI)
  • Medium 4.7
    CVE-2024-22128

    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Business Client for HTML

    SAP NWBC for HTML - versions SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An unauthentic…

    SAP SAP NetWeaver Business Client for HTML
  • Medium 6.1
    CVE-2024-22126

    Cross Site Scripting vulnerability in SAP NetWeaver AS Java (User Admin Application)

    The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading …

    SAP SAP NetWeaver AS JAVA (User Admin Application)
  • Critical 9.1
    CVE-2023-50808

    Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.

  • High 7.3
    CVE-2023-38960

    Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain pr…

  • Medium 6.1
    CVE-2023-48432

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can …

  • Medium 6.1
    CVE-2023-45206

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webm…

  • Medium 6.1
    CVE-2023-45207

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document throug…

  • Medium 5.4
    CVE-2023-52059

    A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML…

  • High 8.8
    CVE-2023-52431

    The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism …

  • Medium 4.3
    CVE-2023-52060

    A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information vi…

  • Critical 9.8
    CVE-2023-42374

    An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a deni…

  • Medium 6.5
    CVE-2023-26562

    In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messa…

  • Medium 6.5
    CVE-2023-49339 Public exploit

    Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/…

  • Critical 9.1
    CVE-2022-48623

    The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obt…

    libcpanel-json-xs-perl libcpanel-json-xs-perl perl-Cpanel-JSON-XS Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2024-24142 Public exploit

    Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.

  • High 7.5
    CVE-2024-25407

    SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnera…

  • Critical 9.8
    CVE-2024-22923

    SQL injection vulnerability in adv radius v.2.2.5 allows a local attacker to execute arbitrary code via a crafted scrip…