Archive
February 2024
Vulnerabilities first published in this month (UTC), newest first.
898 results · Clear filters · Feed
-
High 7.5
Appwrite Directory Traversal vulnerability
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (T…
-
High 7.2
A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload p…
-
High 8.8
Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_me…
-
High 8.8
code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.
-
High 8.8
Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote …
-
High 8.0
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter i…
-
High 8.8
Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote …
-
High 8.0
A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remot…
-
High 7.0CVE-2024-25423 Public exploit
An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 fi…
-
High 8.8
A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a r…
-
High 7.1
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes…
-
High 8.8
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_co…
-
High 8.8
Kirby vulnerable to unrestricted file upload of user avatar images
An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.
-
High 8.8
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_place…
-
High 7.8
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
A maliciously crafted STP and STEP file, when parsed in ASMIMPORT228A.dll and ASMIMPORT229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption…
-
High 7.7
Improper Enforcement of Behavioral Workflow in GitLab
An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.
-
High 8.7CVE-2024-1451 EPSS 51%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of …
-
High 7.8
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
A maliciously crafted STP, CATPART or MODEL file, when parsed in ASMKERN228A.dll and ASMdatax229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corr…
-
High 7.5
Helm's Missing YAML Content Leads To Panic
Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` fi…
-
High 7.1
Access Request for Entitlement Values with Leading/Trailing Whitespace
An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request.
-
High 7.5
cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is called with both a certificate whose public key did n…
-
High 7.5
WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface
In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.
-
High 8.4
Improper limitation of a pathname to a restricted directory (“path traversal”)
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
KEV Apr 28, 2026 -
High 8.4
The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation d…
-
High 7.1
WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in PowerPack Addons for Elementor PowerPack Pro for Elementor.This issue affects PowerPack Pro for Elementor: from n/a before 2.10.8.
-
High 7.8
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1,…
-
High 7.8
The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14.1, tvOS 17.1, macOS Montere…
-
High 7.5
This issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17.1, watchOS 10…
-
High 7.5
An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 16.7.2 an…
-
High 8.2
An access issue was addressed with improvements to the sandbox. This issue is fixed in macOS Ventura 13.6.3, macOS Sono…
-
High 7.7
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ve…
-
High 7.7CVE-2023-42860 Public exploit
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Montere…
-
High 8.4
The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. An app may be abl…
-
High 7.7
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ve…
-
High 7.8
This issue was addressed with improved handling of symlinks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tv…
-
High 8.8CVE-2024-1675 EPSS 11%
Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass…
-
High 8.8
Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised t…
-
High 8.8
Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attack…
-
High 8.8
Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap co…
-
High 8.4
The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of…