Archive
February 2024
Vulnerabilities first published in this month (UTC), newest first.
2,826 results · Feed
-
High 7.8
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in th…
-
Medium 4.3
Missing Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' set…
-
High 7.5
The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows att…
-
Medium 6.5CVE-2023-52160 Public exploit
The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_su…
-
High 7.5
Appwrite Directory Traversal vulnerability
The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APP_STORAGE_CERTIFICATES/.well-known/acme-challenge must exist on disk. (T…
-
High 7.2
A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload p…
-
High 8.8
Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_me…
-
High 8.8
code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.
-
High 8.8
Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote …
-
Medium 6.2
An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 funct…
-
Critical 9.8CVE-2024-25850 EPSS 19%
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter
-
Medium 5.4
Enhavo Cross-site Scripting vulnerability
A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field.
-
High 8.0
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter i…
-
Medium 4.6
SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload …
-
Critical 9.8
SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the atta…
-
High 8.8
Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote …
-
Medium 6.1
A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafte…
-
High 8.0
A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remot…
-
High 7.0CVE-2024-25423 Public exploit
An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 fi…
-
Medium 6.1
Enhavo Cross-site Scripting vulnerability
A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.
-
High 8.8
A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a r…
-
Medium 6.1
Enhavo Cross-site Scripting vulnerability
A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.
-
Medium 4.9
cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
-
Medium 5.4
Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote …
-
Medium 4.7
WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).
-
High 7.1
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes…
-
Medium 4.3
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_tr…
-
Medium 6.1
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_pl…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execu…
-
High 8.8
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_co…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-C…
-
Medium 6.1
A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 all…
-
High 8.8
Kirby vulnerable to unrestricted file upload of user avatar images
An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.
-
Medium 6.1
A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attacker…
-
High 8.8
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_place…
-
Medium 6.1
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_pl…
-
Medium 4.7
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.
-
High 7.8
Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software
A maliciously crafted STP and STEP file, when parsed in ASMIMPORT228A.dll and ASMIMPORT229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption…
-
Medium 6.7
Incorrect Privilege Assignment in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member perm…
-
High 7.7
Improper Enforcement of Behavioral Workflow in GitLab
An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.