Archive
14 March 2024
Vulnerabilities first published on this day (UTC), newest first.
21 results · Clear filters · Feed
-
High 8.0
Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.
-
High 7.2
Plv8 Deferred Trigger Privilege Escalation
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum.
-
High 8.4
IBM i privilege escalation
Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 280203.
-
High 7.3
Privilege Escalation Abusing installer in SupportApp
Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact tha…
-
High 8.2
IBM Maximo Application Suite XML external entity injection
IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 28456…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker m…
-
High 8.1
Arbitrary method invocation turbo_boost-commands
turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing…
-
High 7.2
Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalati…
-
High 7.2
On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when u…
-
High 7.7
Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.
-
High 7.7
Insufficient session timeout vulnerability in Sagemcom router
Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Lo…
-
High 8.1
Apache Airflow: Ignored Airflow Permissions
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airf…
-
High 8.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allow…
-
High 7.2
Server-side resource injection in PaperCut NG/MF
This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code execution on the server hosting the PaperCut NG/MF application server.
-
High 7.2
Unauthorized write operations in PaperCut NG/MF
This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin access and knowledge of both an internal system identifier and details of another valid user to expl…
-
High 8.6CVE-2024-1222 EPSS 64%
Incorrect authorization controls in PaperCut NG/MF APIs
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/MF API calls.
-
High 8.8
An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file para…
-
High 8.8
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/c…
-
High 7.5
greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates…
-
High 8.8CVE-2024-25228 EPSS 26%
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerif…
-
High 7.6
In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with acces…