Archive
22 May 2024
Vulnerabilities first published on this day (UTC), newest first.
178 results · Feed
-
Medium 6.7
An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate p…
-
Medium 6.7
An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with ap…
-
Low 2.7
Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.
-
High 8.8
Veeam Backup Enterprise Manager allows account takeover via NTLM relay.
-
High 7.2
Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.
-
Critical 9.8
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
-
High 7.8
An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.
-
Medium 6.7CVE-2024-22026 Public exploit
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell r…
-
High 8.4
Remote Code Execution in parisneo/lollms-webui
A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'open_file' func…
-
High 7.4
IBM Performance Tools for i privilege escalation
IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 284563.
-
High 7.8
GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability
GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulner…
-
Medium 4.3
IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288175.
-
Critical 9.8
Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability
Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante PACS Server PG. Authentication is not required to exploit this vulner…
-
High 7.8
Avira Prime Link Following Local Privilege Escalation Vulnerability
Avira Prime Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avira Prime. An attacker must first obtain the ability to execute low-privileged code on the tar…
-
Medium 4.3
IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive user information using an expired access token. IBM X-Force ID: 288176.
-
High 7.3
WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability
WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the par…
-
Medium 6.1CVE-2024-35627 Scanner template
tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /dat…
-
Medium 6.1
VuFind Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scrip…
-
Medium 4.3
IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token. IBM X-Force ID: 288174.
-
High 7.5
Silverstripe SiteTree Creation Permission Vulnerability
A vulnerability exists in the permission validation for SiteTree object creation. By default user permissions are not validated by the SiteTree::canCreate method, unless overridden by user code or via the configuration system. This vulnerability will allow us…
-
Critical 9.1
VuFind Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before 9.1.1 allows a remote attacker to overwrite local configuration files to gain access to the administrator panel and ach…
-
Medium 6.1
Silverstripe XSS vulnerability via VirtualPage
A cross-site scripting vulnerability has been discovered in the VirtualPage class. This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the textfields of a page which a VirtualPage refers to. Th…
-
Medium 6.5
IBM App Connect Enterprise denial of service
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of service due to an uncaught exception. IBM X-Force ID: 289647.
-
Medium 6.1
Silverstripe History XSS Vulnerability
A cross-site scripting vulnerability has been discovered in the CMS page history tab. This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the text fields on a page, and if the "compare mode" op…
-
Low 3.8
Silverstripe admin XSS Vulnerability via WYSIWYG editor
It is possible for a bad actor with access to the CMS to make use of onmouseover or onmouseout attributes in the WYSIWYG editor to embed malicious javascript.
-
Medium 4.7
SQL Injection in ADAudit Plus
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability.
-
High 8.8
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow a…
-
Medium 5.3
OpenLiteSpeed before 1.8.1 mishandles chunked encoding.
-
Medium 6.2
xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker t…
-
Medium 6.1
The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length
The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length.
-
Medium 5.8
A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software a…
-
Medium 5.0
A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive…
-
Medium 5.8
A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC)…
-
Medium 5.8
A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat De…
-
Medium 5.8
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that…
-
High 8.8
Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper v…
-
Medium 6.5
Insecure Direct Object Reference In Looker
An Insecure Direct Object Reference in Google Cloud's Looker allowed metadata exposure across authenticated Looker users sharing the same LookML model.
-
High 8.8
Ghost allows CSV Injection during member CSV export
Ghost before 5.82.0 allows CSV Injection during a member CSV export.
-
Medium 5.4
Silverpeas Core vulnerable to Cross Site Scripting
Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.
-
Medium 5.4
Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.