Archive
28 May 2024
Vulnerabilities first published on this day (UTC), newest first.
71 results · Clear filters · Feed
-
High 7.3
PHP Code Injection by malicious attribute in extends-tag in Smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust…
-
High 7.5CVE-2024-22641 Public exploit
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SV…
-
High 7.5
An issue discovered in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions which could lead to a denial…
-
High 7.3
An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of ar…
-
High 7.5
An issue discovered in Comfast Comfast CF-616AC routers allows attackers to hijack TCP sessions which could lead to a d…
-
High 8.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous …
-
High 8.1CVE-2023-46694 Public exploit
Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote c…
-
High 7.5
An issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of se…
-
High 7.5
An issue discovered in H3C Magic R365 and H3C Magic R100 routers allows attackers to hijack TCP sessions which could le…
-
High 7.5
SQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information
-
High 7.6
Cross-site Scripting with Markdown rendering in CoCalc
CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown parser allows `<script>` tags to be included which execute when published. This issue has been addressed in commit `419…
-
High 8.2
Cross-site scripting in ansibleguy-webui
ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed …
-
High 8.8
silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)
There is a low level potential SQL injection vulnerability in the silverstripe/subsites module has been identified and fixed in version 2.1.1.
-
High 8.6
Information disclosure
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
KEV May 30, 2024 -
High 8.0
Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows…
-
High 8.0
Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account. The user is not aske…
-
High 7.3
Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows …
-
High 7.3
Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows …
-
High 8.1
A SQL injection vulnerability in /model/approve_petty_cash.php in campcodes Complete Web-Based School Management System…
-
High 7.5
silverstripe/taxonomy SQL Injection vulnerability
There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (`TaxonomyDirectoryController`) is disabled by default and must be enabled by a developer for the exploit to be possible.
-
High 7.5
Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET …
-
High 7.1
Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute…
-
High 8.4
SUBNET Substation Server Reliance on Insufficiently Trustworthy Component
SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in Substation Server.
-
High 7.0CVE-2024-30212 Public exploit
Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM ca…
-
High 7.5
A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of Automa…
-
High 8.2
A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of Autom…
-
High 8.2
A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of Autom…
-
High 8.2
Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…
-
High 8.2
Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…
-
High 8.2
Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…
-
High 8.2
Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…
-
High 8.2
Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…
-
High 8.2
Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality o…
-
High 7.5
A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of Aut…
-
High 8.3
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code insid…
KEV May 28, 2024 -
High 8.8
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the password parameter in the fun…
-
High 7.8
XML External Entity injection vulnerability in iManager
XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload
-
High 8.8CVE-2024-35397 EPSS 15%
TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithH…
-
High 7.8
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. A special…
-
High 7.8
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0. A special…