Archive
May 2024
Vulnerabilities first published in this month (UTC), newest first.
434 results · Clear filters · Feed
-
Critical 9.8
moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
-
Critical 9.1
An issue in coap_msg.c in Keith Cullen's FreeCoAP v.0.7 allows remote attackers to cause a Denial of Service or potenti…
-
Critical 9.6CVE-2024-29823 EPSS 100%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6CVE-2024-29827 EPSS 72%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6CVE-2024-29826 EPSS 100%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6CVE-2024-29822 EPSS 64%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.6
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
KEV Oct 2, 2024 -
Critical 9.6CVE-2024-29825 EPSS 100%
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
-
Critical 9.4
Vulnerability in Welch Allyn Configuration Tool Software
Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credentials.This issue affects Welch Allyn Configuration Tool: versions 1.9.4.1 and prior.
-
Critical 9.1
Vulnerability in Baxter Welch Allyn Connex Spot Monitor
Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.This issue affects Welch Allyn Connex Spot Monitor in all versions prior to 1.52.
-
Critical 9.8
Multiple Broken Function-Level Authorization vulnerabilities in casgate
casgate is an Open Source Identity and Access Management system. In affected versions `casgate` allows remote unauthenticated attacker to obtain sensitive information via GET request to an API endpoint. This issue has been addressed in PR #201 which is pendin…
-
Critical 9.8
Rejetto HTTP File Server 2.3m Unauthenticated RCE
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted H…
KEV Jul 9, 2024 -
Critical 9.8
Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary c…
-
Critical 9.8
Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110…
-
Critical 9.1
The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the…
-
Critical 9.3
LenelS2 NetBox Improper Neutralization of Argumented Delimiters
LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.
-
Critical 9.3
LenelS2 NetBox Improper Neutralization of Special Elements
LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.
-
Critical 9.8CVE-2024-35469 Public exploit
A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to …
-
Critical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidenti…
-
Critical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidenti…
-
Critical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidenti…
-
Critical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidenti…
-
Critical 9.8
A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidenti…
-
Critical 9.8
NFSD: Fix nfsd4_encode_fattr4() crasher
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().
-
Critical 9.3
Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an…
-
Critical 9.6
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an erro…
-
Critical 9.8
hv_netvsc: Don't free decrypted memory
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and t…
-
Critical 9.3
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail s…
-
Critical 9.1
USB: core: Fix access violation during port device removal
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that t…
-
Critical 9.8CVE-2024-36886 Public exploit
tipc: fix UAF in error path
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list…
-
Critical 9.8
keys: Fix overwrite of key expiration on instantiation
In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for…
-
Critical 9.0CVE-2024-3300 Scanner template
Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024
An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.
-
Critical 9.8
TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution
Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.pha…
-
Critical 9.8
titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack
titon/framework package (which is now abandoned and no longer maintained) is vulnerable to remote code execution via Chosen-Ciphertext Attack.
-
Critical 9.8
Path Traversal in qdrant/qdrant
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary l…
-
Critical 9.8
Symfony XML decoding attack vector through external entities
The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include a…
-
Critical 10.0
SQLi in Vadi Corporate Information Systems' DIGIKENT GIS
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection. This issue affects DIGIKENT GIS: through 2.23.5.
-
Critical 9.8
MinMax CMS - Hidden Functionality
MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and lo…
-
Critical 9.8
Symfony XML decoding attack vector through external entities
The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include a…
-
Critical 9.8
Registration Authentication Bypass Vulnerability
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
KEV Jun 13, 2024