Archive
May 2024
Vulnerabilities first published in this month (UTC), newest first.
157 results · Clear filters · Feed
-
Critical 9.6
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
KEV Oct 2, 2024 -
Critical 9.8
Rejetto HTTP File Server 2.3m Unauthenticated RCE
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted H…
KEV Jul 9, 2024 -
High 8.8
Ollama does not validate the format of the digest (sha256 with 64 hex digits)
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles the TestGetBlobsPath test cases such as fewer than 64 hex digits, more than 64 hex digits, or an initial ../ substring.
-
Critical 9.8CVE-2024-35469 Public exploit
A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to …
-
Medium 5.4CVE-2024-35468 Public exploit
A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers…
-
Critical 9.8CVE-2024-36886 Public exploit
tipc: fix UAF in error path
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list…
-
High 8.8CVE-2024-5326 Public exploit
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update
The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postx_presets_callback' function in all versions up to, and including, 4.1.2. Th…
-
High 8.6CVE-2024-36114 Public exploit
Decompressors can crash the JVM and leak memory content in Aircompressor
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash the JVM for certain input, and in some cases also leak the c…
-
High 8.4CVE-2024-35333 Public exploit
A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3. This vulnerability oc…
-
Critical 9.8
Registration Authentication Bypass Vulnerability
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
KEV Jun 13, 2024 -
Medium 4.7CVE-2024-35511 Public exploit
phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/…
-
High 7.5CVE-2024-22641 Public exploit
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SV…
-
High 8.1CVE-2023-46694 Public exploit
Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote c…
-
High 8.6
Information disclosure
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
KEV May 30, 2024 -
High 7.0CVE-2024-30212 Public exploit
Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM ca…
-
High 8.3
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code insid…
KEV May 28, 2024 -
High 7.8CVE-2024-24685 Public exploit
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially c…
-
High 7.8CVE-2024-24686 Public exploit
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially c…
-
High 7.8CVE-2024-24684 Public exploit
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially c…
-
High 8.1CVE-2024-29415 Public exploit
ip SSRF improper categorization in isPublic
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of …
-
Medium 6.3CVE-2024-5356 Public exploit
anji-plus AJ-Report testTransform;swagger-ui sql injection
A vulnerability, which was classified as critical, was found in anji-plus AJ-Report up to 1.4.1. Affected is an unknown function of the file /dataSet/testTransform;swagger-ui. The manipulation of the argument dynSentence leads to sql injection. It is possible…
-
High 7.1CVE-2024-30056 Public exploit
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
-
Medium 6.5CVE-2024-36079 Public exploit
An issue was discovered in Vaultize 21.07.27. When uploading files, there is no check that the filename parameter is co…
-
Medium 4.3CVE-2023-46442 Public exploit
Soot Infinite Loop vulnerability
An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).
-
High 8.8
NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability
NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to ex…
-
High 7.5CVE-2024-5243 Public exploit
TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability
TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit this vu…
-
Critical 9.8
Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'file_upload_action' function in all versions up to, and including, 1.1.0. This makes it possible for unauthentica…
-
Critical 9.8
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
-
Medium 6.7CVE-2024-22026 Public exploit
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell r…
-
Critical 9.8
Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' parameters in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o…
-
High 7.5CVE-2024-4157 Public exploit
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.1.15 via deserialization of untrusted input in the extractDynamicValue…
-
Critical 9.8
Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter
The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user suppli…
-
High 7.2
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center an…
-
Critical 9.1CVE-2024-31989 Public exploit
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version …
-
Medium 4.9CVE-2024-22275 Public exploit
The vCenter Server contains a partial file read vulnerability. A malicious actor with administrative privileges on the …
-
High 7.2CVE-2024-22274 Public exploit
The vCenter Server contains an authenticated remote code execution vulnerability. A malicious actor with administrative…
-
High 7.2
QTS, QuTS hero
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the foll…
-
Medium 4.3CVE-2024-4875 Public exploit
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification of data|loss of data due to a missing capability check on the 'ajax_dismiss' function in versions up to, and including, 2.5.2. This makes it possible f…
-
Critical 9.1CVE-2024-4442 Public exploit
Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion
The Salon booking system plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 9.8. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for u…
-
Medium 6.3CVE-2024-36039 Public exploit
PyMySQL SQL Injection vulnerability
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.