Archive
May 2024
Vulnerabilities first published in this month (UTC), newest first.
75 results · Clear filters · Feed
-
High 7.3CVE-2023-46870 Public exploit
extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bl…
-
High 7.3CVE-2024-34224 Public exploit
Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using …
-
High 8.8CVE-2024-34221 Public exploit
Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escala…
-
High 8.0CVE-2024-27398 Public exploit
Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the…
-
High 7.8CVE-2024-35205 Public exploit
The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names bef…
-
High 8.8CVE-2024-34310 Public exploit
Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id para…
-
High 7.5CVE-2024-34220 Public exploit
Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter.
-
High 7.8CVE-2023-52654 Public exploit
io_uring/af_unix: disable sending io_uring over sockets
In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with uni…
-
High 7.5
Next.js Server-Side Request Forgery in Server Actions
Next.js is a React framework that can provide building blocks to create web applications. A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an …
-
High 7.5CVE-2024-21793 Public exploit
BIG-IP Central Manager OData Injection Vulnerability
An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
High 7.5CVE-2024-26026 Public exploit
BIG-IP Central Manager SQL Injection
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
-
High 7.5CVE-2024-32371 Public exploit
An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their …
-
High 7.6CVE-2024-3661 Public exploit
DHCP routing options can manipulate interface-based VPN traffic
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network …
-
High 7.5CVE-2024-34069 Public exploit
Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a…
-
High 8.6
An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability…
-
High 8.8CVE-2024-30973 Public exploit
An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary cod…
-
High 7.8CVE-2024-34474 Public exploit
Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there a…
-
High 7.1CVE-2024-34469 Public exploit
Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.
-
High 7.2
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versi…
-
High 7.8CVE-2023-50226 Public exploit
Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability
Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privil…
-
High 7.8CVE-2023-44452 Public exploit
Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability
Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vuln…
-
High 7.8CVE-2023-44451 Public exploit
Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability
Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vu…
-
High 7.8
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this…
-
High 8.8CVE-2023-38120 Public exploit
Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability
Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adtran SR400ac routers. Although authentication is required to exploit this vulnerabil…
-
High 8.8
NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability
NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. …
-
High 8.8CVE-2023-35744 Public exploit
D-Link DAP-2622 DDP Configuration Restore Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability
D-Link DAP-2622 DDP Configuration Restore Server IPv6 Address Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2622 routers.…
-
High 7.8
Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability
Foxit PDF Reader exportXFAData Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulne…
-
High 8.2CVE-2023-27326 Public exploit
Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability
Parallels Desktop Toolgate Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high…
-
High 7.5CVE-2023-27327 Public exploit
Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execut…
-
High 8.8CVE-2024-4406 Public exploit
Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability
Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to e…
-
High 7.6CVE-2024-33911 Public exploit
WordPress The School Management Pro plugin <= 10.3.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro.This issue affects School Management Pro: from n/a through 10.3.4.
-
High 8.5
Apache ActiveMQ: Jolokia and REST API were not secured with default configuration
In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can …
-
High 7.5CVE-2023-50685 Public exploit
An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script …
-
High 7.5CVE-2024-31964 Public exploit
A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3…
-
High 8.8CVE-2024-33775 Public exploit
An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a c…