Archive
June 2024
Vulnerabilities first published in this month (UTC), newest first.
26 results · Clear filters · Feed
-
Medium 6.3CVE-2024-5737 Public exploit
HTML Injection in AdmirorFrames Joomla! Extension
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrame…
-
Medium 6.3CVE-2024-5735 Public exploit
Full Path Disclosure in AdmirorFrames Joomla! Extension
Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0.
-
Medium 6.1CVE-2024-21520 Public exploit
Cross-site Scripting in djangorestframework
Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template filter due to improper input sanitization before splitting and joining with <br> tags.
-
Medium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…
KEV Jul 30, 2024 -
Medium 6.8CVE-2024-3121 Public exploit
Remote Code Execution in create_conda_env function in parisneo/lollms
A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary …
-
Medium 6.1CVE-2024-34312 Public exploit
Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability vi…
-
Medium 6.1CVE-2024-34452 Public exploit
CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.
-
Medium 6.8CVE-2024-34693 Public exploit
Apache Superset: Server arbitrary file read
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allo…
-
Medium 6.5
HTML5 Video Player < 2.5.27 - Unauthenticated SQLi
The HTML5 Video Player WordPress plugin before 2.5.27 does not sanitize and escape a parameter from a REST route before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
-
Medium 5.3
js2py allows remote code execution
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
-
Medium 4.9CVE-2024-23443 Public exploit
A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading …
-
Medium 6.0CVE-2024-37791 Public exploit
DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/in…
-
Medium 6.5
puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter usi…
-
Medium 6.3CVE-2024-6039 Public exploit
Feng Office Workspaces sql injection
A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The e…
-
Medium 6.5CVE-2023-27636 Public exploit
Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
-
Medium 6.1CVE-2024-37888 Public exploit
The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality
The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execute JavaScript code by abusing link href attribute. It affects all users using the Open Link plugin at version < **1.0.5*…
-
Medium 5.3CVE-2024-5961 Public exploit
Reflected XSS in 2ClickPortal
Improper neutralization of input during web page generation vulnerability in 2ClickPortal software allows reflected cross-site scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. T…
-
Medium 6.5
Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability
Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devic…
-
Medium 6.8CVE-2024-5909 Public exploit
Cortex XDR Agent: Local Windows User Can Disable the Agent
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform mal…
-
Medium 4.7CVE-2024-30052 Public exploit
Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
-
Medium 5.9CVE-2024-27815 Public exploit
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 17.5 and iPadOS 1…
-
Medium 6.1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
KEV Oct 24, 2024 -
Medium 4.8CVE-2024-20405 Public exploit
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker …
-
Medium 5.4
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProduc…
-
Medium 6.4
SolarWinds Platform Race Condition Vulnerability
The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.
-
Medium 5.4CVE-2024-0757 Public exploit
Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCE
The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 is not properly filtering which file extensions are allowed to be imported on the server, allowing the uploading of malicious code within zip files