Archive
1 July 2024
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Critical 9.8
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to …
-
Critical 9.3CVE-2024-38368 EPSS 15%
Trunk's 'Claim your pod' could be used to obtain un-used pods
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so…
-
Critical 9.1CVE-2024-28200 Scanner template
N-central Authentication Bypass
The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has…
-
Critical 9.1
N-central Authentication Bypass via Session Rebinding
The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass. This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.
-
Critical 10.0
CoacoaPods trunk RCE in email verification system rfc-822
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX re…
-
Critical 10.0
Fiber Session Middleware Token Injection Vulnerability
Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the …
-
Critical 9.8
Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2…
-
Critical 9.1
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…
KEV May 1, 2025 -
Critical 9.8
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted …
KEV Jul 15, 2024 -
Critical 9.1
Incorrect Provision of Specified Functionality vulnerability in MESbook
Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMU…
-
Critical 9.3
Server-Side Request Forgery vulnerability in MESbook
External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=<FILE|INTERNAL URL|IP/HOST" or "/api/Proxy/Get?userName=&password=…
-
Critical 9.8
In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local esc…
-
Critical 9.8
In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to…
-
Critical 9.8
In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local esc…
-
Critical 9.8
In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privileg…
-
Critical 9.8
ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. This vulnerability a…
-
Critical 9.8
2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. This vulnerability allows …
-
Critical 10.0
robinweser fast-loops vulnerable to prototype pollution
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Critical 9.8
cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability all…
-
Critical 9.8
agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vu…
-
Critical 10.0
An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attacker…
-
Critical 9.8
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. Th…
-
Critical 10.0
jrburke requirejs vulnerable to prototype pollution
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
-
Critical 9.8
rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability…
-
Critical 9.8
Prototype pollution in ag-grid-community via the _.mergeDeep function
ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary pr…
-
Critical 9.9CVE-2024-37762 Public exploit
MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code executi…