Archive
15 July 2024
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
High 8.1
Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media
Plate media is an open source, rich-text editor for React. Editors that use `MediaEmbedElement` and pass custom `urlParsers` to the `useMediaState` hook may be vulnerable to XSS if a custom parser allows `javascript:`, `data:` or `vbscript:` URLs to be embedd…
-
High 7.1
Zoom Apps and SDKs - Race Condition
Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access.
-
High 7.1
Zoom Apps for Windows - Improper Input Validation
Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access.
-
High 8.6
Symantec Privileged Access Manager Remote Command Execution vulnerability
This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.
-
High 8.4
Symantec Privileged Access Manager SQL Injection vulnerability
The vulnerability allows an unauthenticated attacker to read arbitrary information from the database.
-
High 7.8
Local privilege escalation vulnerability in baramundi Management Agent via MSI Installer
Local Privilege Escalation in MSI-Installer in baramundi Management Agent v23.1.172.0 on Windows allows a local unprivileged user to escalate privileges to SYSTEM.
-
High 7.8
Mint Workbench I Unquoted Service Path Enumeration
Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Wor…
-
High 7.3
code-projects Simple Ticket Booking Login adminauthenticate.php sql injection
A vulnerability classified as critical has been found in code-projects Simple Ticket Booking 1.0. Affected is an unknown function of the file adminauthenticate.php of the component Login. The manipulation of the argument email/password leads to sql injection.…
-
High 7.5
tcp: avoid too many retransmit packets
In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two jif…
-
High 8.8
Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability
In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. T…
-
High 8.8
Apache Linkis DataSource: DataSource Remote code execution vulnerability
In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the serv…
-
High 8.8
WP eStore < 8.5.5 - Coupon Deletion via CSRF
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
-
High 8.8
Insert or Embed Articulate Content into WordPress < 4.3000000024 - Author+ Arbitrary File Upload
The Insert or Embed Articulate Content into WordPress plugin before 4.3000000024 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
-
High 8.5CVE-2024-21513 Public exploit
langchain-experimental vulnerable to Arbitrary Code Execution
Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability an…
-
High 8.8
2100 TECHNOLOGY Electronic Official Document Management System - Broken Access Control
The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account.
-
High 8.8
Remote Code Execution in pypa/setuptools
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index …
-
High 7.5
An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards wit…
-
High 7.5
An SMM callout vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firm…
-
High 7.3
eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization chec…
-
High 7.5
An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN m…
-
High 7.3
Tmall_demo before v2024.07.03 was discovered to contain a SQL injection vulnerability.
-
High 7.5
An access control issue in Tmall_demo v2024.07.03 allows attackers to obtain sensitive information.