Skip to content
OpenAdvisories

Archive

22 July 2024

Vulnerabilities first published on this day (UTC), newest first.

← June 2024 2024 / July /22 August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-6806

    Missing Authorization Checks In NI VeriStand Gateway For Project Resources

    The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.

    NI VeriStand
  • Critical 9.3
    CVE-2024-6913

    Execution with Unnecessary Privileges

    Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0.

    PerkinElmer ProcessPlus
  • Critical 9.3
    CVE-2024-6912

    Hardcoded MSSQL Credentials

    Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects ProcessPlus: through 1.11.6507.0.

    PerkinElmer ProcessPlus
  • Critical 9.8
    CVE-2024-6794

    Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server

    A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI Veri…

    NI VeriStand
  • Critical 9.8
    CVE-2024-6793

    Deserialization of Untrusted Data in NI VeriStand DataLogging Server

    A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2…

    NI VeriStand
  • Critical 9.8
    CVE-2024-39686

    fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py bert_gen function

    Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the bert_gen function, which leads to arbitrary command execution. This affect…

    fishaudio Bert-VITS2
  • Critical 9.8
    CVE-2024-39685

    fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py resample function

    Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the resample function, which leads to arbitrary command execution. This affect…

    fishaudio Bert-VITS2
  • Critical 9.6
    CVE-2024-26020 EPSS 15%

    Ankitects Anki arbitrary script execution vulnerability

    An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

    ankitects anki anki anki Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2024-21552

    All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. An atta…

  • Critical 9.8
    CVE-2024-37998

    A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base syst…

    Siemens CPCI85 Central Processing/Communication SICORE Base system ICS / OT
  • Critical 9.3
    CVE-2024-38773 Scanner template

    WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.

    Adrian Tobey FormLift for Infusionsoft Web Forms
  • Critical 9.1
    CVE-2024-5973

    MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.

    Web / CMS
  • Critical 9.8
    CVE-2024-39250 Public exploit Scanner template

    EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in …

  • Critical 9.8
    CVE-2024-28698

    CLSA Directory Traversal vulnerability

    Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.

    Csla NuGet
  • Critical 9.8
    CVE-2024-38944 Public exploit

    An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via th…

  • Critical 9.8
    CVE-2024-40502

    SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute a…

  • Critical 9.8
    CVE-2024-41316

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parame…

  • Critical 9.8
    CVE-2024-41318

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parame…

  • Critical 9.1
    CVE-2024-41704

    LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.