Archive
13 August 2024
Vulnerabilities first published on this day (UTC), newest first.
85 results · Clear filters · Feed
-
Medium 6.3
SourceCodester Clinics Patient Management System update_medicine.php sql injection
A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /update_medicine.php. The manipulation of the argument hidden_id leads to sql inject…
-
Medium 6.3
SourceCodester Clinics Patient Management System medicines.php sql injection
A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /medicines.php. The manipulation of the argument medicine_name leads to s…
-
Medium 6.3
SourceCodester Accounts Manager App delete-account.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Accounts Manager App 1.0. This issue affects some unknown processing of the file /endpoint/delete-account.php. The manipulation of the argument account leads to sql injection.…
-
Medium 5.3
wanglongcn ltcms API Endpoint downloadfile downloadFile path traversal
A vulnerability was found in wanglongcn ltcms 1.0.20 and classified as critical. This issue affects the function downloadFile of the file /api/file/downloadfile of the component API Endpoint. The manipulation of the argument file leads to path traversal. The …
-
Medium 6.5
open-telemetry has an Observable Timing Discrepancy
OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension's server authenticator performs…
-
Medium 4.3
yzane vscode-markdown-pdf cross site scripting
A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to…
-
Medium 6.9
Rockwell Automation Micro850/870 Vulnerable to denial-of-service Vulnerability via CIP/Modbus Port
A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploited, the CIP/Modbus communication may be disrupted for short duration.
-
Medium 5.4
DLL Hijacking Vulnerability Exists in Rockwell Automation Emulate3D™
A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application loads shared libraries, which are readable and writable by any user. If exploited, a malicious user could leverage a mali…
-
Medium 6.8
Windows Initial Machine Configuration Elevation of Privilege Vulnerability
Windows Initial Machine Configuration Elevation of Privilege Vulnerability
-
Medium 6.5
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
-
Medium 6.7
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
-
Medium 6.5
Windows Compressed Folder Tampering Vulnerability
Windows Compressed Folder Tampering Vulnerability
-
Medium 5.5
Security Center Broker Information Disclosure Vulnerability
Security Center Broker Information Disclosure Vulnerability
-
Medium 5.5
Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability
-
Medium 4.2CVE-2024-38143 Public exploit
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
-
Medium 5.5
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
-
Medium 5.5
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
-
Medium 6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Aug 13, 2024 -
Medium 6.5CVE-2024-38197 EPSS 17%
Microsoft Teams for iOS Spoofing Vulnerability
Microsoft Teams for iOS Spoofing Vulnerability
-
Medium 6.5
.NET and Visual Studio Information Disclosure Vulnerability
.NET and Visual Studio Information Disclosure Vulnerability
-
Medium 6.8
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
-
Medium 4.4
Windows Bluetooth Driver Information Disclosure Vulnerability
Windows Bluetooth Driver Information Disclosure Vulnerability
-
Medium 4.8
Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged…
-
Medium 5.7
Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitra…
-
Medium 4.4
Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, pot…
-
Medium 5.0
Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed…
-
Medium 6.5
Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, al…
-
Medium 5.3
IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an at…
-
Medium 4.7
An insufficient DRAM address validation in PMFW may allow a privileged attacker to read from an invalid DRAM address to…
-
Medium 5.2
An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid D…
-
Medium 5.2
Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged…
-
Medium 5.7
A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an …
-
Medium 5.9
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS vers…
-
Medium 5.5
A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and …
-
Medium 6.4
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 thr…
-
Medium 4.7
An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through …
-
Medium 5.3
Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server
"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and…
-
Medium 6.1
Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.
-
Medium 5.9
Phoenix Contact: Start sequence allows attack during the boot process
An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time after system startup.
-
Medium 6.5
WordPress WPSection plugin <= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue affects WPSection: from n/a through 1.3.8.