Archive
20 August 2024
Vulnerabilities first published on this day (UTC), newest first.
28 results · Clear filters · Feed
-
Critical 9.8
net/mlx5e: Fix CT entry update leaks of modify header context
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix CT entry update leaks of modify header context The cited commit allocates a new modify header to replace the old one when updating CT entry. But if failed to allocate a new one…
-
Critical 9.5
An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication w…
-
Critical 9.6
Azure Managed Instance for Apache Cassandra Elevation of Privilege Vulnerability
An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privileges over a network.
-
Critical 9.1
[20240802] - Core - Cache Poisoning in Pagination
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
-
Critical 9.8
Remote Code Execution Vulnerability in MEGABOT
MEGABOT is a fully customized Discord bot for learning and fun. The `/math` command and functionality of MEGABOT versions < 1.5.0 contains a remote code execution vulnerability due to a Python `eval()`. The vulnerability allows an attacker to inject Python co…
-
Critical 9.8CVE-2024-43202 Public exploit
Apache DolphinScheduler: Remote Code Execution Vulnerability
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
-
Critical 9.8
SmartSearch WP <= 2.4.4 - Unauthenticated SQLi
The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when submitting messages to the chatbot.
-
Critical 9.0
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletion
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in multiple functions i…
-
Critical 10.0
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for un…
-
Critical 9.8
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code executi…
-
Critical 9.8
An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday …
-
Critical 9.8
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id paramete…
-
Critical 9.8
An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a …
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter…
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter…
-
Critical 9.8
An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authen…
-
Critical 9.8
ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/c…
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter…
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at…
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter…
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter…
-
Critical 9.6
A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attacke…
-
Critical 9.8CVE-2024-42919 Public exploit
eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parame…
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter…
-
Critical 9.8
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter…
-
Critical 9.8
Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parame…
-
Critical 9.8
Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number…