Archive
7 September 2024
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
High 7.3
SourceCodesters Clinics Patient Management System print_diseases.php sql injection
A vulnerability was found in SourceCodesters Clinics Patient Management System 2.0. It has been rated as critical. This issue affects some unknown processing of the file /print_diseases.php. The manipulation of the argument disease/from/to leads to sql inject…
-
High 8.1
An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system wit…
-
High 8.5
A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitr…
-
High 8.5
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead t…
-
High 7.8
A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to…
-
High 8.8
A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service…
-
High 7.8
A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alt…
-
High 8.8
A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through …
-
High 7.8
A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perfo…
-
High 8.3
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network t…
-
High 7.3
A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.
-
High 7.5
An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.
-
High 7.5
An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.
-
High 7.8
An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remo…
-
High 7.4
Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL wh…
-
High 8.1
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions…
-
High 7.5
A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using…
-
High 7.7
A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This …
-
High 7.5
fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--al…
-
High 7.5
IBM MQ security bypass
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager.
-
High 8.8
Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection
The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘schedule’ parameter in all versions up to, and including, 2.9.9.5.0 due to insufficient escaping on the user supplied parameter and lack of …
-
High 7.2
Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possib…
-
High 8.8
Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised…
-
High 8.8
Apache Airflow: Command Injection in an example DAG
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - …