Archive
10 September 2024
Vulnerabilities first published on this day (UTC), newest first.
237 results · Feed
-
Medium 5.3
Pluto's http.request allows CR and LF in header values
Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens …
-
Medium 6.7
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local aut…
-
Medium 4.3
Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote aut…
-
Medium 5.8
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote…
-
Medium 5.3
Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote…
-
High 7.8CVE-2024-8191 EPSS 20%
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote una…
-
High 8.8
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local au…
-
High 8.8
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.…
-
High 8.2
Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 20…
-
High 8.8
An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Iv…
-
High 8.8
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local au…
-
High 7.8
An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.1…
-
High 7.2
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a rem…
KEV Sep 13, 2024 -
High 7.5
iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Type
SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.
-
Medium 5.3
Mercury MNVR816 web-static file access
A vulnerability was found in Mercury MNVR816 up to 2.0.1.0.5. It has been classified as problematic. This affects an unknown part of the file /web-static/. The manipulation leads to files or directories accessible. It is possible to initiate the attack remote…
-
High 8.8
VICIdial Authenticated Remote Code Execution
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
-
Critical 9.8
VICIdial Unauthenticated SQL Injection
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
-
Critical 10.0
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by t…
-
High 7.4
Directus's session is cached for OpenID and OAuth2 if `redirect` is not used
Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens be…
-
High 8.8
Microsoft SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability
-
High 8.4
Azure Web Apps Elevation of Privilege Vulnerability
An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network.
-
High 7.3
Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
-
Critical 9.8CVE-2024-43491 EPSS 13%
Microsoft Windows Update Remote Code Execution Vulnerability
Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker could exploit these pr…
-
Medium 6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
-
High 7.8
Windows Security Zone Mapping Security Feature Bypass Vulnerability
Windows Security Zone Mapping Security Feature Bypass Vulnerability
-
High 8.5
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
Microsoft Power Automate Desktop Remote Code Execution Vulnerability
-
High 7.6
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
-
High 7.3
Microsoft Windows Admin Center Information Disclosure Vulnerability
Microsoft Windows Admin Center Information Disclosure Vulnerability
-
High 7.3
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
-
High 8.8
Azure CycleCloud Remote Code Execution Vulnerability
Azure CycleCloud Remote Code Execution Vulnerability
-
Medium 6.5
Microsoft SharePoint Server Denial of Service Vulnerability
Microsoft SharePoint Server Denial of Service Vulnerability
-
High 8.8
Windows MSHTML Platform Spoofing Vulnerability
Windows MSHTML Platform Spoofing Vulnerability
KEV Sep 16, 2024 -
High 7.8
Windows Setup and Deployment Elevation of Privilege Vulnerability
Windows Setup and Deployment Elevation of Privilege Vulnerability
-
High 7.7
Windows Networking Information Disclosure Vulnerability
Windows Networking Information Disclosure Vulnerability
-
High 8.8
Windows Remote Desktop Licensing Service Spoofing Vulnerability
Windows Remote Desktop Licensing Service Spoofing Vulnerability
-
High 7.5
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
Windows Network Address Translation (NAT) Remote Code Execution Vulnerability
-
High 7.1CVE-2024-43454 EPSS 22%
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
-
High 8.1
Windows TCP/IP Remote Code Execution Vulnerability
Windows TCP/IP Remote Code Execution Vulnerability
-
High 7.5
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
-
High 8.1
Windows TCP/IP Remote Code Execution Vulnerability
Windows TCP/IP Remote Code Execution Vulnerability