Archive
10 September 2024
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Critical 9.8
VICIdial Unauthenticated SQL Injection
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
-
Critical 10.0
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by t…
-
Critical 9.8CVE-2024-43491 EPSS 13%
Microsoft Windows Update Remote Code Execution Vulnerability
Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker could exploit these pr…
-
Critical 9.0
Azure Stack Hub Elevation of Privilege Vulnerability
Azure Stack Hub Elevation of Privilege Vulnerability
-
Critical 9.1
Nix affected by unsafe NAR unpacking
Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has …
-
Critical 10.0
A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Manageme…
-
Critical 9.1
A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions…
-
Critical 9.8
A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), S…
-
Critical 9.8
Endress+Hauser: Multiple products are vulnerable to code injection
An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
-
Critical 9.8
**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware vers…
-
Critical 9.8
Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
-
Critical 9.8
Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.
-
Critical 9.8
Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.
-
Critical 9.8
An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges vi…
-
Critical 9.8
eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitra…
-
Critical 9.1
Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability …