Skip to content
OpenAdvisories

Archive

18 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /18 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

22 results · Clear filters · Feed

  • Critical 10.0
    CVE-2024-46986 Public exploit Scanner template EPSS 37%

    Arbitrary file write leading to RCE in Camaleon CMS

    Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the w…

    owen2345 Camaleon CMS camaleon_cms RubyGems
  • Critical 9.2
    CVE-2024-6878

    Directory Browsing in Eliz Software's Panel

    Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations. This issue affects Panel: before v2.3.24.

    Eliz Software Panel
  • Critical 9.4
    CVE-2024-6877

    Reflected XSS in Eliz Software's Panel

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS. This issue affects Panel: before v2.3.24.

    Eliz Software Panel
  • Critical 9.8
    CVE-2024-5960

    Plaintext Storage of a Password in Eliz Software's Panel

    Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This issue affects Panel: before v2.3.24.

    Eliz Software Panel
  • Critical 9.3
    CVE-2024-5959

    Stored XSS in Eliz Software's Panel

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS. This issue affects Panel: before v2.3.24.

    Eliz Software Panel
  • Critical 9.4
    CVE-2024-5958

    SQLi in Eliz Software's Panel

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection. This issue affects Panel: before v2.3.24.

    Eliz Software Panel
  • Critical 9.0
    CVE-2024-34026

    A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _…

    OpenPLC OpenPLC_v3
  • Critical 9.3
    CVE-2024-8889

    Improper Input Validation vulnerability on CIRCUTOR TCP2RS+

    Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device has the user/password authentication option enabled, without authentication by sending packets through the UDP protoco…

    Circutor CIRCUTOR TCP2RS+
  • Critical 10.0
    CVE-2024-8888

    Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT

    An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate fro…

    Circutor CIRCUTOR Q-SMT
  • Critical 10.0
    CVE-2024-8887

    Authentication bypass vulnerability on CIRCUTOR Q-SMT

    CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities im…

    Circutor CIRCUTOR Q-SMT
  • Critical 9.8
    CVE-2024-46796

    smb: client: fix double put of @cfile in smb2_set_path_size()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_set_path_size() If smb2_compound_op() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() before retryin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-46736

    smb: client: fix double put of @cfile in smb2_rename_path()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_rename_path() If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() again as the r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-46717

    net/mlx5e: SHAMPO, Fix incorrect page release

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1) No skb created yet 2) header_size == 0 (no SHAMPO header) 3) header_index + 1 % MLX5E_SHAMPO_WQ_HEADER_PER_PAG…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2024-34399

    **UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker…

  • Critical 9.8
    CVE-2024-35515

    sqlitedict insecure deserialization vulnerability

    Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.

    sqlitedict sqlitedict sqlitedict Debian Ubuntu PyPI
  • Critical 9.8
    CVE-2024-46377 Public exploit

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function…

  • Critical 9.8
    CVE-2024-46375

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the…

  • Critical 9.8
    CVE-2024-46374

    Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_category() function of the…

  • Critical 9.8
    CVE-2024-46376

    Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() functio…

  • Critical 9.1
    CVE-2024-45523

    An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.…

  • Critical 9.8
    CVE-2024-40568

    Buffer Overflow vulnerability in btstack mesh commit before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 allows a remote …

  • Critical 9.8
    CVE-2024-44542 Public exploit

    SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news…