Archive
11 October 2024
Vulnerabilities first published on this day (UTC), newest first.
52 results · Clear filters · Feed
-
High 7.4
btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality
btcd is an alternative full node bitcoin implementation written in Go (golang). The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This logic is consensus-critical: the difference in …
-
High 8.5
WordPress Tainacan plugin <= 0.21.8 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows SQL Injection.This issue affects Tainacan: from n/a through <= 0.21.8.
-
High 8.9
HTTP Request Smuggling in Looker
An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: * Looker (Google Cloud core) was found to be vulnerable. This …
-
High 8.5
WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows SQL Injection.This issue affects Backup and Staging by WP Time Capsule: from n/a through…
-
High 8.8
Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary c…
-
High 7.5
Junos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crash
An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an unauthenticated, network based attacker to cause a Denial of Service (Dos). When a non-clustered SRX500…
-
High 7.5
Junos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS
An Allocation of Resources Without Limits or Throttling vulnerability in the kernel of Juniper Networks Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In specific cases the state of TCP sessions that are…
-
High 7.5
Junos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crash
An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS). In a scenario w…
-
High 7.5
Junos OS: SRX Series, QFX Series, MX Series and EX Series: Receiving specific HTTPS traffic causes resource exhaustion
An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX Series and EX Series allows an unauthenticated, network-based attacker to cause Denial-of-Service (DoS). An attacker can s…
-
High 8.2
Junos OS Evolved: ACX 7000 Series: Receipt of specific transit MPLS packets causes resources to be exhausted
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthenticated, network based attacker to cause increased consumption…
-
High 7.3
Junos Space: Remote Command Execution (RCE) vulnerability in web application
A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by th…
-
High 7.5
Junos OS and Junos OS Evolved: cRPD: Receipt of crafted TCP traffic can trigger high CPU utilization
An Improper Handling of Exceptional Conditions vulnerability in the rpd-server of Juniper Networks Junos OS and Junos OS Evolved within cRPD allows an unauthenticated network-based attacker sending crafted TCP traffic to the routing engine (RE) to cause a CPU…
-
High 7.2
Memory leak
In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code w…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker …
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevat…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with ele…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with el…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with eleva…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elev…
-
High 7.8
A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with ele…
-
High 8.6
Picotls double free
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the …
-
High 7.5
Quicly assertion failures
Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is address…
-
High 8.4
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.
Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.This issue affects: Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive) From 7.2.49.0 to 7.2.54.12 (inclusive) 7.2…
-
High 7.2
CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Ex…
-
High 7.8
CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiali…
-
High 8.2
Incorrect Authorization in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circums…
-
High 7.5
A Server-Side Request Forgery (SSRF) vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allo…
-
High 7.8
The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 1…
-
High 8.4CVE-2024-35517 EPSS 15%
Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.
-
High 8.4
Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injecti…
-
High 8.8
SQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html taskmatic 1.0 allows a remot…
-
High 7.5
An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process
-
High 7.5
An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information v…
-
High 7.5
LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware upd…
-
High 8.2
An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via …
-
High 8.8CVE-2024-48827 Public exploit
An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via th…
-
High 7.5
An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive informa…