Archive
26 November 2024
Vulnerabilities first published on this day (UTC), newest first.
65 results · Clear filters · Feed
-
High 7.3
1000 Projects Portfolio Management System MCA forgot_password_process.php sql injection
A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgot_password_process.php. The manipulation of the argument username leads to sql injection. The atta…
-
High 7.3
PHPGurukul User Registration & Login and User Management System signup.php sql injection
A vulnerability classified as critical has been found in PHPGurukul User Registration & Login and User Management System 1.0. This affects an unknown part of the file /signup.php. The manipulation of the argument email leads to sql injection. It is possible t…
-
High 7.3
PHPGurukul User Registration & Login and User Management System index.php sql injection
A vulnerability was found in PHPGurukul User Registration & Login and User Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument username leads…
-
High 7.3CVE-2024-53675 EPSS 81%
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose i…
-
High 7.3CVE-2024-53674 EPSS 47%
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose i…
-
High 8.1
A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute cod…
-
High 7.3
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose i…
-
High 8.8
Tenda AC8 SetStaticRouteCfg route_static_check stack-based overflow
A vulnerability was found in Tenda AC8 16.03.34.09 and classified as critical. Affected by this issue is the function route_static_check of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The att…
-
High 7.3
1000 Projects Portfolio Management System MCA register.php sql injection
A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection.…
-
High 7.6
Microsoft Dynamics 365 Sales Spoofing Vulnerability
Microsoft Dynamics 365 Sales Spoofing Vulnerability
-
High 8.2
Microsoft Azure PolicyWatch Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network.
-
High 8.7CVE-2024-49035 Exploited
Partner.Microsoft.Com Elevation of Privilege Vulnerability
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
KEV Feb 25, 2025 -
High 7.4
Cri-o: checkpoint restore can be triggered from different namespaces
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. A…
-
High 8.2
Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.
-
High 8.1CVE-2024-32965 EPSS 26%
ssrf vulnerability in lobe-chat
Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive informa…
-
High 7.8
Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre…
-
High 7.2
Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and…
-
High 8.4
Buffer Over-read in IPA
An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'
-
High 7.8
Use After Free in Video
Crafted Binder Request Causes Heap UAF in MediaServer
-
High 8.4
Information Exposure in Kernel
Information disclosure possible while audio playback.
-
High 8.4
Information Exposure in Camera Driver
Information disclosure due to uninitialized variable.
-
High 7.8
Improper Access Control in Core.
QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable memory.
-
High 8.8
Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence…
-
High 8.8
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?…
-
High 7.5
Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored d…
-
High 8.1
Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to us…
-
High 8.8
Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corrupt…
-
High 7.1
Stored cross-site scripting vulnerability (CVE-2024-38832)
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.
-
High 7.8
Local privilege escalation vulnerability (CVE-2024-38831)
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware A…
-
High 7.8
Local privilege escalation vulnerability
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations.
-
High 8.4
Prototype Pollution in convict
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject attributes that are used in other components, or to override existing attributes with ones that have …
-
High 7.5
Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth …
-
High 7.8CVE-2023-1521 Public exploit
Local Privilege Escalation in sccache
On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD. If the server is run as root (which is the default when installing the snap package https://…
-
High 7.3
A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affectin…
-
High 7.2
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
High 7.2
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
High 7.2
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
High 7.2
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
High 7.2
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
High 7.2
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…