Archive
January 2025
Vulnerabilities first published in this month (UTC), newest first.
4,293 results · Feed
-
Medium 4.9
Juju controller - Arbitrary file reading vulnerability
An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.
-
Critical 9.8
Ubuntu's configuration of gnome-control-center allowed Remote Desktop Sharing to be enabled by default.
-
Low 3.1
-
High 7.5
-
High 8.8
ChargePoint Home Flex Command Injection
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanapp modu…
-
High 8.8
ChargePoint Home Flex Improper Access Control
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the onboardee mo…
-
High 7.3
Pioneer DMH-WT7600NEX Telematics Directory Traversal
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed…
-
Medium 6.5
Pioneer DMH-WT7600NEX Telematics Improper Certificate Validation
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability. The specific flaw exists withi…
-
Medium 4.3
Silicon Labs Gecko OS Debug Interface Format String
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the debug interface. The i…
-
Low 3.3
SXF Common Library handles input data improperly. If a product using the library reads a crafted file, the product may …
-
Medium 4.3
Pioneer DMH-WT7600NEX Media Service Improper Handling of Exceptional Conditions
This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Pioneer DMH-WT7600NEX devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Media se…
-
Critical 9.8
Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers…
-
High 7.5CVE-2024-53582 Public exploit
An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to exe…
-
High 8.8
Multiple incorrect access control issues in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated…
-
Critical 9.8
Qualisys C++ SDK commit a32a21a was discovered to contain multiple stack buffer overflows via the GetCurrentFrame, Save…
-
High 7.5
Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated a…
-
Critical 9.8CVE-2024-53584 Public exploit
OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.
-
Critical 9.1CVE-2024-53537 Public exploit
An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manage…
-
Critical 9.8
Weak JWT Secret vulnerabilitiy in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote attackers to generate J…
-
Medium 6.5
Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated a…
-
Medium 6.4
Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenti…
-
High 7.5
A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause …
-
Critical 9.1
Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated…
-
High 7.5
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, th…
-
Medium 6.5
In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a nu…
-
High 8.8
macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the tes…
-
High 7.5
macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do n…
-
High 8.8
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCert…
-
Medium 6.1
A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redire…
-
Critical 9.8
SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures …
-
Medium 6.1
A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sani…
-
Critical 9.8
A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without a…
-
Medium 6.1
O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.
-
High 8.0
Alpine Halo9 Stack-based Buffer Overflow
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vu…
-
Medium 5.3
Alpine Halo9 Missing Authentication
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DLT interface, which listens on T…
-
Low 2.6
Server-Side Request Forgery (SSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses …
-
Medium 6.4
Cross-Site Request Forgery (CSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instanc…
-
High 8.8
ChargePoint Home Flex OCPP bswitch Command Injection
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of …
-
Medium 6.5
ChargePoint Home Flex Improper Certificate Validation
This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CURLO…
-
High 8.8
ChargePoint Home Flex wlanchnllst Out-Of-Bounds Write
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanchnllst …