Archive
13 February 2025
Vulnerabilities first published on this day (UTC), newest first.
132 results · Feed
-
High 8.1
CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable w…
-
High 7.5
CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data…
-
High 7.5
CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to s…
-
High 8.1
CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when mal…
-
Medium 5.5
CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of engineering workstation wh…
-
Critical 9.8CVE-2024-10763 Scanner template
Campress <= 1.35 - Unauthenticated Local File Inclusion
The Campress theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.35 via the 'campress_woocommerce_get_ajax_products' function. This makes it possible for unauthenticated attackers to include and execute arbitrary …
-
High 8.1
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'view_more_posts' AJAX action. This makes it possi…
-
Medium 6.4
Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate…
-
Medium 4.3
Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the update_metadata() function in all versions up to, and including, 1.0.235. This makes it possible…
-
Medium 6.4
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Rank Math API in all versions up to, and including, 1.0.235 due to insufficient input sanitization and output escaping…
-
Medium 6.4
DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's De Gallery widget in all versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping on user supplied attribute…
-
Critical 9.8
Orthanc Server Missing Authentication for Critical Function
Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.
-
Medium 4.2
Insufficient Session Expiration in GitLab
An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming resul…
-
Critical 9.6
Execution with Unnecessary Privileges in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.0 which allows an attacker to trigger a pipeline as another user under certain circumstances.
-
Medium 4.4
Execution with Unnecessary Privileges in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.1 prior to 17.6.0, which allows an attacker with maintainer role to trigger a pipeline as project owner under certain circumstances.
-
Critical 9.8
Crayfish allows Remote Code Execution via Homarus Authorization header
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The i…
-
High 7.5
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this tabl…
-
High 7.5
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file,…
-
High 7.5
Mercedes Benz head-unit NTG 6 contains functions to import or export profile settings over USB. During parsing you can …
-
Low 3.7
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside profile folder th…
-
Medium 4.9
Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to this pins a…
-
Medium 4.9
Mercedes-Benz head-unit NTG6 has Ethernet pins on Base Board to connect module CSB. Attacker can connect to these pins …
-
Low 3.3
An issue was discovered on Mercedes Benz NTG 6. A possible integer overflow exists in the user data import/export funct…
-
Critical 9.8
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Some values of this tabl…
-
High 7.7
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. Inside file is encapsula…
-
Medium 5.5
A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command…
-
Medium 5.5
A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when …
-
Medium 5.5
A Stack buffer overflow in the arguments parameter in Immunity Inc. Immunity Debugger v1.85 allows attackers to execute…
-
Medium 6.8
An issue in Docker-proxy v18.09.0 allows attackers to cause a denial of service.
-
High 7.3CVE-2024-57378 Public exploit
Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. This issue allows the unauthorized creat…
-
Medium 6.8
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible stack buffer overfl…
-
Medium 4.6
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible type confusion exists in the use…
-
Medium 4.6
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6. A possible heap buffer overflow exists in t…
-
Medium 4.6
An issue was discovered in Mercedes Benz NTG (New Telematics Generation) 6 through 2021. A possible NULL pointer derefe…
-
Medium 5.4CVE-2024-54951 Public exploit
Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that …
-
Medium 6.8
In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file…
-
High 7.5
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the pskSecret parameter at /userRpm/WlanSe…
-
Medium 4.9
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11 via the username and password parameters at /u…
-
High 7.5
A buffer overflow vulnerability was discovered in TP-Link TL-WR841ND V11, triggered by the dnsserver1 and dnsserver2 pa…
-
Critical 9.8
A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which al…