| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-7331 | Hig | 0.57 | 8.8 | 0.01 | Aug 1, 2024 | A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack may be launched… | ||
| CVE-2024-41262 | Hig | 0.48 | 7.4 | 0.00 | Jul 31, 2024 | mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communications via a man-in-the-middle attack. | ||
| CVE-2024-7326 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | A vulnerability classified as critical has been found in IObit DualSafe Password Manager 1.4.0.3. This affects an unknown part in the library RTL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the… | ||
| CVE-2024-41255 | Hig | 0.49 | 7.5 | 0.00 | Jul 31, 2024 | filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go. | ||
| CVE-2024-41253 | Hig | 0.46 | 7.1 | 0.00 | Jul 31, 2024 | goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component. | ||
| CVE-2024-40465 | Hig | 0.50 | 8.8 | 0.00 | Jul 31, 2024 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file | ||
| CVE-2024-40464 | Hig | 0.50 | 8.8 | 0.01 | Jul 31, 2024 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file | ||
| CVE-2023-1577 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute code with elevated privileges. | ||
| CVE-2022-4002 | Hig | 0.47 | 7.2 | 0.01 | Jul 31, 2024 | A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request. | ||
| CVE-2022-4001 | Hig | 0.47 | 7.3 | 0.00 | Jul 31, 2024 | An authentication bypass vulnerability could allow an attacker to access API functions without authentication. | ||
| CVE-2019-6198 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. | ||
| CVE-2019-6197 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. | ||
| CVE-2024-7325 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | A vulnerability was found in IObit Driver Booster 11.0.0.0. It has been rated as critical. Affected by this issue is some unknown functionality in the library VCL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. Attacking locally is a… | ||
| CVE-2024-41630 | Hig | 0.49 | 7.6 | 0.01 | Jul 31, 2024 | Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary code via the ssid parameter at ip/goform/fast_setting_wifi_set. | ||
| CVE-2024-41108 | Hig | 0.42 | 7.5 | 0.01 | Jul 31, 2024 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if a task is pending… | ||
| CVE-2024-40645 | Hig | 0.50 | 8.8 | 0.01 | Jul 31, 2024 | FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requiring it to be 650… | ||
| CVE-2024-7324 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library madbasic_.bpl of the component BPL Handler. The manipulation leads to uncontrolled search path. Local… | ||
| CVE-2024-6975 | Hig | 0.57 | 8.8 | 0.00 | Jul 31, 2024 | Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34. | ||
| CVE-2024-6974 | Hig | 0.57 | 8.8 | 0.00 | Jul 31, 2024 | Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34. | ||
| CVE-2024-6973 | Hig | 0.49 | 7.5 | 0.01 | Jul 31, 2024 | Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34. | ||
| CVE-2024-41950 | Hig | 0.42 | 7.5 | 0.01 | Jul 31, 2024 | Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in… | ||
| CVE-2024-7340 | Hig | 0.51 | 8.8 | 0.05 | Jul 31, 2024 | The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server… | ||
| CVE-2024-3083 | Hig | 0.54 | 8.3 | 0.00 | Jul 31, 2024 | A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page. | ||
| CVE-2024-31202 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation. | ||
| CVE-2024-31199 | Hig | 0.57 | 8.8 | 0.00 | Jul 31, 2024 | A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascript code. | ||
| CVE-2024-7320 | Hig | 0.48 | 7.3 | 0.01 | Jul 31, 2024 | A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part of the file /admin/index.php of the component Admin Login. The manipulation of the argument user leads to sql injection. It is possible to… | ||
| CVE-2024-7311 | Hig | 0.48 | 7.3 | 0.01 | Jul 31, 2024 | A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file register.php. The manipulation of the argument Email leads to sql injection. The attack may be initiated remotely.… | ||
| CVE-2024-37142 | Hig | 0.47 | 7.3 | 0.00 | Jul 31, 2024 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and… | ||
| CVE-2024-37127 | Hig | 0.51 | 7.8 | 0.00 | Jul 31, 2024 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and… | ||
| CVE-2024-32857 | Hig | 0.47 | 7.3 | 0.00 | Jul 31, 2024 | Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and… | ||
| CVE-2024-6770 | Hig | 0.40 | 7.2 | 0.00 | Jul 31, 2024 | The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for… | ||
| CVE-2024-42381 | Hig | 0.47 | 8.3 | 0.01 | Jul 31, 2024 | os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary… | ||
| CVE-2024-7286 | Hig | 0.48 | 7.3 | 0.01 | Jul 31, 2024 | A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument username leads to sql… | ||
| CVE-2024-39950 | Hig | 0.56 | 8.6 | 0.00 | Jul 31, 2024 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization. | ||
| CVE-2024-39949 | Hig | 0.49 | 7.5 | 0.01 | Jul 31, 2024 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. | ||
| CVE-2024-39948 | Hig | 0.49 | 7.5 | 0.01 | Jul 31, 2024 | A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. | ||
| CVE-2024-39944 | Hig | 0.49 | 7.5 | 0.01 | Jul 31, 2024 | A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash. | ||
| CVE-2024-7279 | Hig | 0.48 | 7.3 | 0.01 | Jul 31, 2024 | A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can… | ||
| CVE-2024-6255 | Hig | 0.54 | 8.2 | 0.14 | Jul 31, 2024 | A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation… | ||
| CVE-2023-33976 | Hig | 0.42 | 7.5 | 0.00 | Jul 30, 2024 | TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12. | ||
| CVE-2024-7297 | Hig | 0.59 | 8.8 | 0.21 | Jul 30, 2024 | Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint. | ||
| CVE-2024-41915 | Hig | 0.47 | 7.2 | 0.01 | Jul 30, 2024 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify… | ||
| CVE-2024-41802 | Hig | 0.53 | 8.1 | 0.00 | Jul 30, 2024 | Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially… | ||
| CVE-2024-4188 | Hig | 0.46 | — | 0.00 | Jul 30, 2024 | Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from 16.7 through 23.4. | ||
| CVE-2024-23091 | Hig | 0.49 | 7.5 | 0.00 | Jul 30, 2024 | Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values. | ||
| CVE-2024-41924 | Hig | 0.47 | 7.2 | 0.00 | Jul 30, 2024 | Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are… | ||
| CVE-2024-41696 | Hig | 0.49 | 7.5 | 0.00 | Jul 30, 2024 | Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | ||
| CVE-2024-41695 | Hig | 0.49 | 7.5 | 0.01 | Jul 30, 2024 | Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory | ||
| CVE-2024-38429 | Hig | 0.49 | 7.5 | 0.00 | Jul 30, 2024 | Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties | ||
| CVE-2024-42228 | Hig | 0.46 | 7.0 | 0.00 | Jul 30, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would… |
- risk 0.57cvss 8.8epss 0.01
A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack may be launched…
- risk 0.48cvss 7.4epss 0.00
mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communications via a man-in-the-middle attack.
- risk 0.51cvss 7.8epss 0.00
A vulnerability classified as critical has been found in IObit DualSafe Password Manager 1.4.0.3. This affects an unknown part in the library RTL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. It is possible to launch the attack on the…
- risk 0.49cvss 7.5epss 0.00
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
- risk 0.46cvss 7.1epss 0.00
goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.
- risk 0.50cvss 8.8epss 0.00
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file
- risk 0.50cvss 8.8epss 0.01
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
- risk 0.51cvss 7.8epss 0.00
A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute code with elevated privileges.
- risk 0.47cvss 7.2epss 0.01
A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request.
- risk 0.47cvss 7.3epss 0.00
An authentication bypass vulnerability could allow an attacker to access API functions without authentication.
- risk 0.51cvss 7.8epss 0.00
A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.
- risk 0.51cvss 7.8epss 0.00
A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.
- risk 0.51cvss 7.8epss 0.00
A vulnerability was found in IObit Driver Booster 11.0.0.0. It has been rated as critical. Affected by this issue is some unknown functionality in the library VCL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. Attacking locally is a…
- risk 0.49cvss 7.6epss 0.01
Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary code via the ssid parameter at ip/goform/fast_setting_wifi_set.
- risk 0.42cvss 7.5epss 0.01
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. The hostinfo page has missing/improper access control since only the host's mac address is required to obtain the configuration information. This data can only be retrieved if a task is pending…
- risk 0.50cvss 8.8epss 0.01
FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server. The Rebranding feature has a check on the client banner image requiring it to be 650…
- risk 0.51cvss 7.8epss 0.00
A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library madbasic_.bpl of the component BPL Handler. The manipulation leads to uncontrolled search path. Local…
- risk 0.57cvss 8.8epss 0.00
Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34.
- risk 0.57cvss 8.8epss 0.00
Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.
- risk 0.49cvss 7.5epss 0.01
Remote Code Execution in Cato Windows SDP client via crafted URLs. This issue affects Windows SDP Client before 5.10.34.
- risk 0.42cvss 7.5epss 0.01
Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Certain Components in…
- risk 0.51cvss 8.8epss 0.05
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server…
- risk 0.54cvss 8.3epss 0.00
A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page.
- risk 0.51cvss 7.8epss 0.00
A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation.
- risk 0.57cvss 8.8epss 0.00
A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascript code.
- risk 0.48cvss 7.3epss 0.01
A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part of the file /admin/index.php of the component Admin Login. The manipulation of the argument user leads to sql injection. It is possible to…
- risk 0.48cvss 7.3epss 0.01
A vulnerability was found in code-projects Online Bus Reservation Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file register.php. The manipulation of the argument Email leads to sql injection. The attack may be initiated remotely.…
- risk 0.47cvss 7.3epss 0.00
Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and…
- risk 0.51cvss 7.8epss 0.00
Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and…
- risk 0.47cvss 7.3epss 0.00
Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and…
- risk 0.40cvss 7.2epss 0.00
The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for…
- risk 0.47cvss 8.3epss 0.01
os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp section. NOTE: this code execution would occur during an un-sandboxed binary…
- risk 0.48cvss 7.3epss 0.01
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument username leads to sql…
- risk 0.56cvss 8.6epss 0.00
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities to initiate device initialization.
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, causing the device to crash.
- risk 0.48cvss 7.3epss 0.01
A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. The attack can…
- risk 0.54cvss 8.2epss 0.14
A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation…
- risk 0.42cvss 7.5epss 0.00
TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.
- risk 0.59cvss 8.8epss 0.21
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the '/api/v1/users' endpoint.
- risk 0.47cvss 7.2epss 0.01
A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. An attacker could exploit this vulnerability to obtain and modify…
- risk 0.53cvss 8.1epss 0.00
Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially…
- risk 0.46cvss —epss 0.00
Unprotected Transport of Credentials vulnerability in OpenText™ Documentum™ Server could allow Credential Stuffing.This issue affects Documentum™ Server: from 16.7 through 23.4.
- risk 0.49cvss 7.5epss 0.00
Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.
- risk 0.47cvss 7.2epss 0.00
Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are…
- risk 0.49cvss 7.5epss 0.00
Priority PRI WEB Portal Add-On for Priority ERP on prem - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- risk 0.49cvss 7.5epss 0.01
Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory
- risk 0.49cvss 7.5epss 0.00
Matrix Tafnit v8 - CWE-552: Files or Directories Accessible to External Parties
- risk 0.46cvss 7.0epss 0.00
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would…