Total 18198 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-26519 1 Casa Systems 1 Ntc-221 Firmware 2024-10-23 9 Critical
An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component.
CVE-2024-49328 2 Vivek Tamrakar, Vivektamrakar 2 Wp Rest Api Fns, Wp Rest Api Fns 2024-10-23 9.8 Critical
Authentication Bypass Using an Alternate Path or Channel vulnerability in Vivek Tamrakar WP REST API FNS allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through 1.0.0.
CVE-2024-49286 1 Moridrin 1 Ssv Events 2024-10-23 9.6 Critical
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Moridrin SSV Events allows PHP Local File Inclusion.This issue affects SSV Events: from n/a through 3.2.7.
CVE-2024-49611 1 Paxman 1 Product Website Showcase 2024-10-23 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Paxman Product Website Showcase allows Upload a Web Shell to a Web Server.This issue affects Product Website Showcase: from n/a through 1.0.
CVE-2024-49604 2 Najeeb Ahmad, Najeebmedia 2 Simple User Registration, Simple User Registration 2024-10-23 9.8 Critical
Authentication Bypass Using an Alternate Path or Channel vulnerability in Najeeb Ahmad Simple User Registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through 5.5.
CVE-2024-48904 1 Trendmicro 1 Cloud Edge 2024-10-23 9.8 Critical
An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: authentication is not required in order to exploit this vulnerability.
CVE-2024-40085 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.6 Critical
A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via pppoe_username and pppoe_password fields being larger than 128 bytes in length.
CVE-2024-35285 1 Mitel 1 Micollab Nupoint Messanger 2024-10-23 9.8 Critical
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.
CVE-2024-40087 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.6 Critical
Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Insecure Permissions. Lack of authentication in the custom TCP service on port 5432 allows remote, unauthenticated attackers to gain administrative access over the router.
CVE-2024-40084 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.6 Critical
A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths.
CVE-2024-40086 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.6 Critical
A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via a password field larger than 64 bytes in length.
CVE-2024-41717 1 Kieback\&peter 10 Ddc4002 Firmware, Ddc4002e Firmware, Ddc4020e Firmware and 7 more 2024-10-23 9.8 Critical
Kieback & Peter's DDC4000 series is vulnerable to a path traversal vulnerability, which may allow an unauthenticated attacker to read files on the system.
CVE-2024-47223 1 Mitel 1 Micollab 2024-10-23 9.4 Critical
A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access non-sensitive user provisioning information and execute arbitrary SQL database commands.
CVE-2024-48659 1 Dcnglobal 1 Dcme-320-l Firmware 2024-10-23 9.8 Critical
An issue in DCME-320-L <=9.3.2.114 allows a remote attacker to execute arbitrary code via the log_u_umount.php component.
CVE-2024-43698 1 Kieback\&peter 10 Ddc4002 Firmware, Ddc4002e Firmware, Ddc4020e Firmware and 7 more 2024-10-23 9.8 Critical
Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system.
CVE-2024-40083 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.6 Critical
A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via sscanf reading the token and timezone JSON fields into a fixed-length buffer.
CVE-2024-40089 1 Viloliving 1 Vilo 5 Mesh Wifi System Firmware 2024-10-23 9.1 Critical
A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device.
CVE-2024-44000 1 Litespeedtech 1 Litespeed Cache 2024-10-23 9.8 Critical
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a before 6.5.0.1.
CVE-2024-9537 1 Sciencelogic 1 Sl1 2024-10-22 9.8 Critical
ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+. Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.
CVE-2024-47485 1 Hikvision 2 Hikcentral Master, Hikcentral Master Lite 2024-10-22 9.8 Critical
There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file.