Search vulnerabilities

Expected end of text, found 'ébec' (at char 15), (line:1, col:16)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,942

CVE-2024-20763

Adobe Animate 2024 GIF file parsing memory corruption

Animate versions 24.0, 23.0.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Animate Macos Windows
CVE-2024-2604

SourceCodester File Manager App update-file.php unrestricted upload

A vulnerability was found in SourceCodester File Manager App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/update-file.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257182 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Remyandrade Sourcecodester
Products
File Manager App File Management App
CVE-2024-3783

Path Traversal vulnerability in WBSAirback

The Backup Agents section in WBSAirback 21.02.04 is affected by a Path Traversal vulnerability, allowing a user with low privileges to download files from the system.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Whitebearsolutions
Products
Wbsairback
CVE-2024-28877

MicroDicom DICOM Viewer Stack-based Buffer Overflow

MicroDicom DICOM Viewer is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit this vulnerability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Microdicom
Products
Dicom Viewer
CVE-2024-2649

Netentsec NS-ASG Application Security Gateway deleteonlineuser.php sql injection

A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257287. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netentsec
Products
Application Security Gateway
CVE-2024-2677

Campcodes Online Job Finder System controller.php sql injection

A vulnerability has been found in Campcodes Online Job Finder System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/category/controller.php. The manipulation of the argument CATEGORYID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257377 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Campcodes
Products
Online Job Finder System
CVE-2024-2687

Campcodes Online Job Finder System index.php sql injection

A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/applicants/index.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257387.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Campcodes
Products
Online Job Finder System
CVE-2024-23821

GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 2.23.4 and 2.24.1 that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the GWC Demos Page. Access to the GWC Demos Page is available to all users although data security may limit users' ability to trigger the XSS. Versions 2.23.4 and 2.24.1 contain a patch for this issue.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Geoserver
Products
Geoserver
CVE-2024-2715

Campcodes Complete Online DJ Booking System user-search.php cross site scripting

A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/user-search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257468.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Campcodes
Products
Complete Online Dj Booking System
CVE-2024-29873

SQL injection vulnerability in Sentrifugo

SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sapplica Sentrifugo
Products
Sentrifugo Sentrifugo
CVE-2024-5888

Stored XSS in Rest Services API for a Toolbox published as GP Service

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51966

Directory traversal vulnerability in ArcGIS Server

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory. There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51963

Stored XSS in ArcGIS Server Manager

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51961

Local file inclusion (LFI) vulnerability in ArcGIS Server

There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration information by reading internal files from the remote server.  Due to the nature of the files accessible in this vulnerability the impact to confidentiality is High there is no impact to both integrity or availability.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51960

Stored XSS in ArcGIS Server Administrator Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51959

Stored XSS issue in Server Admin API

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51958

Directory traversal vulnerability in the admin api for service thumbnails

There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Successful exploitation may allow a remote authenticated attacker with admin privileges to traverse the file system to access files outside of the intended directory.  There is no impact to integrity or availability due to the nature of the files that can be accessed, but there is a potential high impact to confidentiality.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51957

Stored XSS vulnerability in ArcGIS Rest Services Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51956

Stored XSS vulnerability in ArcGIS Server Administrator Directory

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server
CVE-2024-51953

Stored XSS in ArcGIS Server Rest services

There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high, requiring publisher capabilities. The impact is low to both confidentiality and integrity while having no impact to availability.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Server