CVE-2024-21060

mysql: Server: Data Dictionary unspecified vulnerability (CPU Apr 2024)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp Oracle

Products

Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 2 more

CVE-2024-21054

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2024)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp Oracle

Products

Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 2 more

CVE-2024-21053

mysql: Server: DML unspecified vulnerability (CPU Apr 2024)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp Oracle Redhat

Products

Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 3 more

CVE-2024-21052

mysql: Server: DML unspecified vulnerability (CPU Apr 2024)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp Oracle Redhat

Products

Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 3 more

CVE-2025-21492

mysql: Optimizer unspecified vulnerability (CPU Jan 2025)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.36 and prior and 8.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Netapp Oracle

Products

Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 1 more

CVE-2023-39993

WordPress ElementsKit Lite plugin <= 2.9.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Wpmet Elements kit Elementor addons.This issue affects Elements kit Elementor addons: from n/a through 2.9.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmet

Products

Elements Kit Elementor Addons

CVE-2022-4839

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4840

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4841

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4843

NULL Pointer Dereference in radareorg/radare2

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Radare

Products

Radare2

CVE-2022-4847

Incorrectly Specified Destination in a Communication Channel in usememos/memos

Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4848

Improper Verification of Source of a Communication Channel in usememos/memos

Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4849

Cross-Site Request Forgery (CSRF) in usememos/memos

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4855

SourceCodester Lead Management System login.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Lead Management System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-217020.

CVSS 3.1 · 7.3 High EPSS 24.6% KEV · Not listed

Vendors

Lead Management System Project

Products

Lead Management System

CVE-2022-4857

Modbus Tools Modbus Poll mbp File mbpoll.exe buffer overflow

A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file mbpoll.exe of the component mbp File Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-217022 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Modbustools

Products

Modbus Poll

CVE-2023-0051

Heap-based Buffer Overflow in vim/vim

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Vim

Products

Vim

CVE-2024-0259

Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04

Fortra's Robot Schedule Enterprise Agent for Windows prior to version 3.04 is susceptible to privilege escalation. A low-privileged user can overwrite the service executable. When the service is restarted, the replaced binary runs with local system privileges, allowing a low-privileged user to gain elevated privileges.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Fortra Microsoft

Products

Robot Schedule Windows

CVE-2024-29833

WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler

The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

10web

Products

Photo Gallery

CVE-2024-29832

WordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_url

The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

10web

Products

Photo Gallery

CVE-2024-29810

WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_url

The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

10web

Products

Photo Gallery