Search vulnerabilities

Expected end of text, found ',' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,871

CVE-2024-7252

Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability

Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22831.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Comodo
Products
Internet Security
CVE-2024-7251

Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability

Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22832.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Comodo
Products
Internet Security
CVE-2024-7250

Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability

Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22829.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Comodo
Products
Internet Security
CVE-2024-7249

Comodo Firewall Link Following Local Privilege Escalation Vulnerability

Comodo Firewall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cmdagent executable. By creating a symbolic link, an attacker can abuse the application to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-21794.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Comodo
Products
Firewall
CVE-2024-7248

Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability

Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Comodo Internet Security Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the update mechanism. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-19055.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Comodo
Products
Internet Security
CVE-2024-7226

SourceCodester Medicine Tracker System Password Change cross-site request forgery

A vulnerability was found in SourceCodester Medicine Tracker System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /classes/Users.php?f=save_user of the component Password Change Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-272806 is the identifier assigned to this vulnerability.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23 Sourcecodester
Products
Medicine Tracker System Medicine Tracker System
CVE-2024-7225

SourceCodester Insurance Management System Edit Insurance Policy Page update_policy cross site scripting

A vulnerability was found in SourceCodester Insurance Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /Script/admin/core/update_policy of the component Edit Insurance Policy Page. The manipulation of the argument pname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272805 was assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Munyweki
Products
Insurance Management System
CVE-2024-7224

SourceCodester Lot Reservation Management System lot_details.php sql injection

A vulnerability was found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /lot_details.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272804.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Lot Reservation Management System
CVE-2024-7223

SourceCodester Lot Reservation Management System view_model.php sql injection

A vulnerability has been found in SourceCodester Lot Reservation Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /view_model.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272803.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Lot Reservation Management System
CVE-2024-7222

SourceCodester Lot Reservation Management System home.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /home.php. The manipulation of the argument type leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272802 is the identifier assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Lot Reservation Management System
CVE-2024-7217

TOTOLINK CA300-PoE cstecgi.cgi loginauth buffer overflow

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 7.1% KEV · Not listed
Vendors
Totolink
Products
Ca300-poe Ca300-poe Firmware
CVE-2024-7216

TOTOLINK LR1200 shadow.sample hard-coded password

A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
Lr1200 Lr1200 Firmware
CVE-2024-7215

TOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injection

A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272786 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Totolink
Products
Lr1200 Lr1200 Firmware
CVE-2024-7214

TOTOLINK LR350 cstecgi.cgi setWanCfg command injection

A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272785 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS 3.2% KEV · Not listed
Vendors
Totolink
Products
Lr350 Lr350 Firmware
CVE-2024-7213

TOTOLINK A7000R cstecgi.cgi setWizardCfg buffer overflow

A vulnerability, which was classified as critical, was found in TOTOLINK A7000R 9.1.0u.6268_B20220504. Affected is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272784. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Totolink
Products
A7000r A7000r Firmware
CVE-2024-7212

TOTOLINK A7000R cstecgi.cgi loginauth buffer overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK A7000R 9.1.0u.6268_B20220504. This issue affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272783. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.0% KEV · Not listed
Vendors
Totolink
Products
A7000r A7000r Firmware
CVE-2024-7202

Simopro Technology WinMatrix3 Web package - SQL Injection

The query functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Simopro Technology
Products
Winmatrix3
CVE-2024-7201

Simopro Technology WinMatrix3 Web package - SQL Injection

The login functionality of WinMatrix3 Web package from Simopro Technology lacks proper validation of user input, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Simopro Technology
Products
Winmatrix3
CVE-2024-7200

SourceCodester Complaints Report Management System cross site scripting

A vulnerability, which was classified as problematic, has been found in SourceCodester Complaints Report Management System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_settings. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272621 was assigned to this vulnerability.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Complaints Report Management System
CVE-2024-7199

SourceCodester Complaints Report Management System manage_user.php sql injection

A vulnerability classified as critical was found in SourceCodester Complaints Report Management System 1.0. This vulnerability affects unknown code of the file /admin/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272620.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Complaints Report Management System