Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,909

CVE-2024-36410

SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Salesagility
Products
Suitecrm
CVE-2024-36409

SuiteCRM authenticated SQL Injection in TreeData entrypoint

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Salesagility
Products
Suitecrm
CVE-2024-36408

SuiteCRM authenticated SQL Injection in Alerts

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in the `Alerts` controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Salesagility
Products
Suitecrm
CVE-2024-36407

SuiteCRM unauthenticated user password reset on php7

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Salesagility
Products
Suitecrm
CVE-2024-36400

nano-id is unable to generate the correct character set

nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Viz
Products
Nano Id
CVE-2024-36399

Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Kanboard
Products
Kanboard
CVE-2024-36397

Vantiva - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vantiva
Products
Mediaaccess Dga2232 Mediaaccess Dga2232 Firmware
CVE-2024-36396

Verint - CWE-434: Unrestricted Upload of File with Dangerous Type

Verint - CWE-434: Unrestricted Upload of File with Dangerous Type

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Verint
Products
Workforce Optimization
CVE-2024-36395

Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Verint
Products
Workforce Optimization
CVE-2024-36394

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS 3.1 · 9.1 Critical EPSS 1.1% KEV · Not listed
Vendors
Sysaid
Products
Sysaid
CVE-2024-36393

SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Sysaid
Products
Sysaid
CVE-2024-36287

Bypass of TCC restrictions on macOS

Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Apple Mattermost
Products
Macos Mattermost Desktop
CVE-2024-36278

Arkcompiler Ets Runtime has a type confusion vulnerability

in OpenHarmony v4.0.0 and prior versions allow a local attacker cause apps crash through type confusion.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Openatom
Products
Openharmony
CVE-2024-36268

Apache InLong TubeMQ Client: Remote Code Execution vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/pull/10251

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Apache
Products
Inlong
CVE-2024-36260

Arkcompiler Ets Runtime has an out-of-bounds write vulnerability

in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds write.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openatom
Products
Openharmony
CVE-2024-36257

Lack of permission check when updating the profile picture of a remote user (shared channels enabled)

Mattermost versions 9.5.x <= 9.5.5 and 9.8.0, when using shared channels with multiple remote servers connected, fail to check that the remote server A requesting the server B to update the profile picture of a user is the remote that actually has the user as a local one . This allows a malicious remote A to change the profile images of users that belong to another remote server C that is connected to the server A.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost
CVE-2024-36243

Arkcompiler Ets Runtime has an out-of-bounds read vulnerability

in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through out-of-bounds read and write.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openatom
Products
Openharmony
CVE-2024-36239

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Experience Manager
CVE-2024-36238

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a malicious link or to interact with a maliciously crafted web page.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Experience Manager Experience Manager Cloud Service