CVE-2024-23614

Symantec Messaging Gateway Buffer Overflow

A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.

CVSS 3.1 · 10 Critical EPSS 1.6% KEV · Not listed

Vendors

Broadcom

Products

Symantec Messaging Gateway

CVE-2024-23612

Improper Error Handling Issue in LabVIEW

An improper error handling vulnerability in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ni

Products

Labview

CVE-2024-23588

A denial of service vulnerability affects HCL Nomad server on Domino

HCL Nomad server on Domino fails to properly handle users configured with limited Domino access resulting in a possible denial of service vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Nomad Server On Domino

CVE-2024-23562

HCL Domino is susceptible to an information disclosure vulnerability

A security vulnerability in HCL Domino could allow disclosure of sensitive configuration information. A remote unauthenticated attacker could exploit this vulnerability to obtain information to launch further attacks against the affected system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Domino

CVE-2024-23524

WordPress PilotPress plugin <= 2.0.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in ONTRAPORT Inc. PilotPress.This issue affects PilotPress: from n/a through 2.0.30.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ontraport

Products

Pilotpress

CVE-2024-23521

WordPress Happyforms plugin <= 1.25.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Happyforms

Products

Happyforms

CVE-2024-23504

WordPress Ninja Tables plugin <= 5.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmanageninja

Products

Ninja Tables

CVE-2024-23503

WordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmanageninja

Products

Ninja Tables

CVE-2024-23479

SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.

CVSS 3.1 · 9.6 Critical EPSS 5.8% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23478

SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service, resulting in remote code execution.

CVSS 3.1 · 8 High EPSS 81.6% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23477

SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve a Remote Code Execution.

CVSS 3.1 · 7.9 High EPSS 7.8% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23476

SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve the Remote Code Execution.

CVSS 3.1 · 9.6 Critical EPSS 7.1% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23475

SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVSS 3.1 · 9.6 Critical EPSS 2.1% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23474

SolarWinds Access Rights Manager (ARM) deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

The SolarWinds Access Rights Manager was found to be susceptible to an Arbitrary File Deletion and Information Disclosure vulnerability.

CVSS 3.1 · 7.6 High EPSS 1.5% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23470

SolarWinds Access Rights Manager (ARM) UserScriptHumster Exposed Dangerous Method Remote Command Execution Vulnerability

The SolarWinds Access Rights Manager was found to be susceptible to a pre-authentication remote code execution vulnerability. If exploited, this vulnerability allows an unauthenticated user to run commands and executables.

CVSS 3.1 · 9.6 Critical EPSS 1.2% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23468

SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability

The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an unauthenticated user to perform arbitrary file deletion and leak sensitive information.

CVSS 3.1 · 7.6 High EPSS 3.4% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23465

SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability

The SolarWinds Access Rights Manager was found to be susceptible to an authentication bypass vulnerability. This vulnerability allows an unauthenticated user to gain domain admin access within the Active Directory environment.  

CVSS 3.1 · 8.3 High EPSS 1.9% KEV · Not listed

Vendors

Solarwinds

Products

Access Rights Manager

CVE-2024-23448

APM Server Insertion of Sensitive Information into Log File

An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM Server attempted to ingest, this could lead to the insertion of sensitive or private information in the APM Server logs.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Apm Server

CVE-2024-23446

Kibana Broken Access Control issue

An issue was discovered by Elastic, whereby the Detection Engine Search API does not respect Document-level security (DLS) or Field-level security (FLS) when querying the .alerts-security.alerts-{space_id} indices. Users who are authorized to call this API may obtain unauthorized access to documents if their roles are configured with DLS or FLS against the aforementioned index.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2024-23443

kibana: uncontrolled resource consumption

A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted osquery pack.

CVSS 3.1 · 4.9 Medium EPSS 1.8% KEV · Not listed

Vendors

Elastic

Products

Kibana