Search vulnerabilities

Expected end of text, found ':' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,694

CVE-2024-45794

SQL Injection in CreateUser API in devtron

devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Devtron Kubernetes
Products
Devtron Devtron
CVE-2024-9579

Certain Poly Video Conference Devices – Potential Remote Code Execution

A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hp Poly
Products
Poly Studio G62 Poly Studio G62 Firmware Poly Studio G7500 and 21 more
CVE-2024-49522

Substance3D - Painter | Out-of-bounds Write (CWE-787)

Substance3D - Painter versions 10.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Substance 3d Painter
CVE-2024-10452

grafana: Org admin can delete pending invites in different org

Organization admins can delete pending invites created in an organization they are not part of.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Grafana
Products
Grafana
CVE-2023-29126

Insecure loose comparison in Enel X JuiceBox

The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Enelx
Products
Waybox Pro Waybox Pro Firmware
CVE-2023-29116

PHP Information Disclosure in Enel X JuiceBox

Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Enelx
Products
Waybox Pro Waybox Pro Firmware
CVE-2023-29115

Denial of Service via Web Management interface in Enel X JuiceBox

In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Enelx
Products
Waybox Pro Waybox Pro Firmware
CVE-2024-43937

WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability

Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Wp Crowdfunding
CVE-2024-51739

Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. Users unable to upgrade may overload the dictionary entry `"UI:ResetPwd-Error-WrongLogin"` through an extension and replace it with a generic message.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Combodo
Products
Itop
CVE-2024-0134

nvidia-container-toolkit: specially-crafted container image can lead to the creation of unauthorized files on the host

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to data tampering.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Nvidia
Products
Linux Kernel Nvidia Container Toolkit Nvidia Gpu Operator
CVE-2024-30106

HCL Connections is vulnerable to an information disclosure vulnerability

HCL Connections is vulnerable to an information disclosure vulnerability, due to an IBM WebSphere Application Server error, which could allow a user to obtain sensitive information they are not entitled to due to the improper handling of request data.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Connections
CVE-2024-47826

eLabFTW vulnerable to HTML Injection in extended search error message

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" (show mode), "database.php" (show mode) or "search.php". It works by providing HTML code in the extended search string, which will then be displayed back to the user in the error message. This means that injected HTML will appear in a red "alert/danger" box, and be part of an error message. Due to some other security measures, it is not possible to execute arbitrary javascript from this attack. As such, this attack is deemed low impact. Users should upgrade to at least version 5.1.5 to receive a patch. No known workarounds are available.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Elabftw
Products
Elabftw
CVE-2024-47831

Next.js image optimization has Denial of Service condition

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vercel
Products
Next.js
CVE-2024-25566

Open Redirect in PingAM

An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Forgerock
Products
Access Management