Search vulnerabilities

Expected end of text, found '/' (at char 51), (line:1, col:52)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,694

CVE-2024-9983

Ragic Enterprise Cloud Database - Arbitrary File Read through Path Traversal

Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ragic
Products
Enterprise Cloud Database
CVE-2024-9984

Ragic Enterprise Cloud Database - Missing Authentication

Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ragic
Products
Enterprise Cloud Database
CVE-2024-9985

Ragic Enterprise Cloud Database - Arbitrary File Upload

Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Ragic
Products
Enterprise Cloud Database
CVE-2024-23370

Use After Free in Automotive Multimedia

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Qca6584au Qca6584au Firmware Qca6698aq and 19 more
CVE-2024-43780

Unauthorized channel file upload

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Server
CVE-2024-42497

Insufficient permissions checks on teams

Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mattermost
Products
Mattermost Mattermost Server
CVE-2024-8231

Tenda O6 setPortForward fromVirtualSet stack-based overflow

A vulnerability classified as critical has been found in Tenda O6 1.0.0.7(2054). Affected is the function fromVirtualSet of the file /goform/setPortForward. The manipulation of the argument ip/localPort/publicPort/app leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed
Vendors
Tenda
Products
O6 O6 Firmware
CVE-2024-23378

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Qualcomm
Products
Qam8255p Qam8255p Firmware Qam8650p and 33 more
CVE-2024-45290

Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Phpoffice
Products
Phpspreadsheet
CVE-2024-43686

Reflected XSS in TimeProvider 4100 chart component

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

CVSS 4.0 · 5.4 Medium EPSS 13.0% KEV · Not listed
Vendors
Microchip
Products
Timeprovider 4100 Timeprovider 4100 Firmware
CVE-2024-45291

Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. When embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. there are no known workarounds for this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phpoffice
Products
Phpspreadsheet