Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (13718 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-7437 1 Simplemachines 2 Simple Machine Forum, Simple Machines Forum 2024-09-11 5.4 Medium
A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-44410 2 D-link, Dlink 3 Di-8300, Di-8300, Di-8300 Firmware 2024-09-10 9.8 Critical
D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.
CVE-2024-7720 1 Hp 1 Security Manager 2024-09-06 9.8 Critical
HP Security Manager is potentially vulnerable to Remote Code Execution as a result of code vulnerability within the product's solution open-source libraries.
CVE-2024-7569 1 Ivanti 1 Neurons For Itsm 2024-09-06 9.6 Critical
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information.
CVE-2024-37901 1 Xwiki 1 Xwiki 2024-09-06 10 Critical
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2.
CVE-2024-45053 1 Ethyca 1 Fides 2024-09-06 9.1 Critical
Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default `Owner` or `Contributor` role, who can escalate their access and execute code on the underlying Fides Webserver container where the Jinja template rendering function is executed. The vulnerability has been patched in Fides version `2.44.0`. Users are advised to upgrade to this version or later to secure their systems against this threat. There are no workarounds.
CVE-2024-39713 1 Rocket.chat 1 Rocket.chat 2024-09-06 8.6 High
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
CVE-2024-24759 1 Mindsdb 1 Mindsdb 2024-09-06 9.3 Critical
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.
CVE-2024-7345 1 Progress 1 Openedge 2024-09-05 8.3 High
Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms
CVE-2024-38382 1 Openatom 1 Openharmony 2024-09-04 5.5 Medium
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
CVE-2024-39612 1 Openatom 1 Openharmony 2024-09-04 5.5 Medium
in OpenHarmony v4.0.0 and prior versions allow a local attacker cause information leak through out-of-bounds Read.
CVE-2024-39775 1 Openatom 1 Openharmony 2024-09-04 6.5 Medium
in OpenHarmony v4.1.0 and prior versions allow a remote attacker cause information leak through out-of-bounds Read.
CVE-2024-41364 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php
CVE-2024-41366 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php
CVE-2024-41367 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php
CVE-2024-41368 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php
CVE-2024-41361 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php
CVE-2024-41369 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php
CVE-2024-25562 1 Intel 2 Distribution For Gdb, Oneapi Base Toolkit 2024-08-31 5.8 Medium
Improper buffer restrictions in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2024-41889 1 Pimax 2 Pitool, Play 2024-08-30 8.8 High
Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.