По дате публикации
Эксплуатируемые и новые серьёзные CVE: февраль 2024 г.
177 записей · 11 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
24Наблюдать | CVE-2024-24945Proof of concept | A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arremyandrade · travel journal using php and mysql with source code · CWE-79 | Средняя6,1 | — | 0,4 % | 1 февр. 2024 г. |
24Наблюдать | CVE-2024-22927Proof of concept | Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via craftedeyoucms · eyoucms · CWE-79 | Средняя6,1 | — | 1,0 % | 1 февр. 2024 г. |
21Наблюдать | CVE-2023-46344Proof of concept | A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate thsolar-log · 2000 pm\+ firmware · CWE-79 | Средняя5,4 | — | 0,4 % | 1 февр. 2024 г. |
36Наблюдать | CVE-2024-22899Proof of concept | Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime funcvinchin · vinchin backup and recovery · CWE-94 | Высокая8,8 | — | 2,3 % | 1 февр. 2024 г. |
39Наблюдать | CVE-2024-23746Proof of concept | Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bmiro · miro · CWE-94 | Критическая9,8 | — | 1,2 % | 1 февр. 2024 г. |
62На этой неделе | CVE-2024-22319Proof of concept | IBM Operational Decision Manager JDNI injectionibm · operational decision manager · CWE-74 | Критическая9,8 | — | 76,4 % | 1 февр. 2024 г. |
57В плане | CVE-2024-22320Proof of concept | IBM Operational Decision Manager code executionibm · operational decision manager · CWE-502 | Высокая8,8 | — | 73,3 % | 1 февр. 2024 г. |
21Наблюдать | CVE-2024-21485Proof of concept | Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packaplotly · dash · CWE-79 | Средняя5,4 | — | 1,4 % | 2 февр. 2024 г. |
32Наблюдать | CVE-2023-47564Proof of concept | An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central.qnap · qsync central · CWE-732 | Высокая8,1 | — | 1,0 % | 2 февр. 2024 г. |
30Наблюдать | CVE-2023-6387Proof of concept | Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflowsilabs · gecko software development kit · CWE-125 | Высокая7,5 | — | 0,6 % | 2 февр. 2024 г. |
29Наблюдать | CVE-2024-24760Proof of concept | Mailcow Docker Container Exposure to Local Networkmailcow · mailcow\ · CWE-610 | Высокая7,3 | — | 0,8 % | 2 февр. 2024 г. |
21Наблюдать | CVE-2023-49950Proof of concept | The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a custlogpoint · siem · CWE-79 | Средняя5,4 | — | 0,5 % | 3 февр. 2024 г. |
21Наблюдать | CVE-2023-51504Proof of concept | WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)dandulaney · dan\'s embedder for google calendar · CWE-79 | Средняя5,4 | — | 0,7 % | 5 февр. 2024 г. |
41В плане | CVE-2021-4436Proof of concept | 3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Uploadwp3dprinting · 3dprint lite · CWE-434 | Критическая9,8 | — | 6,6 % | 5 февр. 2024 г. |
63На этой неделе | CVE-2024-23108Proof of concept | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to fortinet · fortisiem · CWE-78 | Критическая9,8 | — | 80,3 % | 5 февр. 2024 г. |
30Наблюдать | CVE-2023-47355Proof of concept | The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for eyuepcanyilmaz · root quick reboot · CWE-20 | Высокая7,5 | — | 0,7 % | 5 февр. 2024 г. |
21Наблюдать | CVE-2024-24397Proof of concept | Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarstimulsoft · dashboards.js · CWE-79 | Средняя5,4 | — | 0,7 % | 5 февр. 2024 г. |
24Наблюдать | CVE-2024-24396Proof of concept | Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarstimulsoft · dashboard.js · CWE-79 | Средняя6,1 | — | 0,8 % | 5 февр. 2024 г. |
40В плане | CVE-2024-22567Эксплойта нет | File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.mingsoft · mcms · CWE-434 | Высокая8,8 | — | 17,7 % | 5 февр. 2024 г. |
35Наблюдать | CVE-2023-6700Proof of concept | Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Updatecookieinformation · wp-gdpr-compliance · CWE-862 | Высокая8,8 | — | 1,4 % | 5 февр. 2024 г. |
40В плане | CVE-2023-6846Эксплойта нет | File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Uploadfilemanagerpro · file manager · CWE-94 | Высокая8,8 | — | 15,8 % | 5 февр. 2024 г. |
55В плане | CVE-2023-6933Proof of concept | Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injectionwpengine · better search replace · CWE-502 | Высокая8,8 | — | 68,0 % | 5 февр. 2024 г. |
35Наблюдать | CVE-2023-6985Proof of concept | 10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation10web · ai assistant · CWE-862 | Высокая8,8 | — | 1,3 % | 5 февр. 2024 г. |
56В плане | CVE-2023-6989Proof of concept | Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusiongetshieldsecurity · shield security · CWE-98 | Критическая9,8 | — | 56,5 % | 5 февр. 2024 г. |
31Наблюдать | CVE-2024-0324Proof of concept | User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_updatecozmoslabs · profile builder · CWE-284 | Высокая7,5 | — | 2,4 % | 5 февр. 2024 г. |
24Наблюдать | CVE-2024-0509Proof of concept | WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via requesthwk · wp 404 auto redirect to similar post · CWE-79 | Средняя6,1 | — | 1,2 % | 5 февр. 2024 г. |
23Наблюдать | CVE-2024-1208Proof of concept | LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via APIlearndash · learndash · CWE-200 | Средняя5,3 | — | 5,2 % | 5 февр. 2024 г. |
22Наблюдать | CVE-2024-1209Proof of concept | LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignmentslearndash · learndash · CWE-200 | Средняя5,3 | — | 2,3 % | 5 февр. 2024 г. |
22Наблюдать | CVE-2024-1210Proof of concept | LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via APIlearndash · learndash · CWE-200 | Средняя5,3 | — | 2,0 % | 5 февр. 2024 г. |
40В плане | CVE-2024-24398Proof of concept | Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarystimulsoft · dashboards.php · CWE-22 | Критическая9,8 | — | 2,0 % | 5 февр. 2024 г. |
65На этой неделе | CVE-2023-46359Proof of concept | An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attachardy-barth · cph2 echarge firmware · CWE-78 | Критическая9,8 | — | 87,6 % | 5 февр. 2024 г. |
31Наблюдать | CVE-2023-47889Proof of concept | The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers.binhdrm26 · super reboot · CWE-927 | Высокая7,8 | — | 0,2 % | 5 февр. 2024 г. |
40В плане | CVE-2024-24112Proof of concept | xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.exrick · xmall · CWE-89 | Критическая9,8 | — | 3,3 % | 5 февр. 2024 г. |
40В плане | CVE-2024-22853Proof of concept | D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain rdlink · go-rt-ac750 firmware · CWE-798 | Критическая9,8 | — | 4,8 % | 5 февр. 2024 г. |
30Наблюдать | CVE-2024-23673Proof of concept | Apache Sling Servlets Resolver: Malicious code execution via path traversalapache · sling servlets resolver · CWE-22 | Высокая7,5 | — | 1,3 % | 6 февр. 2024 г. |
55В плане | CVE-2024-23917Proof of concept | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possiblejetbrains · teamcity · CWE-288 | Критическая9,8 | — | 54,0 % | 6 февр. 2024 г. |
31Наблюдать | CVE-2024-24942Эксплойта нет | In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archivesjetbrains · teamcity · CWE-23 | Средняя5,3 | — | 31,9 % | 6 февр. 2024 г. |
22Наблюдать | CVE-2024-0684Proof of concept | Coreutils: heap overflow in split --line-bytes with very long linesgnu · coreutils · CWE-122 | Средняя5,5 | — | 0,4 % | 6 февр. 2024 г. |
36Наблюдать | CVE-2024-24590Proof of concept | Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliclear · clearml · CWE-502 | Высокая8,8 | — | 2,4 % | 6 февр. 2024 г. |
29Наблюдать | CVE-2023-43482Proof of concept | A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322tp-link · er7206 firmware · CWE-78 | Высокая7,2 | — | 3,2 % | 6 февр. 2024 г. |
30Наблюдать | CVE-2024-22241Эксплойта нет | Aria Operations for Networks contains a cross site scripting vulnerability.vmware · aria operations for networks · CWE-79 | Средняя4,8 | — | 37,8 % | 6 февр. 2024 г. |
35Наблюдать | CVE-2024-22514Proof of concept | An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file.ispyconnect · agent dvr · CWE-22 | Высокая8,8 | — | 1,4 % | 6 февр. 2024 г. |
35Наблюдать | CVE-2024-22515Proof of concept | Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio ispyconnect · agent dvr · CWE-434 | Высокая8,8 | — | 1,1 % | 6 февр. 2024 г. |
45В плане | CVE-2024-1283Эксплойта нет | Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via agoogle · chrome · CWE-787 | Критическая9,8 | — | 21,6 % | 6 февр. 2024 г. |
24Наблюдать | CVE-2024-1269Proof of concept | SourceCodester Product Management System supplier.php cross site scriptingremyandrade · product management system · CWE-79 | Средняя6,1 | — | 0,6 % | 6 февр. 2024 г. |
21Наблюдать | CVE-2023-40355Proof of concept | Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, alloaxigen · axigen mobile webmail · CWE-79 | Средняя5,4 | — | 1,0 % | 7 февр. 2024 г. |
24Наблюдать | CVE-2024-24131Proof of concept | SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.superwebmailer · superwebmailer · CWE-79 | Средняя6,1 | — | 0,9 % | 7 февр. 2024 г. |
40В плане | CVE-2024-20290Эксплойта нет | A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) cisco · secure endpoint · CWE-126 | Высокая7,5 | — | 33,3 % | 7 февр. 2024 г. |
24Наблюдать | CVE-2024-24816Proof of concept | Cross-site scripting (XSS) vulnerability in samples with enabled the preview featureckeditor · ckeditor · CWE-79 | Средняя6,1 | — | 1,6 % | 7 февр. 2024 г. |
45В плане | CVE-2024-24824Proof of concept | graylog2-server vulnerable to instantiation of arbitrary classes triggered by API requestgraylog · graylog · CWE-284 | Высокая8,8 | — | 34,7 % | 7 февр. 2024 г. |
22Наблюдать | CVE-2024-24488Proof of concept | An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password ctendacn · cp3 firmware · CWE-312 | Средняя5,5 | — | 0,2 % | 7 февр. 2024 г. |
39Наблюдать | CVE-2023-48974Proof of concept | Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted scriptaxigen · axigen mail server · CWE-79 | Критическая9,6 | — | 2,9 % | 7 февр. 2024 г. |
24Наблюдать | CVE-2024-24034Proof of concept | Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary setorinformatica · s.i.l · CWE-601 | Средняя6,1 | — | 0,5 % | 8 февр. 2024 г. |
21Наблюдать | CVE-2024-24871Эксплойта нет | WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerabilitycreativethemes · blocksy · CWE-79 | Средняя5,4 | — | 0,3 % | 8 февр. 2024 г. |
48В плане | CVE-2024-22836Proof of concept | An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.akaunting · akaunting · CWE-78 | Критическая9,8 | — | 30,0 % | 8 февр. 2024 г. |
32Наблюдать | CVE-2024-24494Proof of concept | Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, prremyandrade · daily habit tracker · CWE-79 | Средняя6,1 | — | 25,8 % | 8 февр. 2024 г. |
39Наблюдать | CVE-2024-24495Proof of concept | SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafteremyandrade · daily habit tracker · CWE-89 | Критическая9,8 | — | 1,3 % | 8 февр. 2024 г. |
45В плане | CVE-2024-24496Proof of concept | An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php,remyandrade · daily habit tracker · CWE-287 | Критическая9,8 | — | 19,5 % | 8 февр. 2024 г. |
22Наблюдать | CVE-2024-22318Proof of concept | IBM i Access Client Solutions information disclosureibm · i access client solutions · CWE-327 | Средняя5,5 | — | 0,5 % | 8 февр. 2024 г. |
32Наблюдать | CVE-2024-25003Proof of concept | KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds check9bis · kitty · CWE-787 | Высокая7,8 | — | 1,8 % | 9 февр. 2024 г. |
32Наблюдать | CVE-2024-25004Proof of concept | KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds check9bis · kitty · CWE-787 | Высокая7,8 | — | 1,7 % | 9 февр. 2024 г. |
32Наблюдать | CVE-2024-23749Proof of concept | KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitizat9bis · kitty · CWE-77 | Высокая7,8 | — | 4,6 % | 9 февр. 2024 г. |
94Срочно | CVE-2024-21762Готовый эксплойт | A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2fortinet · fortiproxy · CWE-787 | Критическая9,8 | KEV | 83,4 % | 9 февр. 2024 г. |
60На этой неделе | CVE-2023-50386Готовый эксплойт | Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsapache · solr · CWE-434 | Высокая8,8 | — | 83,7 % | 9 февр. 2024 г. |
19Наблюдать | CVE-2024-1247Proof of concept | Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name fieldconcretecms · concrete cms · CWE-20 | Средняя4,8 | — | 1,2 % | 9 февр. 2024 г. |
31Наблюдать | CVE-2024-21490Proof of concept | This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.angularjs · angular.js · CWE-1333 | Высокая7,5 | — | 1,8 % | 10 февр. 2024 г. |
37Наблюдать | CVE-2024-23724Proof of concept | Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profghost · ghost · CWE-79 | Критическая9,0 | — | 3,4 % | 10 февр. 2024 г. |
35Наблюдать | CVE-2024-24926Proof of concept | WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injectionunitedthemes · brooklyn · CWE-502 | Высокая8,8 | — | 1,0 % | 12 февр. 2024 г. |
39Наблюдать | CVE-2023-46615Proof of concept | WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injectionkallidan · kd coming soon · CWE-502 | Критическая9,8 | — | 0,8 % | 12 февр. 2024 г. |
40В плане | CVE-2023-6036Proof of concept | Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypassminiorange · web3 - crypto wallet login \& nft token gating · CWE-863 | Критическая9,8 | — | 1,7 % | 12 февр. 2024 г. |
24Наблюдать | CVE-2024-0250Proof of concept | Analytics Insights for Google Analytics 4 < 6.3 - Open Redirectdeconf · analytics insights · CWE-601 | Средняя6,1 | — | 1,2 % | 12 февр. 2024 г. |
29Наблюдать | CVE-2024-0566Proof of concept | Smart Manager < 8.28.0 - Admin+ SQL Injectionstoreapps · smart manager · CWE-89 | Высокая7,2 | — | 3,3 % | 12 февр. 2024 г. |
60На этой неделе | CVE-2024-23759Готовый эксплойт | Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfgambio · gambio · CWE-434 | Критическая9,8 | — | 47,5 % | 12 февр. 2024 г. |
26Наблюдать | CVE-2023-49339Proof of concept | Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retriellucian · banner · CWE-639 | Средняя6,5 | — | 0,5 % | 12 февр. 2024 г. |
60На этой неделе | CVE-2023-47218Готовый эксплойт | QTS, QuTS hero, QuTScloudqnap · qts · CWE-77 | Высокая8,3 | — | 89,9 % | 12 февр. 2024 г. |
27Наблюдать | CVE-2023-50358Эксплойта нет | QTS, QuTS hero, QuTScloudqnap · qts · CWE-78 | Средняя5,8 | — | 13,5 % | 12 февр. 2024 г. |
61На этой неделе | CVE-2024-22024Proof of concept | An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) andivanti · connect secure · CWE-611 | Высокая8,3 | — | 94,7 % | 13 февр. 2024 г. |
24Наблюдать | CVE-2023-45206Эксплойта нет | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.zimbra · collaboration · CWE-79 | Средняя6,1 | — | 0,4 % | 13 февр. 2024 г. |
79На этой неделе | CVE-2024-21338Готовый эксплойт | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-822 | Высокая7,8 | KEV | 59,8 % | 13 февр. 2024 г. |
41В плане | CVE-2024-21345Proof of concept | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows server 2022 23h2 · CWE-122 | Высокая8,8 | — | 20,2 % | 13 февр. 2024 г. |
68На этой неделе | CVE-2024-21351Готовый эксплойт | Windows SmartScreen Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-94 | Высокая7,6 | KEV | 27,7 % | 13 февр. 2024 г. |
40В плане | CVE-2024-21357Эксплойта нет | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-843 | Высокая8,1 | — | 26,8 % | 13 февр. 2024 г. |
31Наблюдать | CVE-2024-21371Эксплойта нет | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-367 | Высокая7,0 | — | 10,8 % | 13 февр. 2024 г. |
38Наблюдать | CVE-2024-21378Proof of concept | Microsoft Outlook Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-94 | Высокая8,8 | — | 10,9 % | 13 февр. 2024 г. |
73На этой неделе | CVE-2024-21410Готовый эксплойт | Microsoft Exchange Server Elevation of Privilege Vulnerabilitymicrosoft · exchange server · CWE-287 | Критическая9,8 | KEV | 12,5 % | 13 февр. 2024 г. |
92Срочно | CVE-2024-21412Готовый эксплойт | Internet Shortcut Files Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1809 · CWE-693 | Высокая8,1 | KEV | 99,4 % | 13 февр. 2024 г. |
97Срочно | CVE-2024-21413Готовый эксплойт | Microsoft Outlook Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-20 | Критическая9,8 | KEV | 94,6 % | 13 февр. 2024 г. |
24Наблюдать | CVE-2023-31346Proof of concept | Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.amd · epyc 7773x firmware · CWE-284 | Средняя6,0 | — | 0,3 % | 13 февр. 2024 г. |
39Наблюдать | CVE-2024-24142Proof of concept | Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.rems · school task manager · CWE-89 | Критическая9,8 | — | 1,1 % | 13 февр. 2024 г. |
30Наблюдать | CVE-2024-25125Эксплойта нет | Absolute path traversal vulnerability in digdag servertreasuredata · digdag · CWE-22 | Средняя5,3 | — | 29,6 % | 13 февр. 2024 г. |
60На этой неделе | CVE-2023-50387Proof of concept | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of serredhat · enterprise linux · CWE-770 | Высокая7,5 | — | 99,9 % | 14 февр. 2024 г. |
52В плане | CVE-2023-50868Proof of concept | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a dennetapp · hci baseboard management controller · CWE-400 | Высокая7,5 | — | 73,7 % | 14 февр. 2024 г. |
56В плане | CVE-2024-25617Эксплойта нет | Denial of Service in HTTP Header parser in squid proxysquid-cache · squid · CWE-182 | Высокая7,5 | — | 88,0 % | 14 февр. 2024 г. |
27Наблюдать | CVE-2022-23093Proof of concept | Stack overflow in ping(8)freebsd · freebsd · CWE-120 | Средняя6,5 | — | 2,3 % | 15 февр. 2024 г. |
28Наблюдать | CVE-2024-24386Proof of concept | An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.vitalpbx · vitalpbx · CWE-284 | Высокая7,2 | — | 1,0 % | 15 февр. 2024 г. |
88Срочно | CVE-2024-23113Готовый эксплойт | A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fofortinet · fortiproxy · CWE-134 | Критическая9,8 | KEV | 61,7 % | 15 февр. 2024 г. |
56В плане | CVE-2024-23478Эксплойта нет | SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Executionsolarwinds · access rights manager · CWE-502 | Высокая8,0 | — | 81,5 % | 15 февр. 2024 г. |
31Наблюдать | CVE-2023-40109Proof of concept | In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass.google · android · CWE-266 | Высокая7,8 | — | 0,1 % | 15 февр. 2024 г. |
22Наблюдать | CVE-2024-0030Proof of concept | In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check.google · android · CWE-125 | Средняя5,5 | — | 0,3 % | 15 февр. 2024 г. |
31Наблюдать | CVE-2024-0040Proof of concept | In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow.google · android · CWE-787 | Высокая7,5 | — | 1,9 % | 15 февр. 2024 г. |
- CVE-2024-2494524Наблюдать
A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute ar
СредняяCVSS 6,1Proof of conceptEPSS 0 %remyandrade · travel journal using php and mysql with source code1 февр. 2024 г.
- CVE-2024-2292724Наблюдать
Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted
СредняяCVSS 6,1Proof of conceptEPSS 1 %eyoucms · eyoucms1 февр. 2024 г.
- CVE-2023-4634421Наблюдать
A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate th
СредняяCVSS 5,4Proof of conceptEPSS 0 %solar-log · 2000 pm\+ firmware1 февр. 2024 г.
- CVE-2024-2289936Наблюдать
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime func
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %vinchin · vinchin backup and recovery1 февр. 2024 г.
- CVE-2024-2374639Наблюдать
Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (b
КритическаяCVSS 9,8Proof of conceptEPSS 1 %miro · miro1 февр. 2024 г.
- CVE-2024-2231962На этой неделе
IBM Operational Decision Manager JDNI injection
КритическаяCVSS 9,8Proof of conceptEPSS 76 %ibm · operational decision manager1 февр. 2024 г.
- CVE-2024-2232057В плане
IBM Operational Decision Manager code execution
ВысокаяCVSS 8,8Proof of conceptEPSS 73 %ibm · operational decision manager1 февр. 2024 г.
- CVE-2024-2148521Наблюдать
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packa
СредняяCVSS 5,4Proof of conceptEPSS 1 %plotly · dash2 февр. 2024 г.
- CVE-2023-4756432Наблюдать
An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central.
ВысокаяCVSS 8,1Proof of conceptEPSS 1 %qnap · qsync central2 февр. 2024 г.
- CVE-2023-638730Наблюдать
Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %silabs · gecko software development kit2 февр. 2024 г.
- CVE-2024-2476029Наблюдать
Mailcow Docker Container Exposure to Local Network
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %mailcow · mailcow\2 февр. 2024 г.
- CVE-2023-4995021Наблюдать
The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a cust
СредняяCVSS 5,4Proof of conceptEPSS 0 %logpoint · siem3 февр. 2024 г.
- CVE-2023-5150421Наблюдать
WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)
СредняяCVSS 5,4Proof of conceptEPSS 0 %dandulaney · dan\'s embedder for google calendar5 февр. 2024 г.
- CVE-2021-443641В плане
3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 6 %wp3dprinting · 3dprint lite5 февр. 2024 г.
- CVE-2024-2310863На этой неделе
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to
КритическаяCVSS 9,8Proof of conceptEPSS 80 %fortinet · fortisiem5 февр. 2024 г.
- CVE-2023-4735530Наблюдать
The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %eyuepcanyilmaz · root quick reboot5 февр. 2024 г.
- CVE-2024-2439721Наблюдать
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar
СредняяCVSS 5,4Proof of conceptEPSS 0 %stimulsoft · dashboards.js5 февр. 2024 г.
- CVE-2024-2439624Наблюдать
Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar
СредняяCVSS 6,1Proof of conceptEPSS 0 %stimulsoft · dashboard.js5 февр. 2024 г.
- CVE-2024-2256740В плане
File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.
ВысокаяCVSS 8,8Эксплойта нетEPSS 17 %mingsoft · mcms5 февр. 2024 г.
- CVE-2023-670035Наблюдать
Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %cookieinformation · wp-gdpr-compliance5 февр. 2024 г.
- CVE-2023-684640В плане
File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload
ВысокаяCVSS 8,8Эксплойта нетEPSS 15 %filemanagerpro · file manager5 февр. 2024 г.
- CVE-2023-693355В плане
Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection
ВысокаяCVSS 8,8Proof of conceptEPSS 68 %wpengine · better search replace5 февр. 2024 г.
- CVE-2023-698535Наблюдать
10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %10web · ai assistant5 февр. 2024 г.
- CVE-2023-698956В плане
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion
КритическаяCVSS 9,8Proof of conceptEPSS 56 %getshieldsecurity · shield security5 февр. 2024 г.
- CVE-2024-032431Наблюдать
User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %cozmoslabs · profile builder5 февр. 2024 г.
- CVE-2024-050924Наблюдать
WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request
СредняяCVSS 6,1Proof of conceptEPSS 1 %hwk · wp 404 auto redirect to similar post5 февр. 2024 г.
- CVE-2024-120823Наблюдать
LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
СредняяCVSS 5,3Proof of conceptEPSS 5 %learndash · learndash5 февр. 2024 г.
- CVE-2024-120922Наблюдать
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
СредняяCVSS 5,3Proof of conceptEPSS 2 %learndash · learndash5 февр. 2024 г.
- CVE-2024-121022Наблюдать
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API
СредняяCVSS 5,3Proof of conceptEPSS 2 %learndash · learndash5 февр. 2024 г.
- CVE-2024-2439840В плане
Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary
КритическаяCVSS 9,8Proof of conceptEPSS 2 %stimulsoft · dashboards.php5 февр. 2024 г.
- CVE-2023-4635965На этой неделе
An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attac
КритическаяCVSS 9,8Proof of conceptEPSS 87 %hardy-barth · cph2 echarge firmware5 февр. 2024 г.
- CVE-2023-4788931Наблюдать
The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %binhdrm26 · super reboot5 февр. 2024 г.
- CVE-2024-2411240В плане
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 3 %exrick · xmall5 февр. 2024 г.
- CVE-2024-2285340В плане
D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain r
КритическаяCVSS 9,8Proof of conceptEPSS 4 %dlink · go-rt-ac750 firmware5 февр. 2024 г.
- CVE-2024-2367330Наблюдать
Apache Sling Servlets Resolver: Malicious code execution via path traversal
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %apache · sling servlets resolver6 февр. 2024 г.
- CVE-2024-2391755В плане
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
КритическаяCVSS 9,8Proof of conceptEPSS 54 %jetbrains · teamcity6 февр. 2024 г.
- CVE-2024-2494231Наблюдать
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
СредняяCVSS 5,3Эксплойта нетEPSS 31 %jetbrains · teamcity6 февр. 2024 г.
- CVE-2024-068422Наблюдать
Coreutils: heap overflow in split --line-bytes with very long lines
СредняяCVSS 5,5Proof of conceptEPSS 0 %gnu · coreutils6 февр. 2024 г.
- CVE-2024-2459036Наблюдать
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a mali
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %clear · clearml6 февр. 2024 г.
- CVE-2023-4348229Наблюдать
A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322
ВысокаяCVSS 7,2Proof of conceptEPSS 3 %tp-link · er7206 firmware6 февр. 2024 г.
- CVE-2024-2224130Наблюдать
Aria Operations for Networks contains a cross site scripting vulnerability.
СредняяCVSS 4,8Эксплойта нетEPSS 37 %vmware · aria operations for networks6 февр. 2024 г.
- CVE-2024-2251435Наблюдать
An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file.
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %ispyconnect · agent dvr6 февр. 2024 г.
- CVE-2024-2251535Наблюдать
Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %ispyconnect · agent dvr6 февр. 2024 г.
- CVE-2024-128345В плане
Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a
КритическаяCVSS 9,8Эксплойта нетEPSS 21 %google · chrome6 февр. 2024 г.
- CVE-2024-126924Наблюдать
SourceCodester Product Management System supplier.php cross site scripting
СредняяCVSS 6,1Proof of conceptEPSS 0 %remyandrade · product management system6 февр. 2024 г.
- CVE-2023-4035521Наблюдать
Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allo
СредняяCVSS 5,4Proof of conceptEPSS 1 %axigen · axigen mobile webmail7 февр. 2024 г.
- CVE-2024-2413124Наблюдать
SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.
СредняяCVSS 6,1Proof of conceptEPSS 0 %superwebmailer · superwebmailer7 февр. 2024 г.
- CVE-2024-2029040В плане
A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS)
ВысокаяCVSS 7,5Эксплойта нетEPSS 33 %cisco · secure endpoint7 февр. 2024 г.
- CVE-2024-2481624Наблюдать
Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature
СредняяCVSS 6,1Proof of conceptEPSS 1 %ckeditor · ckeditor7 февр. 2024 г.
- CVE-2024-2482445В плане
graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request
ВысокаяCVSS 8,8Proof of conceptEPSS 34 %graylog · graylog7 февр. 2024 г.
- CVE-2024-2448822Наблюдать
An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password c
СредняяCVSS 5,5Proof of conceptEPSS 0 %tendacn · cp3 firmware7 февр. 2024 г.
- CVE-2023-4897439Наблюдать
Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script
КритическаяCVSS 9,6Proof of conceptEPSS 2 %axigen · axigen mail server7 февр. 2024 г.
- CVE-2024-2403424Наблюдать
Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary
СредняяCVSS 6,1Proof of conceptEPSS 0 %setorinformatica · s.i.l8 февр. 2024 г.
- CVE-2024-2487121Наблюдать
WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability
СредняяCVSS 5,4Эксплойта нетEPSS 0 %creativethemes · blocksy8 февр. 2024 г.
- CVE-2024-2283648В плане
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.
КритическаяCVSS 9,8Proof of conceptEPSS 30 %akaunting · akaunting8 февр. 2024 г.
- CVE-2024-2449432Наблюдать
Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pr
СредняяCVSS 6,1Proof of conceptEPSS 25 %remyandrade · daily habit tracker8 февр. 2024 г.
- CVE-2024-2449539Наблюдать
SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafte
КритическаяCVSS 9,8Proof of conceptEPSS 1 %remyandrade · daily habit tracker8 февр. 2024 г.
- CVE-2024-2449645В плане
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php,
КритическаяCVSS 9,8Proof of conceptEPSS 19 %remyandrade · daily habit tracker8 февр. 2024 г.
- CVE-2024-2231822Наблюдать
IBM i Access Client Solutions information disclosure
СредняяCVSS 5,5Proof of conceptEPSS 0 %ibm · i access client solutions8 февр. 2024 г.
- CVE-2024-2500332Наблюдать
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds check
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %9bis · kitty9 февр. 2024 г.
- CVE-2024-2500432Наблюдать
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds check
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %9bis · kitty9 февр. 2024 г.
- CVE-2024-2374932Наблюдать
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitizat
ВысокаяCVSS 7,8Proof of conceptEPSS 4 %9bis · kitty9 февр. 2024 г.
- CVE-2024-2176294Срочно
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 83 %fortinet · fortiproxy9 февр. 2024 г.
- CVE-2023-5038660На этой неделе
Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
ВысокаяCVSS 8,8Готовый эксплойтEPSS 83 %apache · solr9 февр. 2024 г.
- CVE-2024-124719Наблюдать
Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field
СредняяCVSS 4,8Proof of conceptEPSS 1 %concretecms · concrete cms9 февр. 2024 г.
- CVE-2024-2149031Наблюдать
This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %angularjs · angular.js10 февр. 2024 г.
- CVE-2024-2372437Наблюдать
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG prof
КритическаяCVSS 9,0Proof of conceptEPSS 3 %ghost · ghost10 февр. 2024 г.
- CVE-2024-2492635Наблюдать
WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %unitedthemes · brooklyn12 февр. 2024 г.
- CVE-2023-4661539Наблюдать
WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection
КритическаяCVSS 9,8Proof of conceptEPSS 0 %kallidan · kd coming soon12 февр. 2024 г.
- CVE-2023-603640В плане
Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 1 %miniorange · web3 - crypto wallet login \& nft token gating12 февр. 2024 г.
- CVE-2024-025024Наблюдать
Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect
СредняяCVSS 6,1Proof of conceptEPSS 1 %deconf · analytics insights12 февр. 2024 г.
- CVE-2024-056629Наблюдать
Smart Manager < 8.28.0 - Admin+ SQL Injection
ВысокаяCVSS 7,2Proof of conceptEPSS 3 %storeapps · smart manager12 февр. 2024 г.
- CVE-2024-2375960На этой неделе
Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopf
КритическаяCVSS 9,8Готовый эксплойтEPSS 47 %gambio · gambio12 февр. 2024 г.
- CVE-2023-4933926Наблюдать
Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retri
СредняяCVSS 6,5Proof of conceptEPSS 0 %ellucian · banner12 февр. 2024 г.
- CVE-2023-4721860На этой неделе
QTS, QuTS hero, QuTScloud
ВысокаяCVSS 8,3Готовый эксплойтEPSS 89 %qnap · qts12 февр. 2024 г.
- CVE-2023-5035827Наблюдать
QTS, QuTS hero, QuTScloud
СредняяCVSS 5,8Эксплойта нетEPSS 13 %qnap · qts12 февр. 2024 г.
- CVE-2024-2202461На этой неделе
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and
ВысокаяCVSS 8,3Proof of conceptEPSS 94 %ivanti · connect secure13 февр. 2024 г.
- CVE-2023-4520624Наблюдать
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.
СредняяCVSS 6,1Эксплойта нетEPSS 0 %zimbra · collaboration13 февр. 2024 г.
- CVE-2024-2133879На этой неделе
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 59 %microsoft · windows 10 180913 февр. 2024 г.
- CVE-2024-2134541В плане
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 20 %microsoft · windows server 2022 23h213 февр. 2024 г.
- CVE-2024-2135168На этой неделе
Windows SmartScreen Security Feature Bypass Vulnerability
ВысокаяCVSS 7,6KEVГотовый эксплойтEPSS 27 %microsoft · windows 10 150713 февр. 2024 г.
- CVE-2024-2135740В плане
Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Эксплойта нетEPSS 26 %microsoft · windows 10 150713 февр. 2024 г.
- CVE-2024-2137131Наблюдать
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 7,0Эксплойта нетEPSS 10 %microsoft · windows 10 150713 февр. 2024 г.
- CVE-2024-2137838Наблюдать
Microsoft Outlook Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 10 %microsoft · 365 apps13 февр. 2024 г.
- CVE-2024-2141073На этой неделе
Microsoft Exchange Server Elevation of Privilege Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 12 %microsoft · exchange server13 февр. 2024 г.
- CVE-2024-2141292Срочно
Internet Shortcut Files Security Feature Bypass Vulnerability
ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 99 %microsoft · windows 10 180913 февр. 2024 г.
- CVE-2024-2141397Срочно
Microsoft Outlook Remote Code Execution Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 94 %microsoft · 365 apps13 февр. 2024 г.
- CVE-2023-3134624Наблюдать
Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.
СредняяCVSS 6,0Proof of conceptEPSS 0 %amd · epyc 7773x firmware13 февр. 2024 г.
- CVE-2024-2414239Наблюдать
Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %rems · school task manager13 февр. 2024 г.
- CVE-2024-2512530Наблюдать
Absolute path traversal vulnerability in digdag server
СредняяCVSS 5,3Эксплойта нетEPSS 29 %treasuredata · digdag13 февр. 2024 г.
- CVE-2023-5038760На этой неделе
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of ser
ВысокаяCVSS 7,5Proof of conceptEPSS 99 %redhat · enterprise linux14 февр. 2024 г.
- CVE-2023-5086852В плане
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a den
ВысокаяCVSS 7,5Proof of conceptEPSS 73 %netapp · hci baseboard management controller14 февр. 2024 г.
- CVE-2024-2561756В плане
Denial of Service in HTTP Header parser in squid proxy
ВысокаяCVSS 7,5Эксплойта нетEPSS 88 %squid-cache · squid14 февр. 2024 г.
- CVE-2022-2309327Наблюдать
Stack overflow in ping(8)
СредняяCVSS 6,5Proof of conceptEPSS 2 %freebsd · freebsd15 февр. 2024 г.
- CVE-2024-2438628Наблюдать
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %vitalpbx · vitalpbx15 февр. 2024 г.
- CVE-2024-2311388Срочно
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 61 %fortinet · fortiproxy15 февр. 2024 г.
- CVE-2024-2347856В плане
SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution
ВысокаяCVSS 8,0Эксплойта нетEPSS 81 %solarwinds · access rights manager15 февр. 2024 г.
- CVE-2023-4010931Наблюдать
In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android15 февр. 2024 г.
- CVE-2024-003022Наблюдать
In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check.
СредняяCVSS 5,5Proof of conceptEPSS 0 %google · android15 февр. 2024 г.
- CVE-2024-004031Наблюдать
In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow.
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %google · android15 февр. 2024 г.