Эксплуатируемые и новые серьёзные CVE: март 2024 г.

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.

• RCE без входа
• Открытый редирект

nteract · nteract1 мар. 2024 г.

mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.

• RCE

mjml · mjml app1 мар. 2024 г.

SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

• RCE без входа
• Десериализация

solarwinds · security event manager1 мар. 2024 г.

Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.

• Без аутентификации
• Обход аутентификации
• Нарушение контроля доступа (IDOR)

linksys · e2000 firmware1 мар. 2024 г.

Mini-Tmall 1 sql injection

• SQL-инъекция

1 мар. 2024 г.

ClamAV VirusEvent File Processing Command Injection Vulnerability

• RCE
• Локальное повышение привилегий
• Инъекция команд

clamav · clamav1 мар. 2024 г.

Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category.

• RCE без входа
• XSS

oretnom23 · book store management system1 мар. 2024 г.

Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/history.

• RCE без входа
• XSS

oretnom23 · book store management system1 мар. 2024 г.

Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functio

• Без аутентификации
• Нарушение контроля доступа (IDOR)

book store management system project · book store management system1 мар. 2024 г.

A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via ma

• SQL-инъекция

oretnom23 · customer support system1 мар. 2024 г.

A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicat

• Без аутентификации
• Нарушение контроля доступа (IDOR)

oretnom23 · customer support system1 мар. 2024 г.

Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa

• RCE без входа
• XSS

mayurik · petrol pump management1 мар. 2024 г.

Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa

• RCE без входа
• XSS

mayurik · petrol pump management1 мар. 2024 г.

SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to th

• RCE без входа
• SQL-инъекция

mayurik · petrol pump management1 мар. 2024 г.

File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the

• RCE без входа
• Загрузка файлов

mayurik · petrol pump management1 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM

• RCE без входа
• XSS

public knowledge project · open journal systems1 мар. 2024 г.

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_ch

• RCE
• Обход пути

langchain · langchain3 мар. 2024 г.

In wlan service, there is a possible out of bounds write due to improper input validation.

• RCE без входа

mediatek · software development kit3 мар. 2024 г.

Configuration Issue in WLAN Host and Firmware

• Без аутентификации
• Отказ в обслуживании

qualcomm · ar8035 firmware4 мар. 2024 г.

Mali GPU Kernel Driver allows improper GPU memory processing operations

• Локальное повышение привилегий
• Ошибки памяти
• Состояние гонки

arm · 5th gen gpu architecture kernel driver4 мар. 2024 г.

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

• Без аутентификации
• Обход аутентификации

jetbrains · teamcity4 мар. 2024 г.

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible

• Без аутентификации
• Обход пути

jetbrains · teamcity4 мар. 2024 г.

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.

• SQL-инъекция

oretnom23 · customer support system4 мар. 2024 г.

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?

• Без аутентификации
• SQL-инъекция

oretnom23 · customer support system4 мар. 2024 г.

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?

• SQL-инъекция

oretnom23 · customer support system4 мар. 2024 г.

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_departme

• Без аутентификации
• SQL-инъекция

oretnom23 · customer support system4 мар. 2024 г.

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=

• SQL-инъекция

oretnom23 · customer support system4 мар. 2024 г.

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?a

• Без аутентификации
• SQL-инъекция

oretnom23 · customer support system4 мар. 2024 г.

The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a

• Без аутентификации
• Зашитые учётные данные

elinksmart · esmartcam4 мар. 2024 г.

SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information

• SQL-инъекция
• Локальное повышение привилегий

4 мар. 2024 г.

pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter.

• Без аутентификации
• SSRF

dirk1983 · chatgpt5 мар. 2024 г.

A memory corruption issue was addressed with improved validation.

• Ошибки памяти

apple · ipados5 мар. 2024 г.

A memory corruption issue was addressed with improved validation.

• Ошибки памяти

apple · ipados5 мар. 2024 г.

Artica Proxy Loopback Services Remotely Accessible Unauthenticated

• Без аутентификации
• Обход аутентификации

articatech · artica proxy5 мар. 2024 г.

An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access

• Без аутентификации

multilaser · re160v firmware5 мар. 2024 г.

TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrl

• Нарушение контроля доступа (IDOR)

tp-link · tl-sg2210p firmware5 мар. 2024 г.

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a cr

• Без аутентификации

plone · plone5 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

• RCE без входа
• XSS

oretnom23 · customer support system5 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

• RCE без входа
• XSS

oretnom23 · customer support system5 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

• RCE без входа
• XSS

oretnom23 · customer support system5 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

• RCE
• XSS

oretnom23 · customer support system5 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra

• RCE без входа
• XSS

oretnom23 · customer support system5 мар. 2024 г.

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carri

• RCE без входа

cisco · secure client6 мар. 2024 г.

A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to ele

• RCE
• Локальное повышение привилегий

cisco · secure client6 мар. 2024 г.

Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-

• XSS

jenkins · build monitor view6 мар. 2024 г.

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) v

• XSS

jenkins · gitbucket6 мар. 2024 г.

SQUID-2024:1 Denial of Service in HTTP Chunked Decoding

• Без аутентификации
• Отказ в обслуживании

squid-cache · squid6 мар. 2024 г.

pgx SQL Injection via Protocol Message Size Overflow

• Без аутентификации
• SQL-инъекция

jackc · pgproto36 мар. 2024 г.

Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access

• Без аутентификации
• Ошибки памяти

google · chrome6 мар. 2024 г.

Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption

• Без аутентификации
• Ошибки памяти

google · chrome6 мар. 2024 г.

Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter.

• RCE без входа
• Инъекция команд

cypress · ctm-200 firmware6 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow attackers to execute ar

• RCE без входа
• XSS

oretnom23 · school fees management system6 мар. 2024 г.

A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execu

• RCE без входа
• XSS

oretnom23 · school fees management system6 мар. 2024 г.

Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.

• Без аутентификации
• SQL-инъекция

pratham-jaiswal · hotel booking management system6 мар. 2024 г.

Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.

• Без аутентификации
• SQL-инъекция

pratham-jaiswal · hotel booking management system6 мар. 2024 г.

Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script fir

• XSS

oretnom23 · customer support system6 мар. 2024 г.

A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7

• Ошибки памяти

netgear · rax30 firmware7 мар. 2024 г.

Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable

7 мар. 2024 г.

Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.

• RCE без входа
• XSS

setorinformatica · s.i.l.7 мар. 2024 г.

Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4

• RCE
• Десериализация

pgadmin · pgadmin 47 мар. 2024 г.

The issue was addressed with improved memory handling.

• RCE
• Локальное повышение привилегий
• Нарушение контроля доступа (IDOR)

apple · ipad os7 мар. 2024 г.

Numbas editor before 7.3 mishandles editing of themes and extensions.

numbas · editor8 мар. 2024 г.

QTS, QuTS hero, QuTScloud

• Без аутентификации
• Обход аутентификации

qnap · qts8 мар. 2024 г.

A SQL injection vulnerability has been reported to affect myQNAPcloud.

• SQL-инъекция

qnap · myqnapcloud8 мар. 2024 г.

Netentsec NS-ASG Application Security Gateway index.php sql injection

• Без аутентификации
• SQL-инъекция

netentsec · application security gateway9 мар. 2024 г.

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityP

• Без аутентификации
• Отказ в обслуживании

libexpat project · libexpat10 мар. 2024 г.

Libvirt: off-by-one error in udevlistinterfacesbystatus()

• Локальное повышение привилегий
• Отказ в обслуживании

red hat · red hat enterprise linux 911 мар. 2024 г.

Privilege escalation in windows agent

• Локальное повышение привилегий

checkmk · checkmk11 мар. 2024 г.

In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check.

• RCE без входа
• Ошибки памяти

google · android11 мар. 2024 г.

In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation.

• Локальное повышение привилегий

google · android11 мар. 2024 г.

Seriously Simple Podcasting < 3.0.0 - Unauthenticated Administrator Email Disclosure

• Без аутентификации

castos · seriously simple podcasting11 мар. 2024 г.

NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting

• Без аутентификации
• SSRF
• XSS

nextchat · nextchat11 мар. 2024 г.

Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

• RCE
• Инъекция команд

sap · netweaver application server java11 мар. 2024 г.

HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and

• RCE
• XSS

12 мар. 2024 г.

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, Fort

• Без аутентификации
• Ошибки памяти

fortinet · fortiproxy12 мар. 2024 г.

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.

• Без аутентификации
• SQL-инъекция

fortinet · forticlient enterprise management server12 мар. 2024 г.

Multiple Vulnerabilities in Badger Meter's Monitool

• Без аутентификации
• SQL-инъекция

badgermeter · monitool12 мар. 2024 г.

Multiple Vulnerabilities in Badger Meter's Monitool

• Утечка информации

badgermeter · monitool12 мар. 2024 г.

Multiple Vulnerabilities in Badger Meter's Monitool

• Обход пути

badgermeter · monitool12 мар. 2024 г.

Multiple Vulnerabilities in Badger Meter's Monitool

• Без аутентификации
• XSS

badgermeter · monitool12 мар. 2024 г.

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

• RCE без входа
• Ошибки памяти

microsoft · open management infrastructure12 мар. 2024 г.

Windows Hyper-V Remote Code Execution Vulnerability

• RCE без входа
• Ошибки памяти

microsoft · windows 10 150712 мар. 2024 г.

Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability

microsoft · windows 11 22h212 мар. 2024 г.

Windows Error Reporting Service Elevation of Privilege Vulnerability

• Локальное повышение привилегий

microsoft · windows 10 150712 мар. 2024 г.

Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability

• Локальное повышение привилегий

microsoft · windows 10 21h212 мар. 2024 г.

Windows Compressed Folder Tampering Vulnerability

• Без аутентификации
• Обход пути

microsoft · windows 11 22h212 мар. 2024 г.

Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

• Обход пути

apache · pulsar12 мар. 2024 г.

RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.

• Без аутентификации
• XSS

ritecms · ritecms13 мар. 2024 г.

Ultimate Member <= 2.8.3 - Unauthenticated Stored Cross-Site Scripting

• Без аутентификации
• XSS

ultimatemember · ultimate member13 мар. 2024 г.

Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114

• RCE без входа
• Обход пути

fortra · filecatalyst workflow13 мар. 2024 г.

File Manager And File Manager Pro (Multiple Versions) - Directory Traversal

• Обход пути

mndpsingh287 · file manager13 мар. 2024 г.

Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

• Без аутентификации
• Утечка информации

wpmudev · hustle13 мар. 2024 г.

Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorization

• Без аутентификации
• Нарушение контроля доступа (IDOR)

autopolis · bulgarisation for woocommerce13 мар. 2024 г.

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v

• Без аутентификации
• SQL-инъекция

ultimatemember · ultimate member13 мар. 2024 г.

Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

• XSS

exclusiveaddons · exclusive addons for elementor13 мар. 2024 г.

Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export

• Без аутентификации
• Нарушение контроля доступа (IDOR)

relevanssi · relevanssi13 мар. 2024 г.

Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection

• SQL-инъекция

themeum · tutor lms13 мар. 2024 г.

Apache Tomcat: HTTP/2 header handling DoS

• Без аутентификации
• Отказ в обслуживании

apache · tomcat13 мар. 2024 г.

WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting

• Без аутентификации
• XSS

veronalabs · wp statistics – simple, privacy-friendly google analytics alternative13 мар. 2024 г.

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

• Локальное повышение привилегий
• Состояние гонки

paloaltonetworks · globalprotect13 мар. 2024 г.