По дате публикации
Эксплуатируемые и новые серьёзные CVE: март 2024 г.
206 записей · 8 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
40В плане | CVE-2024-0799Proof of concept | Authentication Bypass via wizardLogin in Arcserve Unified Data Protectionarcserve · udp · CWE-287 | Критическая9,8 | — | 4,3 % | 13 мар. 2024 г. |
43В плане | CVE-2024-0801Proof of concept | Unauthenticated DoS in Arcserve Unified Data Protectionarcserve · udp · CWE-75 | Высокая7,5 | — | 41,8 % | 13 мар. 2024 г. |
24Наблюдать | CVE-2024-2242Proof of concept | Contact Form 7 <= 5.9 - Reflected Cross-Site Scriptingrocklobster · contact form 7 · CWE-79 | Средняя6,1 | — | 1,3 % | 13 мар. 2024 г. |
43В плане | CVE-2024-25228Эксплойта нет | Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function ivinchin · vinchin backup and recovery · CWE-77 | Высокая8,8 | — | 25,8 % | 13 мар. 2024 г. |
58В плане | CVE-2024-1222Эксплойта нет | Incorrect authorization controls in PaperCut NG/MF APIspapercut · papercut mf · CWE-250 | Критическая9,8 | — | 63,9 % | 13 мар. 2024 г. |
42В плане | CVE-2024-1883Эксплойта нет | Reflected XSS in PaperCut NG/MFpapercut · papercut mf · CWE-76 | Средняя6,1 | — | 61,4 % | 14 мар. 2024 г. |
37Наблюдать | CVE-2024-1884Эксплойта нет | Server Side Request Forgery in PaperCut NG/MFpapercut · papercut mf · CWE-918 | Средняя6,5 | — | 37,9 % | 14 мар. 2024 г. |
22Наблюдать | CVE-2024-0311Proof of concept | A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.skyhigh · skyhigh client proxy · CWE-622 | Средняя5,5 | — | 0,4 % | 14 мар. 2024 г. |
39Наблюдать | CVE-2023-42286Эксплойта нет | There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system coeyoucms · eyoucms · CWE-434 | Критическая9,8 | — | 0,9 % | 14 мар. 2024 г. |
22Наблюдать | CVE-2024-26475Proof of concept | An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grubradare · radare2 · CWE-476 | Средняя5,5 | — | 0,2 % | 14 мар. 2024 г. |
36Наблюдать | CVE-2024-26503Proof of concept | Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code vopeneclass · openeclass · CWE-434 | Критическая9,1 | — | 1,1 % | 14 мар. 2024 г. |
39Наблюдать | CVE-2024-25227Proof of concept | SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), escaabocms · abo.cms · CWE-89 | Критическая9,8 | — | 0,7 % | 15 мар. 2024 г. |
38Наблюдать | CVE-2024-28752Proof of concept | Apache CXF SSRF Vulnerability using the Aegis databindingapache · cxf · CWE-918 | Критическая9,3 | — | 2,4 % | 15 мар. 2024 г. |
22Наблюдать | CVE-2024-2193Proof of concept | Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.amd · cpu · CWE-362 | Средняя5,7 | — | 1,2 % | 15 мар. 2024 г. |
39Наблюдать | CVE-2024-28253Proof of concept | SpEL Injection in `PUT /api/v1/policies` in OpenMetadataopen-metadata · openmetadata · CWE-94 | Высокая8,8 | — | 12,5 % | 15 мар. 2024 г. |
49В плане | CVE-2024-28254Готовый эксплойт | SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadataopen-metadata · openmetadata · CWE-78 | Высокая8,8 | — | 45,7 % | 15 мар. 2024 г. |
61На этой неделе | CVE-2024-28255Готовый эксплойт | Authentication Bypass in OpenMetadataopen-metadata · openmetadata · CWE-287 | Критическая9,8 | — | 73,2 % | 15 мар. 2024 г. |
22Наблюдать | CVE-2024-23298Proof of concept | A logic issue was addressed with improved state management.apple · xcode | Средняя5,5 | — | 0,5 % | 15 мар. 2024 г. |
34Наблюдать | CVE-2024-28640Эксплойта нет | Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause totolink · x5000r firmware · CWE-125 | Высокая7,5 | — | 14,1 % | 16 мар. 2024 г. |
22Наблюдать | CVE-2024-22513Proof of concept | djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure.CWE-306 | Средняя5,5 | — | 0,8 % | 16 мар. 2024 г. |
89Срочно | CVE-2024-20767Готовый эксплойт | ColdFusion | Improper Access Control (CWE-284)adobe · coldfusion · CWE-284 | Высокая7,4 | KEV | 98,5 % | 18 мар. 2024 г. |
25Наблюдать | CVE-2024-27937Эксплойта нет | glpi Users emails enumerationglpi-project · glpi · CWE-285 | Средняя4,3 | — | 27,1 % | 18 мар. 2024 г. |
44В плане | CVE-2024-27096Эксплойта нет | SQL Injection in through the search engineglpi-project · glpi · CWE-89 | Средняя6,5 | — | 58,8 % | 18 мар. 2024 г. |
49В плане | CVE-2024-27098Эксплойта нет | Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPIglpi-project · glpi · CWE-918 | Критическая9,6 | — | 35,7 % | 18 мар. 2024 г. |
24Наблюдать | CVE-2024-27914Proof of concept | Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPIglpi-project · glpi · CWE-79 | Средняя6,1 | — | 0,8 % | 18 мар. 2024 г. |
31Наблюдать | CVE-2024-23333Эксплойта нет | LAM vulnerable to Authenticated Remote Code Executionldap-account-manager · ldap account manager · CWE-74 | Средняя6,6 | — | 17,7 % | 18 мар. 2024 г. |
60На этой неделе | CVE-2024-24578Готовый эксплойт | RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Uploadraspberrymatic · raspberrymatic · CWE-23 | Критическая9,8 | — | 8,7 % | 18 мар. 2024 г. |
40В плане | CVE-2024-2621Proof of concept | Fujian Kelixin Communication Command and Dispatch Platform pwd_update.php sql injectionkelixin communication command and dispatch project · kelixin communication command and dispatch · CWE-89 | Критическая9,8 | — | 1,9 % | 18 мар. 2024 г. |
29Наблюдать | CVE-2024-22017Proof of concept | setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().nodejs · node · CWE-250 | Высокая7,3 | — | 0,8 % | 19 мар. 2024 г. |
31Наблюдать | CVE-2023-40278Proof of concept | An issue was discovered in OpenClinic GA 5.247.01.openclinic ga project · openclinic ga · CWE-200 | Высокая7,5 | — | 3,0 % | 19 мар. 2024 г. |
31Наблюдать | CVE-2023-40279Proof of concept | An issue was discovered in OpenClinic GA 5.247.01.openclinic ga project · openclinic ga · CWE-22 | Высокая7,5 | — | 3,3 % | 19 мар. 2024 г. |
25Наблюдать | CVE-2024-28734Proof of concept | Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted CWE-79 | Средняя6,1 | — | 1,7 % | 19 мар. 2024 г. |
24Наблюдать | CVE-2024-29137Proof of concept | WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerabilitythemefic · tourfic · CWE-79 | Средняя6,1 | — | 0,6 % | 19 мар. 2024 г. |
24Наблюдать | CVE-2024-29138Proof of concept | WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerabilitydev.institute · restrict user access · CWE-79 | Средняя6,1 | — | 0,6 % | 19 мар. 2024 г. |
39Наблюдать | CVE-2024-28595Proof of concept | SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in walterjnr1 · employee management system · CWE-89 | Критическая9,8 | — | 1,2 % | 19 мар. 2024 г. |
32Наблюдать | CVE-2024-2169Proof of concept | Implementations of UDP application protocols are susceptible to network loops and denial of servicemikrotik · routeros-tftp · CWE-406 | Высокая7,5 | — | 5,3 % | 19 мар. 2024 г. |
35Наблюдать | CVE-2024-28715Proof of concept | Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functiohtml-js · doracms · CWE-79 | Высокая8,8 | — | 1,0 % | 19 мар. 2024 г. |
24Наблюдать | CVE-2024-2387Proof of concept | Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Scriptnasirahmed · afi – the easiest integration plugin · CWE-89 | Средняя6,1 | — | 1,6 % | 19 мар. 2024 г. |
21Наблюдать | CVE-2023-7246Proof of concept | System Dashboard < 2.8.10 - XSS via Header Injectionbowo · system dashboard · CWE-79 | Средняя5,4 | — | 0,8 % | 20 мар. 2024 г. |
24Наблюдать | CVE-2024-0337Proof of concept | Travelpayouts <= 1.1.15 - Open Redirecttravelpayouts · travelpayouts · CWE-601 | Средняя6,1 | — | 0,8 % | 20 мар. 2024 г. |
47В плане | CVE-2024-1800Готовый эксплойт | Progress Telerik Report Server Deserializationprogress · telerik report server · CWE-502 | Высокая8,8 | — | 40,3 % | 20 мар. 2024 г. |
29Наблюдать | CVE-2023-51444Proof of concept | GeoServer arbitrary file upload vulnerability in REST Coverage Store APIgeoserver · geoserver · CWE-20 | Высокая7,2 | — | 1,8 % | 20 мар. 2024 г. |
41В плане | CVE-2024-2625Эксплойта нет | Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via google · chrome | Высокая8,8 | — | 21,4 % | 20 мар. 2024 г. |
30Наблюдать | CVE-2024-28231Proof of concept | Manipulated DATA Submessage causes a heap-buffer-overflow erroreprosima · fast dds · CWE-122 | Высокая7,5 | — | 0,9 % | 20 мар. 2024 г. |
35Наблюдать | CVE-2023-49978Proof of concept | Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions resoretnom23 · customer support system · CWE-284 | Высокая8,8 | — | 0,8 % | 20 мар. 2024 г. |
30Наблюдать | CVE-2023-49979Proof of concept | A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicatmayurik · best student management system · CWE-862 | Высокая7,5 | — | 0,7 % | 20 мар. 2024 г. |
30Наблюдать | CVE-2023-49980Proof of concept | A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files witmayurik · best student result management system · CWE-862 | Высокая7,5 | — | 0,7 % | 20 мар. 2024 г. |
30Наблюдать | CVE-2023-49981Proof of concept | A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the oretnom23 · school fees management system · CWE-862 | Высокая7,5 | — | 0,7 % | 20 мар. 2024 г. |
35Наблюдать | CVE-2023-49982Proof of concept | Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privilegesoretnom23 · school fees management system · CWE-863 | Высокая8,8 | — | 0,8 % | 20 мар. 2024 г. |
27Наблюдать | CVE-2023-49983Proof of concept | A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execoretnom23 · school fees management system · CWE-79 | Средняя6,8 | — | 0,5 % | 20 мар. 2024 г. |
24Наблюдать | CVE-2023-49984Proof of concept | A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to eoretnom23 · school fees management system · CWE-79 | Средняя6,1 | — | 0,4 % | 20 мар. 2024 г. |
26Наблюдать | CVE-2023-49985Proof of concept | A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to execoretnom23 · school fees management system · CWE-79 | Средняя6,5 | — | 0,4 % | 20 мар. 2024 г. |
51В плане | CVE-2024-27292Proof of concept | Docassemble unauthorized access through URL manipulationjhpyle · docassemble · CWE-706 | Высокая7,5 | — | 69,4 % | 20 мар. 2024 г. |
43В плане | CVE-2024-2053Proof of concept | Artica Proxy Unauthenticated LFI Protection Bypass Vulnerabilityarticatech · artica proxy · CWE-23 | Высокая7,5 | — | 44,5 % | 20 мар. 2024 г. |
63На этой неделе | CVE-2024-2054Готовый эксплойт | Artica Proxy Unauthenticated PHP Deserialization Vulnerabilityarticatech · artica proxy · CWE-502 | Критическая9,8 | — | 81,2 % | 20 мар. 2024 г. |
38Наблюдать | CVE-2024-1538Эксплойта нет | File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusionfilemanagerpro · file manager · CWE-352 | Высокая8,8 | — | 10,6 % | 21 мар. 2024 г. |
67На этой неделе | CVE-2024-27956Готовый эксплойт | WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerabilityvalvepress · automatic · CWE-89 | Критическая9,8 | — | 94,0 % | 21 мар. 2024 г. |
53В плане | CVE-2024-27921Эксплойта нет | Grav File Upload Path Traversal vulnerabilitygetgrav · grav · CWE-22 | Высокая8,8 | — | 60,5 % | 21 мар. 2024 г. |
37Наблюдать | CVE-2024-28116Proof of concept | Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypassgetgrav · grav · CWE-94 | Высокая8,8 | — | 5,8 % | 21 мар. 2024 г. |
29Наблюдать | CVE-2024-29272Proof of concept | Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and ovvveb · vvvebjs · CWE-434 | Средняя6,5 | — | 9,3 % | 22 мар. 2024 г. |
40В плане | CVE-2024-29275Proof of concept | SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive iseacms · seacms · CWE-89 | Критическая9,8 | — | 4,9 % | 22 мар. 2024 г. |
46В плане | CVE-2024-29943Proof of concept | An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination.mozilla · firefox · CWE-125 | Критическая9,8 | — | 22,9 % | 22 мар. 2024 г. |
52В плане | CVE-2024-2448Эксплойта нет | LoadMaster Command Injection Vulnerabilityprogress · loadmaster · CWE-78 | Высокая8,8 | — | 55,4 % | 22 мар. 2024 г. |
34Наблюдать | CVE-2024-2449Эксплойта нет | LoadMaster Cross-Site Request Forgery (CSRF)progress · loadmaster · CWE-352 | Высокая7,5 | — | 12,8 % | 22 мар. 2024 г. |
90Срочно | CVE-2024-29059Готовый эксплойт | .NET Framework Information Disclosure Vulnerabilitymicrosoft · .net framework · CWE-209 | Высокая7,5 | KEV | 98,6 % | 22 мар. 2024 г. |
50В плане | CVE-2024-24725Готовый эксплойт | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modgibbonedu · gibbon · CWE-502 | Высокая8,8 | — | 51,3 % | 23 мар. 2024 г. |
54В плане | CVE-2024-2862Proof of concept | Password reset vulnerability without authorization on LG LED Assistantlg · lg led assistant · CWE-287 | Критическая9,8 | — | 51,0 % | 25 мар. 2024 г. |
58В плане | CVE-2024-2863Proof of concept | Path traversal via file upload on LG LED Assistantlg · lg led assistant · CWE-35 | Критическая9,8 | — | 63,9 % | 25 мар. 2024 г. |
24Наблюдать | CVE-2024-25175Proof of concept | An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack.kickdler · kickdler · CWE-79 | Средняя6,1 | — | 0,4 % | 25 мар. 2024 г. |
24Наблюдать | CVE-2024-29041Эксплойта нет | Express.js Open Redirect in malformed URLsopenjsf · express · CWE-601 | Средняя6,1 | — | 0,7 % | 25 мар. 2024 г. |
30Наблюдать | CVE-2024-23722Proof of concept | In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-treasuredata · fluent bit · CWE-476 | Высокая7,5 | — | 0,9 % | 26 мар. 2024 г. |
38Наблюдать | CVE-2023-28787Proof of concept | WordPress Quiz And Survey Master plugin <= 8.1.4 - Unauthenticated SQL Injection vulnerabilityexpresstech · quiz and survey master · CWE-89 | Критическая9,3 | — | 1,9 % | 26 мар. 2024 г. |
36Наблюдать | CVE-2023-29386Proof of concept | WordPress Manager for Icomoon plugin <= 2.0 - Arbitrary File Upload vulnerabilityjulien crego · manager for icomoon · CWE-434 | Критическая9,1 | — | 0,7 % | 26 мар. 2024 г. |
29Наблюдать | CVE-2023-47873Proof of concept | WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerabilitywensolutions · wp child theme generator · CWE-434 | Высокая7,2 | — | 2,2 % | 26 мар. 2024 г. |
36Наблюдать | CVE-2023-48777Proof of concept | WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerabilityelementor · website builder · CWE-434 | Высокая8,8 | — | 4,1 % | 26 мар. 2024 г. |
35Наблюдать | CVE-2024-2887Proof of concept | Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTMLgoogle · chrome · CWE-843 | Высокая7,7 | — | 17,9 % | 26 мар. 2024 г. |
31Наблюдать | CVE-2024-25734Proof of concept | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.wyrestorm · apollo vx20 firmware · CWE-200 | Высокая7,5 | — | 4,0 % | 26 мар. 2024 г. |
51В плане | CVE-2024-25735Proof of concept | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.wyrestorm · apollo vx20 firmware · CWE-319 | Критическая9,1 | — | 50,6 % | 26 мар. 2024 г. |
31Наблюдать | CVE-2024-25736Proof of concept | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.wyrestorm · apollo vx20 firmware · CWE-284 | Высокая7,5 | — | 4,3 % | 26 мар. 2024 г. |
33Наблюдать | CVE-2023-40289Proof of concept | A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.supermicro · x11ssm-f firmware · CWE-269 | Высокая7,2 | — | 18,2 % | 27 мар. 2024 г. |
39Наблюдать | CVE-2023-31634Proof of concept | In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data.teslamate · teslamate · CWE-287 | Критическая9,8 | — | 0,8 % | 27 мар. 2024 г. |
24Наблюдать | CVE-2024-30194Proof of concept | WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitysunshinephotocart · sunshine photo cart · CWE-79 | Средняя6,1 | — | 0,7 % | 27 мар. 2024 г. |
24Наблюдать | CVE-2024-29931Proof of concept | WordPress WP Go Maps plugin <= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerabilitycodecabin · wp go maps · CWE-79 | Средняя6,1 | — | 0,7 % | 27 мар. 2024 г. |
45В плане | CVE-2024-2398Эксплойта нет | HTTP/2 push headers memory-leakhaxx · curl · CWE-772 | Высокая8,6 | — | 36,0 % | 27 мар. 2024 г. |
21Наблюдать | CVE-2024-28784Proof of concept | IBM QRadar cross-site scriptingibm · qradar security information and event manager · CWE-79 | Средняя5,4 | — | 0,3 % | 27 мар. 2024 г. |
24Наблюдать | CVE-2024-29792Proof of concept | WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerabilityunlimited-elements · unlimited elements for elementor · CWE-79 | Средняя6,1 | — | 0,7 % | 27 мар. 2024 г. |
24Наблюдать | CVE-2023-34020Proof of concept | WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerabilityuncannyowl · uncanny toolkit for learndash · CWE-601 | Средняя6,1 | — | 0,9 % | 27 мар. 2024 г. |
33Наблюдать | CVE-2024-1540Proof of concept | Command Injection in gradio-app/gradio via deploy+test-visual.yml workflowgradio project · gradio · CWE-77 | Высокая8,2 | — | 1,9 % | 27 мар. 2024 г. |
14Наблюдать | CVE-2024-28085Proof of concept | wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals tkernel · util-linux · CWE-150 | Низкая3,3 | — | 2,2 % | 27 мар. 2024 г. |
26Наблюдать | CVE-2024-28247Proof of concept | Pihole Authenticated Arbitrary File Read with root privilegespi-hole · pi-hole · CWE-200 | Средняя6,5 | — | 1,4 % | 27 мар. 2024 г. |
21Наблюдать | CVE-2024-2997Proof of concept | Bdtask Multi-Store Inventory Management System cross site scriptingbdtask · multi store inventory management system · CWE-79 | Средняя5,4 | — | 1,2 % | 27 мар. 2024 г. |
15Наблюдать | CVE-2024-3013Эксплойта нет | Teledyne FLIR AX8 User Registration test_login.php improper authorizationflir · flir ax8 firmware · CWE-266 | Низкая2,1 | — | 22,9 % | 27 мар. 2024 г. |
24Наблюдать | CVE-2024-29882Proof of concept | SRS DOM - XSS on JSONP callbackossrs · simple realtime server · CWE-79 | Средняя6,1 | — | 1,0 % | 28 мар. 2024 г. |
43В плане | CVE-2024-31138Эксплойта нет | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingsjetbrains · teamcity · CWE-79 | Средняя5,4 | — | 74,6 % | 28 мар. 2024 г. |
31Наблюдать | CVE-2023-42931Proof of concept | The issue was addressed with improved checks.apple · macos · CWE-280 | Высокая7,8 | — | 1,1 % | 28 мар. 2024 г. |
33Наблюдать | CVE-2024-23727Proof of concept | The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitraryCWE-94 | Высокая8,4 | — | 0,5 % | 28 мар. 2024 г. |
40В плане | CVE-2024-30490Proof of concept | WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerabilitymetagauss · profilegrid · CWE-89 | Критическая9,8 | — | 2,2 % | 29 мар. 2024 г. |
45В плане | CVE-2024-30491Эксплойта нет | WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerabilitymetagauss · profilegrid · CWE-89 | Высокая8,8 | — | 32,0 % | 29 мар. 2024 г. |
41В плане | CVE-2024-30498Proof of concept | WordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerabilitycrmperks · crm perks forms · CWE-89 | Критическая10,0 | — | 2,2 % | 29 мар. 2024 г. |
29Наблюдать | CVE-2024-27619Proof of concept | Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow.CWE-120 | Высокая7,3 | — | 0,8 % | 29 мар. 2024 г. |
- CVE-2024-079940В плане
Authentication Bypass via wizardLogin in Arcserve Unified Data Protection
КритическаяCVSS 9,8Proof of conceptEPSS 4 %arcserve · udp13 мар. 2024 г.
- CVE-2024-080143В плане
Unauthenticated DoS in Arcserve Unified Data Protection
ВысокаяCVSS 7,5Proof of conceptEPSS 41 %arcserve · udp13 мар. 2024 г.
- CVE-2024-224224Наблюдать
Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting
СредняяCVSS 6,1Proof of conceptEPSS 1 %rocklobster · contact form 713 мар. 2024 г.
- CVE-2024-2522843В плане
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function i
ВысокаяCVSS 8,8Эксплойта нетEPSS 25 %vinchin · vinchin backup and recovery13 мар. 2024 г.
- CVE-2024-122258В плане
Incorrect authorization controls in PaperCut NG/MF APIs
КритическаяCVSS 9,8Эксплойта нетEPSS 63 %papercut · papercut mf13 мар. 2024 г.
- CVE-2024-188342В плане
Reflected XSS in PaperCut NG/MF
СредняяCVSS 6,1Эксплойта нетEPSS 61 %papercut · papercut mf14 мар. 2024 г.
- CVE-2024-188437Наблюдать
Server Side Request Forgery in PaperCut NG/MF
СредняяCVSS 6,5Эксплойта нетEPSS 37 %papercut · papercut mf14 мар. 2024 г.
- CVE-2024-031122Наблюдать
A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.
СредняяCVSS 5,5Proof of conceptEPSS 0 %skyhigh · skyhigh client proxy14 мар. 2024 г.
- CVE-2023-4228639Наблюдать
There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system co
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %eyoucms · eyoucms14 мар. 2024 г.
- CVE-2024-2647522Наблюдать
An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub
СредняяCVSS 5,5Proof of conceptEPSS 0 %radare · radare214 мар. 2024 г.
- CVE-2024-2650336Наблюдать
Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code v
КритическаяCVSS 9,1Proof of conceptEPSS 1 %openeclass · openeclass14 мар. 2024 г.
- CVE-2024-2522739Наблюдать
SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), esca
КритическаяCVSS 9,8Proof of conceptEPSS 0 %abocms · abo.cms15 мар. 2024 г.
- CVE-2024-2875238Наблюдать
Apache CXF SSRF Vulnerability using the Aegis databinding
КритическаяCVSS 9,3Proof of conceptEPSS 2 %apache · cxf15 мар. 2024 г.
- CVE-2024-219322Наблюдать
Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.
СредняяCVSS 5,7Proof of conceptEPSS 1 %amd · cpu15 мар. 2024 г.
- CVE-2024-2825339Наблюдать
SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
ВысокаяCVSS 8,8Proof of conceptEPSS 12 %open-metadata · openmetadata15 мар. 2024 г.
- CVE-2024-2825449В плане
SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
ВысокаяCVSS 8,8Готовый эксплойтEPSS 45 %open-metadata · openmetadata15 мар. 2024 г.
- CVE-2024-2825561На этой неделе
Authentication Bypass in OpenMetadata
КритическаяCVSS 9,8Готовый эксплойтEPSS 73 %open-metadata · openmetadata15 мар. 2024 г.
- CVE-2024-2329822Наблюдать
A logic issue was addressed with improved state management.
СредняяCVSS 5,5Proof of conceptEPSS 0 %apple · xcode15 мар. 2024 г.
- CVE-2024-2864034Наблюдать
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause
ВысокаяCVSS 7,5Эксплойта нетEPSS 14 %totolink · x5000r firmware16 мар. 2024 г.
- CVE-2024-2251322Наблюдать
djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure.
СредняяCVSS 5,5Proof of conceptEPSS 0 %16 мар. 2024 г.
- CVE-2024-2076789Срочно
ColdFusion | Improper Access Control (CWE-284)
ВысокаяCVSS 7,4KEVГотовый эксплойтEPSS 98 %adobe · coldfusion18 мар. 2024 г.
- CVE-2024-2793725Наблюдать
glpi Users emails enumeration
СредняяCVSS 4,3Эксплойта нетEPSS 27 %glpi-project · glpi18 мар. 2024 г.
- CVE-2024-2709644В плане
SQL Injection in through the search engine
СредняяCVSS 6,5Эксплойта нетEPSS 58 %glpi-project · glpi18 мар. 2024 г.
- CVE-2024-2709849В плане
Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI
КритическаяCVSS 9,6Эксплойта нетEPSS 35 %glpi-project · glpi18 мар. 2024 г.
- CVE-2024-2791424Наблюдать
Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI
СредняяCVSS 6,1Proof of conceptEPSS 0 %glpi-project · glpi18 мар. 2024 г.
- CVE-2024-2333331Наблюдать
LAM vulnerable to Authenticated Remote Code Execution
СредняяCVSS 6,6Эксплойта нетEPSS 17 %ldap-account-manager · ldap account manager18 мар. 2024 г.
- CVE-2024-2457860На этой неделе
RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload
КритическаяCVSS 9,8Готовый эксплойтEPSS 8 %raspberrymatic · raspberrymatic18 мар. 2024 г.
- CVE-2024-262140В плане
Fujian Kelixin Communication Command and Dispatch Platform pwd_update.php sql injection
КритическаяCVSS 9,8Proof of conceptEPSS 1 %kelixin communication command and dispatch project · kelixin communication command and dispatch18 мар. 2024 г.
- CVE-2024-2201729Наблюдать
setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %nodejs · node19 мар. 2024 г.
- CVE-2023-4027831Наблюдать
An issue was discovered in OpenClinic GA 5.247.01.
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %openclinic ga project · openclinic ga19 мар. 2024 г.
- CVE-2023-4027931Наблюдать
An issue was discovered in OpenClinic GA 5.247.01.
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %openclinic ga project · openclinic ga19 мар. 2024 г.
- CVE-2024-2873425Наблюдать
Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted
СредняяCVSS 6,1Proof of conceptEPSS 1 %19 мар. 2024 г.
- CVE-2024-2913724Наблюдать
WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 0 %themefic · tourfic19 мар. 2024 г.
- CVE-2024-2913824Наблюдать
WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 0 %dev.institute · restrict user access19 мар. 2024 г.
- CVE-2024-2859539Наблюдать
SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in
КритическаяCVSS 9,8Proof of conceptEPSS 1 %walterjnr1 · employee management system19 мар. 2024 г.
- CVE-2024-216932Наблюдать
Implementations of UDP application protocols are susceptible to network loops and denial of service
ВысокаяCVSS 7,5Proof of conceptEPSS 5 %mikrotik · routeros-tftp19 мар. 2024 г.
- CVE-2024-2871535Наблюдать
Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functio
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %html-js · doracms19 мар. 2024 г.
- CVE-2024-238724Наблюдать
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Script
СредняяCVSS 6,1Proof of conceptEPSS 1 %nasirahmed · afi – the easiest integration plugin19 мар. 2024 г.
- CVE-2023-724621Наблюдать
System Dashboard < 2.8.10 - XSS via Header Injection
СредняяCVSS 5,4Proof of conceptEPSS 0 %bowo · system dashboard20 мар. 2024 г.
- CVE-2024-033724Наблюдать
Travelpayouts <= 1.1.15 - Open Redirect
СредняяCVSS 6,1Proof of conceptEPSS 0 %travelpayouts · travelpayouts20 мар. 2024 г.
- CVE-2024-180047В плане
Progress Telerik Report Server Deserialization
ВысокаяCVSS 8,8Готовый эксплойтEPSS 40 %progress · telerik report server20 мар. 2024 г.
- CVE-2023-5144429Наблюдать
GeoServer arbitrary file upload vulnerability in REST Coverage Store API
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %geoserver · geoserver20 мар. 2024 г.
- CVE-2024-262541В плане
Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via
ВысокаяCVSS 8,8Эксплойта нетEPSS 21 %google · chrome20 мар. 2024 г.
- CVE-2024-2823130Наблюдать
Manipulated DATA Submessage causes a heap-buffer-overflow error
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %eprosima · fast dds20 мар. 2024 г.
- CVE-2023-4997835Наблюдать
Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions res
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %oretnom23 · customer support system20 мар. 2024 г.
- CVE-2023-4997930Наблюдать
A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicat
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %mayurik · best student management system20 мар. 2024 г.
- CVE-2023-4998030Наблюдать
A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files wit
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %mayurik · best student result management system20 мар. 2024 г.
- CVE-2023-4998130Наблюдать
A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %oretnom23 · school fees management system20 мар. 2024 г.
- CVE-2023-4998235Наблюдать
Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %oretnom23 · school fees management system20 мар. 2024 г.
- CVE-2023-4998327Наблюдать
A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to exec
СредняяCVSS 6,8Proof of conceptEPSS 0 %oretnom23 · school fees management system20 мар. 2024 г.
- CVE-2023-4998424Наблюдать
A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to e
СредняяCVSS 6,1Proof of conceptEPSS 0 %oretnom23 · school fees management system20 мар. 2024 г.
- CVE-2023-4998526Наблюдать
A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to exec
СредняяCVSS 6,5Proof of conceptEPSS 0 %oretnom23 · school fees management system20 мар. 2024 г.
- CVE-2024-2729251В плане
Docassemble unauthorized access through URL manipulation
ВысокаяCVSS 7,5Proof of conceptEPSS 69 %jhpyle · docassemble20 мар. 2024 г.
- CVE-2024-205343В плане
Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 44 %articatech · artica proxy20 мар. 2024 г.
- CVE-2024-205463На этой неделе
Artica Proxy Unauthenticated PHP Deserialization Vulnerability
КритическаяCVSS 9,8Готовый эксплойтEPSS 81 %articatech · artica proxy20 мар. 2024 г.
- CVE-2024-153838Наблюдать
File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
ВысокаяCVSS 8,8Эксплойта нетEPSS 10 %filemanagerpro · file manager21 мар. 2024 г.
- CVE-2024-2795667На этой неделе
WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
КритическаяCVSS 9,8Готовый эксплойтEPSS 94 %valvepress · automatic21 мар. 2024 г.
- CVE-2024-2792153В плане
Grav File Upload Path Traversal vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 60 %getgrav · grav21 мар. 2024 г.
- CVE-2024-2811637Наблюдать
Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
ВысокаяCVSS 8,8Proof of conceptEPSS 5 %getgrav · grav21 мар. 2024 г.
- CVE-2024-2927229Наблюдать
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and o
СредняяCVSS 6,5Proof of conceptEPSS 9 %vvveb · vvvebjs22 мар. 2024 г.
- CVE-2024-2927540В плане
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive i
КритическаяCVSS 9,8Proof of conceptEPSS 4 %seacms · seacms22 мар. 2024 г.
- CVE-2024-2994346В плане
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination.
КритическаяCVSS 9,8Proof of conceptEPSS 22 %mozilla · firefox22 мар. 2024 г.
- CVE-2024-244852В плане
LoadMaster Command Injection Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 55 %progress · loadmaster22 мар. 2024 г.
- CVE-2024-244934Наблюдать
LoadMaster Cross-Site Request Forgery (CSRF)
ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %progress · loadmaster22 мар. 2024 г.
- CVE-2024-2905990Срочно
.NET Framework Information Disclosure Vulnerability
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 98 %microsoft · .net framework22 мар. 2024 г.
- CVE-2024-2472550В плане
Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the mod
ВысокаяCVSS 8,8Готовый эксплойтEPSS 51 %gibbonedu · gibbon23 мар. 2024 г.
- CVE-2024-286254В плане
Password reset vulnerability without authorization on LG LED Assistant
КритическаяCVSS 9,8Proof of conceptEPSS 51 %lg · lg led assistant25 мар. 2024 г.
- CVE-2024-286358В плане
Path traversal via file upload on LG LED Assistant
КритическаяCVSS 9,8Proof of conceptEPSS 63 %lg · lg led assistant25 мар. 2024 г.
- CVE-2024-2517524Наблюдать
An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack.
СредняяCVSS 6,1Proof of conceptEPSS 0 %kickdler · kickdler25 мар. 2024 г.
- CVE-2024-2904124Наблюдать
Express.js Open Redirect in malformed URLs
СредняяCVSS 6,1Эксплойта нетEPSS 0 %openjsf · express25 мар. 2024 г.
- CVE-2024-2372230Наблюдать
In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %treasuredata · fluent bit26 мар. 2024 г.
- CVE-2023-2878738Наблюдать
WordPress Quiz And Survey Master plugin <= 8.1.4 - Unauthenticated SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %expresstech · quiz and survey master26 мар. 2024 г.
- CVE-2023-2938636Наблюдать
WordPress Manager for Icomoon plugin <= 2.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,1Proof of conceptEPSS 0 %julien crego · manager for icomoon26 мар. 2024 г.
- CVE-2023-4787329Наблюдать
WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerability
ВысокаяCVSS 7,2Proof of conceptEPSS 2 %wensolutions · wp child theme generator26 мар. 2024 г.
- CVE-2023-4877736Наблюдать
WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 4 %elementor · website builder26 мар. 2024 г.
- CVE-2024-288735Наблюдать
Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML
ВысокаяCVSS 7,7Proof of conceptEPSS 17 %google · chrome26 мар. 2024 г.
- CVE-2024-2573431Наблюдать
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.
ВысокаяCVSS 7,5Proof of conceptEPSS 4 %wyrestorm · apollo vx20 firmware26 мар. 2024 г.
- CVE-2024-2573551В плане
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.
КритическаяCVSS 9,1Proof of conceptEPSS 50 %wyrestorm · apollo vx20 firmware26 мар. 2024 г.
- CVE-2024-2573631Наблюдать
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.
ВысокаяCVSS 7,5Proof of conceptEPSS 4 %wyrestorm · apollo vx20 firmware26 мар. 2024 г.
- CVE-2023-4028933Наблюдать
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.
ВысокаяCVSS 7,2Proof of conceptEPSS 18 %supermicro · x11ssm-f firmware27 мар. 2024 г.
- CVE-2023-3163439Наблюдать
In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data.
КритическаяCVSS 9,8Proof of conceptEPSS 0 %teslamate · teslamate27 мар. 2024 г.
- CVE-2024-3019424Наблюдать
WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 0 %sunshinephotocart · sunshine photo cart27 мар. 2024 г.
- CVE-2024-2993124Наблюдать
WordPress WP Go Maps plugin <= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 0 %codecabin · wp go maps27 мар. 2024 г.
- CVE-2024-239845В плане
HTTP/2 push headers memory-leak
ВысокаяCVSS 8,6Эксплойта нетEPSS 36 %haxx · curl27 мар. 2024 г.
- CVE-2024-2878421Наблюдать
IBM QRadar cross-site scripting
СредняяCVSS 5,4Proof of conceptEPSS 0 %ibm · qradar security information and event manager27 мар. 2024 г.
- CVE-2024-2979224Наблюдать
WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 0 %unlimited-elements · unlimited elements for elementor27 мар. 2024 г.
- CVE-2023-3402024Наблюдать
WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 0 %uncannyowl · uncanny toolkit for learndash27 мар. 2024 г.
- CVE-2024-154033Наблюдать
Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow
ВысокаяCVSS 8,2Proof of conceptEPSS 1 %gradio project · gradio27 мар. 2024 г.
- CVE-2024-2808514Наблюдать
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals t
НизкаяCVSS 3,3Proof of conceptEPSS 2 %kernel · util-linux27 мар. 2024 г.
- CVE-2024-2824726Наблюдать
Pihole Authenticated Arbitrary File Read with root privileges
СредняяCVSS 6,5Proof of conceptEPSS 1 %pi-hole · pi-hole27 мар. 2024 г.
- CVE-2024-299721Наблюдать
Bdtask Multi-Store Inventory Management System cross site scripting
СредняяCVSS 5,4Proof of conceptEPSS 1 %bdtask · multi store inventory management system27 мар. 2024 г.
- CVE-2024-301315Наблюдать
Teledyne FLIR AX8 User Registration test_login.php improper authorization
НизкаяCVSS 2,1Эксплойта нетEPSS 22 %flir · flir ax8 firmware27 мар. 2024 г.
- CVE-2024-2988224Наблюдать
SRS DOM - XSS on JSONP callback
СредняяCVSS 6,1Proof of conceptEPSS 1 %ossrs · simple realtime server28 мар. 2024 г.
- CVE-2024-3113843В плане
In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings
СредняяCVSS 5,4Эксплойта нетEPSS 74 %jetbrains · teamcity28 мар. 2024 г.
- CVE-2023-4293131Наблюдать
The issue was addressed with improved checks.
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %apple · macos28 мар. 2024 г.
- CVE-2024-2372733Наблюдать
The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %28 мар. 2024 г.
- CVE-2024-3049040В плане
WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 2 %metagauss · profilegrid29 мар. 2024 г.
- CVE-2024-3049145В плане
WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 32 %metagauss · profilegrid29 мар. 2024 г.
- CVE-2024-3049841В плане
WordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 2 %crmperks · crm perks forms29 мар. 2024 г.
- CVE-2024-2761929Наблюдать
Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %29 мар. 2024 г.