Filtered by vendor Subscriptions
Total 322231 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-11100 1 1000projects 1 Beauty Parlour Management System 2024-11-18 7.3 High
A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-11017 1 Vice 1 Webopac 2024-11-18 8.8 High
Webopac from Grand Vice info does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells, which could lead to arbitrary code execution on the server.
CVE-2024-49521 1 Adobe 2 Commerce, Magento 2024-11-18 7.7 High
Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction.
CVE-2024-10990 2 Oretnom23, Sourcecodester 2 Online Veterinary Appointment System, Online Veterinary Appointment System 2024-11-18 6.3 Medium
A vulnerability classified as critical was found in SourceCodester Online Veterinary Appointment System 1.0. This vulnerability affects unknown code of the file /admin/services/view_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-10991 1 Codezips 1 Hospital Appointment System 2024-11-18 7.3 High
A vulnerability, which was classified as critical, has been found in Codezips Hospital Appointment System 1.0. This issue affects some unknown processing of the file /editBranchResult.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-49526 3 Adobe, Apple, Microsoft 3 Animate, Macos, Windows 2024-11-18 7.8 High
Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-10993 1 Codezips 1 Online Institute Management System 2024-11-18 6.3 Medium
A vulnerability, which was classified as critical, was found in Codezips Online Institute Management System 1.0. Affected is an unknown function of the file /manage_website.php. The manipulation of the argument website_image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-10994 1 Codezips 1 Online Institute Management System 2024-11-18 6.3 Medium
A vulnerability has been found in Codezips Online Institute Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /edit_user.php. The manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-49527 3 Adobe, Apple, Microsoft 3 Animate, Macos, Windows 2024-11-18 5.5 Medium
Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-50836 1 Lopalopa 1 E-learning Management System 2024-11-18 6.1 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and lastname parameters.
CVE-2024-49528 3 Adobe, Apple, Microsoft 3 Animate, Macos, Windows 2024-11-18 7.8 High
Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-44761 2 Gzequan, Yiquan Information 2 Eq Enterprise Management System, Eq Enterprise Management System 2024-11-18 9.9 Critical
An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests.
CVE-2024-42678 1 Cysoft168 1 Super Easy Enterprise Management System 2024-11-18 5 Medium
Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the /WebSet/DlgGridSet.html component.
CVE-2024-49514 3 Adobe, Apple, Microsoft 5 Photoshop, Photoshop 2023, Photoshop 2024 and 2 more 2024-11-18 7.8 High
Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-8049 1 Progress 1 Telerik Document Processing Libraries 2024-11-18 6.5 Medium
In Progress Telerik Document Processing Libraries, versions prior to 2024 Q4 (2024.4.1106), importing a document with unsupported features can lead to excessive processing, leading to excessive use of computing resources leaving the application process unavailable.
CVE-2024-7295 1 Progress 1 Telerik Report Server 2024-11-18 7.1 High
In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.
CVE-2024-52876 1 Holy Stone Remote Id Module 1 Holy Stone Remote Id Module 2024-11-18 7.5 High
Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.
CVE-2015-20111 1 Bitcoin 1 Bitcoin Core 2024-11-18 9.8 Critical
miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in conjunction with CVE-2015-6031 exploitation.
CVE-2024-52300 2 Xwiki, Xwikisas 2 Pdf Viewer Macro, Macro Pdfviewer 2024-11-18 9.1 Critical
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the malicious code. This is fixed in 2.5.6.
CVE-2024-52299 2 Xwiki, Xwikisas 2 Pdf Viewer Macro, Macro Pdfviewer 2024-11-18 7.5 High
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.