Filtered by vendor Subscriptions
Total 322231 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-6068 1 Rcokwellautomation 1 Arena Input Analyzer 2024-11-15 7.3 High
A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information and to execute arbitrary code. To exploit this vulnerability a legitimate user must open a malicious DFT file.
CVE-2024-47915 1 Vaemendis 1 Vaemendis Ubooquity 2024-11-15 7.5 High
VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2022-2232 1 Redhat 1 Red Hat Single Sign On 2024-11-15 7.5 High
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.
CVE-2023-4348 2024-11-15 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-51377 1 Ladybirdweb 1 Faveo Helpdesk 2024-11-15 8.8 High
An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields
CVE-2024-49381 1 Plenti 2 Plenti, Plentico 2024-11-15 7.5 High
Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.
CVE-2024-49376 1 Autolabproject 1 Autolab 2024-11-15 8.8 High
Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.
CVE-2024-11016 1 Vice 1 Webopac 2024-11-15 9.8 Critical
Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2024-10381 2 Matrix Comsec, Matrixcomsec 3 Matrix Door Controller Cosec Vega Faxq Firmware, Cosec Vega Faxq, Cosec Vega Faxq Firmware 2024-11-15 9.8 Critical
This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the vulnerable device. Successful exploitation of this vulnerability could allow remote attacker to gain unauthorized access and take complete control of the targeted device.
CVE-2024-41738 1 Ibm 1 Txseries For Multiplatforms 2024-11-14 5.9 Medium
IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
CVE-2024-25431 1 Bytecodealliance 1 Webassembly Micro Runtime 2024-11-14 8.8 High
An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.
CVE-2024-41741 1 Ibm 1 Txseries For Multiplatforms 2024-11-14 5.3 Medium
IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system.
CVE-2024-50634 2 Sbond, Sbondco 2 Watcharr, Watcharr 2024-11-14 8.8 High
A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication.
CVE-2024-40592 1 Fortinet 2 Forticlient, Forticlientmac 2024-11-14 6.8 Medium
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process.
CVE-2024-41745 1 Ibm 1 Cics Tx 2024-11-14 6.1 Medium
IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-46635 2024-11-14 5.9 Medium
An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information via a crafted payload to the UserNameOrPhoneNumber parameter.
CVE-2024-36513 1 Fortinet 2 Forticlient, Forticlientwindows 2024-11-14 7.4 High
A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their privileges via lua auto patch scripts.
CVE-2024-36509 1 Fortinet 1 Fortiweb 2024-11-14 3.8 Low
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and below, version 6.3.23 and below may allow an authenticated attacker to access the encrypted passwords of other administrators via the "Log Access Event" logs page.
CVE-2024-36507 1 Fortinet 2 Forticlient, Forticlientwindows 2024-11-14 6.7 Medium
A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering.
CVE-2024-51597 1 Brandevolutionco 1 Themeshark Templates \& Widgets For Elementor 2024-11-14 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeShark ThemeShark Templates & Widgets for Elementor allows Stored XSS.This issue affects ThemeShark Templates & Widgets for Elementor: from n/a through 1.1.7.