Filtered by vendor Subscriptions
Total 322276 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-52372 1 Webtechglobal 1 Easy Csv Importer Beta 2024-11-15 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA allows Upload a Web Shell to a Web Server.This issue affects Easy CSV Importer BETA: from n/a through 7.0.0.
CVE-2024-47914 2024-11-15 4.5 Medium
VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF)
CVE-2024-47916 2024-11-15 7.5 High
Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-52370 1 Hivesupport 1 Hive Support 2024-11-15 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Hive Support Hive Support – WordPress Help Desk allows Upload a Web Shell to a Web Server.This issue affects Hive Support – WordPress Help Desk: from n/a through 1.1.1.
CVE-2024-51688 2024-11-15 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in FraudLabs Pro FraudLabs Pro SMS Verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through 1.10.1.
CVE-2024-6068 1 Rcokwellautomation 1 Arena Input Analyzer 2024-11-15 7.3 High
A memory corruption vulnerability exists in the affected products when parsing DFT files. Local threat actors can exploit this issue to disclose information and to execute arbitrary code. To exploit this vulnerability a legitimate user must open a malicious DFT file.
CVE-2024-47915 1 Vaemendis 1 Vaemendis Ubooquity 2024-11-15 7.5 High
VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2022-2232 1 Redhat 1 Red Hat Single Sign On 2024-11-15 7.5 High
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.
CVE-2023-4348 2024-11-15 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-51377 1 Ladybirdweb 1 Faveo Helpdesk 2024-11-15 8.8 High
An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields
CVE-2024-49381 1 Plenti 2 Plenti, Plentico 2024-11-15 7.5 High
Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability.
CVE-2024-49376 1 Autolabproject 1 Autolab 2024-11-15 8.8 High
Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.
CVE-2024-11016 1 Vice 1 Webopac 2024-11-15 9.8 Critical
Webopac from Grand Vice info has a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents.
CVE-2024-10381 2 Matrix Comsec, Matrixcomsec 3 Matrix Door Controller Cosec Vega Faxq Firmware, Cosec Vega Faxq, Cosec Vega Faxq Firmware 2024-11-15 9.8 Critical
This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the vulnerable device. Successful exploitation of this vulnerability could allow remote attacker to gain unauthorized access and take complete control of the targeted device.
CVE-2024-41738 1 Ibm 1 Txseries For Multiplatforms 2024-11-14 5.9 Medium
IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.
CVE-2024-25431 1 Bytecodealliance 1 Webassembly Micro Runtime 2024-11-14 8.8 High
An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges via a crafted file to the check_was_abi_compatibility function.
CVE-2024-41741 1 Ibm 1 Txseries For Multiplatforms 2024-11-14 5.3 Medium
IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system.
CVE-2024-50634 2 Sbond, Sbondco 2 Watcharr, Watcharr 2024-11-14 8.8 High
A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication.
CVE-2024-40592 1 Fortinet 2 Forticlient, Forticlientmac 2024-11-14 6.8 Medium
An improper verification of cryptographic signature vulnerability [CWE-347] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition during the installation process.
CVE-2024-41745 1 Ibm 1 Cics Tx 2024-11-14 6.1 Medium
IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.