Filtered by vendor Subscriptions
Total 322231 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-45794 1 Kubernetes 1 Devtron 2024-11-08 8.3 High
devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-36064 1 Nllcom 1 Acr Phone 2024-11-08 6.2 Medium
The NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.nll.cb.dialer.dialer.DialerActivity component.
CVE-2024-9579 2 Hp, Poly 24 Poly Studio G62, Poly Studio G62 Firmware, Poly Studio G7500 and 21 more 2024-11-08 7.5 High
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
CVE-2024-49522 1 Adobe 1 Substance 3d Painter 2024-11-08 7.8 High
Substance3D - Painter versions 10.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-10452 1 Grafana 1 Grafana 2024-11-08 2.2 Low
Organization admins can delete pending invites created in an organization they are not part of.
CVE-2024-51482 1 Zoneminder 1 Zoneminder 2024-11-08 10 Critical
ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-based SQL Injection in function of web/ajax/event.php. This is fixed in 1.37.65.
CVE-2024-51501 1 Reactiveui 1 Refit 2024-11-08 N/A
Refit is an automatic type-safe REST library for .NET Core, Xamarin and .NET The various header-related Refit attributes (Header, HeaderCollection and Authorize) are vulnerable to CRLF injection. The way HTTP headers are added to a request is via the `HttpHeaders.TryAddWithoutValidation` method. This method does not check for CRLF characters in the header value. This means that any headers added to a refit request are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests. If an application using the Refit library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery. Strictly speaking this is a potential vulnerability in applications using Refit and not in Refit itself. This issue has been addressed in release versions 7.2.22 and 8.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-29126 1 Enelx 2 Waybox Pro, Waybox Pro Firmware 2024-11-08 4.2 Medium
The Waybox Enel X web management application contains a PHP-type juggling vulnerability that may allow a brute force process and under certain conditions bypass authentication.
CVE-2023-29125 2 Enel X, Enelx 3 Juicebox Pro3.0 22kw Cellular, Waybox Pro, Waybox Pro Firmware 2024-11-08 9 Critical
A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700.
CVE-2023-29121 2 Enel X, Enelx 3 Juicebox Pro3.0 22kw Cellular, Waybox Pro, Waybox Pro Firmware 2024-11-08 9.6 Critical
Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system.
CVE-2023-29120 2 Enel X, Enelx 3 Juicebox Pro3.0 22kw Cellular, Waybox Pro, Waybox Pro Firmware 2024-11-08 9.6 Critical
Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system.
CVE-2023-29119 2 Enel X, Enelx 3 Juicebox Pro3.0 22kw Cellular, Waybox Pro, Waybox Pro Firmware 2024-11-08 9.6 Critical
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php.
CVE-2023-29118 2 Enel X, Enelx 3 Juicebox Pro3.0 22kw Cellular, Waybox Pro, Waybox Pro Firmware 2024-11-08 9.6 Critical
Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php.
CVE-2023-29117 2 Enel X, Enelx 3 Juicebox Pro3.0 22kw Cellular, Waybox Pro, Waybox Pro Firmware 2024-11-08 8.8 High
Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system.
CVE-2023-29116 1 Enelx 2 Waybox Pro, Waybox Pro Firmware 2024-11-08 4.3 Medium
Under certain conditions, through a request directed to the Waybox Enel X web management application, information like Waybox OS version or service configuration details could be obtained.
CVE-2023-29115 1 Enelx 2 Waybox Pro, Waybox Pro Firmware 2024-11-08 6.5 Medium
In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).
CVE-2024-9178 1 Xplodedthemes 1 Xt Floating Cart For Woocommerce 2024-11-08 6.4 Medium
The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVE-2024-9657 1 Bdthemes 1 Element Pack 2024-11-08 6.5 Medium
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip' parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-9867 1 Bdthemes 1 Element Pack 2024-11-08 5.4 Medium
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Open Map Widget' marker_content parameter in all versions up to, and including, 5.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-10263 1 Tickera 1 Tickera 2024-11-08 7.3 High
The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.