[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 424789
> CVE-2023-41611 [MEDIUM 6.5]
[PUBLISHED: 2024-09-18] [EPSS 0.35%]
Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data.
AFFECTED_PRODUCTS: Govicture Pc420 Firmware
> CVE-2023-41610 [HIGH 8.8]
[PUBLISHED: 2024-09-18] [EPSS 0.40%]
Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.
AFFECTED_PRODUCTS: Govicture Pc420 Firmware
> CVE-2024-46990 [MEDIUM 5.0]
[PUBLISHED: 2024-09-18] [EPSS 0.47%]
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been address...
> CVE-2024-45813 [MEDIUM 5.3]
[PUBLISHED: 2024-09-18] [EPSS 0.68%]
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like...
> CVE-2024-45298 [MEDIUM 4.3]
[PUBLISHED: 2024-09-18] [EPSS 0.40%]
Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. To my shock, not only did it let me reset...
> CVE-2023-47105 [HIGH 8.6]
[PUBLISHED: 2024-09-18] [EPSS 1.67%]
exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication.
> CVE-2024-46086 [HIGH 8.8]
[PUBLISHED: 2024-09-18] [EPSS 0.30%]
FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/delete/123
AFFECTED_PRODUCTS: Frogcms Project Frogcms
> CVE-2022-25777 [MEDIUM 6.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.
AFFECTED_PRODUCTS: Acquia Mautic, Acquia Mautic, Acquia Mautic
> CVE-2024-6878
[PUBLISHED: 2024-09-18] [EPSS 0.41%]
Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common Resource Locations.This issue affects Panel: before v2.3.24.
> CVE-2024-6877 [MEDIUM 6.1]
[PUBLISHED: 2024-09-18] [EPSS 0.27%]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Reflected XSS.This issue affects Panel: before v2.3.24.
AFFECTED_PRODUCTS: Elizsoftware Panel
> CVE-2024-5960 [CRITICAL 9.8]
[PUBLISHED: 2024-09-18] [EPSS 0.44%]
Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials.This issue affects Panel: before v2.3.24.
AFFECTED_PRODUCTS: Elizsoftware Panel
> CVE-2024-5959 [MEDIUM 5.4]
[PUBLISHED: 2024-09-18] [EPSS 0.26%]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Software Panel allows Stored XSS.This issue affects Panel: before v2.3.24.
AFFECTED_PRODUCTS: Elizsoftware Panel
> CVE-2024-5958 [HIGH 8.8]
[PUBLISHED: 2024-09-18] [EPSS 0.51%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Panel allows Command Line Execution through SQL Injection.This issue affects Panel: before v2.3.24.
AFFECTED_PRODUCTS: Elizsoftware Panel
> CVE-2024-46598 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.42%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46597 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46596 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46595 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46594 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46593 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46592 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.42%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt_5g%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46591 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.42%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sDnsPro parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46590 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.42%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ssidencrypt%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46589 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sIpv6AiccuUser parameter at inetipv6.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46588 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at wizfw.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46586 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sCloudPass parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46585 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at usergrp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46584 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the AControlIp1 parameter at acontrol.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46583 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the extRadSrv2 parameter at cgiapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46582 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvAddr parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46581 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.45%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46580 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.42%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the fid parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46571 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.42%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPPPSrvNm parameter at fwuser.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46568 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.42%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPeerId parameter at vpn.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46567 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iProfileIdx parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46566 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAppName parameter at sslapp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46565 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sSrvName parameter at service.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46564 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at fextobj.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46561 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the queryret parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46560 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pub_key parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46559 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_UsrNme parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46558 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the newProname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46557 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46556 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sInRCSecret0 parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46555 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the pb parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46554 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the profname parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46553 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the ipaddrmsk%d parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46552 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sStRtMskShow parameter at ipstrt.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46551 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sBPA_Pwd parameter at inet15.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-46550 [HIGH 7.5]
[PUBLISHED: 2024-09-18] [EPSS 0.52%]
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
AFFECTED_PRODUCTS: Draytek Vigor3910 Firmware
> CVE-2024-45858 [HIGH 7.8]
[PUBLISHED: 2024-09-18] [EPSS 0.38%]
An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it t...