[CVE_SUBSCRIPTIONS]

Receive alerts for specific vendors, products, or severities
📡 [FLUX RSS CVE]

Subscribe to the CVE feed

7 derniers jours

> FILTERS

> Last 7 Days

STATISTIQUES

Total CVE: 425077
> CVE-2024-30513 [MEDIUM 6.5]
[PUBLISHED: 2024-03-29] [EPSS 0.46%]
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.
AFFECTED_PRODUCTS: Metagauss Profilegrid
> CVE-2024-30511 [MEDIUM 5.3]
[PUBLISHED: 2024-03-29] [EPSS 0.47%]
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.
> CVE-2024-30492 [MEDIUM 4.3]
[PUBLISHED: 2024-03-29] [EPSS 0.52%]
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2.
> CVE-2024-30482 [MEDIUM 4.3]
[PUBLISHED: 2024-03-29] [EPSS 0.24%]
Cross-Site Request Forgery (CSRF) vulnerability in Brice CAPOBIANCO Simple Revisions Delete.This issue affects Simple Revisions Delete: from n/a through 1.5.3.
AFFECTED_PRODUCTS: B-Website Simple Revisions Delete
> CVE-2024-30477 [MEDIUM 5.3]
[PUBLISHED: 2024-03-29] [EPSS 0.48%]
Missing Authorization vulnerability in Klarna Klarna Payments for WooCommerce.This issue affects Klarna Payments for WooCommerce: from n/a through 3.2.4.
AFFECTED_PRODUCTS: Klarna Klarna For Woocommerce
> CVE-2024-30469 [MEDIUM 5.3]
[PUBLISHED: 2024-03-29] [EPSS 0.45%]
Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
AFFECTED_PRODUCTS: Wpexperts Wholesale For Woocommerce
> CVE-2024-30247 [CRITICAL 10.0]
[PUBLISHED: 2024-03-29] [EPSS 2.12%]
NextcloudPi is a ready to use image for Virtual Machines, Raspberry Pi, Odroid HC1, Rock64 and other boards. A command injection vulnerability in NextCloudPi allows command execution as the root user via the NextCloudPi web-panel. Due to a security misconfiguration this can be used by anyone with ac...
AFFECTED_PRODUCTS: Nextcloud Nextcloudpi
> CVE-2024-30246 [HIGH 7.6]
[PUBLISHED: 2024-03-29] [EPSS 0.62%]
Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information...
AFFECTED_PRODUCTS: Enalean Tuleap, Enalean Tuleap, Enalean Tuleap ... (+7)
> CVE-2024-29904 [HIGH 7.5]
[PUBLISHED: 2024-03-29] [EPSS 0.77%]
CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later.
AFFECTED_PRODUCTS: Codeigniter Codeigniter
> CVE-2024-29901 [MEDIUM 4.8]
[PUBLISHED: 2024-03-29] [EPSS 0.66%]
The AuthKit library for Next.js provides helpers for authentication and session management using WorkOS & AuthKit with Next.js. A user can reuse an expired session by controlling the `x-workos-session` header. The vulnerability is patched in v0.4.2.
AFFECTED_PRODUCTS: Workos Authkit
> CVE-2024-29900 [HIGH 7.5]
[PUBLISHED: 2024-03-29] [EPSS 0.63%]
Electron Packager bundles Electron-based application source code with a renamed Electron executable and supporting files into folders ready for distribution. A random segment of ~1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memo...
AFFECTED_PRODUCTS: Openjsf Packager
> CVE-2024-29686 [HIGH 7.2]
[PUBLISHED: 2024-03-29] [EPSS 1.82%]
Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be entered by a trusted user, such as the own...
AFFECTED_PRODUCTS: Wintercms Winter
> CVE-2023-49231 [CRITICAL 9.8]
[PUBLISHED: 2024-03-29] [⚡ EPSS 42.9%]
An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token.
> CVE-2024-3081 [LOW 3.5]
[PUBLISHED: 2024-03-29] [EPSS 0.54%]
A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. The...
AFFECTED_PRODUCTS: Easycorp Easyadmin
> CVE-2024-30508 [MEDIUM 6.5]
[PUBLISHED: 2024-03-29] [EPSS 0.52%]
Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.
AFFECTED_PRODUCTS: Thimpress Wp Hotel Booking
> CVE-2024-30507 [LOW 2.7]
[PUBLISHED: 2024-03-29] [EPSS 0.43%]
Authorization Bypass Through User-Controlled Key vulnerability in Molongui.This issue affects Molongui: from n/a through 4.7.7.
> CVE-2024-30506 [HIGH 7.1]
[PUBLISHED: 2024-03-29] [EPSS 0.42%]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Stored XSS.This issue affects All In One Redirection: from n/a through 2.2.0.
> CVE-2024-30505 [MEDIUM 5.4]
[PUBLISHED: 2024-03-29] [EPSS 0.47%]
Missing Authorization vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 4.1.18.
> CVE-2024-30504 [HIGH 7.6]
[PUBLISHED: 2024-03-29] [EPSS 0.57%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.
AFFECTED_PRODUCTS: Wptravelengine Wp Travel Engine
> CVE-2024-30502 [CRITICAL 9.3]
[PUBLISHED: 2024-03-29] [EPSS 2.25%] [🎯 NUCLEI]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.
AFFECTED_PRODUCTS: Wptravelengine Wp Travel Engine
> CVE-2024-29893 [MEDIUM 6.5]
[PUBLISHED: 2024-03-29] [EPSS 0.97%]
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of...
AFFECTED_PRODUCTS: Argoproj Argo Cd, Argoproj Argo Cd, Argoproj Argo Cd
> CVE-2024-29890 [HIGH 8.8]
[PUBLISHED: 2024-03-29] [EPSS 0.78%]
DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart type with the ability to pass custom javascript code that would later be executed in an unprotected sandbox on subsequent requests to that chart. The problem was...
> CVE-2024-29202 [CRITICAL 9.9]
[PUBLISHED: 2024-03-29] [EPSS 5.94%]
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and ha...
AFFECTED_PRODUCTS: Fit2Cloud Jumpserver
> CVE-2024-29201 [CRITICAL 9.9]
[PUBLISHED: 2024-03-29] [EPSS 5.99%]
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database a...
AFFECTED_PRODUCTS: Fit2Cloud Jumpserver
> CVE-2024-29024 [MEDIUM 4.6]
[PUBLISHED: 2024-03-29] [EPSS 0.24%]
JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference (IDOR) vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files, potentially compromisi...
AFFECTED_PRODUCTS: Fit2Cloud Jumpserver
> CVE-2024-29020 [MEDIUM 4.6]
[PUBLISHED: 2024-03-29] [EPSS 0.29%]
JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information contained within playbook files if they manage to learn the playbook_id of another user. This breach of confidentiality can lead to information di...
AFFECTED_PRODUCTS: Fit2Cloud Jumpserver
> CVE-2024-28867 [MEDIUM 5.9]
[PUBLISHED: 2024-03-29] [EPSS 0.65%]
Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or simi...
> CVE-2024-28405 [HIGH 7.2]
[PUBLISHED: 2024-03-29] [EPSS 0.80%]
SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin is a valid user in the admin page because authentication function is called from there, users gain admin privileges.
AFFECTED_PRODUCTS: Sem-Cms Semcms
> CVE-2024-27619 [HIGH 7.3]
[PUBLISHED: 2024-03-29] [EPSS 0.84%]
Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. Any user having read/write access to ftp server can write directly to ram causing buffer overflow if file or files uploaded are greater than available ram. Ftp server allows change of directory to root which is one level up than r...
> CVE-2024-23539 [HIGH 8.3]
[PUBLISHED: 2024-03-29] [EPSS 1.49%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.
AFFECTED_PRODUCTS: Apache Fineract
> CVE-2024-23538 [CRITICAL 9.9]
[PUBLISHED: 2024-03-29] [EPSS 1.29%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue.
AFFECTED_PRODUCTS: Apache Fineract
> CVE-2024-23537 [HIGH 8.4]
[PUBLISHED: 2024-03-29] [EPSS 1.10%]
Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0, which fixes the issue.
AFFECTED_PRODUCTS: Apache Fineract
> CVE-2024-30639 [MEDIUM 6.5]
[PUBLISHED: 2024-03-29] [EPSS 0.52%]
Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability in the page parameter of fromAddressNat function.
AFFECTED_PRODUCTS: Tenda F1202 Firmware
> CVE-2024-30638 [MEDIUM 4.3]
[PUBLISHED: 2024-03-29] [EPSS 0.45%]
Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the entrys parameter in the fromAddressNat function.
AFFECTED_PRODUCTS: Tenda F1202 Firmware
> CVE-2024-30637 [HIGH 8.8]
[PUBLISHED: 2024-03-29] [EPSS 1.76%]
Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter.
AFFECTED_PRODUCTS: Tenda F1202 Firmware
> CVE-2024-30636 [MEDIUM 6.5]
[PUBLISHED: 2024-03-29] [EPSS 0.42%]
Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the PPPOEPassword parameter in the formQuickIndex function.
AFFECTED_PRODUCTS: Tenda F1202 Firmware
> CVE-2024-30635 [CRITICAL 9.8]
[PUBLISHED: 2024-03-29] [EPSS 0.81%]
Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function.
AFFECTED_PRODUCTS: Tenda F1202 Firmware
> CVE-2024-30634 [HIGH 8.0]
[PUBLISHED: 2024-03-29] [EPSS 0.70%]
Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the mitInterface parameter in the fromAddressNat function.
AFFECTED_PRODUCTS: Tenda F1202 Firmware
> CVE-2024-30510 [CRITICAL 10.0]
[PUBLISHED: 2024-03-29] [EPSS 0.67%]
Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5.
AFFECTED_PRODUCTS: Salonbookingsystem Salon Booking System
> CVE-2024-30501 [HIGH 7.6]
[PUBLISHED: 2024-03-29] [EPSS 0.61%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.
AFFECTED_PRODUCTS: Wpchill Download Monitor
> CVE-2024-30500 [CRITICAL 9.9]
[PUBLISHED: 2024-03-29] [EPSS 0.64%]
Unrestricted Upload of File with Dangerous Type vulnerability in CubeWP CubeWP – All-in-One Dynamic Content Framework.This issue affects CubeWP – All-in-One Dynamic Content Framework: from n/a through 1.1.12.
AFFECTED_PRODUCTS: Cubewp Cubewp
> CVE-2024-30499 [HIGH 8.5]
[PUBLISHED: 2024-03-29] [EPSS 0.58%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
AFFECTED_PRODUCTS: Crmperks Crm Perks Forms
> CVE-2024-30498 [CRITICAL 9.3]
[PUBLISHED: 2024-03-29] [EPSS 2.25%] [🎯 NUCLEI]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.
AFFECTED_PRODUCTS: Crmperks Crm Perks Forms
> CVE-2024-30497 [HIGH 8.5]
[PUBLISHED: 2024-03-29] [EPSS 0.58%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs.This issue affects WP Responsive Tabs horizontal vertical and accordion Tabs: from n/a through 1.1.17.
AFFECTED_PRODUCTS: I13Websolution Wp Responsive Tabs
> CVE-2024-30496 [HIGH 8.5]
[PUBLISHED: 2024-03-29] [EPSS 0.58%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.
AFFECTED_PRODUCTS: Bdthemes Element Pack
> CVE-2024-30495 [HIGH 7.6]
[PUBLISHED: 2024-03-29] [EPSS 0.57%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faboba Falang multilanguage.This issue affects Falang multilanguage: from n/a through 1.3.47.
AFFECTED_PRODUCTS: Faboba Falang
> CVE-2024-30494 [HIGH 7.6]
[PUBLISHED: 2024-03-29] [EPSS 0.52%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 沈唁 OSS Aliyun.This issue affects OSS Aliyun: from n/a through 1.4.10.
> CVE-2024-30493 [MEDIUM 4.3]
[PUBLISHED: 2024-03-29] [EPSS 0.21%]
Cross-Site Request Forgery (CSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 4.1.7.
> CVE-2024-30491 [HIGH 8.5]
[PUBLISHED: 2024-03-29] [⚡ EPSS 32.0%]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.
AFFECTED_PRODUCTS: Metagauss Profilegrid
> CVE-2024-30490 [CRITICAL 9.3]
[PUBLISHED: 2024-03-29] [EPSS 2.25%] [🎯 NUCLEI]
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.
AFFECTED_PRODUCTS: Metagauss Profilegrid