Total
81928 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-29125 | 1 Enelx | 2 Waybox Pro, Waybox Pro Firmware | 2024-11-08 | N/A | 8.0 HIGH |
| A heap buffer overflow could be triggered by sending a specific packet to TCP port 7700. | |||||
| CVE-2023-29121 | 1 Enelx | 2 Waybox Pro, Waybox Pro Firmware | 2024-11-08 | N/A | 8.8 HIGH |
| Waybox Enel TCF Agent service could be used to get administrator’s privileges over the Waybox system. | |||||
| CVE-2023-29120 | 1 Enelx | 2 Waybox Pro, Waybox Pro Firmware | 2024-11-08 | N/A | 8.8 HIGH |
| Waybox Enel X web management application could be used to execute arbitrary OS commands and provide administrator’s privileges over the Waybox system. | |||||
| CVE-2023-29119 | 1 Enelx | 2 Waybox Pro, Waybox Pro Firmware | 2024-11-08 | N/A | 8.8 HIGH |
| Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/dbstore.php. | |||||
| CVE-2023-29118 | 1 Enelx | 2 Waybox Pro, Waybox Pro Firmware | 2024-11-08 | N/A | 8.8 HIGH |
| Waybox Enel X web management application could execute arbitrary requests on the internal database via /admin/versions.php. | |||||
| CVE-2023-29117 | 1 Enelx | 2 Waybox Pro, Waybox Pro Firmware | 2024-11-08 | N/A | 8.8 HIGH |
| Waybox Enel X web management API authentication could be bypassed and provide administrator’s privileges over the Waybox system. | |||||
| CVE-2024-10263 | 1 Tickera | 1 Tickera | 2024-11-08 | N/A | 7.3 HIGH |
| The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. | |||||
| CVE-2024-47831 | 1 Vercel | 1 Next.js | 2024-11-08 | N/A | 7.5 HIGH |
| Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned. | |||||
| CVE-2024-38190 | 1 Microsoft | 1 Power Platform | 2024-11-08 | N/A | 8.6 HIGH |
| Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. | |||||
| CVE-2024-0129 | 4 Apple, Linux, Microsoft and 1 more | 4 Macos, Linux Kernel, Windows and 1 more | 2024-11-08 | N/A | 7.8 HIGH |
| NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering. | |||||
| CVE-2024-7985 | 1 Fileorganizer | 1 Fileorganizer | 2024-11-08 | N/A | 8.8 HIGH |
| The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizer_ajax_handler" function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, and permissions granted by an administrator, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: The FileOrganizer Pro plugin must be installed and active to allow Subscriber+ users to upload files. | |||||
| CVE-2024-38139 | 1 Microsoft | 1 Dataverse | 2024-11-08 | N/A | 8.8 HIGH |
| Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2024-45085 | 1 Ibm | 1 Websphere Application Server | 2024-11-08 | N/A | 7.5 HIGH |
| IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A remote attacker could exploit this vulnerability to cause an error resulting in a denial of service. | |||||
| CVE-2024-49340 | 1 Ibm | 1 Watson Studio Local | 2024-11-08 | N/A | 8.8 HIGH |
| IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | |||||
| CVE-2024-51661 | 1 Davidlingren | 1 Media Library Assistant | 2024-11-08 | N/A | 7.2 HIGH |
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media Library Assistant allows Command Injection.This issue affects Media Library Assistant: from n/a through 3.19. | |||||
| CVE-2024-50129 | 1 Linux | 1 Linux Kernel | 2024-11-07 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: net: pse-pd: Fix out of bound for loop Adjust the loop limit to prevent out-of-bounds access when iterating over PI structures. The loop should not reach the index pcdev->nr_lines since we allocate exactly pcdev->nr_lines number of PI structures. This fix ensures proper bounds are maintained during iterations. | |||||
| CVE-2024-51523 | 1 Huawei | 1 Harmonyos | 2024-11-07 | N/A | 7.5 HIGH |
| Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2024-38406 | 1 Qualcomm | 88 Aqt1000, Aqt1000 Firmware, Fastconnect 6200 and 85 more | 2024-11-07 | N/A | 7.0 HIGH |
| Memory corruption while handling IOCTL calls in JPEG Encoder driver. | |||||
| CVE-2024-38424 | 1 Qualcomm | 238 Ar8035, Ar8035 Firmware, Fastconnect 6200 and 235 more | 2024-11-07 | N/A | 7.8 HIGH |
| Memory corruption during GNSS HAL process initialization. | |||||
| CVE-2024-38423 | 1 Qualcomm | 412 205 Mobile Platform, 205 Mobile Platform Firmware, 215 Mobile Platform and 409 more | 2024-11-07 | N/A | 7.8 HIGH |
| Memory corruption while processing GPU page table switch. | |||||