Search

Expected end of text, found '.' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (333857 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-20465 1 Cisco 1 Ios 2024-10-24 5.8 Medium
A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet 4000, 4010, and 5000 Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the incorrect handling of IPv4 ACLs on switched virtual interfaces when an administrator enables and disables Resilient Ethernet Protocol (REP). An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.
CVE-2024-20437 1 Cisco 1 Ios Xe 2024-10-24 8.1 High
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack and execute commands on the CLI of an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an already authenticated user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
CVE-2024-50050 1 Meta Platforms Inc 1 Llama Stack 2024-10-24 6.3 Medium
Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.
CVE-2024-46937 1 Mfasoft 1 Secure Authentication Server 2024-10-24 9.1 Critical
An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.
CVE-2024-49326 1 Vasiliskerasiotis 1 Affiliator 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Vasilis Kerasiotis Affiliator allows Upload a Web Shell to a Web Server.This issue affects Affiliator: from n/a through 2.1.3.
CVE-2024-49324 1 Sovratec 2 Case Management, Sovratec Case Management 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Sovratec Sovratec Case Management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through 1.0.0.
CVE-2024-49327 1 Asepbagjapriandana 1 Woostagram Connect 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Asep Bagja Priandana Woostagram Connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through 1.0.2.
CVE-2024-49329 2 Vivek Tamrakar, Vivektamrakar 2 Wp Rest Api Fns, Wp Rest Api Fns 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Vivek Tamrakar WP REST API FNS allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through 1.0.0.
CVE-2024-49330 1 Brx8r 1 Nice Backgrounds 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through 1.0.
CVE-2024-49331 2 Myriad Solutionz, Myriadsolutionz 2 Property Lot Management System, Property Lot Management System 2024-10-24 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through 4.2.38.
CVE-2024-49332 2 Giveaway Boost, Giveawayboost 2 Giveaway Boost, Giveaway Boost 2024-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in Giveaway Boost allows Object Injection.This issue affects Giveaway Boost: from n/a through 2.1.4.
CVE-2024-49607 2 Redwan Hilali, Redwanhilali 2 Wp Dropbox Dropins, Wp Dropbox Dropins 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Redwan Hilali WP Dropbox Dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through 1.0.
CVE-2024-49608 1 Gerryntabuhashe 1 Gerryworks Post By Mail 2024-10-24 8.8 High
: Incorrect Privilege Assignment vulnerability in Gerry Ntabuhashe GERRYWORKS Post by Mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through 1.0.
CVE-2024-49610 2 Jack Zhu, Jackzhu 2 Photokit, Photokit 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Jack Zhu allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through 1.0.
CVE-2024-49621 1 Apa 1 Apa Register Newsletter Form 2024-10-24 8.2 High
Cross-Site Request Forgery (CSRF) vulnerability in Apa APA Register Newsletter Form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through 1.0.0.
CVE-2024-49612 1 Infotuts 1 Sw Contact Form 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infotuts SW Contact Form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through 1.0.
CVE-2024-49609 1 Brandonwhite 1 Author Discussion 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through 0.2.2.
CVE-2024-49605 1 Avchat.net 1 Avchat Video Chat 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Avchat.Net AVChat Video Chat allows Stored XSS.This issue affects AVChat Video Chat: from n/a through 2.2.
CVE-2024-49335 1 Edush Maxim 1 Googledrive Folder List 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2.
CVE-2024-47325 1 Themeisle 1 Multiple Page Generator 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows SQL Injection.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.7.