CVE Vulnerability Database
Search and browse 394,625 CVE records with CVSS scores, EPSS exploit predictions, CISA KEV status and whether the Vulnix engine has a detection for them.
160 records from 2024Clear filters
- CVE-2024-43461High 8.8KEVSep 10, 2024Windows MSHTML Platform Spoofing Vulnerability
- CVE-2024-38226High 7.3KEVSep 10, 2024Microsoft Publisher Security Feature Bypass Vulnerability
- CVE-2024-38217Medium 5.4KEVSep 10, 2024Windows Mark of the Web Security Feature Bypass Vulnerability
- CVE-2024-38014High 7.8KEVSep 10, 2024Windows Installer Elevation of Privilege Vulnerability
- CVE-2024-40711Critical 9.8KEVSep 7, 2024A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
- CVE-2024-20439Critical 9.8KEVSep 4, 2024A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit this vulnerability by using the static credentials to login to the affected system. A successful exploit could allow the attacker to login to the affected system with administrative rights over the CSLU application API.
- CVE-2024-45195High 7.5KEVSep 4, 2024Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- CVE-2024-6670Critical 9.8KEVAug 29, 2024In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
- CVE-2024-40766Critical 9.8KEVAug 23, 2024An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
- CVE-2024-39717High 7.2KEVAug 22, 2024The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
- CVE-2024-28987Critical 9.1KEVAug 21, 2024The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
- CVE-2024-7971Critical 9.6KEVAug 21, 2024Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-7965High 8.8KEVAug 21, 2024Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-7262High 7.8KEVAug 15, 2024Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
- CVE-2024-28986Critical 9.8KEVAug 13, 2024SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
- CVE-2024-7593Critical 9.8KEVAug 13, 2024Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
- CVE-2024-38213Medium 6.5KEVAug 13, 2024Windows Mark of the Web Security Feature Bypass Vulnerability
- CVE-2024-38193High 7.8KEVAug 13, 2024Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- CVE-2024-38189High 8.8KEVAug 13, 2024Microsoft Project Remote Code Execution Vulnerability
- CVE-2024-38178High 7.5KEVAug 13, 2024Scripting Engine Memory Corruption Vulnerability
- CVE-2024-38107High 7.8KEVAug 13, 2024Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
- CVE-2024-38106High 7.0KEVAug 13, 2024Windows Kernel Elevation of Privilege Vulnerability
- CVE-2024-41710High 7.2KEVAug 12, 2024A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.
- CVE-2024-27443Medium 6.1KEVAug 12, 2024An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
- CVE-2024-7694High 7.2KEVAug 12, 2024ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.