Total
258583 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-33996 | 2024-07-03 | N/A | 6.2 MEDIUM | ||
| Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to. | |||||
| CVE-2024-33905 | 2024-07-03 | N/A | 4.6 MEDIUM | ||
| In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type. | |||||
| CVE-2024-33900 | 2024-07-03 | N/A | 6.5 MEDIUM | ||
| KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory dump. NOTE: the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs. | |||||
| CVE-2024-33899 | 2024-07-03 | N/A | 7.1 HIGH | ||
| RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences. | |||||
| CVE-2024-33891 | 2024-07-03 | N/A | 8.8 HIGH | ||
| Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute. | |||||
| CVE-2024-33881 | 2 Microsoft, Virtosoftware | 2 Sharepoint Server, Sharepoint Bulk File Download | 2024-07-03 | N/A | 5.3 MEDIUM |
| An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter. | |||||
| CVE-2024-33877 | 2024-07-03 | N/A | 8.8 HIGH | ||
| HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5T__conv_struct_opt in H5Tconv.c. | |||||
| CVE-2024-33874 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| HDF5 Library through 1.14.3 has a heap buffer overflow in H5O__mtime_new_encode in H5Omtime.c. | |||||
| CVE-2024-33873 | 2024-07-03 | N/A | 8.8 HIGH | ||
| HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5D__scatter_mem in H5Dscatgath.c. | |||||
| CVE-2024-33868 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection. | |||||
| CVE-2024-33867 | 2024-07-03 | N/A | 4.8 MEDIUM | ||
| An issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt. | |||||
| CVE-2024-33864 | 2024-07-03 | N/A | 5.9 MEDIUM | ||
| An issue was discovered in linqi before 1.4.0.1 on Windows. There is SSRF via Document template generation; i.e., via remote images in process creation, file inclusion, and PDF document generation via malicious JavaScript. | |||||
| CVE-2024-33863 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| An issue was discovered in linqi before 1.4.0.1 on Windows. There is /api/Cdn/GetFile local file inclusion. | |||||
| CVE-2024-33860 | 2024-07-03 | N/A | 6.5 MEDIUM | ||
| An issue was discovered in Logpoint before 7.4.0. It allows Local File Inclusion (LFI) when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming logs. | |||||
| CVE-2024-33857 | 2024-07-03 | N/A | 9.6 CRITICAL | ||
| An issue was discovered in Logpoint before 7.4.0. Due to a lack of input validation on URLs in threat intelligence, an attacker with low-level access to the system can trigger Server Side Request Forgery. | |||||
| CVE-2024-33856 | 2024-07-03 | N/A | 5.3 MEDIUM | ||
| An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password endpoint. | |||||
| CVE-2024-33836 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X, the method `JmarketplaceproductModuleFrontController::init()` and in version 8.X, the method `JmarketplaceSellerproductModuleFrontController::init()` allow upload of .php files, which will lead to a critical vulnerability. | |||||
| CVE-2024-33835 | 2024-07-03 | N/A | 9.8 CRITICAL | ||
| Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the remoteIp parameter from formSetSafeWanWebMan function. | |||||
| CVE-2024-33832 | 2024-07-03 | N/A | 6.3 MEDIUM | ||
| OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_info. | |||||
| CVE-2024-33831 | 2024-07-03 | N/A | 7.4 HIGH | ||
| A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field. | |||||