CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47836 – Admidio vulnerable to HTML Injection In The Messages Section
https://notcve.org/view.php?id=CVE-2024-47836
16 Oct 2024 — Prior to version 4.3.12, an unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. • https://github.com/Admidio/admidio/security/advisories/GHSA-7c4c-749j-pfp2 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2024-9143 – Low-level invalid GF(2^m) parameters lead to OOB memory access
https://notcve.org/view.php?id=CVE-2024-9143
16 Oct 2024 — Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary (GF(2^m)) curves that can't represent problematic input values. Impact summary: Out of bound memory writes can lead to an application crash or ev... • https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712 • CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-38814 – VMware HCX listExtensions SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-38814
16 Oct 2024 — An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-administrator privileges may be able to enter specially crafted SQL queries and perform unauthorized remote code execution on the HCX manager. ... This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware HCX. ... An attacker can leverage this vulnerability to execute ... • https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25019 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-20512 – Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2024-20512
16 Oct 2024 — A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. ... A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccmpdm-rxss-tAX76U3k • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2024-20460 – Cisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2024-20460
16 Oct 2024 — A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user. ... A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information on an affected device. • https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9348 – Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view
https://notcve.org/view.php?id=CVE-2024-9348
16 Oct 2024 — Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view. Docker Desktop anterior a v4.34.3 permite RCE a través de un enlace de origen de GitHub no desinfectado en la vista de compilación. • https://docs.docker.com/desktop/release-notes/#4343 • CWE-20: Improper Input Validation CWE-116: Improper Encoding or Escaping of Output •
CVSS: -EPSS: 0%CPEs: -EXPL: 0CVE-2024-45257 – BYOB Unauthenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2024-45257
https://blog.chebuya.com/posts/unauthenticated-remote-command-execution-on-byob •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32188 – JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2023-32188
16 Oct 2024 — This can lead to an RCE. ... Esto puede dar lugar a una RCE. • https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188 • CWE-1270: Generation of Incorrect Security Tokens •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45711 – SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-45711
16 Oct 2024 — SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. • https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45711 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-46213
https://notcve.org/view.php?id=CVE-2024-46213
16 Oct 2024 — REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability. Se descubrió que REDAXO CMS v2.11.0 contenía una vulnerabilidad de ejecución remota de código (RCE). • https://github.com/Purposex7/Vulns4Study/blob/main/REDAXO%20Cronjobs%20%20AddOns%20RCE.md •