CVSS: 8.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-42681
https://notcve.org/view.php?id=CVE-2024-42681
Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component. • https://github.com/xuxueli/xxl-job/issues/3516 • CWE-277: Insecure Inherited Permissions •
CVSS: 6.3EPSS: 0%CPEs: -EXPL: 0CVE-2024-22219
https://notcve.org/view.php?id=CVE-2024-22219
XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which could lead to various actions such as accessing the underlying server, remote code execution (RCE), or performing Server-Side Request Forgery (SSRF) attacks. • https://docs.terminalfour.com/articles/release-notes-highlights https://docs.terminalfour.com/release-notes/security-notices/cve-2024-22218--cve-2024-22219 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-42676
https://notcve.org/view.php?id=CVE-2024-42676
File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary code via the /nssys/common/Upload. • https://github.com/WarmBrew/web_vul/blob/main/HZ-cve/HZupload.md • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-27730
https://notcve.org/view.php?id=CVE-2024-27730
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature. • https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures https://github.com/friendica/friendica/pull/13927 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 7.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-42679
https://notcve.org/view.php?id=CVE-2024-42679
SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code via a crafted script to the/ajax/Login.ashx component. • https://github.com/WarmBrew/web_vul/blob/main/CYGLXT/CYsqli.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •