CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-10571 – Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source
https://notcve.org/view.php?id=CVE-2024-10571
13 Nov 2024 — This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. • https://plugins.trac.wordpress.org/browser/chart-builder/tags/2.9.6/admin/partials/charts/actions/chart-builder-charts-actions-options.php?rev=3184238 • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 7.2EPSS: 0%CPEs: -EXPL: 0CVE-2024-37376 – Ivanti Endpoint Manager Report_RunPatch SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-37376
13 Nov 2024 — SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. ... An attacker can leverage this vulnerability to execute code in the context of the service account. • https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: -EXPL: 0CVE-2023-38920
https://notcve.org/view.php?id=CVE-2023-38920
13 Nov 2024 — Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the adminname parameter. • https://github.com/amanahmed000/Cyber-Cafe-Management-System-XSS-Advisory/blob/main/CVE-2023-38920.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: -EXPL: 0CVE-2024-32839 – Ivanti Endpoint Manager MP_VistaReport SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-32839
13 Nov 2024 — SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. ... An attacker can leverage this vulnerability to execute code in the context of the service account. • https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: -EXPL: 0CVE-2024-32841 – Ivanti Endpoint Manager GetCountForQuery SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-32841
13 Nov 2024 — SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. ... An attacker can leverage this vulnerability to execute code in the context of the service account. • https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: -EXPL: 0CVE-2024-32844 – Ivanti Endpoint Manager MP_QueryDetail2 SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-32844
13 Nov 2024 — SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. ... An attacker can leverage this vulnerability to execute code in the context of the service account. • https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: -EXPL: 0CVE-2024-32847 – Ivanti Endpoint Manager Report_Run2 SQL Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-32847
13 Nov 2024 — SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. ... An attacker can leverage this vulnerability to execute code in the context of the service account. • https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-49515 – Substance3D - Painter | Untrusted Search Path (CWE-426)
https://notcve.org/view.php?id=CVE-2024-49515
12 Nov 2024 — Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. • https://helpx.adobe.com/security/products/substance3d_painter/apsb24-86.html • CWE-426: Untrusted Search Path •
CVSS: 8.8EPSS: 0%CPEs: -EXPL: 1CVE-2024-8069 – Limited remote code execution with privilege of a NetworkService Account access
https://notcve.org/view.php?id=CVE-2024-8069
12 Nov 2024 — Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server • https://github.com/XiaomingX/cve-2024-8069-exp-Citrix-Virtual-Apps-XEN • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-49050 – Visual Studio Code Python Extension Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-49050
12 Nov 2024 — Visual Studio Code Python Extension Remote Code Execution Vulnerability • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49050 • CWE-501: Trust Boundary Violation •