Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2024-53438 |
Description: EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.
EPSS Score: 0.04%
November 28th, 2024 (5 months ago)
|
|
CVE-2024-53264 |
Description: bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS: MEDIUM (5.1) EPSS Score: 0.06%
November 28th, 2024 (5 months ago)
|
|
CVE-2024-53260 |
Description: Autolab is a course management service that enables auto-graded programming assignments. A user can modify their first and or last name to include a valid excel / spreadsheet formula. When an instructor downloads their course's roster and opens, this name will then be evaluated as a formula. This could lead to leakage of information of students in the course roster by sending the data to a remote endpoint. This issue has been patched in the source code repository and the fix is expected to be released in the next version. Users are advised to manually patch their systems or to wait for the next release. There are no known workarounds for this vulnerability.
CVSS: MEDIUM (6.8) EPSS Score: 0.04%
November 28th, 2024 (5 months ago)
|
|
CVE-2024-52959 |
Description: A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.
CVSS: CRITICAL (9.3) EPSS Score: 0.04%
November 28th, 2024 (5 months ago)
|
|
CVE-2024-52958 |
Description: A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.
CVSS: CRITICAL (9.3) EPSS Score: 0.04%
November 28th, 2024 (5 months ago)
|
|
CVE-2024-52951 |
Description: Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History
EPSS Score: 0.05%
November 28th, 2024 (5 months ago)
|
|
CVE-2024-52787 |
|
|
CVE-2024-52771 |
|
|
CVE-2024-52726 |
|
|
CVE-2024-52323 |
Description: Zohocorp ManageEngine Analytics Plus versions below 6100 are vulnerable to authenticated sensitive data exposure which allows the users to retrieve sensitive tokens associated to the org-admin account.
CVSS: HIGH (8.1) EPSS Score: 0.04%
November 28th, 2024 (5 months ago)
|