Export limit exceeded: 29932 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (29932 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-5755 | 1 Lunary | 1 Lunary | 2024-11-21 | 5.3 Medium |
| In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., 'attacker123@gmail.com' and 'attacker.123@gmail.com'), leading to incorrect synchronization and potential security issues. | ||||
| CVE-2024-5735 | 1 Admiror-design-studio | 1 Admirorframes | 2024-11-21 | 7.5 High |
| Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0. | ||||
| CVE-2024-5661 | 1 Citrix | 2 Hypervisor, Xenserver | 2024-11-21 | 6 Medium |
| An issue has been identified in both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR which may allow a malicious administrator of a guest VM to cause the host to become slow and/or unresponsive. | ||||
| CVE-2024-5464 | 1 Huawei | 2 Emui, Harmonyos | 2024-11-21 | 4 Medium |
| Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2024-5389 | 1 Lunary | 1 Lunary | 2024-11-21 | 8.1 High |
| In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the requesting user. As a result, unauthorized modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper authorization. This vulnerability impacts the integrity and consistency of dataset information, potentially affecting the results of experiments. | ||||
| CVE-2024-45411 | 1 Symfony | 1 Twig | 2024-11-21 | 8.6 High |
| Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0. | ||||
| CVE-2024-45272 | 2 Helmholz, Mbconnectline | 25 Myrex24.virtual, Myrex24 V2, Myrex24 V2 Virtual Server and 22 more | 2024-11-21 | 7.5 High |
| An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. | ||||
| CVE-2024-41828 | 1 Jetbrains | 1 Teamcity | 2024-11-21 | 2.6 Low |
| In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time | ||||
| CVE-2024-41703 | 1 Librechat | 1 Librechat | 2024-11-21 | 5.4 Medium |
| LibreChat through 0.7.4-rc1 has incorrect access control for message updates. | ||||
| CVE-2024-41684 | 1 Syrotech | 2 Sy-gpon-1110-wdont, Sy-gpon-1110-wdont Firmware | 2024-11-21 | 5.3 Medium |
| This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management interface. An attacker with remote access could exploit this by intercepting transmission within an HTTP session on the vulnerable system. Successful exploitation of this vulnerability could allow the attacker to capture cookies and compromise the targeted system. | ||||
| CVE-2024-3099 | 1 Lfprojects | 1 Mlflow | 2024-11-21 | 5.4 Medium |
| A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts. | ||||
| CVE-2024-39743 | 1 Ibm | 1 Mq Operator | 2024-11-21 | 5.9 Medium |
| IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 IBM MQ Container Developer Edition is vulnerable to denial of service caused by incorrect memory de-allocation. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 297172. | ||||
| CVE-2024-39671 | 1 Huawei | 2 Emui, Harmonyos | 2024-11-21 | 9.3 Critical |
| Access control vulnerability in the security verification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2024-39375 | 1 Markoni | 4 Markoni-d \(compact\), Markoni-d \(compact\) Firmware, Markoni-dh \(exciter\+amplifiers\) and 1 more | 2024-11-21 | 9.8 Critical |
| TELSAT marKoni FM Transmitters are vulnerable to an attacker bypassing authentication and gaining administrator privileges. | ||||
| CVE-2024-39361 | 1 Mattermost | 1 Mattermost | 2024-11-21 | 3.1 Low |
| Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5 fail to prevent users from specifying a RemoteId for their posts which allows an attacker to specify both a remoteId and the post ID, resulting in creating a post with a user-defined post ID. This can cause some broken functionality in the channel or thread with user-defined posts | ||||
| CVE-2024-39325 | 1 Aimeos | 1 Aimeos Frontend Controller | 2024-11-21 | 5.3 Medium |
| aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue. | ||||
| CVE-2024-39303 | 1 Weblate | 1 Weblate | 2024-11-21 | 4.4 Medium |
| Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects. | ||||
| CVE-2024-39210 | 2 Best House Rental Management System, Mayurik | 2 Best House Rental Management System, Best House Rental Management System | 2024-11-21 | 7.5 High |
| Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. This vulnerability allows attackers to read arbitrary PHP files and access other sensitive information within the application. | ||||
| CVE-2024-38367 | 1 Cocoapods | 1 Trunk.cocoapods.org | 2024-11-21 | 8.2 High |
| trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023. | ||||
| CVE-2024-37677 | 2 Access Management Specialist Project, Shenzhenweitillage | 2 Access Management Specialist, Access Management Specialist | 2024-11-21 | 7.5 High |
| An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitive information. | ||||