CVE-2024-6418A vulnerability classified as critical has been found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file /classes/Users.php?f=register_user. Th…
6.9 MOYENNE
CVE-2024-6417A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin…
5.3 MOYENNE
CVE-2024-6416A vulnerability was found in SeaCMS 12.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /js/player/dmplayer/dmku/?ac=edit…
5.3 MOYENNE
CVE-2024-34703Les applications utilisant la bibliothèque de cryptographie Botan (versions antérieures à 2.19.4 et 3.3.0) sont vulnérables à une attaque par déni de service. Un attaquant distant …
7.5 ÉLEVÉE
CVE-2024-28794IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int…
5.4 MOYENNE
CVE-2023-50964IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int…
5.4 MOYENNE
CVE-2024-31898IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references…
5.4 MOYENNE
CVE-2024-28797IBM InfoSphere Information Server 11.7 is vulnerable stored to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering …
6.4 MOYENNE
CVE-2023-50953IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be…
5.4 MOYENNE
CVE-2023-50952IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, …
5.4 MOYENNE
CVE-2024-35119IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This inf…
5.3 MOYENNE
CVE-2024-31902IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a us…
4.3 MOYENNE
CVE-2024-28798IBM InfoSphere Information Server 11.7 est affecté par une faille de cross-site scripting (XSS) stockée dans son interface utilisateur Web. Un attaquant peut injecter à distance du…
7.2 ÉLEVÉE
CVE-2023-50954IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force ID: 275776.
4.3 MOYENNE
CVE-2024-5062A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web pa…
6.1 MOYENNE
CVE-2024-28795IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int…
5.4 MOYENNE
CVE-2023-35022IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254.
3.3 FAIBLE
CVE-2024-6415A vulnerability classified as problematic was found in Ingenico Estate Manager 2023. Affected by this vulnerability is an unknown functionality of the file /emgui/rest/preferences/…
5.1 MOYENNE
CVE-2024-6414A vulnerability classified as problematic has been found in Parsec Automation TrakSYS 11.x.x. Affected is an unknown function of the file TS/export/contentpage of the component Exp…
6.9 MOYENNE
CVE-2024-5926Toutes les versions de l'agent IA Devika sont affectées par une faille de traversée de répertoire (path traversal) dans la gestion des fichiers de projet. Un attaquant distant non …
9.1 CRITIQUE
CVE-2024-39848Internet2 Grouper (versions antérieures à 5.6) et Grouper for Web Services (versions antérieures à 4.13.1) sont concernés s'ils utilisent l'authentification LDAP. Un attaquant peut…
9.1 CRITIQUE
CVE-2024-39846NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOTE: in each case, data…
3.5 FAIBLE
CVE-2024-39840Les clients Factorio utilisant des versions antérieures à la 1.1.101 sont vulnérables à l'exécution de code à distance lors de la connexion à un serveur malveillant. En rejoignant …
8.8 ÉLEVÉE
CVE-2024-2386Les sites WordPress utilisant l'extension WP MAPS (version 4.6.1 et versions antérieures) sont vulnérables à une attaque par injection SQL. Un utilisateur authentifié disposant de …
8.8 ÉLEVÉE
CVE-2024-25943Dell iDRAC9 (versions antérieures à 7.00.00.172 pour la 14e génération et 7.10.50.00 pour la 15e/16e génération) est susceptible de subir un détournement de session via IPMI. Un at…
7.6 ÉLEVÉE
CVE-2023-4017The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameters in versions up to, and including, 1…
6.1 MOYENNE
CVE-2024-5819The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versi…
6.4 MOYENNE
CVE-2024-6363The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortcode in all versions up to, and including, 3.24.4 due to insuf…
6.4 MOYENNE
CVE-2024-5790The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin's Gradient Heading widget in all versions…
6.4 MOYENNE
CVE-2024-5666The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the EE Button widget in all versions up to, and includ…
6.4 MOYENNE
CVE-2024-6265Les sites WordPress utilisant l'extension UsersWP (version 1.2.10 et versions antérieures) sont vulnérables à une faille d'injection SQL. Un attaquant non authentifié peut envoyer …
9.8 CRITIQUE
CVE-2024-5942The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to mis…
4.3 MOYENNE
CVE-2024-5889The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘country’ parameter in all versions up to, …
6.1 MOYENNE
CVE-2024-5598Les sites WordPress utilisant l'extension Advanced File Manager (version 5.2.4 et versions antérieures) sont susceptibles de subir une exposition non autorisée de données. Un attaq…
7.5 ÉLEVÉE
CVE-2024-5192The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells plugin for WordPress is vulnerable to St…
6.4 MOYENNE
CVE-2024-6405The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce va…
6.1 MOYENNE
CVE-2019-25211Les applications web utilisant le middleware CORS du framework Gin-Gonic (versions antérieures à 1.6.0) sont vulnérables à un contournement de la validation de l'origine. Un attaqu…
9.1 CRITIQUE
CVE-2024-37371Les installations MIT Kerberos 5 sont affectées par une faille dans la manière dont les jetons de message GSS sont traités. Un attaquant distant et non authentifié peut envoyer un …
9.1 CRITIQUE
CVE-2024-39828R74n Sandboxels 1.9 through 1.9.5 allows XSS via a message in a modified saved-game file. This was fixed in a hotfix to 1.9.5 on 2024-06-29.
6.1 MOYENNE
CVE-2024-38533ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access due to the addresses used to access the stack not properly …
6.5 MOYENNE
CVE-2024-38532affecte l'implémentation de référence `dcp_tool` utilisée avec les modules matériels NXP Data Co-Processor. Un attaquant disposant d'identifiants utilisateur de bas niveau et d'un …
7.1 ÉLEVÉE
CVE-2024-38525Les applications utilisant la bibliothèque `dd-trace-cpp` de Datadog sont susceptibles de planter si elles reçoivent du Unicode malformé dans leur contexte de trace. Un attaquant n…
7.5 ÉLEVÉE
CVE-2024-37370Les systèmes utilisant MIT Kerberos 5 avant la version 1.21.3 sont vulnérables à une faille permettant à un attaquant de modifier un champ spécifique dans un jeton réseau confident…
7.5 ÉLEVÉE
CVE-2024-39307Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing context. Kavita doesn't sanitize or sandbox th…
3.5 FAIBLE
CVE-2024-39302BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the…
3.7 FAIBLE
CVE-2024-38518BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into g…
4.6 MOYENNE
CVE-2024-29040This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by F…
4.3 MOYENNE
CVE-2024-5827Les utilisateurs de Vanna v0.3.4 utilisant l'intégration DuckDB sont exposés à un risque d'attaque par injection SQL via les API Web Flask. Un attaquant distant non authentifié peu…
9.8 CRITIQUE
CVE-2024-5712Les utilisateurs de l'application Devika AI sont affectés par une faille qui permet à un attaquant d'inciter un utilisateur connecté à effectuer des actions non autorisées, comme l…
8.1 ÉLEVÉE
CVE-2024-3995In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.
2.0 FAIBLE