Live feed · cooey

2025-04-24 NVD CVE

CVE-2025-31324: SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper a CRITICAL ◈ 2 sources · orig. NVD CVE

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host...

2025-04-20 NVD CVE

CVE-2025-43955: TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons- LOW

TwsCachedXPathAPI in Convertigo versions before 8.3.11 did not restrict commons-jxpath functions, which could allow expression injection in contexts where an attacker can influence an evaluated XPath expression....

2025-04-07 NVD CVE

CVE-2025-3248: Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/ CRITICAL ◈ 2 sources · orig. NVD CVE

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

2025-04-03 NVD CVE

CVE-2025-22457: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, CRITICAL ◈ 2 sources · orig. NVD CVE

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker...

2025-02-27 NVD CVE

CVE-2024-10918: Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflo MEDIUM

Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to overflow the buffer allocated for the Modbus response if the function tries to reply to a Modbus request with an unexpected length.

2025-01-23 NVD CVE

CVE-2025-23006: Pre-authentication deserialization of untrusted data vulnerability has been iden CRITICAL ◈ 2 sources · orig. NVD CVE

Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could...

2025-01-16 NVD CVE

CVE-2024-48885: A improper limitation of a pathname to a restricted directory ('path traversal') MEDIUM

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4,...

2025-01-14 NVD CVE

CVE-2024-55591: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-2 CRITICAL ◈ 2 sources · orig. NVD CVE

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote...

2025-01-14 NVD CVE

CVE-2024-35276: A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 thro MEDIUM

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through 7.0.12, FortiAnalyzer 6.4.0 through 6.4.14, FortiAnalyzer...

2025-01-14 NVD CVE

CVE-2024-48884: A improper limitation of a pathname to a restricted directory ('path traversal') HIGH

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3,...

2025-01-09 NVD CVE

CVE-2024-53704: An Improper Authentication vulnerability in the SSLVPN authentication mechanism CRITICAL ◈ 2 sources · orig. NVD CVE

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.

2025-01-08 NVD CVE

CVE-2025-0282: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, CRITICAL ◈ 2 sources · orig. NVD CVE

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote...

2024-12-13 NVD CVE

CVE-2024-55956: In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5. CRITICAL ◈ 2 sources · orig. NVD CVE

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the...

2024-11-27 NVD CVE

CVE-2024-11667: A directory traversal vulnerability in the web management interface of Zyxel ATP HIGH ◈ 2 sources · orig. NVD CVE

A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series...

2024-11-26 NVD CVE

CVE-2024-11680: ProjectSend versions prior to r1720 are affected by an improper authentication v CRITICAL ◈ 2 sources · orig. NVD CVE

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling...

2024-11-22 NVD CVE

CVE-2024-52723: In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str f CRITICAL

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.

2024-11-19 NVD CVE

CVE-2024-52714: Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the f CRITICAL

Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime.

2024-11-18 NVD CVE

CVE-2024-0012: An authentication bypass in Palo Alto Networks PAN-OS software enables an unauth CRITICAL ◈ 2 sources · orig. NVD CVE

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative...

2024-10-29 NVD CVE

CVE-2024-51378: getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) CRITICAL ◈ 2 sources · orig. NVD CVE

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or...

2024-10-29 NVD CVE

CVE-2024-51567: upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before CRITICAL ◈ 2 sources · orig. NVD CVE

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing...

2024-10-28 NVD CVE

CVE-2024-50623: In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5. CRITICAL ◈ 2 sources · orig. NVD CVE

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

2024-10-21 NVD CVE

CVE-2024-41713: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiColl CRITICAL ◈ 2 sources · orig. NVD CVE

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input...

2024-10-20 NVD CVE

CVE-2024-49604: Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Medi CRITICAL

Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.

2024-10-09 NVD CVE

CVE-2024-9680: An attacker was able to achieve code execution in the content process by exploit CRITICAL ◈ 2 sources · orig. NVD CVE

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability...

2024-10-07 NVD CVE

CVE-2024-46446: Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct CRITICAL

Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of...

2024-09-25 NVD CVE

CVE-2024-6593: Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka CRITICAL

Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. An attacker that has...

2024-09-25 NVD CVE

CVE-2024-6592: An incorrect authorization vulnerability in the protocol communication between t CRITICAL

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS...

2024-09-19 NVD CVE

CVE-2024-33109: Directory Traversal in the web interface of the Tiptel IP 286 with firmware vers CRITICAL

Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.

2024-09-17 NVD CVE

CVE-2024-44004: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti CRITICAL

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.

2024-09-10 NVD CVE

CVE-2024-38194: An authenticated attacker can exploit an improper authorization vulnerability in HIGH

An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network.

2024-09-10 NVD CVE

CVE-2024-38216: Azure Stack Hub Elevation of Privilege Vulnerability HIGH

Azure Stack Hub Elevation of Privilege Vulnerability

2024-09-10 NVD CVE

CVE-2024-21416: Windows TCP/IP Remote Code Execution Vulnerability HIGH

Windows TCP/IP Remote Code Execution Vulnerability

2024-09-10 NVD CVE

CVE-2024-37341: Microsoft SQL Server Elevation of Privilege Vulnerability HIGH

Microsoft SQL Server Elevation of Privilege Vulnerability

2024-09-10 NVD CVE

CVE-2024-37980: Microsoft SQL Server Elevation of Privilege Vulnerability HIGH

Microsoft SQL Server Elevation of Privilege Vulnerability

2024-09-10 NVD CVE

CVE-2024-43455: Windows Remote Desktop Licensing Service Spoofing Vulnerability HIGH

Windows Remote Desktop Licensing Service Spoofing Vulnerability

2024-09-10 NVD CVE

CVE-2024-38240: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability HIGH

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

2024-09-10 NVD CVE

CVE-2024-38225: Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability HIGH

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

2024-09-09 NVD CVE

CVE-2024-44902: A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to CRITICAL

A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

2024-08-29 NVD CVE

CVE-2024-44777: A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the CRITICAL

A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.

2024-08-29 NVD CVE

CVE-2024-44778: A reflected cross-site scripting (XSS) vulnerability in the parent parameter in CRITICAL

A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.