CVE-Datenbank
Archiv bekannter Schwachstellen (CVEs) mit CVSS-Wert, Schweregrad, betroffenen Produkten und Herstellern. Nach Jahr und Schweregrad filterbar.
- CVE-2024-40766Kritisch9.8
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
- CVE-2024-39717Hoch7.2
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
- CVE-2024-28987Kritisch9.1
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
- CVE-2024-7971Kritisch9.6
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-7965Hoch8.8
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CVE-2024-28000Kritisch9.8
Fehlerhafte Privilegienzuteilung-Schwachstelle in LiteSpeed Technologies LiteSpeed Cache litespeed-cache. Dieses Problem betrifft LiteSpeed Cache: von n/a bis <= 6.3.0.1.
- CVE-2024-7262Hoch7.8
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
- CVE-2024-28986Kritisch9.8
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
- CVE-2024-7593Kritisch9.8
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
- CVE-2024-38213Mittel6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
- CVE-2024-38193Hoch7.8
Windows Ancillary Function Driver for WinSock Schwachstelle zur Erhöhung von Berechtigungen
- CVE-2024-38189Hoch8.8
Microsoft Project Remote Code Execution Vulnerability
- CVE-2024-38178Hoch7.5
Scripting Engine Memory Corruption Vulnerability
- CVE-2024-38107Hoch7.8
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
- CVE-2024-38106Hoch7.0
Windows Kernel Elevation of Privilege Vulnerability
- CVE-2024-41710Hoch7.2
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.
- CVE-2024-27443Mittel6.1
In Zimbra Collaboration (ZCS) 9.0 und 10.0 wurde ein Problem entdeckt. Eine Cross-Site Scripting (XSS)-Schwachstelle besteht in der CalendarInvite-Funktion der Zimbra webmail classic-Benutzeroberfläche aufgrund unzureichender Eingabevalidierung bei der Verarbeitung des Kalender-Headers. Ein Angreifer kann dies über eine E-Mail-Nachricht ausnutzen, die einen präparierten Kalender-Header mit eingebetteter XSS-Payload enthält. Wenn ein Opfer diese Nachricht in der Zimbra webmail classic-Oberfläche betrachtet, wird die Payload im Kontext der Sitzung des Opfers ausgeführt, was möglicherweise zur Ausführung von beliebigem JavaScript-Code führt.
- CVE-2024-7694Hoch7.2
ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.
- CVE-2024-7399Hoch8.8
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.
- CVE-2024-42009Kritisch9.3
Eine Cross-Site-Scripting-Schwachstelle in Roundcube bis 1.5.7 und 1.6.x bis 1.6.7 ermöglicht es einem Remote-Angreifer, E-Mails eines Opfers zu stehlen und zu versenden, mittels einer präparierten E-Mail-Nachricht, die ein Desanitization-Problem in message_body() in program/actions/mail/show.php ausnutzt.
This product uses the NVD API but is not endorsed or certified by the NVD.