CVE Arsenal Intel

CVE-2024-4885

🔥 KEV WhatsUp Gold General ⚡ nuclei

9.8

CRITICAL

EPSS

94.3%

2024 CWE-22 1 PoC

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

nuclei -t CVE-2024-4885.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-52433

My Geo Posts Free General ⚡ nuclei

9.8

CRITICAL

EPSS

80.5%

2024 CWE-502 1 PoC

Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.

nuclei -t CVE-2024-52433.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-13161

🔥 KEV Endpoint Manager General ⚡ nuclei

9.8

CRITICAL

EPSS

91.3%

2024 CWE-36 1 PoC

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

nuclei -t CVE-2024-13161.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-24329

Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

83.3%

2024 0 PoCs

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.

nuclei -t CVE-2024-24329.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2024-27198

🔥 KEV TeamCity General ⚡ nuclei

9.8

CRITICAL

EPSS

93.0%

2024 CWE-288 19 PoCs

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

nuclei -t CVE-2024-27198.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +13 más 🔍 GCVE ⚔ EDB

CVE-2024-24882

Masteriyo - LMS General ⚡ nuclei

9.8

CRITICAL

EPSS

48.3%

2024 CWE-266 0 PoCs

Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.2.

nuclei -t CVE-2024-24882.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2024-44000

LiteSpeed Cache General ⚡ nuclei

9.8

CRITICAL

EPSS

92.8%

2024 CWE-522 6 PoCs

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

nuclei -t CVE-2024-44000.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 🔍 GCVE ⚔ EDB

CVE-2024-3408

man-group/dtale General ⚡ nuclei

9.8

CRITICAL

EPSS

90.5%

2024 CWE-798 0 PoCs

man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass aut

nuclei -t CVE-2024-3408.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2024-23917

TeamCity General ⚡ nuclei

9.8

CRITICAL

EPSS

72.9%

2024 CWE-288 0 PoCs

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

nuclei -t CVE-2024-23917.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2024-0799

Unified Data Protection General ⚡ nuclei

9.8

CRITICAL

EPSS

37.9%

2024 CWE-287 1 PoC

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.

nuclei -t CVE-2024-0799.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-50623

🔥 KEV Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

94.0%

2024 CWE-434 5 PoCs

In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.

nuclei -t CVE-2024-50623.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 🔍 GCVE ⚔ EDB

CVE-2024-31849

Connect General ⚡ nuclei

9.8

CRITICAL

EPSS

92.2%

2024 CWE-22 1 PoC

A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application.

nuclei -t CVE-2024-31849.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-34102

🔥 KEV Adobe Commerce General ⚡ nuclei

9.8

CRITICAL

EPSS

94.1%

2024 CWE-611 29 PoCs

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

nuclei -t CVE-2024-34102.yaml ⎘

↗ PoC 1 ↗ PoC 2 ↗ PoC 3 ↗ PoC 4 ↗ PoC 5 ↗ PoC 6 +23 más 🔍 GCVE ⚔ EDB

CVE-2024-50477

Stacks Mobile App Builder General ⚡ nuclei

9.8

CRITICAL

EPSS

82.2%

2024 CWE-288 1 PoC

Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.

nuclei -t CVE-2024-50477.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-45488

Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

86.9%

2024 0 PoCs

One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appliance installations (VMware or HyperV). The fixed versions are 7.0.5.1 LTS, 7.4.2, and 7.5.2.

nuclei -t CVE-2024-45488.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2024-13159

🔥 KEV Endpoint Manager General ⚡ nuclei

9.8

CRITICAL

EPSS

94.0%

2024 CWE-36 1 PoC

Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.

nuclei -t CVE-2024-13159.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-30568

Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

89.7%

2024 1 PoC

Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.

nuclei -t CVE-2024-30568.yaml ⎘

↗ PoC 1 🔍 GCVE ⚔ EDB

CVE-2024-24116

Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

88.9%

2024 0 PoCs

An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.

nuclei -t CVE-2024-24116.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2024-28986

🔥 KEV Web Help Desk General ⚡ nuclei

9.8

CRITICAL

EPSS

79.7%

2024 CWE-502 0 PoCs

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.

nuclei -t CVE-2024-28986.yaml ⎘

🔍 GCVE ⚔ EDB

CVE-2024-34257

Software Genérico General ⚡ nuclei

9.8

CRITICAL

EPSS

89.6%

2024 0 PoCs

TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges.

nuclei -t CVE-2024-34257.yaml ⎘

🔍 GCVE ⚔ EDB