Critical-severity CVEs (page 97)
Page 97 of 100 — critical-severity CVEs, newest first, with CVSS scores and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47777 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavparse_smpl_chunk funct… |
CVE-2024-47776 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk within gstwavparse.c. Th… |
CVE-2024-47775 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 function within gstwavp… |
CVE-2024-47774 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_subtitle_parse_gab2_c… |
CVE-2024-47615 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis_setup_packet withi… |
CVE-2024-47613 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in `gst_gdk_pixbuf_de… |
CVE-2024-47607 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_parse_header function… |
CVE-2024-47606 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_parse_theora_extens… |
CVE-2024-47600 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been detected in the format_channel_mask function in… |
CVE-2024-47598 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been discovered in the qtdemux_merge_sample_table fu… |
CVE-2024-47597 | Critical | 9.1 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been detected in the function qtdemux_parse_samples within qtdemux… |
CVE-2024-47540 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst_matro… |
CVE-2024-47539 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. An out-of-bounds write vulnerability was identified in the convert_to_s334_1a func… |
CVE-2024-47538 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the `vorbis_handle_identification_pac… |
CVE-2024-47537 | Critical | 9.8 | 2024-12-12 | GStreamer is a library for constructing graphs of media-handling components. The program attempts to reallocate the memory pointed to by stream->samples to acc… |
CVE-2024-45337 | Critical | 9.1 | 2024-12-12 | Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorizatio… |
CVE-2024-42448 | Critical | 9.9 | 2024-12-12 | From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution… |
CVE-2024-11948 | Critical | 9.8 | 2024-12-12 | GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations… |
CVE-2024-53677 | Critical | 9.8 | 2024-12-11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lea… |
CVE-2024-11737 | Critical | 9.8 | 2024-12-11 | CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when a… |
CVE-2024-54036 | Critical | 9.3 | 2024-12-10 | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject… |
CVE-2024-54034 | Critical | 9.3 | 2024-12-10 | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a vict… |
CVE-2024-54032 | Critical | 9.3 | 2024-12-10 | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject… |
CVE-2024-53480 | Critical | 9.8 | 2024-12-10 | Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` parameter. |
CVE-2024-46340 | Critical | 9.8 | 2024-12-10 | TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing… |
CVE-2024-46442 | Critical | 9.8 | 2024-12-10 | An issue in the BYD Dilink Headunit System v3.0 to v4.0 allows attackers to bypass authentication via a bruteforce attack. |
CVE-2024-11773 | Critical | 9.1 | 2024-12-10 | SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL sta… |
CVE-2024-11772 | Critical | 9.1 | 2024-12-10 | Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote co… |
CVE-2024-11639 | Critical | 10.0 | 2024-12-10 | An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access |
CVE-2024-11634 | Critical | 9.1 | 2024-12-10 | Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with… |
CVE-2024-11633 | Critical | 9.1 | 2024-12-10 | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code executi… |
CVE-2024-53866 | Critical | 9.8 | 2024-12-10 | The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in gl… |
CVE-2024-12286 | Critical | 9.8 | 2024-12-10 | MOBATIME Network Master Clock - DTS 4801 allows attackers to use SSH to gain initial access using default credentials. |
CVE-2024-55547 | Critical | 9.8 | 2024-12-10 | SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e. |
CVE-2024-45494 | Critical | 9.8 | 2024-12-10 | An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has an internally used shared administrative u… |
CVE-2024-45493 | Critical | 9.8 | 2024-12-10 | An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). The FieldServer Gateway has internal users, whose access is supposed t… |
CVE-2024-54751 | Critical | 9.8 | 2024-12-10 | COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-5660 | Critical | 9.8 | 2024-12-10 | Use of Hardware Page Aggregation (HPA) and Stage-1 and/or Stage-2 translation on Cortex-A77, Cortex-A78, Cortex-A78C, Cortex-A78AE, Cortex-A710, Cortex-X1, Cor… |
CVE-2024-55586 | Critical | 9.8 | 2024-12-10 | Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the ve… |
CVE-2024-37143 | Critical | 10.0 | 2024-12-10 | Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to… |
CVE-2024-53552 | Critical | 9.8 | 2024-12-10 | CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover. |
CVE-2024-47578 | Critical | 9.1 | 2024-12-10 | Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to targ… |
CVE-2024-55638 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before… |
CVE-2024-55637 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55636 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-46455 | Critical | 9.8 | 2024-12-09 | unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. |
CVE-2024-53441 | Critical | 9.1 | 2024-12-09 | An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. |
CVE-2024-54934 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php. |
CVE-2024-54932 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php. |
CVE-2024-54931 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL com… |
CVE-2024-54925 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL co… |
CVE-2024-54924 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL com… |
CVE-2024-54923 | Critical | 9.8 | 2024-12-09 | A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arb… |
CVE-2024-54921 | Critical | 9.8 | 2024-12-09 | A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitrary SQL command… |
CVE-2024-54918 | Critical | 9.8 | 2024-12-09 | Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.php. |
CVE-2024-48956 | Critical | 9.8 | 2024-12-09 | Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint r… |
CVE-2022-38946 | Critical | 9.8 | 2024-12-09 | Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary code. |
CVE-2024-40583 | Critical | 9.1 | 2024-12-09 | Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials. |
CVE-2022-38947 | Critical | 9.8 | 2024-12-09 | SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary code. |
CVE-2024-54920 | Critical | 9.8 | 2024-12-09 | A SQL Injection vulnerability was found in /teacher_signup.php of kashipara E-learning Management System v1.0, which allows remote attackers to execute arbitra… |
CVE-2024-8259 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Manage… |
CVE-2024-53947 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific fu… |
CVE-2024-54215 | Critical | 9.3 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy.This issue affects Revy: from n/a throu… |
CVE-2024-53822 | Critical | 10.0 | 2024-12-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Genetech Pie Register Premium.This issue affects Pie Register Premium: from n/a before 3.8.3.3. |
CVE-2024-43222 | Critical | 9.8 | 2024-12-09 | Missing Authorization vulnerability in SeventhQueen Sweet Date sweetdate allows Privilege Escalation.This issue affects Sweet Date: from n/a through <= 3.7.3. |
CVE-2023-32117 | Critical | 9.8 | 2024-12-09 | Missing Authorization vulnerability in SoftLab Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-55564 | Critical | 9.8 | 2024-12-09 | The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow. |
CVE-2024-55560 | Critical | 9.8 | 2024-12-08 | MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation. |
CVE-2024-12209 | Critical | 9.8 | 2024-12-08 | The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via… |
CVE-2024-44852 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component theta_star::ThetaStar… |
CVE-2024-41650 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41649 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41648 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41647 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41646 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41645 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via a cra… |
CVE-2024-41644 | Critical | 9.8 | 2024-12-06 | Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbitrary code via the d… |
CVE-2024-38927 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38926 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38925 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38924 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38923 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-38922 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability… |
CVE-2024-38921 | Critical | 9.8 | 2024-12-06 | Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerabil… |
CVE-2024-52324 | Critical | 9.8 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT m… |
CVE-2024-48874 | Critical | 9.8 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could give attackers the ability to force Ruijie's proxy servers to perform any request the at… |
CVE-2024-52320 | Critical | 9.8 | 2024-12-06 | The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result… |
CVE-2024-48871 | Critical | 9.8 | 2024-12-06 | The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails t… |
CVE-2024-47547 | Critical | 9.4 | 2024-12-06 | Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication… |
CVE-2024-50393 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2024-50389 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We… |
CVE-2024-50388 | Critical | 9.8 | 2024-12-06 | An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to exe… |
CVE-2024-50387 | Critical | 9.8 | 2024-12-06 | A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers… |
CVE-2024-48863 | Critical | 9.8 | 2024-12-06 | A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary… |
CVE-2024-48859 | Critical | 9.1 | 2024-12-06 | An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote… |
CVE-2024-54750 | Critical | 9.8 | 2024-12-06 | Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. NOTE: In Ubiquiti'… |
CVE-2024-54747 | Critical | 9.8 | 2024-12-06 | WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-54745 | Critical | 9.8 | 2024-12-06 | WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-54136 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerabilit… |
CVE-2024-54135 | Critical | 9.8 | 2024-12-06 | ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulner… |