Core Security Vulnerabilities

CVE-2024-38374

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java leverages XPath expressions to determine the schema version of the...

CVE-2024-38527

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment feature allows the...

CVE-2024-6206

A security vulnerability has been identified in HPE Athonet Mobile Core software. The core application contains a code injection vulnerability where a threat actor could execute arbitrary commands with the privilege of the underlying container leading to complete takeover of the target...

CVE-2023-38389

Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JupiterX Core: from n/a through...

CVE-2023-38394

Missing Authorization vulnerability in Artbees JupiterX Core.This issue affects JupiterX Core: from 3.0.0 through...

CVE-2024-21685

This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.4, allows an unauthenticated attacker to view sensitive information via an Information...

CVE-2024-36265

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or....

CVE-2024-36263

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that...

CVE-2024-35265

Windows Perception Service Elevation of Privilege...

CVE-2024-35250

Windows Kernel-Mode Driver Elevation of Privilege...

CVE-2024-30097

Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution...

CVE-2024-30095

Windows Routing and Remote Access Service (RRAS) Remote Code Execution...

CVE-2024-30099

Windows Kernel Elevation of Privilege...

CVE-2024-30096

Windows Cryptographic Services Information Disclosure...

CVE-2024-30089

Microsoft Streaming Service Elevation of Privilege...

CVE-2024-30090

Microsoft Streaming Service Elevation of Privilege...

CVE-2024-30093

Windows Storage Elevation of Privilege...

CVE-2024-30094

Windows Routing and Remote Access Service (RRAS) Remote Code Execution...

CVE-2024-30091

Win32k Elevation of Privilege...

CVE-2024-30087

Win32k Elevation of Privilege...

CVE-2024-30088

Windows Kernel Elevation of Privilege...

CVE-2024-30085

Windows Cloud Files Mini Filter Driver Elevation of Privilege...

CVE-2024-30086

Windows Win32 Kernel Subsystem Elevation of Privilege...

CVE-2024-30083

Windows Standards-Based Storage Management Service Denial of Service...

CVE-2024-30082

Win32k Elevation of Privilege...

CVE-2024-30080

Microsoft Message Queuing (MSMQ) Remote Code Execution...

CVE-2024-30084

Windows Kernel-Mode Driver Elevation of Privilege...

CVE-2024-30076

Windows Container Manager Service Elevation of Privilege...

CVE-2024-30075

Windows Link Layer Topology Discovery Protocol Remote Code Execution...

CVE-2024-30074

Windows Link Layer Topology Discovery Protocol Remote Code Execution...

CVE-2024-30077

Windows OLE Remote Code Execution...

CVE-2024-30078

Windows Wi-Fi Driver Remote Code Execution...

CVE-2024-30068

Windows Kernel Elevation of Privilege...

CVE-2024-30072

Microsoft Event Trace Log File Parsing Remote Code Execution...

CVE-2024-30069

Windows Remote Access Connection Manager Information Disclosure...

CVE-2024-30070

DHCP Server Service Denial of Service...

CVE-2024-30066

Winlogon Elevation of Privilege...

CVE-2024-30067

Winlogon Elevation of Privilege...

CVE-2024-30063

Windows Distributed File System (DFS) Remote Code Execution...

CVE-2024-30064

Windows Kernel Elevation of Privilege...

CVE-2024-30065

Windows Themes Denial of Service...

CVE-2024-30062

Windows Standards-Based Storage Management Service Remote Code Execution...

CVE-2024-37295

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version...

CVE-2024-37294

Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to...

CVE-2024-36419

SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the /legacy route. Version 8.6.1 contains a patch for the...

CVE-2024-33555

Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through...

CVE-2024-34554

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm Core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through...

CVE-2024-33557

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 8theme XStore Core allows PHP Local File Inclusion.This issue affects XStore Core: from n/a through...

CVE-2024-30212

If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM can be exposed. The same method works...

CVE-2024-36105

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Prior to versions 1.6.15, 1.7.15, and 1.8.1, Binding to INADDR_ANY (0.0.0.0) or IN6ADDR_ANY (::) exposes an application on all network interfaces, increasing.....