VulDB Recent Entries

A vulnerability was found in Silabs EFR32 BLE SDK up to 7.1.1/8.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to incorrect synchronization. This vulnerability is uniquely identified as CVE-2024-6657. The attack needs to be done within the local network. There is no exploit available.

A vulnerability was found in GitLab Community Edition and Enterprise Edition up to 17.2.8/17.3.4/17.4.1 and classified as problematic. Affected by this issue is some unknown functionality of the component Pipeline Handler. The manipulation leads to incorrect authorization. This vulnerability is handled as CVE-2024-8970. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in GitLab Enterprise Edition up to 17.2.8/17.3.4/17.4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Pipeline Handler. The manipulation leads to missing authentication. This vulnerability is known as CVE-2024-9164. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in GitLab Enterprise Edition up to 17.2.8/17.3.4/17.4.1. Affected is an unknown function of the component API. The manipulation leads to incorrect provision of specified functionality. This vulnerability is traded as CVE-2024-5005. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in parisneo lollms-webui. This issue affects the function add_rag_database/toggle_mount_rag_database/vectorize_folder of the file lollms_file_system.py of the component SQLite File Handler. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2024-6971. The attack needs to be approached locally. There is no exploit available.

A vulnerability classified as problematic was found in posimyththemes Plus Addons for Elementor Plugin up to 5.6.11 on WordPress. This vulnerability affects the function render of the file modules/widgets/tp_accordion.php of the component Template Data Handler. The manipulation leads to information disclosure. This vulnerability was named CVE-2024-8913. The attack can be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in bitpressadmin Contact Form Plugin up to 2.15.2 on WordPress. This affects the function iconUpload of the component Arbitrary File Handler. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2024-9507. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been rated as problematic. Affected by this issue is some unknown functionality of the component System Settings Page. The manipulation of the argument Login Interface Copyright leads to cross site scripting. This vulnerability is handled as CVE-2024-9856. The attack may be launched remotely. Furthermore, there is an exploit available. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.

A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been declared as critical. Affected by this vulnerability is the function uploadFile of the file /admin/SysModule/upload/ajaxmodel/upload/uploadfilepath/sysmodule_1 of the component Module Plug-In Handler. The manipulation of the argument file leads to unrestricted upload. This vulnerability is known as CVE-2024-9855. The attack can be launched remotely. Furthermore, there is an exploit available. The affected product is known with different names like 07FLYCMS, 07FLY-CMS, and 07FlyCRM. It was not possible to reach out to the vendor before assigning a CVE due to a not working mail address.

A vulnerability was found in ShopLentor Plugin up to 2.9.8 on WordPress. It has been classified as problematic. Affected is an unknown function of the component FAQ Widget Elementor Template. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2024-9538. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Comments Import & Export Plugin up to 2.3.7 on WordPress and classified as critical. This issue affects some unknown processing. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2024-7514. The attack may be initiated remotely. There is no exploit available.

A vulnerability has been found in Open Cluster Management and classified as problematic. This vulnerability affects unknown code of the component cluster-manager. The manipulation leads to permission issues. This vulnerability was named CVE-2024-9779. Access to the local network is required for this attack to succeed. There is no exploit available.

A vulnerability, which was classified as problematic, was found in GitHub Enterprise Server up to 3.11.15/3.12.9/3.13.4/3.14.1. This affects an unknown part of the component SAML SSO. The manipulation leads to improper verification of cryptographic signature. This vulnerability is uniquely identified as CVE-2024-9487. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Snipe-IT up to 7.0.9. Affected by this issue is some unknown functionality. The manipulation of the argument APP_KEY leads to Privilege Escalation. This vulnerability is handled as CVE-2024-48987. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Gradio up to 4.x. Affected by this vulnerability is the function async_save_url_to_cache of the file /queue/join of the component Video Component. The manipulation leads to server-side request forgery. This vulnerability is known as CVE-2024-47167. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Gradio up to 4.x. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2024-47872. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in HashiCorp Vault and Vault Enterprise. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to incorrect privilege assignment. The identification of this vulnerability is CVE-2024-9180. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in jsonpath-plus up to 9.x. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to code injection. This vulnerability was named CVE-2024-21534. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Gradio up to 4.43. It has been classified as critical. This affects an unknown part. The manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2024-47084. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Gradio up to 4.x and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument localhost_aliases leads to improper authorization. This vulnerability is handled as CVE-2024-47165. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.