Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2024-09-12 CVE-2024-28991 SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability.
low complexity
CWE-502
critical
 9.0
9.0
2024-09-12 CVE-2024-8522 The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
network
low complexity
CWE-89
critical
 10.0
10
2024-09-12 CVE-2024-8529 The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
network
low complexity
CWE-89
critical
 10.0
10
2024-09-12 CVE-2024-29847 Deserialization of Untrusted Data vulnerability in Ivanti Endpoint Manager
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
network
low complexity
ivanti CWE-502
critical
 9.8
9.8
2024-09-11 CVE-2019-25212 The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.
network
low complexity
CWE-89
critical
 9.1
9.1
2024-09-11 CVE-2024-8277 The WooCommerce Photo Reviews Premium plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.3.13.2.
network
low complexity
CWE-288
critical
 9.8
9.8
2024-09-10 CVE-2024-8191 SQL Injection vulnerability in Ivanti Endpoint Manager
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
network
low complexity
ivanti CWE-89
critical
 9.8
9.8
2024-09-10 CVE-2024-38220 Azure Stack Hub Elevation of Privilege Vulnerability
network
low complexity
CWE-284
critical
 9.0
9.0
2024-09-10 CVE-2024-43491 Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015).
network
low complexity
critical
 9.8
9.8
2024-09-10 CVE-2024-6596 An unauthenticated remote attacker can run malicious c# code included in curve files and execute commands in the users context.
network
low complexity
CWE-94
critical
 9.8
9.8