Total
395538 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-47947 | 2026-06-17 | N/A | 4.7 MEDIUM | ||
| Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function which is available at the URL https://$SCANNER/cgi/admin.cgi?-rdisclaimer+-apre The stored Javascript payload will be executed every time the ScanWizard is loaded, even in the Kiosk-mode browser. | |||||
| CVE-2024-47946 | 2026-06-17 | N/A | 7.2 HIGH | ||
| If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as "www-data". | |||||
| CVE-2024-47945 | 1 Rittal | 4 Cmc Iii Processing Units, Cmc Iii Processing Units Firmware, Iot Interface and 1 more | 2026-06-17 | N/A | 9.8 CRITICAL |
| The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions. This is not only due to the use of an (insecure) rand() function call but also because of missing initialization via srand(). As a result only the PIDs are effectively used as seed. | |||||
| CVE-2024-47944 | 2026-06-17 | N/A | 6.8 MEDIUM | ||
| The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function. | |||||
| CVE-2024-47943 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the firmware and is freely available for download. This allows crafting malicious "signed" .patch files in order to compromise the device and execute arbitrary code. | |||||
| CVE-2024-47942 | 1 Siemens | 1 Solid Edge Se2024 | 2026-06-17 | N/A | 7.3 HIGH |
| A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications suffer from a DLL hijacking vulnerability. This could allow an attacker to execute arbitrary code via placing a crafted DLL file on the system. | |||||
| CVE-2024-47941 | 1 Siemens | 1 Solid Edge Se2024 | 2026-06-17 | N/A | 7.8 HIGH |
| A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process. | |||||
| CVE-2024-47940 | 1 Siemens | 1 Solid Edge Se2024 | 2026-06-17 | N/A | 7.8 HIGH |
| A vulnerability has been identified in Solid Edge SE2024 (All versions < V224.0 Update 9). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process. | |||||
| CVE-2024-47939 | 2026-06-17 | N/A | 7.7 HIGH | ||
| Stack-based buffer overflow vulnerability exists in multiple laser printers and MFPs which implement Ricoh Web Image Monitor. If this vulnerability is exploited, receiving a specially crafted request created and sent by an attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition. As for the details of affected product names and versions, refer to the information provided by the vendors under [References]. | |||||
| CVE-2024-47935 | 2026-06-17 | N/A | 6.7 MEDIUM | ||
| Improper Validation of Integrity Check Value vulnerability in TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock allows an attacker to escalate their privileges in the victim’s device. The attacker needs to hijack the DLL file in advance. This issue affects StellarProtect (Legacy Mode): before 3.2; StellarEnforce: before 3.2; Safe Lock: from 3.0.0 before 3.1.1076. *Note: StellarProtect (Legacy Mode) is the new name for StellarEnforce, they are the same product. | |||||
| CVE-2024-47934 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| Improper Input Validation vulnerability in Management Program in TXOne Networks Portable Inspector and Portable Inspector Pro Edition allows remote attacker to crash management service. The Denial of Service situation can be resolved by restarting the management service. This issue affects Portable Inspector: through 1.0.0; Portable Inspector Pro Edition: through 1.0.0. | |||||
| CVE-2024-47926 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | |||||
| CVE-2024-47925 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2024-47924 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2024-47923 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | |||||
| CVE-2024-47922 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor | |||||
| CVE-2024-47921 | 2026-06-17 | N/A | 8.4 HIGH | ||
| Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm | |||||
| CVE-2024-47920 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2024-47919 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | |||||
| CVE-2024-47918 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | |||||