По дате публикации
Эксплуатируемые и новые серьёзные CVE: сентябрь 2024 г.
162 записей · 13 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
24Наблюдать | CVE-2024-7354Proof of concept | Ninja Forms 3.8.6-3.8.10 - Reflected XSSninjaforms · ninja forms · CWE-79 | Средняя6,1 | — | 0,7 % | 2 сент. 2024 г. |
31Наблюдать | CVE-2024-42471Proof of concept | Arbitrary File Write via artifact extraction in actions/artifactgithub · actions\/artifact · CWE-22 | Высокая7,5 | — | 3,2 % | 2 сент. 2024 г. |
22Наблюдать | CVE-2024-44947Proof of concept | fuse: Initialize beyond-EOF page contents before setting uptodatelinux · linux kernel · CWE-665 | Средняя5,5 | — | 0,8 % | 2 сент. 2024 г. |
47В плане | CVE-2024-45388Proof of concept | Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)hoverfly · hoverfly · CWE-200 | Высокая7,5 | — | 55,5 % | 2 сент. 2024 г. |
50В плане | CVE-2024-45622Proof of concept | ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication BypassCWE-89 | Критическая9,8 | — | 36,4 % | 2 сент. 2024 г. |
42В плане | CVE-2024-7261Эксплойта нет | The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4zyxel · nwa110ax firmware · CWE-78 | Критическая9,8 | — | 11,4 % | 2 сент. 2024 г. |
33Наблюдать | CVE-2024-6473Proof of concept | DLL Hijacking in Yandex Browseryandex · yandex browser · CWE-426 | Высокая8,4 | — | 0,7 % | 3 сент. 2024 г. |
31Наблюдать | CVE-2024-6232Proof of concept | Regular-expression DoS when parsing TarFile headerspython · python · CWE-1333 | Высокая7,5 | — | 2,2 % | 3 сент. 2024 г. |
40В плане | CVE-2024-8381Proof of concept | A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmenmozilla · firefox · CWE-843 | Критическая9,8 | — | 4,3 % | 3 сент. 2024 г. |
20Наблюдать | CVE-2024-34463Proof of concept | BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets.CWE-285 | Средняя5,1 | — | 0,6 % | 3 сент. 2024 г. |
50В плане | CVE-2024-6119Эксплойта нет | Possible denial of service in X.509 name checksopenssl · openssl · CWE-843 | Высокая7,5 | — | 66,5 % | 3 сент. 2024 г. |
40В плане | CVE-2024-6926Proof of concept | Viral Signup <= 2.1 - Unauthenticated SQLiwow-company · viral signup · CWE-89 | Критическая9,8 | — | 3,2 % | 4 сент. 2024 г. |
22Наблюдать | CVE-2024-7786Proof of concept | Sensei LMS < 4.24.2 - Unauthenticated Email Template Leakautomattic · sensei lms · CWE-862 | Средняя5,3 | — | 1,7 % | 4 сент. 2024 г. |
90Срочно | CVE-2024-45195Готовый эксплойт | Apache OFBiz: Confused controller-view authorization logic (forced browsing)apache · ofbiz · CWE-425 | Высокая7,5 | KEV | 99,9 % | 4 сент. 2024 г. |
67На этой неделе | CVE-2024-45507Proof of concept | Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCEapache · ofbiz · CWE-94 | Критическая9,8 | — | 93,2 % | 4 сент. 2024 г. |
39Наблюдать | CVE-2024-8289Proof of concept | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeovemultivendorx · multivendorx · CWE-862 | Критическая9,8 | — | 1,2 % | 4 сент. 2024 г. |
43В плане | CVE-2024-44400Эксплойта нет | A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical.dlink · di-8400 firmware · CWE-77 | Критическая9,8 | — | 14,4 % | 4 сент. 2024 г. |
98Срочно | CVE-2024-20439Готовый эксплойт | A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by uscisco · smart license utility · CWE-912 | Критическая9,8 | KEV | 97,0 % | 4 сент. 2024 г. |
46В плане | CVE-2024-20440Proof of concept | A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.cisco · smart license utility · CWE-532 | Высокая7,5 | — | 51,8 % | 4 сент. 2024 г. |
26Наблюдать | CVE-2024-42642Proof of concept | Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially craftedcrucial · mx500 firmware · CWE-787 | Средняя6,7 | — | 0,4 % | 4 сент. 2024 г. |
33Наблюдать | CVE-2024-7627Proof of concept | Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Conditionbitapps · file manager · CWE-94 | Высокая8,1 | — | 2,8 % | 4 сент. 2024 г. |
21Наблюдать | CVE-2024-6846Proof of concept | SmartSearchWP <= 2.4.4 - Unauthenticated Log Purgewebdigit · chatbot with chatgpt · CWE-862 | Средняя5,3 | — | 1,2 % | 5 сент. 2024 г. |
30Наблюдать | CVE-2024-8465Proof of concept | SQL injection vulnerability in Job Portalphpgurukul · job portal · CWE-89 | Высокая7,5 | — | 0,4 % | 5 сент. 2024 г. |
23Наблюдать | CVE-2024-45589Proof of concept | RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote atidentityautomation · rapididentity · CWE-307 | Средняя5,9 | — | 0,9 % | 5 сент. 2024 г. |
37Наблюдать | CVE-2024-24759Proof of concept | MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebindingmindsdb · mindsdb · CWE-918 | Критическая9,1 | — | 4,9 % | 5 сент. 2024 г. |
41В плане | CVE-2024-7591Proof of concept | Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injectionkemptechnologies · loadmaster · CWE-78 | Высокая7,2 | — | 43,8 % | 5 сент. 2024 г. |
67На этой неделе | CVE-2024-8517Готовый эксплойт | SPIP Bigup Multipart File Upload OS Command Injectionspip · spip · CWE-73 | Критическая9,8 | — | 94,6 % | 6 сент. 2024 г. |
35Наблюдать | CVE-2023-45038Proof of concept | An improper authentication vulnerability has been reported to affect Music Station.qnap · music station · CWE-287 | Высокая8,8 | — | 1,2 % | 6 сент. 2024 г. |
32Наблюдать | CVE-2024-36138Эксплойта нет | Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via childnodejs · node · CWE-77 | Высокая8,1 | — | 1,0 % | 7 сент. 2024 г. |
96Срочно | CVE-2024-40711Готовый эксплойт | A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).veeam · veeam backup \& replication · CWE-502 | Критическая9,8 | KEV | 90,3 % | 7 сент. 2024 г. |
40В плане | CVE-2024-6924Proof of concept | TrueBooker < 1.0.3 - Multiple Unauthenticated SQLithemetechmount · truebooker · CWE-89 | Критическая9,8 | — | 3,2 % | 8 сент. 2024 г. |
40В плане | CVE-2024-6928Proof of concept | Opti Marketing <= 2.0.9 - Unauthenticated SQLiopti.marketing · opti marketing · CWE-89 | Критическая9,8 | — | 3,2 % | 8 сент. 2024 г. |
39Наблюдать | CVE-2024-44333Эксплойта нет | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400CWE-78 | Высокая8,8 | — | 12,4 % | 9 сент. 2024 г. |
45В плане | CVE-2024-44334Эксплойта нет | D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400CWE-77 | Высокая8,8 | — | 31,7 % | 9 сент. 2024 г. |
39Наблюдать | CVE-2024-44335Эксплойта нет | D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v2CWE-77 | Высокая8,8 | — | 12,4 % | 9 сент. 2024 г. |
53В плане | CVE-2024-44849Proof of concept | Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.qualitor · qualitor · CWE-434 | Критическая9,8 | — | 46,2 % | 9 сент. 2024 г. |
40В плане | CVE-2024-44902Proof of concept | A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.thinkphp · thinkphp · CWE-502 | Критическая9,8 | — | 4,2 % | 9 сент. 2024 г. |
39Наблюдать | CVE-2024-44087Эксплойта нет | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SPsiemens · automation license manager v5 · CWE-190 | Критическая9,2 | — | 10,8 % | 10 сент. 2024 г. |
31Наблюдать | CVE-2024-37728Proof of concept | Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attackCWE-22 | Высокая7,5 | — | 1,8 % | 10 сент. 2024 г. |
30Наблюдать | CVE-2024-44867Proof of concept | phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.phpok · phpok · CWE-22 | Высокая7,5 | — | 1,0 % | 10 сент. 2024 г. |
18Наблюдать | CVE-2024-44815Proof of concept | Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Fhathway · skyworth cm5100-511 firmware · CWE-522 | Средняя4,6 | — | 0,6 % | 10 сент. 2024 г. |
30Наблюдать | CVE-2024-45590Proof of concept | body-parser vulnerable to denial of service when url encoding is enabledopenjsf · body-parser · CWE-405 | Высокая7,5 | — | 0,8 % | 10 сент. 2024 г. |
22Наблюдать | CVE-2024-45591Proof of concept | XWiki Platform document history including authors of any page exposed to unauthorized actorsxwiki · xwiki · CWE-359 | Средняя5,3 | — | 3,4 % | 10 сент. 2024 г. |
63На этой неделе | CVE-2024-38014Готовый эксплойт | Windows Installer Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-269 | Высокая7,8 | KEV | 6,2 % | 10 сент. 2024 г. |
50В плане | CVE-2024-38018Эксплойта нет | Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 | Высокая8,8 | — | 51,1 % | 10 сент. 2024 г. |
60На этой неделе | CVE-2024-38217Готовый эксплойт | Windows Mark of the Web Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1507 · CWE-693 | Средняя5,4 | KEV | 10,0 % | 10 сент. 2024 г. |
60На этой неделе | CVE-2024-38226Готовый эксплойт | Microsoft Publisher Security Feature Bypass Vulnerabilitymicrosoft · office 2019 · CWE-693 | Высокая7,3 | KEV | 2,6 % | 10 сент. 2024 г. |
35Наблюдать | CVE-2024-43454Эксплойта нет | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerabilitymicrosoft · windows server 2008 · CWE-23 | Высокая7,1 | — | 21,8 % | 10 сент. 2024 г. |
81Срочно | CVE-2024-43461Готовый эксплойт | Windows MSHTML Platform Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-451 | Высокая8,8 | KEV | 54,4 % | 10 сент. 2024 г. |
39Наблюдать | CVE-2024-43464Эксплойта нет | Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 | Высокая7,2 | — | 36,2 % | 10 сент. 2024 г. |
43В плане | CVE-2024-43491Эксплойта нет | Microsoft Windows Update Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 | Критическая9,8 | — | 12,9 % | 10 сент. 2024 г. |
33Наблюдать | CVE-2024-44871Proof of concept | An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via upmozilo · mozilocms · CWE-434 | Высокая7,2 | — | 16,2 % | 10 сент. 2024 г. |
24Наблюдать | CVE-2024-34831Proof of concept | cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter ingibbonedu · gibbon · CWE-79 | Средняя6,1 | — | 0,8 % | 10 сент. 2024 г. |
42В плане | CVE-2024-45409Proof of concept | The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectoronelogin · ruby-saml · CWE-347 | Критическая9,8 | — | 10,6 % | 10 сент. 2024 г. |
38Наблюдать | CVE-2024-8232Proof of concept | iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Typeininet solutions gmbh · spidercontrol scada web server · CWE-434 | Высокая8,7 | — | 13,0 % | 10 сент. 2024 г. |
63На этой неделе | CVE-2024-8503Готовый эксплойт | VICIdial Unauthenticated SQL Injectionvicidial · vicidial · CWE-89 | Критическая9,8 | — | 79,2 % | 10 сент. 2024 г. |
58В плане | CVE-2024-8504Готовый эксплойт | VICIdial Authenticated Remote Code Executionvicidial · vicidial · CWE-78 | Высокая8,8 | — | 76,2 % | 10 сент. 2024 г. |
85Срочно | CVE-2024-8190Готовый эксплойт | An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attivanti · cloud services appliance · CWE-78 | Высокая7,2 | KEV | 88,5 % | 10 сент. 2024 г. |
45В плане | CVE-2024-8191Эксплойта нет | SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attackerivanti · endpoint manager · CWE-89 | Критическая9,8 | — | 20,3 % | 10 сент. 2024 г. |
41В плане | CVE-2024-27115Proof of concept | Remote Code Execution through File Upload in SOPlanning before 1.52.02soplanning · soplanning · CWE-434 | Критическая10,0 | — | 4,6 % | 11 сент. 2024 г. |
35Наблюдать | CVE-2024-8636Proof of concept | Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via agoogle · chrome · CWE-122 | Высокая8,8 | — | 0,6 % | 11 сент. 2024 г. |
42В плане | CVE-2024-44466Эксплойта нет | COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4.comfast · cf-xr11 firmware · CWE-77 | Критическая9,8 | — | 10,7 % | 11 сент. 2024 г. |
40В плане | CVE-2024-44541Proof of concept | evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."CWE-89 | Критическая9,8 | — | 2,5 % | 11 сент. 2024 г. |
55В плане | CVE-2024-29847Proof of concept | Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthentiivanti · endpoint manager · CWE-502 | Критическая9,8 | — | 52,9 % | 11 сент. 2024 г. |
36Наблюдать | CVE-2024-32840Эксплойта нет | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 25,3 % | 11 сент. 2024 г. |
35Наблюдать | CVE-2024-32845Эксплойта нет | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 24,0 % | 11 сент. 2024 г. |
41В плане | CVE-2024-32848Эксплойта нет | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 43,3 % | 11 сент. 2024 г. |
35Наблюдать | CVE-2024-34779Эксплойта нет | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 24,0 % | 11 сент. 2024 г. |
41В плане | CVE-2024-34783Эксплойта нет | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 43,3 % | 11 сент. 2024 г. |
36Наблюдать | CVE-2024-34785Эксплойта нет | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 25,3 % | 11 сент. 2024 г. |
50В плане | CVE-2024-37397Эксплойта нет | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allowivanti · endpoint manager · CWE-611 | Высокая8,2 | — | 59,2 % | 11 сент. 2024 г. |
60На этой неделе | CVE-2024-8522Готовый эксплойт | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'thimpress · learnpress · CWE-89 | Высокая7,5 | — | 62,8 % | 12 сент. 2024 г. |
60На этой неделе | CVE-2024-8529Готовый эксплойт | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'thimpress · learnpress · CWE-89 | Высокая7,5 | — | 12,0 % | 12 сент. 2024 г. |
36Наблюдать | CVE-2024-40457Proof of concept | No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file.CWE-312 | Критическая9,1 | — | 0,6 % | 12 сент. 2024 г. |
38Наблюдать | CVE-2024-45826Эксплойта нет | ThinManager® Code Execution Vulnerabilityrockwellautomation · thinmanager · CWE-610 | Высокая8,5 | — | 12,3 % | 12 сент. 2024 г. |
42В плане | CVE-2024-8124Эксплойта нет | Inefficient Regular Expression Complexity in GitLabgitlab · gitlab · CWE-1333 | Высокая7,5 | — | 40,2 % | 12 сент. 2024 г. |
20Наблюдать | CVE-2024-45383Proof of concept | A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36microsoft · high definition audio bus driver · CWE-664 | Средняя5,0 | — | 1,5 % | 12 сент. 2024 г. |
36Наблюдать | CVE-2024-6678Proof of concept | Authentication Bypass by Spoofing in GitLabgitlab · gitlab · CWE-290 | Высокая8,8 | — | 1,9 % | 12 сент. 2024 г. |
25Наблюдать | CVE-2024-45607Эксплойта нет | whatsapp-api-js fails to validate message's signaturesecreto31126 · whatsapp-api-js · CWE-347 | Средняя5,3 | — | 14,4 % | 12 сент. 2024 г. |
34Наблюдать | CVE-2024-38816Proof of concept | CVE-2024-38816: Path traversal vulnerability in functional web frameworksspring · spring · CWE-22 | Высокая7,5 | — | 14,7 % | 13 сент. 2024 г. |
48В плане | CVE-2024-41874Эксплойта нет | ColdFusion | Deserialization of Untrusted Data (CWE-502)adobe · coldfusion · CWE-502 | Критическая9,8 | — | 30,3 % | 13 сент. 2024 г. |
42В плане | CVE-2024-46048Эксплойта нет | Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function itenda · fh451 firmware · CWE-77 | Критическая9,8 | — | 10,5 % | 13 сент. 2024 г. |
41В плане | CVE-2024-6587Proof of concept | SSRF in berriai/litellmlitellm · litellm · CWE-918 | Высокая7,5 | — | 35,3 % | 13 сент. 2024 г. |
39Наблюдать | CVE-2024-39924Эксплойта нет | An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.dani-garcia · vaultwarden · CWE-276 | Высокая8,8 | — | 13,3 % | 13 сент. 2024 г. |
33Наблюдать | CVE-2024-8669Эксплойта нет | Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injectionsoftaculous · backuply · CWE-89 | Высокая7,2 | — | 16,6 % | 14 сент. 2024 г. |
44В плане | CVE-2024-46938Proof of concept | An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release thrositecore · experience commerce · CWE-200 | Высокая7,5 | — | 46,7 % | 15 сент. 2024 г. |
39Наблюдать | CVE-2024-46451Proof of concept | TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.totolink · t8 firmware · CWE-120 | Критическая9,8 | — | 1,2 % | 16 сент. 2024 г. |
39Наблюдать | CVE-2024-44623Proof of concept | An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function.spx · spx graphics controller · CWE-94 | Критическая9,8 | — | 1,1 % | 16 сент. 2024 г. |
41В плане | CVE-2024-8752Proof of concept | WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerabilitysmart-hmi · webiq · CWE-22 | Критическая9,3 | — | 11,7 % | 16 сент. 2024 г. |
22Наблюдать | CVE-2024-27876Proof of concept | A race condition was addressed with improved locking.apple · ipados · CWE-362 | Средняя5,5 | — | 0,4 % | 16 сент. 2024 г. |
22Наблюдать | CVE-2024-40842Proof of concept | An issue was addressed with improved validation of environment variables.apple · macos · CWE-200 | Средняя5,5 | — | 0,2 % | 16 сент. 2024 г. |
24Наблюдать | CVE-2024-44133Proof of concept | This issue was addressed by removing the vulnerable code.apple · macos | Средняя5,5 | — | 7,6 % | 16 сент. 2024 г. |
85Срочно | CVE-2024-38812Готовый эксплойт | Heap-overflow vulnerabilityvmware · cloud foundation · CWE-122 | Критическая9,8 | KEV | 54,5 % | 17 сент. 2024 г. |
74На этой неделе | CVE-2024-38813Готовый эксплойт | Privilege escalation vulnerabilityvmware · cloud foundation · CWE-250 | Критическая9,8 | KEV | 17,3 % | 17 сент. 2024 г. |
26Наблюдать | CVE-2024-8945Proof of concept | CodeCanyon RISE Ultimate Project Manager save sql injectionfairsketch · rise ultimate project manager · CWE-89 | Средняя5,3 | — | 15,9 % | 17 сент. 2024 г. |
39Наблюдать | CVE-2024-45798Proof of concept | Multiple Poisoned Pipeline Execution (PPE) vulnerabilitiesespressif · arduino-esp32 · CWE-20 | Критическая9,9 | — | 0,8 % | 17 сент. 2024 г. |
21Наблюдать | CVE-2024-8949Proof of concept | SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership managementoretnom23 · online eyewear shop · CWE-282 | Средняя5,3 | — | 0,7 % | 17 сент. 2024 г. |
84Срочно | CVE-2024-8956Готовый эксплойт | PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authenticationptzoptics · pt30x-sdi firmware · CWE-306 | Критическая9,1 | KEV | 58,7 % | 17 сент. 2024 г. |
82Срочно | CVE-2024-8957Готовый эксплойт | PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configurationptzoptics · pt30x-sdi firmware · CWE-78 | Высокая7,2 | KEV | 79,8 % | 17 сент. 2024 г. |
48В плане | CVE-2024-46982Proof of concept | Cache Poisoning in next.jsvercel · next.js · CWE-639 | Высокая7,5 | — | 59,1 % | 17 сент. 2024 г. |
- CVE-2024-735424Наблюдать
Ninja Forms 3.8.6-3.8.10 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %ninjaforms · ninja forms2 сент. 2024 г.
- CVE-2024-4247131Наблюдать
Arbitrary File Write via artifact extraction in actions/artifact
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %github · actions\/artifact2 сент. 2024 г.
- CVE-2024-4494722Наблюдать
fuse: Initialize beyond-EOF page contents before setting uptodate
СредняяCVSS 5,5Proof of conceptEPSS 0 %linux · linux kernel2 сент. 2024 г.
- CVE-2024-4538847В плане
Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)
ВысокаяCVSS 7,5Proof of conceptEPSS 55 %hoverfly · hoverfly2 сент. 2024 г.
- CVE-2024-4562250В плане
ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 36 %2 сент. 2024 г.
- CVE-2024-726142В плане
The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %zyxel · nwa110ax firmware2 сент. 2024 г.
- CVE-2024-647333Наблюдать
DLL Hijacking in Yandex Browser
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %yandex · yandex browser3 сент. 2024 г.
- CVE-2024-623231Наблюдать
Regular-expression DoS when parsing TarFile headers
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %python · python3 сент. 2024 г.
- CVE-2024-838140В плане
A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmen
КритическаяCVSS 9,8Proof of conceptEPSS 4 %mozilla · firefox3 сент. 2024 г.
- CVE-2024-3446320Наблюдать
BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets.
СредняяCVSS 5,1Proof of conceptEPSS 0 %3 сент. 2024 г.
- CVE-2024-611950В плане
Possible denial of service in X.509 name checks
ВысокаяCVSS 7,5Эксплойта нетEPSS 66 %openssl · openssl3 сент. 2024 г.
- CVE-2024-692640В плане
Viral Signup <= 2.1 - Unauthenticated SQLi
КритическаяCVSS 9,8Proof of conceptEPSS 3 %wow-company · viral signup4 сент. 2024 г.
- CVE-2024-778622Наблюдать
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
СредняяCVSS 5,3Proof of conceptEPSS 1 %automattic · sensei lms4 сент. 2024 г.
- CVE-2024-4519590Срочно
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 99 %apache · ofbiz4 сент. 2024 г.
- CVE-2024-4550767На этой неделе
Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE
КритическаяCVSS 9,8Proof of conceptEPSS 93 %apache · ofbiz4 сент. 2024 г.
- CVE-2024-828939Наблюдать
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeove
КритическаяCVSS 9,8Proof of conceptEPSS 1 %multivendorx · multivendorx4 сент. 2024 г.
- CVE-2024-4440043В плане
A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical.
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %dlink · di-8400 firmware4 сент. 2024 г.
- CVE-2024-2043998Срочно
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by us
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 97 %cisco · smart license utility4 сент. 2024 г.
- CVE-2024-2044046В плане
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.
ВысокаяCVSS 7,5Proof of conceptEPSS 51 %cisco · smart license utility4 сент. 2024 г.
- CVE-2024-4264226Наблюдать
Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted
СредняяCVSS 6,7Proof of conceptEPSS 0 %crucial · mx500 firmware4 сент. 2024 г.
- CVE-2024-762733Наблюдать
Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition
ВысокаяCVSS 8,1Proof of conceptEPSS 2 %bitapps · file manager4 сент. 2024 г.
- CVE-2024-684621Наблюдать
SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
СредняяCVSS 5,3Proof of conceptEPSS 1 %webdigit · chatbot with chatgpt5 сент. 2024 г.
- CVE-2024-846530Наблюдать
SQL injection vulnerability in Job Portal
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %phpgurukul · job portal5 сент. 2024 г.
- CVE-2024-4558923Наблюдать
RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote at
СредняяCVSS 5,9Proof of conceptEPSS 0 %identityautomation · rapididentity5 сент. 2024 г.
- CVE-2024-2475937Наблюдать
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
КритическаяCVSS 9,1Proof of conceptEPSS 4 %mindsdb · mindsdb5 сент. 2024 г.
- CVE-2024-759141В плане
Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection
ВысокаяCVSS 7,2Proof of conceptEPSS 43 %kemptechnologies · loadmaster5 сент. 2024 г.
- CVE-2024-851767На этой неделе
SPIP Bigup Multipart File Upload OS Command Injection
КритическаяCVSS 9,8Готовый эксплойтEPSS 94 %spip · spip6 сент. 2024 г.
- CVE-2023-4503835Наблюдать
An improper authentication vulnerability has been reported to affect Music Station.
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %qnap · music station6 сент. 2024 г.
- CVE-2024-3613832Наблюдать
Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child
ВысокаяCVSS 8,1Эксплойта нетEPSS 1 %nodejs · node7 сент. 2024 г.
- CVE-2024-4071196Срочно
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 90 %veeam · veeam backup \& replication7 сент. 2024 г.
- CVE-2024-692440В плане
TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi
КритическаяCVSS 9,8Proof of conceptEPSS 3 %themetechmount · truebooker8 сент. 2024 г.
- CVE-2024-692840В плане
Opti Marketing <= 2.0.9 - Unauthenticated SQLi
КритическаяCVSS 9,8Proof of conceptEPSS 3 %opti.marketing · opti marketing8 сент. 2024 г.
- CVE-2024-4433339Наблюдать
D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400
ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %9 сент. 2024 г.
- CVE-2024-4433445В плане
D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400
ВысокаяCVSS 8,8Эксплойта нетEPSS 31 %9 сент. 2024 г.
- CVE-2024-4433539Наблюдать
D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v2
ВысокаяCVSS 8,8Эксплойта нетEPSS 12 %9 сент. 2024 г.
- CVE-2024-4484953В плане
Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.
КритическаяCVSS 9,8Proof of conceptEPSS 46 %qualitor · qualitor9 сент. 2024 г.
- CVE-2024-4490240В плане
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
КритическаяCVSS 9,8Proof of conceptEPSS 4 %thinkphp · thinkphp9 сент. 2024 г.
- CVE-2024-4408739Наблюдать
A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP
КритическаяCVSS 9,2Эксплойта нетEPSS 10 %siemens · automation license manager v510 сент. 2024 г.
- CVE-2024-3772831Наблюдать
Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attack
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %10 сент. 2024 г.
- CVE-2024-4486730Наблюдать
phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %phpok · phpok10 сент. 2024 г.
- CVE-2024-4481518Наблюдать
Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash F
СредняяCVSS 4,6Proof of conceptEPSS 0 %hathway · skyworth cm5100-511 firmware10 сент. 2024 г.
- CVE-2024-4559030Наблюдать
body-parser vulnerable to denial of service when url encoding is enabled
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %openjsf · body-parser10 сент. 2024 г.
- CVE-2024-4559122Наблюдать
XWiki Platform document history including authors of any page exposed to unauthorized actors
СредняяCVSS 5,3Proof of conceptEPSS 3 %xwiki · xwiki10 сент. 2024 г.
- CVE-2024-3801463На этой неделе
Windows Installer Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 6 %microsoft · windows 10 150710 сент. 2024 г.
- CVE-2024-3801850В плане
Microsoft SharePoint Server Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 51 %microsoft · sharepoint server10 сент. 2024 г.
- CVE-2024-3821760На этой неделе
Windows Mark of the Web Security Feature Bypass Vulnerability
СредняяCVSS 5,4KEVГотовый эксплойтEPSS 10 %microsoft · windows 10 150710 сент. 2024 г.
- CVE-2024-3822660На этой неделе
Microsoft Publisher Security Feature Bypass Vulnerability
ВысокаяCVSS 7,3KEVГотовый эксплойтEPSS 2 %microsoft · office 201910 сент. 2024 г.
- CVE-2024-4345435Наблюдать
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
ВысокаяCVSS 7,1Эксплойта нетEPSS 21 %microsoft · windows server 200810 сент. 2024 г.
- CVE-2024-4346181Срочно
Windows MSHTML Platform Spoofing Vulnerability
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 54 %microsoft · windows 10 150710 сент. 2024 г.
- CVE-2024-4346439Наблюдать
Microsoft SharePoint Server Remote Code Execution Vulnerability
ВысокаяCVSS 7,2Эксплойта нетEPSS 36 %microsoft · sharepoint server10 сент. 2024 г.
- CVE-2024-4349143В плане
Microsoft Windows Update Remote Code Execution Vulnerability
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %microsoft · windows 10 150710 сент. 2024 г.
- CVE-2024-4487133Наблюдать
An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via up
ВысокаяCVSS 7,2Proof of conceptEPSS 16 %mozilo · mozilocms10 сент. 2024 г.
- CVE-2024-3483124Наблюдать
cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in
СредняяCVSS 6,1Proof of conceptEPSS 0 %gibbonedu · gibbon10 сент. 2024 г.
- CVE-2024-4540942В плане
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
КритическаяCVSS 9,8Proof of conceptEPSS 10 %onelogin · ruby-saml10 сент. 2024 г.
- CVE-2024-823238Наблюдать
iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Type
ВысокаяCVSS 8,7Proof of conceptEPSS 13 %ininet solutions gmbh · spidercontrol scada web server10 сент. 2024 г.
- CVE-2024-850363На этой неделе
VICIdial Unauthenticated SQL Injection
КритическаяCVSS 9,8Готовый эксплойтEPSS 79 %vicidial · vicidial10 сент. 2024 г.
- CVE-2024-850458В плане
VICIdial Authenticated Remote Code Execution
ВысокаяCVSS 8,8Готовый эксплойтEPSS 76 %vicidial · vicidial10 сент. 2024 г.
- CVE-2024-819085Срочно
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated att
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 88 %ivanti · cloud services appliance10 сент. 2024 г.
- CVE-2024-819145В плане
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker
КритическаяCVSS 9,8Эксплойта нетEPSS 20 %ivanti · endpoint manager10 сент. 2024 г.
- CVE-2024-2711541В плане
Remote Code Execution through File Upload in SOPlanning before 1.52.02
КритическаяCVSS 10,0Proof of conceptEPSS 4 %soplanning · soplanning11 сент. 2024 г.
- CVE-2024-863635Наблюдать
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %google · chrome11 сент. 2024 г.
- CVE-2024-4446642В плане
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4.
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %comfast · cf-xr11 firmware11 сент. 2024 г.
- CVE-2024-4454140В плане
evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."
КритическаяCVSS 9,8Proof of conceptEPSS 2 %11 сент. 2024 г.
- CVE-2024-2984755В плане
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenti
КритическаяCVSS 9,8Proof of conceptEPSS 52 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-3284036Наблюдать
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p
ВысокаяCVSS 7,2Эксплойта нетEPSS 25 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-3284535Наблюдать
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p
ВысокаяCVSS 7,2Эксплойта нетEPSS 24 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-3284841В плане
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p
ВысокаяCVSS 7,2Эксплойта нетEPSS 43 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-3477935Наблюдать
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p
ВысокаяCVSS 7,2Эксплойта нетEPSS 24 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-3478341В плане
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p
ВысокаяCVSS 7,2Эксплойта нетEPSS 43 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-3478536Наблюдать
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p
ВысокаяCVSS 7,2Эксплойта нетEPSS 25 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-3739750В плане
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allow
ВысокаяCVSS 8,2Эксплойта нетEPSS 59 %ivanti · endpoint manager11 сент. 2024 г.
- CVE-2024-852260На этой неделе
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
ВысокаяCVSS 7,5Готовый эксплойтEPSS 62 %thimpress · learnpress12 сент. 2024 г.
- CVE-2024-852960На этой неделе
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
ВысокаяCVSS 7,5Готовый эксплойтEPSS 12 %thimpress · learnpress12 сент. 2024 г.
- CVE-2024-4045736Наблюдать
No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file.
КритическаяCVSS 9,1Proof of conceptEPSS 0 %12 сент. 2024 г.
- CVE-2024-4582638Наблюдать
ThinManager® Code Execution Vulnerability
ВысокаяCVSS 8,5Эксплойта нетEPSS 12 %rockwellautomation · thinmanager12 сент. 2024 г.
- CVE-2024-812442В плане
Inefficient Regular Expression Complexity in GitLab
ВысокаяCVSS 7,5Эксплойта нетEPSS 40 %gitlab · gitlab12 сент. 2024 г.
- CVE-2024-4538320Наблюдать
A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36
СредняяCVSS 5,0Proof of conceptEPSS 1 %microsoft · high definition audio bus driver12 сент. 2024 г.
- CVE-2024-667836Наблюдать
Authentication Bypass by Spoofing in GitLab
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %gitlab · gitlab12 сент. 2024 г.
- CVE-2024-4560725Наблюдать
whatsapp-api-js fails to validate message's signature
СредняяCVSS 5,3Эксплойта нетEPSS 14 %secreto31126 · whatsapp-api-js12 сент. 2024 г.
- CVE-2024-3881634Наблюдать
CVE-2024-38816: Path traversal vulnerability in functional web frameworks
ВысокаяCVSS 7,5Proof of conceptEPSS 14 %spring · spring13 сент. 2024 г.
- CVE-2024-4187448В плане
ColdFusion | Deserialization of Untrusted Data (CWE-502)
КритическаяCVSS 9,8Эксплойта нетEPSS 30 %adobe · coldfusion13 сент. 2024 г.
- CVE-2024-4604842В плане
Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %tenda · fh451 firmware13 сент. 2024 г.
- CVE-2024-658741В плане
SSRF in berriai/litellm
ВысокаяCVSS 7,5Proof of conceptEPSS 35 %litellm · litellm13 сент. 2024 г.
- CVE-2024-3992439Наблюдать
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %dani-garcia · vaultwarden13 сент. 2024 г.
- CVE-2024-866933Наблюдать
Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection
ВысокаяCVSS 7,2Эксплойта нетEPSS 16 %softaculous · backuply14 сент. 2024 г.
- CVE-2024-4693844В плане
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release thro
ВысокаяCVSS 7,5Proof of conceptEPSS 46 %sitecore · experience commerce15 сент. 2024 г.
- CVE-2024-4645139Наблюдать
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %totolink · t8 firmware16 сент. 2024 г.
- CVE-2024-4462339Наблюдать
An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %spx · spx graphics controller16 сент. 2024 г.
- CVE-2024-875241В плане
WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 11 %smart-hmi · webiq16 сент. 2024 г.
- CVE-2024-2787622Наблюдать
A race condition was addressed with improved locking.
СредняяCVSS 5,5Proof of conceptEPSS 0 %apple · ipados16 сент. 2024 г.
- CVE-2024-4084222Наблюдать
An issue was addressed with improved validation of environment variables.
СредняяCVSS 5,5Proof of conceptEPSS 0 %apple · macos16 сент. 2024 г.
- CVE-2024-4413324Наблюдать
This issue was addressed by removing the vulnerable code.
СредняяCVSS 5,5Proof of conceptEPSS 7 %apple · macos16 сент. 2024 г.
- CVE-2024-3881285Срочно
Heap-overflow vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 54 %vmware · cloud foundation17 сент. 2024 г.
- CVE-2024-3881374На этой неделе
Privilege escalation vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 17 %vmware · cloud foundation17 сент. 2024 г.
- CVE-2024-894526Наблюдать
CodeCanyon RISE Ultimate Project Manager save sql injection
СредняяCVSS 5,3Proof of conceptEPSS 15 %fairsketch · rise ultimate project manager17 сент. 2024 г.
- CVE-2024-4579839Наблюдать
Multiple Poisoned Pipeline Execution (PPE) vulnerabilities
КритическаяCVSS 9,9Proof of conceptEPSS 0 %espressif · arduino-esp3217 сент. 2024 г.
- CVE-2024-894921Наблюдать
SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management
СредняяCVSS 5,3Proof of conceptEPSS 0 %oretnom23 · online eyewear shop17 сент. 2024 г.
- CVE-2024-895684Срочно
PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
КритическаяCVSS 9,1KEVГотовый эксплойтEPSS 58 %ptzoptics · pt30x-sdi firmware17 сент. 2024 г.
- CVE-2024-895782Срочно
PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 79 %ptzoptics · pt30x-sdi firmware17 сент. 2024 г.
- CVE-2024-4698248В плане
Cache Poisoning in next.js
ВысокаяCVSS 7,5Proof of conceptEPSS 59 %vercel · next.js17 сент. 2024 г.