По дате публикации
Эксплуатируемые и новые серьёзные CVE: сентябрь 2024 г.
163 записей · 13 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
48В плане | CVE-2024-46982Proof of concept | Cache Poisoning in next.jsvercel · next.js · CWE-639 | Высокая7,5 | — | 59,1 % | 17 сент. 2024 г. |
24Наблюдать | CVE-2024-43971Proof of concept | WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilitysunshinephotocart · sunshine photo cart · CWE-79 | Средняя6,1 | — | 0,6 % | 17 сент. 2024 г. |
16Наблюдать | CVE-2024-39081Proof of concept | An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications.jktyre · smart tyre car \& bike · CWE-294 | Средняя4,2 | — | 0,4 % | 18 сент. 2024 г. |
39Наблюдать | CVE-2024-44542Proof of concept | SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.todesk · todesk · CWE-89 | Критическая9,8 | — | 1,1 % | 18 сент. 2024 г. |
35Наблюдать | CVE-2023-47105Proof of concept | exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without autCWE-78 | Высокая8,6 | — | 1,6 % | 18 сент. 2024 г. |
51В плане | CVE-2024-46986Proof of concept | Arbitrary file write leading to RCE in Camaleon CMStuzitio · camaleon cms · CWE-74 | Критическая9,9 | — | 40,9 % | 18 сент. 2024 г. |
40В плане | CVE-2024-46987Готовый эксплойт | Arbitrary path traversal in Camaleon CMStuzitio · camaleon cms · CWE-22 | Высокая7,7 | — | 14,5 % | 18 сент. 2024 г. |
39Наблюдать | CVE-2024-46377Proof of concept | Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/amayurik · best house rental management system · CWE-434 | Критическая9,8 | — | 1,2 % | 18 сент. 2024 г. |
31Наблюдать | CVE-2024-8698Proof of concept | Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakred hat · red hat build of keycloak · CWE-347 | Высокая7,7 | — | 2,0 % | 19 сент. 2024 г. |
25Наблюдать | CVE-2024-8883Proof of concept | Keycloak: vulnerable redirect uri validation results in open redirecredhat · build of keycloak · CWE-601 | Средняя6,1 | — | 2,1 % | 19 сент. 2024 г. |
96Срочно | CVE-2024-8963Готовый эксплойт | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.ivanti · endpoint manager cloud services appliance · CWE-22 | Критическая9,1 | KEV | 98,6 % | 19 сент. 2024 г. |
26Наблюдать | CVE-2024-9004Эксплойта нет | D-Link DAR-7000 Backup_Server_commit.php os command injectiondlink · dar-7000 firmware · CWE-78 | Средняя5,3 | — | 16,6 % | 19 сент. 2024 г. |
49В плане | CVE-2023-27584Proof of concept | Dragonfly2 vulnerable to hard coded cyptographic keylinuxfoundation · dragonfly · CWE-321 | Критическая9,8 | — | 33,8 % | 19 сент. 2024 г. |
30Наблюдать | CVE-2024-45410Proof of concept | HTTP client can remove the X-Forwarded headers in Traefiktraefik · traefik · CWE-345 | Высокая7,5 | — | 1,5 % | 19 сент. 2024 г. |
21Наблюдать | CVE-2024-45614Proof of concept | Header normalization allows for client to clobber proxy set headers in Pumapuma · puma · CWE-639 | Средняя5,4 | — | 0,6 % | 19 сент. 2024 г. |
21Наблюдать | CVE-2024-9007Proof of concept | jeanmarc77 123solar detailed.php cross site scriptingjeanmarc77 · 123solar · CWE-79 | Средняя5,3 | — | 1,0 % | 19 сент. 2024 г. |
21Наблюдать | CVE-2024-42346Proof of concept | Stored Cross Site Scripting (Stored XSS) in Galaxygalaxyproject · galaxy · CWE-79 | Средняя5,4 | — | 0,7 % | 20 сент. 2024 г. |
38Наблюдать | CVE-2024-47062Proof of concept | Multiple SQL Injections and ORM Leak in navidromenavidrome · navidrome · CWE-89 | Критическая9,4 | — | 4,4 % | 20 сент. 2024 г. |
37Наблюдать | CVE-2024-42323Proof of concept | Apache HertzBeat: RCE by snakeYaml deser load malicious xmlapache · hertzbeat · CWE-502 | Высокая8,8 | — | 8,3 % | 21 сент. 2024 г. |
26Наблюдать | CVE-2024-9076Эксплойта нет | DedeCMS article_string_mix.php os command injectiondedecms · dedecms · CWE-77 | Средняя5,1 | — | 20,7 % | 21 сент. 2024 г. |
34Наблюдать | CVE-2024-43989Эксплойта нет | WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerabilityfirsh · justified image grid · CWE-918 | Высокая7,5 | — | 12,4 % | 22 сент. 2024 г. |
28Наблюдать | CVE-2024-23922Proof of concept | Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerabilitysony · xav-ax5500 firmware · CWE-345 | Средняя6,8 | — | 1,7 % | 23 сент. 2024 г. |
39Наблюдать | CVE-2024-47066Proof of concept | Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)lobehub · lobe chat · CWE-918 | Высокая8,8 | — | 11,8 % | 23 сент. 2024 г. |
29Наблюдать | CVE-2024-9014Proof of concept | OAuth2 client id and secret exposed through the web browser in pgAdmin 4pgadmin · pgadmin 4 · CWE-522 | Средняя6,5 | — | 9,6 % | 23 сент. 2024 г. |
21Наблюдать | CVE-2023-46948Proof of concept | A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitCWE-79 | Средняя5,4 | — | 0,3 % | 23 сент. 2024 г. |
30Наблюдать | CVE-2024-42861Proof of concept | An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message linuxptp project · linuxptp | Высокая7,5 | — | 1,5 % | 23 сент. 2024 г. |
30Наблюдать | CVE-2023-5359Proof of concept | W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintextboldgrid · w3 total cache · CWE-200 | Высокая7,5 | — | 0,8 % | 24 сент. 2024 г. |
32Наблюдать | CVE-2024-21545Proof of concept | Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization.proxmox · pve-manager · CWE-73 | Высокая8,2 | — | 0,3 % | 24 сент. 2024 г. |
50В плане | CVE-2024-8877Proof of concept | Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204.riello-ups · netman 204 firmware · CWE-89 | Средняя6,9 | — | 77,2 % | 24 сент. 2024 г. |
28Наблюдать | CVE-2024-8349Proof of concept | Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalationuncannyowl · uncanny groups for learndash · CWE-862 | Высокая7,2 | — | 1,1 % | 24 сент. 2024 г. |
31Наблюдать | CVE-2024-8484Proof of concept | REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injectionjianbo · rest api to miniprogram · CWE-89 | Высокая7,5 | — | 3,7 % | 24 сент. 2024 г. |
54В плане | CVE-2024-8275Proof of concept | The Events Calendar <= 6.6.4 - Unauthenticated SQL Injectionstellarwp · the events calendar · CWE-89 | Критическая9,8 | — | 49,9 % | 25 сент. 2024 г. |
21Наблюдать | CVE-2024-6845Proof of concept | SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosurewebdigit · chatbot with chatgpt · CWE-862 | Средняя5,3 | — | 1,1 % | 25 сент. 2024 г. |
35Наблюдать | CVE-2024-7479Proof of concept | Improper signature verification of VPN driver installation in TeamViewer Remote Clientsteamviewer · remote full client · CWE-347 | Высокая8,8 | — | 0,4 % | 25 сент. 2024 г. |
37Наблюдать | CVE-2024-6592Proof of concept | WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypasswatchguard · authentication gateway · CWE-306 | Критическая9,3 | — | 1,1 % | 25 сент. 2024 г. |
34Наблюдать | CVE-2024-20467Proof of concept | A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, remcisco · ios xe · CWE-399 | Высокая8,6 | — | 0,9 % | 25 сент. 2024 г. |
45В плане | CVE-2024-0132Proof of concept | NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration nvidia · nvidia container toolkit · CWE-367 | Высокая8,3 | — | 40,8 % | 26 сент. 2024 г. |
24Наблюдать | CVE-2024-6517Proof of concept | Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSSdotsquares · contact form 7 math captcha · CWE-79 | Средняя6,1 | — | 0,7 % | 26 сент. 2024 г. |
37Наблюдать | CVE-2024-46627Proof of concept | Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.CWE-284 | Критическая9,1 | — | 4,0 % | 26 сент. 2024 г. |
37Наблюдать | CVE-2024-9166Proof of concept | OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiveratelmo · atemio am 520 hd full hd satellite receiver · CWE-78 | Критическая9,3 | — | 1,5 % | 26 сент. 2024 г. |
20Наблюдать | CVE-2024-8118Proof of concept | Grafana alerting wrong permission on datasource rule write endpointgrafana · grafana · CWE-653 | Средняя5,1 | — | 0,5 % | 26 сент. 2024 г. |
43В плане | CVE-2024-46628Эксплойта нет | Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName paramettendacn · g3 firmware · CWE-78 | Критическая9,8 | — | 11,6 % | 26 сент. 2024 г. |
35Наблюдать | CVE-2024-47179Proof of concept | RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.diygod · rsshub · CWE-20 | Высокая8,8 | — | 0,7 % | 26 сент. 2024 г. |
33Наблюдать | CVE-2024-6769Proof of concept | Medium to High Integrity Privilege Escalation in Microsoft Windowsmicrosoft · windows 10 · CWE-426 | Высокая8,4 | — | 1,0 % | 26 сент. 2024 г. |
29Наблюдать | CVE-2024-40506Proof of concept | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMHospitalitopenpetra · openpetra · CWE-79 | Высокая7,3 | — | 0,7 % | 26 сент. 2024 г. |
29Наблюдать | CVE-2024-40507Proof of concept | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMPersonnel.openpetra · openpetra · CWE-79 | Высокая7,3 | — | 0,7 % | 26 сент. 2024 г. |
29Наблюдать | CVE-2024-40508Proof of concept | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMConferenceopenpetra · openpetra · CWE-79 | Высокая7,3 | — | 0,7 % | 26 сент. 2024 г. |
60На этой неделе | CVE-2024-47076Готовый эксплойт | libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP serveropenprinting · libcupsfilters · CWE-20 | Высокая8,6 | — | 79,8 % | 26 сент. 2024 г. |
60На этой неделе | CVE-2024-47175Готовый эксплойт | libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD bufferopenprinting · libppd · CWE-20 | Критическая9,8 | — | 63,6 % | 26 сент. 2024 г. |
60На этой неделе | CVE-2024-47176Готовый эксплойт | cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any sourceopenprinting · cups-browsed · CWE-1327 | Средняя5,3 | — | 50,6 % | 26 сент. 2024 г. |
30Наблюдать | CVE-2024-7714Proof of concept | AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Callsays-pro · chatgpt assistant · CWE-862 | Высокая7,5 | — | 0,8 % | 27 сент. 2024 г. |
29Наблюдать | CVE-2024-6931Эксплойта нет | The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scriptingstellarwp · the events calendar · CWE-79 | Средняя6,1 | — | 16,7 % | 27 сент. 2024 г. |
29Наблюдать | CVE-2024-40511Proof of concept | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmiopenpetra · openpetra · CWE-79 | Высокая7,3 | — | 0,7 % | 27 сент. 2024 г. |
29Наблюдать | CVE-2024-40512Proof of concept | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting.openpetra · openpetra · CWE-79 | Высокая7,3 | — | 0,7 % | 27 сент. 2024 г. |
29Наблюдать | CVE-2024-40509Proof of concept | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asmopenpetra · openpetra · CWE-79 | Высокая7,3 | — | 0,7 % | 27 сент. 2024 г. |
32Наблюдать | CVE-2024-40510Proof of concept | Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMCommon.asmopenpetra · openpetra · CWE-79 | Высокая8,2 | — | 0,7 % | 27 сент. 2024 г. |
24Наблюдать | CVE-2024-25411Proof of concept | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadflatpress · flatpress · CWE-79 | Средняя6,1 | — | 0,8 % | 27 сент. 2024 г. |
24Наблюдать | CVE-2024-25412Proof of concept | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadflatpress · flatpress · CWE-79 | Средняя6,1 | — | 1,0 % | 27 сент. 2024 г. |
40В плане | CVE-2024-46256Proof of concept | A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certijc21 · nginx proxy manager · CWE-77 | Критическая9,8 | — | 3,0 % | 27 сент. 2024 г. |
60На этой неделе | CVE-2024-8353Готовый эксплойт | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injectiongivewp · givewp · CWE-502 | Критическая9,8 | — | 28,7 % | 27 сент. 2024 г. |
27Наблюдать | CVE-2024-9326Proof of concept | PHPGurukul Online Shopping Portal Admin Panel index.php sql injectionphpgurukul · online shopping portal · CWE-89 | Средняя6,9 | — | 1,4 % | 29 сент. 2024 г. |
25Наблюдать | CVE-2024-45200Proof of concept | In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-basedCWE-94 | Средняя6,3 | — | 1,4 % | 30 сент. 2024 г. |
23Наблюдать | CVE-2024-46635Proof of concept | An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information CWE-922 | Средняя5,9 | — | 0,2 % | 30 сент. 2024 г. |
- CVE-2024-4698248В плане
Cache Poisoning in next.js
ВысокаяCVSS 7,5Proof of conceptEPSS 59 %vercel · next.js17 сент. 2024 г.
- CVE-2024-4397124Наблюдать
WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 0 %sunshinephotocart · sunshine photo cart17 сент. 2024 г.
- CVE-2024-3908116Наблюдать
An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communications.
СредняяCVSS 4,2Proof of conceptEPSS 0 %jktyre · smart tyre car \& bike18 сент. 2024 г.
- CVE-2024-4454239Наблюдать
SQL Injection vulnerability in todesk v.1.1 allows a remote attacker to execute arbitrary code via the /todesk.com/news.html parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %todesk · todesk18 сент. 2024 г.
- CVE-2023-4710535Наблюдать
exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without aut
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %18 сент. 2024 г.
- CVE-2024-4698651В плане
Arbitrary file write leading to RCE in Camaleon CMS
КритическаяCVSS 9,9Proof of conceptEPSS 40 %tuzitio · camaleon cms18 сент. 2024 г.
- CVE-2024-4698740В плане
Arbitrary path traversal in Camaleon CMS
ВысокаяCVSS 7,7Готовый эксплойтEPSS 14 %tuzitio · camaleon cms18 сент. 2024 г.
- CVE-2024-4637739Наблюдать
Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/a
КритическаяCVSS 9,8Proof of conceptEPSS 1 %mayurik · best house rental management system18 сент. 2024 г.
- CVE-2024-869831Наблюдать
Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
ВысокаяCVSS 7,7Proof of conceptEPSS 2 %red hat · red hat build of keycloak19 сент. 2024 г.
- CVE-2024-888325Наблюдать
Keycloak: vulnerable redirect uri validation results in open redirec
СредняяCVSS 6,1Proof of conceptEPSS 2 %redhat · build of keycloak19 сент. 2024 г.
- CVE-2024-896396Срочно
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
КритическаяCVSS 9,1KEVГотовый эксплойтEPSS 98 %ivanti · endpoint manager cloud services appliance19 сент. 2024 г.
- CVE-2024-900426Наблюдать
D-Link DAR-7000 Backup_Server_commit.php os command injection
СредняяCVSS 5,3Эксплойта нетEPSS 16 %dlink · dar-7000 firmware19 сент. 2024 г.
- CVE-2023-2758449В плане
Dragonfly2 vulnerable to hard coded cyptographic key
КритическаяCVSS 9,8Proof of conceptEPSS 33 %linuxfoundation · dragonfly19 сент. 2024 г.
- CVE-2024-4541030Наблюдать
HTTP client can remove the X-Forwarded headers in Traefik
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %traefik · traefik19 сент. 2024 г.
- CVE-2024-4561421Наблюдать
Header normalization allows for client to clobber proxy set headers in Puma
СредняяCVSS 5,4Proof of conceptEPSS 0 %puma · puma19 сент. 2024 г.
- CVE-2024-900721Наблюдать
jeanmarc77 123solar detailed.php cross site scripting
СредняяCVSS 5,3Proof of conceptEPSS 1 %jeanmarc77 · 123solar19 сент. 2024 г.
- CVE-2024-4234621Наблюдать
Stored Cross Site Scripting (Stored XSS) in Galaxy
СредняяCVSS 5,4Proof of conceptEPSS 0 %galaxyproject · galaxy20 сент. 2024 г.
- CVE-2024-4706238Наблюдать
Multiple SQL Injections and ORM Leak in navidrome
КритическаяCVSS 9,4Proof of conceptEPSS 4 %navidrome · navidrome20 сент. 2024 г.
- CVE-2024-4232337Наблюдать
Apache HertzBeat: RCE by snakeYaml deser load malicious xml
ВысокаяCVSS 8,8Proof of conceptEPSS 8 %apache · hertzbeat21 сент. 2024 г.
- CVE-2024-907626Наблюдать
DedeCMS article_string_mix.php os command injection
СредняяCVSS 5,1Эксплойта нетEPSS 20 %dedecms · dedecms21 сент. 2024 г.
- CVE-2024-4398934Наблюдать
WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 12 %firsh · justified image grid22 сент. 2024 г.
- CVE-2024-2392228Наблюдать
Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability
СредняяCVSS 6,8Proof of conceptEPSS 1 %sony · xav-ax5500 firmware23 сент. 2024 г.
- CVE-2024-4706639Наблюдать
Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
ВысокаяCVSS 8,8Proof of conceptEPSS 11 %lobehub · lobe chat23 сент. 2024 г.
- CVE-2024-901429Наблюдать
OAuth2 client id and secret exposed through the web browser in pgAdmin 4
СредняяCVSS 6,5Proof of conceptEPSS 9 %pgadmin · pgadmin 423 сент. 2024 г.
- CVE-2023-4694821Наблюдать
A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbit
СредняяCVSS 5,4Proof of conceptEPSS 0 %23 сент. 2024 г.
- CVE-2024-4286130Наблюдать
An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %linuxptp project · linuxptp23 сент. 2024 г.
- CVE-2023-535930Наблюдать
W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %boldgrid · w3 total cache24 сент. 2024 г.
- CVE-2024-2154532Наблюдать
Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization.
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %proxmox · pve-manager24 сент. 2024 г.
- CVE-2024-887750В плане
Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204.
СредняяCVSS 6,9Proof of conceptEPSS 77 %riello-ups · netman 204 firmware24 сент. 2024 г.
- CVE-2024-834928Наблюдать
Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %uncannyowl · uncanny groups for learndash24 сент. 2024 г.
- CVE-2024-848431Наблюдать
REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %jianbo · rest api to miniprogram24 сент. 2024 г.
- CVE-2024-827554В плане
The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 49 %stellarwp · the events calendar25 сент. 2024 г.
- CVE-2024-684521Наблюдать
SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
СредняяCVSS 5,3Proof of conceptEPSS 1 %webdigit · chatbot with chatgpt25 сент. 2024 г.
- CVE-2024-747935Наблюдать
Improper signature verification of VPN driver installation in TeamViewer Remote Clients
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %teamviewer · remote full client25 сент. 2024 г.
- CVE-2024-659237Наблюдать
WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass
КритическаяCVSS 9,3Proof of conceptEPSS 1 %watchguard · authentication gateway25 сент. 2024 г.
- CVE-2024-2046734Наблюдать
A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, rem
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %cisco · ios xe25 сент. 2024 г.
- CVE-2024-013245В плане
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration
ВысокаяCVSS 8,3Proof of conceptEPSS 40 %nvidia · nvidia container toolkit26 сент. 2024 г.
- CVE-2024-651724Наблюдать
Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %dotsquares · contact form 7 math captcha26 сент. 2024 г.
- CVE-2024-4662737Наблюдать
Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.
КритическаяCVSS 9,1Proof of conceptEPSS 4 %26 сент. 2024 г.
- CVE-2024-916637Наблюдать
OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver
КритическаяCVSS 9,3Proof of conceptEPSS 1 %atelmo · atemio am 520 hd full hd satellite receiver26 сент. 2024 г.
- CVE-2024-811820Наблюдать
Grafana alerting wrong permission on datasource rule write endpoint
СредняяCVSS 5,1Proof of conceptEPSS 0 %grafana · grafana26 сент. 2024 г.
- CVE-2024-4662843В плане
Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName paramet
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %tendacn · g3 firmware26 сент. 2024 г.
- CVE-2024-4717935Наблюдать
RSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %diygod · rsshub26 сент. 2024 г.
- CVE-2024-676933Наблюдать
Medium to High Integrity Privilege Escalation in Microsoft Windows
ВысокаяCVSS 8,4Proof of conceptEPSS 1 %microsoft · windows 1026 сент. 2024 г.
- CVE-2024-4050629Наблюдать
Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMHospitalit
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %openpetra · openpetra26 сент. 2024 г.
- CVE-2024-4050729Наблюдать
Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMPersonnel.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %openpetra · openpetra26 сент. 2024 г.
- CVE-2024-4050829Наблюдать
Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMConference
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %openpetra · openpetra26 сент. 2024 г.
- CVE-2024-4707660На этой неделе
libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server
ВысокаяCVSS 8,6Готовый эксплойтEPSS 79 %openprinting · libcupsfilters26 сент. 2024 г.
- CVE-2024-4717560На этой неделе
libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer
КритическаяCVSS 9,8Готовый эксплойтEPSS 63 %openprinting · libppd26 сент. 2024 г.
- CVE-2024-4717660На этой неделе
cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
СредняяCVSS 5,3Готовый эксплойтEPSS 50 %openprinting · cups-browsed26 сент. 2024 г.
- CVE-2024-771430Наблюдать
AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %ays-pro · chatgpt assistant27 сент. 2024 г.
- CVE-2024-693129Наблюдать
The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting
СредняяCVSS 6,1Эксплойта нетEPSS 16 %stellarwp · the events calendar27 сент. 2024 г.
- CVE-2024-4051129Наблюдать
Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmi
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %openpetra · openpetra27 сент. 2024 г.
- CVE-2024-4051229Наблюдать
Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %openpetra · openpetra27 сент. 2024 г.
- CVE-2024-4050929Наблюдать
Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asm
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %openpetra · openpetra27 сент. 2024 г.
- CVE-2024-4051032Наблюдать
Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMCommon.asm
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %openpetra · openpetra27 сент. 2024 г.
- CVE-2024-2541124Наблюдать
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
СредняяCVSS 6,1Proof of conceptEPSS 0 %flatpress · flatpress27 сент. 2024 г.
- CVE-2024-2541224Наблюдать
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
СредняяCVSS 6,1Proof of conceptEPSS 1 %flatpress · flatpress27 сент. 2024 г.
- CVE-2024-4625640В плане
A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certi
КритическаяCVSS 9,8Proof of conceptEPSS 3 %jc21 · nginx proxy manager27 сент. 2024 г.
- CVE-2024-835360На этой неделе
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
КритическаяCVSS 9,8Готовый эксплойтEPSS 28 %givewp · givewp27 сент. 2024 г.
- CVE-2024-932627Наблюдать
PHPGurukul Online Shopping Portal Admin Panel index.php sql injection
СредняяCVSS 6,9Proof of conceptEPSS 1 %phpgurukul · online shopping portal29 сент. 2024 г.
- CVE-2024-4520025Наблюдать
In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based
СредняяCVSS 6,3Proof of conceptEPSS 1 %30 сент. 2024 г.
- CVE-2024-4663523Наблюдать
An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information
СредняяCVSS 5,9Proof of conceptEPSS 0 %30 сент. 2024 г.