По дате публикации
Эксплуатируемые и новые серьёзные CVE: октябрь 2024 г.
237 записей · 17 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
40В плане | CVE-2024-9106Proof of concept | Wechat Social login <= 1.3.0 - Authentication Bypassxunhuweb · wechat social login 微信qq钉钉登录插件 · CWE-288 | Критическая9,8 | — | 1,7 % | 1 окт. 2024 г. |
26Наблюдать | CVE-2024-9224Proof of concept | Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Readkau-boys · hello world · CWE-22 | Средняя6,5 | — | 1,4 % | 1 окт. 2024 г. |
39Наблюдать | CVE-2024-41276Proof of concept | A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism.CWE-307 | Критическая9,8 | — | 1,0 % | 1 окт. 2024 г. |
22Наблюдать | CVE-2024-44610Proof of concept | PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters iCWE-77 | Средняя5,6 | — | 0,9 % | 1 окт. 2024 г. |
19Наблюдать | CVE-2024-31835Proof of concept | Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload flatpress · flatpress · CWE-79 | Средняя4,8 | — | 1,0 % | 1 окт. 2024 г. |
30Наблюдать | CVE-2024-47525Эксплойта нет | Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.phplibrenms · librenms · CWE-79 | Средняя5,4 | — | 29,6 % | 1 окт. 2024 г. |
40В плане | CVE-2024-7855Эксплойта нет | WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Uploadthimpress · wp hotel booking · CWE-434 | Высокая8,8 | — | 17,7 % | 2 окт. 2024 г. |
31Наблюдать | CVE-2024-44193Proof of concept | A logic issue was addressed with improved restrictions.apple · itunes · CWE-281 | Высокая7,8 | — | 0,4 % | 2 окт. 2024 г. |
21Наблюдать | CVE-2024-33209Proof of concept | FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS).flatpress · flatpress · CWE-79 | Средняя5,4 | — | 0,8 % | 2 окт. 2024 г. |
21Наблюдать | CVE-2024-33210Proof of concept | A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.flatpress · flatpress · CWE-79 | Средняя5,4 | — | 0,6 % | 2 окт. 2024 г. |
32Наблюдать | CVE-2024-41290Proof of concept | FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.flatpress · flatpress · CWE-315 | Высокая8,1 | — | 0,4 % | 2 окт. 2024 г. |
35Наблюдать | CVE-2024-46626Proof of concept | OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.os4ed · opensis · CWE-89 | Высокая8,8 | — | 0,8 % | 2 окт. 2024 г. |
48В плане | CVE-2024-24116Proof of concept | An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.ruijie · rg-nbs2009g-p firmware · CWE-280 | Критическая9,8 | — | 28,4 % | 2 окт. 2024 г. |
55В плане | CVE-2024-9441Proof of concept | Linear eMerge e3-Series Forgot Password Command Injectionlinear · emerge e3-series · CWE-78 | Критическая9,8 | — | 53,4 % | 2 окт. 2024 г. |
99Срочно | CVE-2024-45519Готовый эксплойт | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.synacor · zimbra collaboration suite · CWE-78 | Критическая9,8 | KEV | 99,9 % | 2 окт. 2024 г. |
46В плане | CVE-2024-41163Эксплойта нет | A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0.veertu · anka build cloud · CWE-22 | Высокая7,5 | — | 52,4 % | 3 окт. 2024 г. |
26Наблюдать | CVE-2024-45870Proof of concept | Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.bandisoft · bandiview · CWE-284 | Средняя6,5 | — | 0,4 % | 3 окт. 2024 г. |
39Наблюдать | CVE-2024-46658Proof of concept | Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.CWE-78 | Высокая8,0 | — | 24,3 % | 3 окт. 2024 г. |
26Наблюдать | CVE-2024-47855Эксплойта нет | util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string. | Средняя5,3 | — | 17,5 % | 4 окт. 2024 г. |
26Наблюдать | CVE-2024-9513Proof of concept | Netadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposurenetadmin · netadmin iam · CWE-203 | Средняя6,3 | — | 1,7 % | 4 окт. 2024 г. |
25Наблюдать | CVE-2024-43686Эксплойта нет | Reflected XSS in TimeProvider 4100 chart componentmicrochip · timeprovider 4100 firmware · CWE-79 | Средняя5,4 | — | 12,9 % | 4 окт. 2024 г. |
30Наблюдать | CVE-2024-43687Proof of concept | XSS vulnerability in bannerconfig endpoint in TimeProvider 4100microchip · timeprovider 4100 firmware · CWE-79 | Высокая7,7 | — | 0,8 % | 4 окт. 2024 г. |
25Наблюдать | CVE-2024-7801Proof of concept | SQL injection in get_chart_data in TimeProvider 4100microchip · timeprovider 4100 firmware · CWE-89 | Средняя6,3 | — | 0,8 % | 4 окт. 2024 г. |
39Наблюдать | CVE-2024-9054Proof of concept | Remote code Execution inTimeProvider® 4100microchip · timeprovider 4100 firmware · CWE-78 | Высокая8,5 | — | 15,6 % | 4 окт. 2024 г. |
37Наблюдать | CVE-2024-47841Эксплойта нет | Path traversal when loading stylesheetswikimedia · wikimedia-extensions-css · CWE-22 | Средняя6,9 | — | 34,5 % | 4 окт. 2024 г. |
27Наблюдать | CVE-2024-8743Proof of concept | Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Uploadbitpressadmin · file manager · CWE-434 | Средняя6,8 | — | 0,7 % | 5 окт. 2024 г. |
27Наблюдать | CVE-2024-9161Proof of concept | Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Deleterankmath · seo · CWE-862 | Средняя6,5 | — | 2,1 % | 5 окт. 2024 г. |
24Наблюдать | CVE-2024-47374Proof of concept | WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerabilitylitespeedtech · litespeed cache · CWE-79 | Средняя6,1 | — | 1,3 % | 5 окт. 2024 г. |
31Наблюдать | CVE-2024-38399Proof of concept | Use After Free in Graphicsqualcomm · wsa8835 firmware · CWE-416 | Высокая7,8 | — | 0,1 % | 7 окт. 2024 г. |
61На этой неделе | CVE-2024-43047Готовый эксплойт | Use After Free in DSP Servicequalcomm · fastconnect 6700 firmware · CWE-416 | Высокая7,8 | KEV | 0,6 % | 7 окт. 2024 г. |
34Наблюдать | CVE-2024-46278Proof of concept | Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.sismics · teedy · CWE-79 | Высокая8,4 | — | 2,8 % | 7 окт. 2024 г. |
35Наблюдать | CVE-2024-9570Proof of concept | D-Link DIR-619L B1 formEasySetTimezone buffer overflowdlink · dir-619l firmware · CWE-120 | Высокая8,7 | — | 2,9 % | 7 окт. 2024 г. |
24Наблюдать | CVE-2024-42831Proof of concept | A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaCWE-79 | Средняя6,1 | — | 0,8 % | 7 окт. 2024 г. |
36Наблюдать | CVE-2024-31449Proof of concept | Lua library commands may lead to stack overflow and RCE in Redisredis · redis · CWE-20 | Высокая8,8 | — | 4,4 % | 7 окт. 2024 г. |
31Наблюдать | CVE-2024-45293Proof of concept | XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX readerphpoffice · phpspreadsheet · CWE-611 | Высокая7,5 | — | 2,7 % | 7 окт. 2024 г. |
33Наблюдать | CVE-2024-43362Эксплойта нет | Stored Cross-site Scripting (XSS) when creating external links in Cacticacti · cacti · CWE-79 | Средняя5,4 | — | 38,5 % | 7 окт. 2024 г. |
39Наблюдать | CVE-2024-43363Proof of concept | Remote code execution via Log Poisoning in Cacticacti · cacti · CWE-94 | Высокая7,2 | — | 35,5 % | 7 окт. 2024 г. |
43В плане | CVE-2024-43364Эксплойта нет | Stored Cross-site Scripting (XSS) when creating external links in Cacticacti · cacti · CWE-79 | Высокая8,2 | — | 37,8 % | 7 окт. 2024 г. |
40В плане | CVE-2024-43365Эксплойта нет | Stored Cross-site Scripting (XSS) when creating external links in Cacticacti · cacti · CWE-79 | Высокая8,2 | — | 25,0 % | 7 окт. 2024 г. |
29Наблюдать | CVE-2024-21532Proof of concept | All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the bCWE-78 | Высокая7,3 | — | 1,2 % | 8 окт. 2024 г. |
26Наблюдать | CVE-2024-21533Proof of concept | All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL CWE-88 | Средняя6,5 | — | 0,5 % | 8 окт. 2024 г. |
40В плане | CVE-2024-8911Proof of concept | LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injectionlatepoint · latepoint · CWE-89 | Критическая9,8 | — | 2,9 % | 8 окт. 2024 г. |
40В плане | CVE-2024-8943Proof of concept | LatePoint <= 5.0.12 - Authentication Bypasslatepoint · latepoint · CWE-288 | Критическая9,8 | — | 3,0 % | 8 окт. 2024 г. |
38Наблюдать | CVE-2024-45230Эксплойта нет | An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.djangoproject · django · CWE-120 | Высокая7,5 | — | 25,7 % | 8 окт. 2024 г. |
37Наблюдать | CVE-2024-47949Эксплойта нет | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary locationjetbrains · teamcity · CWE-23 | Высокая7,5 | — | 23,4 % | 8 окт. 2024 г. |
41В плане | CVE-2024-44349Proof of concept | A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commandsCWE-89 | Критическая9,8 | — | 5,7 % | 8 окт. 2024 г. |
44В плане | CVE-2024-47008Эксплойта нет | Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.ivanti · avalanche · CWE-918 | Высокая7,5 | — | 47,0 % | 8 окт. 2024 г. |
50В плане | CVE-2024-47010Эксплойта нет | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.ivanti · avalanche · CWE-22 | Критическая9,8 | — | 37,7 % | 8 окт. 2024 г. |
47В плане | CVE-2024-47011Эксплойта нет | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive informationivanti · avalanche · CWE-22 | Высокая7,5 | — | 56,3 % | 8 окт. 2024 г. |
76На этой неделе | CVE-2024-9380Готовый эксплойт | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker witivanti · endpoint manager cloud services appliance · CWE-77 | Высокая7,2 | KEV | 59,6 % | 8 окт. 2024 г. |
33Наблюдать | CVE-2024-9381Эксплойта нет | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions.ivanti · endpoint manager cloud services appliance · CWE-22 | Высокая7,2 | — | 15,5 % | 8 окт. 2024 г. |
36Наблюдать | CVE-2024-38124Proof of concept | Windows Netlogon Elevation of Privilege Vulnerabilitymicrosoft · windows server 2008 · CWE-287 | Критическая9,0 | — | 1,1 % | 8 окт. 2024 г. |
93Срочно | CVE-2024-43468Готовый эксплойт | Microsoft Configuration Manager Remote Code Execution Vulnerabilitymicrosoft · configuration manager 2403 · CWE-89 | Критическая9,8 | KEV | 81,0 % | 8 окт. 2024 г. |
39Наблюдать | CVE-2024-43532Эксплойта нет | Remote Registry Service Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-636 | Высокая8,8 | — | 11,9 % | 8 окт. 2024 г. |
28Наблюдать | CVE-2024-43535Proof of concept | Windows Kernel-Mode Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 | Высокая7,0 | — | 0,5 % | 8 окт. 2024 г. |
81Срочно | CVE-2024-43572Готовый эксплойт | Microsoft Management Console Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-707 | Высокая7,8 | KEV | 66,6 % | 8 окт. 2024 г. |
76На этой неделе | CVE-2024-43573Готовый эксплойт | Windows MSHTML Platform Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-79 | Высокая8,1 | KEV | 46,1 % | 8 окт. 2024 г. |
31Наблюдать | CVE-2024-43583Proof of concept | Winlogon Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-250 | Высокая7,8 | — | 1,3 % | 8 окт. 2024 г. |
18Наблюдать | CVE-2024-43612Эксплойта нет | Power BI Report Server Spoofing Vulnerabilitymicrosoft · power bi report server · CWE-79 | Средняя4,7 | — | 0,7 % | 8 окт. 2024 г. |
32Наблюдать | CVE-2024-47773Proof of concept | Anonymous cache poisoning via XHR requests in Discoursediscourse · discourse · CWE-610 | Высокая8,2 | — | 1,6 % | 8 окт. 2024 г. |
30Наблюдать | CVE-2024-47823Proof of concept | Livewire Remote Code Execution (RCE) on File Uploadslaravel · livewire · CWE-20 | Высокая7,7 | — | 0,8 % | 8 окт. 2024 г. |
71На этой неделе | CVE-2024-9379Готовый эксплойт | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to ruivanti · endpoint manager cloud services appliance · CWE-89 | Высокая7,2 | KEV | 43,7 % | 8 окт. 2024 г. |
76На этой неделе | CVE-2024-9680Готовый эксплойт | An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.mozilla · firefox · CWE-416 | Критическая9,8 | KEV | 23,1 % | 9 окт. 2024 г. |
35Наблюдать | CVE-2024-7293Эксплойта нет | Password policy for new users is not strong enoughprogress · telerik reporting · CWE-521 | Высокая8,8 | — | 0,3 % | 9 окт. 2024 г. |
99Срочно | CVE-2024-9463Готовый эксплойт | Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosurepaloaltonetworks · expedition · CWE-78 | Критическая9,9 | KEV | 98,5 % | 9 окт. 2024 г. |
62На этой неделе | CVE-2024-9464Proof of concept | Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosurepaloaltonetworks · expedition · CWE-78 | Критическая9,3 | — | 82,6 % | 9 окт. 2024 г. |
96Срочно | CVE-2024-9465Готовый эксплойт | Expedition: SQL Injection Leads to Firewall Admin Credential Disclosurepaloaltonetworks · expedition · CWE-89 | Критическая9,2 | KEV | 99,6 % | 9 окт. 2024 г. |
36Наблюдать | CVE-2024-9466Proof of concept | Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosurepaloaltonetworks · expedition · CWE-532 | Высокая8,2 | — | 13,5 % | 9 окт. 2024 г. |
33Наблюдать | CVE-2024-3656Proof of concept | Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesred hat · red hat build of keycloak · CWE-200 | Высокая8,1 | — | 2,8 % | 9 окт. 2024 г. |
40В плане | CVE-2024-9796Proof of concept | WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injectioninternet-formation · wp-advanced-search · CWE-89 | Критическая9,8 | — | 2,9 % | 10 окт. 2024 г. |
37Наблюдать | CVE-2023-25581Proof of concept | Deserialization of untrusted data in InternalAttributeHandler in pac4jpac4j · pac4j · CWE-502 | Критическая9,2 | — | 1,9 % | 10 окт. 2024 г. |
28Наблюдать | CVE-2024-9793Эксплойта нет | Tenda AC1206 ate ate_ifconfig_set command injectiontenda · ac1206 firmware · CWE-77 | Средняя5,3 | — | 23,1 % | 10 окт. 2024 г. |
27Наблюдать | CVE-2024-47167Proof of concept | SSRF in the path parameter of /queue/join in Gradiogradio project · gradio · CWE-918 | Средняя6,9 | — | 0,4 % | 10 окт. 2024 г. |
46В плане | CVE-2024-9487Proof of concept | An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassedgithub · enterprise server · CWE-347 | Критическая9,5 | — | 25,6 % | 10 окт. 2024 г. |
39Наблюдать | CVE-2024-9822Proof of concept | Pedalo Connector <= 2.0.5 - Authentication Bypass to Administratorpedalo · pedalo connector · CWE-288 | Критическая9,8 | — | 0,9 % | 10 окт. 2024 г. |
42В плане | CVE-2024-21534Proof of concept | All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.CWE-94 | Критическая9,8 | — | 9,0 % | 11 окт. 2024 г. |
26Наблюдать | CVE-2024-7514Proof of concept | WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversalwebtoffee · comments import & export · CWE-22 | Средняя6,5 | — | 1,0 % | 11 окт. 2024 г. |
42В плане | CVE-2024-9234Proof of concept | GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Uploadataurr · gutenkit – page builder blocks, patterns, and templates for gutenberg block editor · CWE-862 | Критическая9,8 | — | 10,4 % | 11 окт. 2024 г. |
42В плане | CVE-2024-9707Proof of concept | Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activationthemehunk · hunk companion · CWE-862 | Критическая9,8 | — | 9,0 % | 11 окт. 2024 г. |
24Наблюдать | CVE-2024-47875Proof of concept | DOMPurify nesting-based mXSScure53 · dompurify · CWE-79 | Средняя6,1 | — | 1,1 % | 11 окт. 2024 г. |
51В плане | CVE-2024-42640Proof of concept | angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php.CWE-434 | Критическая9,8 | — | 39,9 % | 11 окт. 2024 г. |
36Наблюдать | CVE-2024-48827Proof of concept | An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password funsbond · watcharr · CWE-613 | Высокая8,8 | — | 2,7 % | 11 окт. 2024 г. |
39Наблюдать | CVE-2024-46532Proof of concept | SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.classCWE-89 | Критическая9,8 | — | 0,9 % | 11 окт. 2024 г. |
33Наблюдать | CVE-2024-35517Эксплойта нет | Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.netgear · xr1000 firmware · CWE-77 | Высокая7,2 | — | 15,0 % | 11 окт. 2024 г. |
35Наблюдать | CVE-2024-9821Proof of concept | Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypassguruteam · bot for telegram on woocommerce · CWE-200 | Высокая8,8 | — | 1,1 % | 11 окт. 2024 г. |
67На этой неделе | CVE-2024-9047Proof of concept | WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.phpiptanus · wordpress file upload · CWE-22 | Критическая9,8 | — | 93,3 % | 12 окт. 2024 г. |
17Наблюдать | CVE-2024-9756Proof of concept | Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Uploaddirectsoftware · order attachments for woocommerce · CWE-862 | Средняя4,3 | — | 0,8 % | 12 окт. 2024 г. |
49В плане | CVE-2024-9916Proof of concept | HuangDou UTCMS cli.php os command injectionusualtool · usualtoolcms · CWE-78 | Средняя6,9 | — | 73,6 % | 13 окт. 2024 г. |
21Наблюдать | CVE-2024-48120Proof of concept | X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module.x2engine · x2crm · CWE-79 | Средняя5,4 | — | 0,6 % | 14 окт. 2024 г. |
29Наблюдать | CVE-2024-48259Proof of concept | Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.magicbug · cloudlog · CWE-89 | Высокая7,3 | — | 0,9 % | 14 окт. 2024 г. |
40В плане | CVE-2023-50780Proof of concept | Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansapache · artemis · CWE-285 | Высокая8,8 | — | 17,4 % | 14 окт. 2024 г. |
26Наблюдать | CVE-2024-41997Proof of concept | An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02).CWE-94 | Средняя6,6 | — | 1,1 % | 14 окт. 2024 г. |
25Наблюдать | CVE-2024-45741Эксплойта нет | Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprisesplunk · splunk · CWE-79 | Средняя5,4 | — | 14,7 % | 14 окт. 2024 г. |
17Наблюдать | CVE-2024-46528Proof of concept | An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x CWE-639 | Средняя4,3 | — | 1,5 % | 14 окт. 2024 г. |
27Наблюдать | CVE-2024-9977Эксплойта нет | MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injectionmitrastar · gpt-2541gnac · CWE-78 | Средняя5,1 | — | 22,9 % | 15 окт. 2024 г. |
54В плане | CVE-2024-48914Proof of concept | Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyvendure-ecommerce · vendure · CWE-20 | Критическая9,1 | — | 60,4 % | 15 окт. 2024 г. |
14Наблюдать | CVE-2024-9506Proof of concept | Regular Expression Denial of Service (ReDoS)vue · vue · CWE-1333 | Низкая3,7 | — | 0,5 % | 15 окт. 2024 г. |
37Наблюдать | CVE-2024-35584Proof of concept | SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSisos4ed · opensis · CWE-89 | Высокая8,8 | — | 5,8 % | 15 окт. 2024 г. |
26Наблюдать | CVE-2024-21262Proof of concept | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).oracle · mysql connector\/odbc · CWE-863 | Средняя6,5 | — | 0,5 % | 15 окт. 2024 г. |
20Наблюдать | CVE-2024-44337Proof of concept | The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. | Средняя5,1 | — | 0,5 % | 15 окт. 2024 г. |
- CVE-2024-910640В плане
Wechat Social login <= 1.3.0 - Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 1 %xunhuweb · wechat social login 微信qq钉钉登录插件1 окт. 2024 г.
- CVE-2024-922426Наблюдать
Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read
СредняяCVSS 6,5Proof of conceptEPSS 1 %kau-boys · hello world1 окт. 2024 г.
- CVE-2024-4127639Наблюдать
A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %1 окт. 2024 г.
- CVE-2024-4461022Наблюдать
PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters i
СредняяCVSS 5,6Proof of conceptEPSS 0 %1 окт. 2024 г.
- CVE-2024-3183519Наблюдать
Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload
СредняяCVSS 4,8Proof of conceptEPSS 1 %flatpress · flatpress1 окт. 2024 г.
- CVE-2024-4752530Наблюдать
Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php
СредняяCVSS 5,4Эксплойта нетEPSS 29 %librenms · librenms1 окт. 2024 г.
- CVE-2024-785540В плане
WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
ВысокаяCVSS 8,8Эксплойта нетEPSS 17 %thimpress · wp hotel booking2 окт. 2024 г.
- CVE-2024-4419331Наблюдать
A logic issue was addressed with improved restrictions.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %apple · itunes2 окт. 2024 г.
- CVE-2024-3320921Наблюдать
FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS).
СредняяCVSS 5,4Proof of conceptEPSS 0 %flatpress · flatpress2 окт. 2024 г.
- CVE-2024-3321021Наблюдать
A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.
СредняяCVSS 5,4Proof of conceptEPSS 0 %flatpress · flatpress2 окт. 2024 г.
- CVE-2024-4129032Наблюдать
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %flatpress · flatpress2 окт. 2024 г.
- CVE-2024-4662635Наблюдать
OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %os4ed · opensis2 окт. 2024 г.
- CVE-2024-2411648В плане
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.
КритическаяCVSS 9,8Proof of conceptEPSS 28 %ruijie · rg-nbs2009g-p firmware2 окт. 2024 г.
- CVE-2024-944155В плане
Linear eMerge e3-Series Forgot Password Command Injection
КритическаяCVSS 9,8Proof of conceptEPSS 53 %linear · emerge e3-series2 окт. 2024 г.
- CVE-2024-4551999Срочно
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 99 %synacor · zimbra collaboration suite2 окт. 2024 г.
- CVE-2024-4116346В плане
A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0.
ВысокаяCVSS 7,5Эксплойта нетEPSS 52 %veertu · anka build cloud3 окт. 2024 г.
- CVE-2024-4587026Наблюдать
Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.
СредняяCVSS 6,5Proof of conceptEPSS 0 %bandisoft · bandiview3 окт. 2024 г.
- CVE-2024-4665839Наблюдать
Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.
ВысокаяCVSS 8,0Proof of conceptEPSS 24 %3 окт. 2024 г.
- CVE-2024-4785526Наблюдать
util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
СредняяCVSS 5,3Эксплойта нетEPSS 17 %4 окт. 2024 г.
- CVE-2024-951326Наблюдать
Netadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposure
СредняяCVSS 6,3Proof of conceptEPSS 1 %netadmin · netadmin iam4 окт. 2024 г.
- CVE-2024-4368625Наблюдать
Reflected XSS in TimeProvider 4100 chart component
СредняяCVSS 5,4Эксплойта нетEPSS 12 %microchip · timeprovider 4100 firmware4 окт. 2024 г.
- CVE-2024-4368730Наблюдать
XSS vulnerability in bannerconfig endpoint in TimeProvider 4100
ВысокаяCVSS 7,7Proof of conceptEPSS 0 %microchip · timeprovider 4100 firmware4 окт. 2024 г.
- CVE-2024-780125Наблюдать
SQL injection in get_chart_data in TimeProvider 4100
СредняяCVSS 6,3Proof of conceptEPSS 0 %microchip · timeprovider 4100 firmware4 окт. 2024 г.
- CVE-2024-905439Наблюдать
Remote code Execution inTimeProvider® 4100
ВысокаяCVSS 8,5Proof of conceptEPSS 15 %microchip · timeprovider 4100 firmware4 окт. 2024 г.
- CVE-2024-4784137Наблюдать
Path traversal when loading stylesheets
СредняяCVSS 6,9Эксплойта нетEPSS 34 %wikimedia · wikimedia-extensions-css4 окт. 2024 г.
- CVE-2024-874327Наблюдать
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload
СредняяCVSS 6,8Proof of conceptEPSS 0 %bitpressadmin · file manager5 окт. 2024 г.
- CVE-2024-916127Наблюдать
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete
СредняяCVSS 6,5Proof of conceptEPSS 2 %rankmath · seo5 окт. 2024 г.
- CVE-2024-4737424Наблюдать
WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability
СредняяCVSS 6,1Proof of conceptEPSS 1 %litespeedtech · litespeed cache5 окт. 2024 г.
- CVE-2024-3839931Наблюдать
Use After Free in Graphics
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %qualcomm · wsa8835 firmware7 окт. 2024 г.
- CVE-2024-4304761На этой неделе
Use After Free in DSP Service
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 0 %qualcomm · fastconnect 6700 firmware7 окт. 2024 г.
- CVE-2024-4627834Наблюдать
Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.
ВысокаяCVSS 8,4Proof of conceptEPSS 2 %sismics · teedy7 окт. 2024 г.
- CVE-2024-957035Наблюдать
D-Link DIR-619L B1 formEasySetTimezone buffer overflow
ВысокаяCVSS 8,7Proof of conceptEPSS 2 %dlink · dir-619l firmware7 окт. 2024 г.
- CVE-2024-4283124Наблюдать
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary Java
СредняяCVSS 6,1Proof of conceptEPSS 0 %7 окт. 2024 г.
- CVE-2024-3144936Наблюдать
Lua library commands may lead to stack overflow and RCE in Redis
ВысокаяCVSS 8,8Proof of conceptEPSS 4 %redis · redis7 окт. 2024 г.
- CVE-2024-4529331Наблюдать
XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %phpoffice · phpspreadsheet7 окт. 2024 г.
- CVE-2024-4336233Наблюдать
Stored Cross-site Scripting (XSS) when creating external links in Cacti
СредняяCVSS 5,4Эксплойта нетEPSS 38 %cacti · cacti7 окт. 2024 г.
- CVE-2024-4336339Наблюдать
Remote code execution via Log Poisoning in Cacti
ВысокаяCVSS 7,2Proof of conceptEPSS 35 %cacti · cacti7 окт. 2024 г.
- CVE-2024-4336443В плане
Stored Cross-site Scripting (XSS) when creating external links in Cacti
ВысокаяCVSS 8,2Эксплойта нетEPSS 37 %cacti · cacti7 окт. 2024 г.
- CVE-2024-4336540В плане
Stored Cross-site Scripting (XSS) when creating external links in Cacti
ВысокаяCVSS 8,2Эксплойта нетEPSS 25 %cacti · cacti7 окт. 2024 г.
- CVE-2024-2153229Наблюдать
All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the b
ВысокаяCVSS 7,3Proof of conceptEPSS 1 %8 окт. 2024 г.
- CVE-2024-2153326Наблюдать
All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL
СредняяCVSS 6,5Proof of conceptEPSS 0 %8 окт. 2024 г.
- CVE-2024-891140В плане
LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 2 %latepoint · latepoint8 окт. 2024 г.
- CVE-2024-894340В плане
LatePoint <= 5.0.12 - Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 3 %latepoint · latepoint8 окт. 2024 г.
- CVE-2024-4523038Наблюдать
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.
ВысокаяCVSS 7,5Эксплойта нетEPSS 25 %djangoproject · django8 окт. 2024 г.
- CVE-2024-4794937Наблюдать
In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
ВысокаяCVSS 7,5Эксплойта нетEPSS 23 %jetbrains · teamcity8 окт. 2024 г.
- CVE-2024-4434941В плане
A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands
КритическаяCVSS 9,8Proof of conceptEPSS 5 %8 окт. 2024 г.
- CVE-2024-4700844В плане
Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.
ВысокаяCVSS 7,5Эксплойта нетEPSS 47 %ivanti · avalanche8 окт. 2024 г.
- CVE-2024-4701050В плане
Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.
КритическаяCVSS 9,8Эксплойта нетEPSS 37 %ivanti · avalanche8 окт. 2024 г.
- CVE-2024-4701147В плане
Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information
ВысокаяCVSS 7,5Эксплойта нетEPSS 56 %ivanti · avalanche8 окт. 2024 г.
- CVE-2024-938076На этой неделе
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker wit
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 59 %ivanti · endpoint manager cloud services appliance8 окт. 2024 г.
- CVE-2024-938133Наблюдать
Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions.
ВысокаяCVSS 7,2Эксплойта нетEPSS 15 %ivanti · endpoint manager cloud services appliance8 окт. 2024 г.
- CVE-2024-3812436Наблюдать
Windows Netlogon Elevation of Privilege Vulnerability
КритическаяCVSS 9,0Proof of conceptEPSS 1 %microsoft · windows server 20088 окт. 2024 г.
- CVE-2024-4346893Срочно
Microsoft Configuration Manager Remote Code Execution Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 81 %microsoft · configuration manager 24038 окт. 2024 г.
- CVE-2024-4353239Наблюдать
Remote Registry Service Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 11 %microsoft · windows 10 15078 окт. 2024 г.
- CVE-2024-4353528Наблюдать
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,0Proof of conceptEPSS 0 %microsoft · windows 10 15078 окт. 2024 г.
- CVE-2024-4357281Срочно
Microsoft Management Console Remote Code Execution Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 66 %microsoft · windows 10 15078 окт. 2024 г.
- CVE-2024-4357376На этой неделе
Windows MSHTML Platform Spoofing Vulnerability
ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 46 %microsoft · windows 10 15078 окт. 2024 г.
- CVE-2024-4358331Наблюдать
Winlogon Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %microsoft · windows 10 15078 окт. 2024 г.
- CVE-2024-4361218Наблюдать
Power BI Report Server Spoofing Vulnerability
СредняяCVSS 4,7Эксплойта нетEPSS 0 %microsoft · power bi report server8 окт. 2024 г.
- CVE-2024-4777332Наблюдать
Anonymous cache poisoning via XHR requests in Discourse
ВысокаяCVSS 8,2Proof of conceptEPSS 1 %discourse · discourse8 окт. 2024 г.
- CVE-2024-4782330Наблюдать
Livewire Remote Code Execution (RCE) on File Uploads
ВысокаяCVSS 7,7Proof of conceptEPSS 0 %laravel · livewire8 окт. 2024 г.
- CVE-2024-937971На этой неделе
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to ru
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 43 %ivanti · endpoint manager cloud services appliance8 окт. 2024 г.
- CVE-2024-968076На этой неделе
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 23 %mozilla · firefox9 окт. 2024 г.
- CVE-2024-729335Наблюдать
Password policy for new users is not strong enough
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %progress · telerik reporting9 окт. 2024 г.
- CVE-2024-946399Срочно
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
КритическаяCVSS 9,9KEVГотовый эксплойтEPSS 98 %paloaltonetworks · expedition9 окт. 2024 г.
- CVE-2024-946462На этой неделе
Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure
КритическаяCVSS 9,3Proof of conceptEPSS 82 %paloaltonetworks · expedition9 окт. 2024 г.
- CVE-2024-946596Срочно
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
КритическаяCVSS 9,2KEVГотовый эксплойтEPSS 99 %paloaltonetworks · expedition9 окт. 2024 г.
- CVE-2024-946636Наблюдать
Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure
ВысокаяCVSS 8,2Proof of conceptEPSS 13 %paloaltonetworks · expedition9 окт. 2024 г.
- CVE-2024-365633Наблюдать
Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities
ВысокаяCVSS 8,1Proof of conceptEPSS 2 %red hat · red hat build of keycloak9 окт. 2024 г.
- CVE-2024-979640В плане
WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection
КритическаяCVSS 9,8Proof of conceptEPSS 2 %internet-formation · wp-advanced-search10 окт. 2024 г.
- CVE-2023-2558137Наблюдать
Deserialization of untrusted data in InternalAttributeHandler in pac4j
КритическаяCVSS 9,2Proof of conceptEPSS 1 %pac4j · pac4j10 окт. 2024 г.
- CVE-2024-979328Наблюдать
Tenda AC1206 ate ate_ifconfig_set command injection
СредняяCVSS 5,3Эксплойта нетEPSS 23 %tenda · ac1206 firmware10 окт. 2024 г.
- CVE-2024-4716727Наблюдать
SSRF in the path parameter of /queue/join in Gradio
СредняяCVSS 6,9Proof of conceptEPSS 0 %gradio project · gradio10 окт. 2024 г.
- CVE-2024-948746В плане
An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed
КритическаяCVSS 9,5Proof of conceptEPSS 25 %github · enterprise server10 окт. 2024 г.
- CVE-2024-982239Наблюдать
Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator
КритическаяCVSS 9,8Proof of conceptEPSS 0 %pedalo · pedalo connector10 окт. 2024 г.
- CVE-2024-2153442В плане
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.
КритическаяCVSS 9,8Proof of conceptEPSS 9 %11 окт. 2024 г.
- CVE-2024-751426Наблюдать
WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal
СредняяCVSS 6,5Proof of conceptEPSS 1 %webtoffee · comments import & export11 окт. 2024 г.
- CVE-2024-923442В плане
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 10 %ataurr · gutenkit – page builder blocks, patterns, and templates for gutenberg block editor11 окт. 2024 г.
- CVE-2024-970742В плане
Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
КритическаяCVSS 9,8Proof of conceptEPSS 9 %themehunk · hunk companion11 окт. 2024 г.
- CVE-2024-4787524Наблюдать
DOMPurify nesting-based mXSS
СредняяCVSS 6,1Proof of conceptEPSS 1 %cure53 · dompurify11 окт. 2024 г.
- CVE-2024-4264051В плане
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php.
КритическаяCVSS 9,8Proof of conceptEPSS 39 %11 окт. 2024 г.
- CVE-2024-4882736Наблюдать
An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password fun
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %sbond · watcharr11 окт. 2024 г.
- CVE-2024-4653239Наблюдать
SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class
КритическаяCVSS 9,8Proof of conceptEPSS 0 %11 окт. 2024 г.
- CVE-2024-3551733Наблюдать
Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.
ВысокаяCVSS 7,2Эксплойта нетEPSS 15 %netgear · xr1000 firmware11 окт. 2024 г.
- CVE-2024-982135Наблюдать
Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %guruteam · bot for telegram on woocommerce11 окт. 2024 г.
- CVE-2024-904767На этой неделе
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
КритическаяCVSS 9,8Proof of conceptEPSS 93 %iptanus · wordpress file upload12 окт. 2024 г.
- CVE-2024-975617Наблюдать
Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload
СредняяCVSS 4,3Proof of conceptEPSS 0 %directsoftware · order attachments for woocommerce12 окт. 2024 г.
- CVE-2024-991649В плане
HuangDou UTCMS cli.php os command injection
СредняяCVSS 6,9Proof of conceptEPSS 73 %usualtool · usualtoolcms13 окт. 2024 г.
- CVE-2024-4812021Наблюдать
X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module.
СредняяCVSS 5,4Proof of conceptEPSS 0 %x2engine · x2crm14 окт. 2024 г.
- CVE-2024-4825929Наблюдать
Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %magicbug · cloudlog14 окт. 2024 г.
- CVE-2023-5078040В плане
Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
ВысокаяCVSS 8,8Proof of conceptEPSS 17 %apache · artemis14 окт. 2024 г.
- CVE-2024-4199726Наблюдать
An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02).
СредняяCVSS 6,6Proof of conceptEPSS 1 %14 окт. 2024 г.
- CVE-2024-4574125Наблюдать
Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise
СредняяCVSS 5,4Эксплойта нетEPSS 14 %splunk · splunk14 окт. 2024 г.
- CVE-2024-4652817Наблюдать
An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x
СредняяCVSS 4,3Proof of conceptEPSS 1 %14 окт. 2024 г.
- CVE-2024-997727Наблюдать
MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection
СредняяCVSS 5,1Эксплойта нетEPSS 22 %mitrastar · gpt-2541gnac15 окт. 2024 г.
- CVE-2024-4891454В плане
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
КритическаяCVSS 9,1Proof of conceptEPSS 60 %vendure-ecommerce · vendure15 окт. 2024 г.
- CVE-2024-950614Наблюдать
Regular Expression Denial of Service (ReDoS)
НизкаяCVSS 3,7Proof of conceptEPSS 0 %vue · vue15 окт. 2024 г.
- CVE-2024-3558437Наблюдать
SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis
ВысокаяCVSS 8,8Proof of conceptEPSS 5 %os4ed · opensis15 окт. 2024 г.
- CVE-2024-2126226Наблюдать
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).
СредняяCVSS 6,5Proof of conceptEPSS 0 %oracle · mysql connector\/odbc15 окт. 2024 г.
- CVE-2024-4433720Наблюдать
The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML.
СредняяCVSS 5,1Proof of conceptEPSS 0 %15 окт. 2024 г.