По дате публикации
Эксплуатируемые и новые серьёзные CVE: октябрь 2024 г.
237 записей · 17 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
33Наблюдать | CVE-2012-10018Proof of concept | Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirptingmapplic · mapplic · CWE-918 | Высокая8,3 | — | 1,1 % | 16 окт. 2024 г. |
24Наблюдать | CVE-2016-15041Proof of concept | MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scriptingmainwp · mainwp dashboard · CWE-79 | Средняя6,1 | — | 1,3 % | 16 окт. 2024 г. |
24Наблюдать | CVE-2017-20192Proof of concept | Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scriptingstrategy11 · formidable form builder · CWE-79 | Средняя6,1 | — | 1,0 % | 16 окт. 2024 г. |
31Наблюдать | CVE-2019-25213Proof of concept | Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Readvasyltech · advanced access manager · CWE-22 | Высокая7,5 | — | 2,7 % | 16 окт. 2024 г. |
32Наблюдать | CVE-2020-36836Proof of concept | WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletionwpfastestcache · wp fastest cache · CWE-352 | Высокая8,0 | — | 1,4 % | 16 окт. 2024 г. |
39Наблюдать | CVE-2021-4448Proof of concept | Kaswara Modern VC Addons <= 3.0.1 - Missing Authorizationkaswara project · kaswara · CWE-862 | Критическая9,8 | — | 1,3 % | 16 окт. 2024 г. |
41В плане | CVE-2021-4449Proof of concept | ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Uploaddigitalzoomstudio · zoomsounds · CWE-434 | Критическая9,8 | — | 5,3 % | 16 окт. 2024 г. |
29Наблюдать | CVE-2022-4971Proof of concept | Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scriptingheateor · sassy social share · CWE-79 | Средняя6,1 | — | 17,3 % | 16 окт. 2024 г. |
41В плане | CVE-2016-15042Proof of concept | Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Uploadnajeebmedia · frontend file manager · CWE-434 | Критическая9,8 | — | 5,7 % | 16 окт. 2024 г. |
21Наблюдать | CVE-2017-20194Proof of concept | Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosurestrategy11 · formidable form builder · CWE-200 | Средняя5,3 | — | 1,1 % | 16 окт. 2024 г. |
35Наблюдать | CVE-2020-36842Proof of concept | Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Uploadwpvivid · migration\, backup\, staging · CWE-434 | Высокая8,8 | — | 1,1 % | 16 окт. 2024 г. |
40В плане | CVE-2023-22649Готовый эксплойт | Rancher 'Audit Log' leaks sensitive informationsuse · rancher · CWE-532 | Высокая8,4 | — | 2,0 % | 16 окт. 2024 г. |
67На этой неделе | CVE-2024-45216Proof of concept | Apache Solr: Authentication bypass possible using a fake URL Path endingapache · solr · CWE-287 | Критическая9,8 | — | 92,7 % | 16 окт. 2024 г. |
55В плане | CVE-2024-9061Proof of concept | WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Addthemehunk · wp popup builder · CWE-94 | Критическая9,8 | — | 52,2 % | 16 окт. 2024 г. |
37Наблюдать | CVE-2024-45844Эксплойта нет | BIG-IP monitors vulnerabilityf5 · big-ip access policy manager · CWE-306 | Высокая8,6 | — | 10,6 % | 16 окт. 2024 г. |
40В плане | CVE-2024-38814Эксплойта нет | An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware.vmware · vmware hcx · CWE-89 | Высокая8,8 | — | 15,4 % | 16 окт. 2024 г. |
22Наблюдать | CVE-2024-44762Proof of concept | A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.webmin · usermin · CWE-209 | Средняя5,3 | — | 2,5 % | 16 окт. 2024 г. |
28Наблюдать | CVE-2024-6333Proof of concept | Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Productsxerox · altalink® b8045 / b8055 / b8065 / b8075 / b8090 | c8030 / c8035 / c8045 / c8055 / c807 · CWE-77 | Высокая7,2 | — | 1,1 % | 17 окт. 2024 г. |
37Наблюдать | CVE-2024-48634Эксплойта нет | D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in tdlink · dir-882 firmware · CWE-78 | Высокая8,0 | — | 17,6 % | 17 окт. 2024 г. |
22Наблюдать | CVE-2023-39593Proof of concept | Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated prmariadb · mariadb · CWE-94 | Средняя5,6 | — | 0,7 % | 17 окт. 2024 г. |
22Наблюдать | CVE-2024-27766Proof of concept | An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function.mariadb · mariadb · CWE-94 | Средняя5,7 | — | 1,2 % | 17 окт. 2024 г. |
32Наблюдать | CVE-2024-33453Proof of concept | Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.espressif · esp-idf · CWE-120 | Высокая8,1 | — | 0,9 % | 17 окт. 2024 г. |
66На этой неделе | CVE-2024-9264Готовый эксплойт | Grafana SQL Expressions allow for remote code executiongrafana · grafana · CWE-94 | Критическая9,4 | — | 97,1 % | 18 окт. 2024 г. |
21Наблюдать | CVE-2024-38820Proof of concept | CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exceptionvmware · spring framework · CWE-178 | Средняя5,3 | — | 0,6 % | 18 окт. 2024 г. |
68На этой неделе | CVE-2024-9537Готовый эксплойт | ScienceLogic SL1 unspecified vulnerabilitysciencelogic · sl1 | Критическая9,3 | KEV | 3,8 % | 18 окт. 2024 г. |
37Наблюдать | CVE-2024-9593Proof of concept | Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Executionwpplugin · time clock · CWE-94 | Высокая8,3 | — | 12,4 % | 18 окт. 2024 г. |
56В плане | CVE-2024-37404Готовый эксплойт | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1ivanti · connect secure | Высокая8,8 | — | 70,9 % | 18 окт. 2024 г. |
21Наблюдать | CVE-2024-10140Proof of concept | code-projects Pharmacy Management System manage_supplier.php sql injectioncode-projects · pharmacy management system · CWE-89 | Средняя5,3 | — | 1,3 % | 19 окт. 2024 г. |
25Наблюдать | CVE-2024-10193Эксплойта нет | WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping_ddns command injectionwavlink · wn530h4 firmware · CWE-77 | Средняя5,1 | — | 15,4 % | 20 окт. 2024 г. |
39Наблюдать | CVE-2024-49328Proof of concept | WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerabilityvivektamrakar · wp rest api fns · CWE-288 | Критическая9,8 | — | 1,4 % | 20 окт. 2024 г. |
39Наблюдать | CVE-2024-49607Proof of concept | WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerabilityredwanhilali · wp dropbox dropins · CWE-434 | Критическая9,8 | — | 1,0 % | 20 окт. 2024 г. |
64На этой неделе | CVE-2024-44000Готовый эксплойт | WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerabilitylitespeedtech · litespeed cache · CWE-522 | Критическая9,8 | — | 82,3 % | 20 окт. 2024 г. |
29Наблюдать | CVE-2024-8625Proof of concept | TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injectiontotal-soft · ts poll · CWE-89 | Высокая7,2 | — | 2,3 % | 21 окт. 2024 г. |
60На этой неделе | CVE-2024-45309Готовый эксплойт | OneDev vulnerable to arbitrary file reading for unauthenticated useronedev project · onedev · CWE-200 | Высокая8,7 | — | 24,5 % | 21 окт. 2024 г. |
43В плане | CVE-2024-49368Proof of concept | Unchecked logrotate settings lead to arbitrary command executionnginxui · nginx ui · CWE-20 | Высокая8,9 | — | 27,6 % | 21 окт. 2024 г. |
31Наблюдать | CVE-2024-49882Proof of concept | ext4: fix double brelse() the buffer of the extents pathlinux · linux kernel · CWE-415 | Высокая7,8 | — | 0,3 % | 21 окт. 2024 г. |
59В плане | CVE-2024-35286Proof of concept | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection mitel · micollab · CWE-89 | Критическая9,8 | — | 65,7 % | 21 окт. 2024 г. |
22Наблюдать | CVE-2024-35315Proof of concept | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2mitel · micollab · CWE-94 | Средняя5,6 | — | 0,7 % | 21 окт. 2024 г. |
95Срочно | CVE-2024-41713Готовый эксплойт | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthentimitel · micollab · CWE-22 | Критическая9,1 | KEV | 97,2 % | 21 окт. 2024 г. |
21Наблюдать | CVE-2024-8852Proof of concept | All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logsservmask · all-in-one wp migration · CWE-200 | Средняя5,3 | — | 1,1 % | 22 окт. 2024 г. |
21Наблюдать | CVE-2022-23861Proof of concept | Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53.ysoft · safeq · CWE-79 | Средняя5,4 | — | 0,5 % | 22 окт. 2024 г. |
31Наблюдать | CVE-2022-23862Proof of concept | A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53.ysoft · safeq · CWE-306 | Высокая7,8 | — | 0,4 % | 22 окт. 2024 г. |
31Наблюдать | CVE-2024-48605Proof of concept | An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wowhelakuru · helakuru · CWE-427 | Высокая7,8 | — | 0,5 % | 22 окт. 2024 г. |
41В плане | CVE-2024-45518Эксплойта нет | An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Pzimbra · collaboration · CWE-918 | Высокая8,8 | — | 20,7 % | 22 окт. 2024 г. |
43В плане | CVE-2024-46538Proof of concept | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadnetgate · pfsense · CWE-79 | Средняя4,8 | — | 80,2 % | 22 окт. 2024 г. |
39Наблюдать | CVE-2024-44812Proof of concept | SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password parjanobe · online complaint site · CWE-89 | Критическая9,8 | — | 1,2 % | 22 окт. 2024 г. |
39Наблюдать | CVE-2024-46483Proof of concept | Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap ovCWE-190 | Критическая9,8 | — | 1,1 % | 22 окт. 2024 г. |
20Наблюдать | CVE-2024-48415Proof of concept | itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middlrazormist · loan management system · CWE-79 | Средняя5,0 | — | 0,3 % | 22 окт. 2024 г. |
21Наблюдать | CVE-2024-48644Proof of concept | Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remoteCWE-203 | Средняя5,3 | — | 0,7 % | 22 окт. 2024 г. |
19Наблюдать | CVE-2024-48652Proof of concept | Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name fieldtuzitio · camaleon cms · CWE-79 | Средняя4,8 | — | 1,1 % | 22 окт. 2024 г. |
25Наблюдать | CVE-2024-50050Proof of concept | Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potenmeta platforms, inc · llama stack · CWE-502 | Средняя6,3 | — | 0,8 % | 23 окт. 2024 г. |
97Срочно | CVE-2024-47575Готовый эксплойт | A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fofortinet · fortimanager · CWE-306 | Критическая9,8 | KEV | 94,7 % | 23 окт. 2024 г. |
23Наблюдать | CVE-2024-5764Proof of concept | Nexus Repository 3 - Static hard-coded encryption passphrase used by defaultsonatype · nexus repository manager · CWE-798 | Средняя5,9 | — | 0,3 % | 23 окт. 2024 г. |
39Наблюдать | CVE-2024-49653Proof of concept | WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerabilityjames-eggers · portfolleo · CWE-434 | Критическая9,9 | — | 1,1 % | 23 окт. 2024 г. |
40В плане | CVE-2024-49668Proof of concept | WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerabilitychristopherdewese1099 · verbalize wp · CWE-434 | Критическая10,0 | — | 1,4 % | 23 окт. 2024 г. |
23Наблюдать | CVE-2024-20384Эксплойта нет | A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Decisco · adaptive security appliance software · CWE-290 | Средняя5,8 | — | 0,4 % | 23 окт. 2024 г. |
60На этой неделе | CVE-2024-20481Готовый эксплойт | A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defecisco · secure firewall threat defense · CWE-772 | Средняя5,8 | KEV | 15,8 % | 23 окт. 2024 г. |
35Наблюдать | CVE-2024-40431Proof of concept | A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUG | Высокая8,8 | — | 1,2 % | 23 окт. 2024 г. |
26Наблюдать | CVE-2024-40432Proof of concept | A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_C | Средняя6,5 | — | 0,3 % | 23 окт. 2024 г. |
31Наблюдать | CVE-2024-6049Proof of concept | Unauthenticated Path Traversallawo ag · vsm ltc time sync (vtimesync) · CWE-32 | Высокая7,5 | — | 4,2 % | 24 окт. 2024 г. |
37Наблюдать | CVE-2024-49681Proof of concept | WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerabilityactivity-log.com · wp sessions time monitoring full automatic · CWE-89 | Критическая9,3 | — | 1,0 % | 24 окт. 2024 г. |
30Наблюдать | CVE-2024-48139Proof of concept | A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequentCWE-77 | Высокая7,5 | — | 0,4 % | 24 окт. 2024 г. |
35Наблюдать | CVE-2024-48427Proof of concept | A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitoretnom23 · packers and movers management system · CWE-89 | Высокая8,8 | — | 0,9 % | 24 окт. 2024 г. |
42В плане | CVE-2024-45242Эксплойта нет | EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping oCWE-78 | Высокая7,8 | — | 35,3 % | 24 окт. 2024 г. |
34Наблюдать | CVE-2024-48208Proof of concept | pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow.pureftpd · pure-ftpd · CWE-125 | Высокая8,6 | — | 1,5 % | 24 окт. 2024 г. |
37Наблюдать | CVE-2024-49357Proof of concept | ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leakzimaspace · zimaos · CWE-200 | Высокая7,5 | — | 23,6 % | 24 окт. 2024 г. |
20Наблюдать | CVE-2024-10354Proof of concept | SourceCodester Petrol Pump Management Software print.php sql injectionmayurik · petrol pump management · CWE-89 | Средняя5,1 | — | 0,7 % | 24 окт. 2024 г. |
20Наблюдать | CVE-2024-10355Proof of concept | SourceCodester Petrol Pump Management Software invoice.php sql injectionmayurik · petrol pump management · CWE-89 | Средняя5,1 | — | 0,9 % | 24 окт. 2024 г. |
36Наблюдать | CVE-2024-49380Proof of concept | Plenti arbitrary file write vulnerabilityplenti · plenti · CWE-74 | Высокая8,9 | — | 2,7 % | 25 окт. 2024 г. |
20Наблюдать | CVE-2024-49757Proof of concept | Zitadel User Registration Bypass Vulnerabilityzitadel · zitadel · CWE-287 | Средняя4,9 | — | 2,5 % | 25 окт. 2024 г. |
43В плане | CVE-2024-10386Эксплойта нет | Rockwell Automation FactoryTalk ThinManager Authentication Vulnerabilityrockwellautomation · thinmanager · CWE-306 | Критическая9,3 | — | 19,3 % | 25 окт. 2024 г. |
35Наблюдать | CVE-2024-9890Proof of concept | User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypassderyck · user toolkit · CWE-288 | Высокая8,8 | — | 1,0 % | 25 окт. 2024 г. |
50В плане | CVE-2024-9932Proof of concept | Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Uploadjurredeklijn · wux blog editor · CWE-434 | Критическая9,8 | — | 36,3 % | 25 окт. 2024 г. |
40В плане | CVE-2024-9933Proof of concept | WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Checkwatchtowerhq · watchtowerhq · CWE-288 | Критическая9,8 | — | 1,9 % | 25 окт. 2024 г. |
29Наблюдать | CVE-2024-9772Proof of concept | Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Executionuiux · uix shortcodes · CWE-94 | Высокая7,3 | — | 1,4 % | 26 окт. 2024 г. |
21Наблюдать | CVE-2024-10410Proof of concept | SourceCodester Online Hotel Reservation System controller.php upload unrestricted uploadjanobe · online hotel reservation system · CWE-434 | Средняя5,3 | — | 1,1 % | 27 окт. 2024 г. |
23Наблюдать | CVE-2024-50602Proof of concept | An issue was discovered in libexpat before 2.6.4.netapp · active iq unified manager · CWE-754 | Средняя5,9 | — | 1,1 % | 27 окт. 2024 г. |
38Наблюдать | CVE-2024-10428Эксплойта нет | WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injectionwavlink · wn530h4 firmware · CWE-77 | Высокая8,6 | — | 14,8 % | 27 окт. 2024 г. |
39Наблюдать | CVE-2024-10429Эксплойта нет | WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set_ipv6 command injectionwavlink · wn530h4 firmware · CWE-77 | Высокая8,6 | — | 18,2 % | 27 окт. 2024 г. |
99Срочно | CVE-2024-50623Готовый эксплойт | In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download thcleo · harmony · CWE-434 | Критическая9,8 | KEV | 98,6 % | 28 окт. 2024 г. |
29Наблюдать | CVE-2024-9162Proof of concept | All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injectionservmask · all-in-one wp migration and backup · CWE-94 | Высокая7,2 | — | 2,7 % | 28 окт. 2024 г. |
37Наблюдать | CVE-2024-38821Proof of concept | Authorization Bypass of Static Resources in WebFlux Applicationsspring · spring · CWE-770 | Критическая9,1 | — | 1,7 % | 28 окт. 2024 г. |
39Наблюдать | CVE-2024-50450Proof of concept | WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerabilitypluginus · wordpress meta data and taxonomies filter · CWE-94 | Критическая9,8 | — | 1,1 % | 28 окт. 2024 г. |
41В плане | CVE-2024-50477Proof of concept | WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerabilitystacksmarket · stacks mobile app builder · CWE-288 | Критическая9,8 | — | 8,1 % | 28 окт. 2024 г. |
39Наблюдать | CVE-2024-50492Proof of concept | WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerabilitywpplugin · scottcart · CWE-94 | Критическая9,8 | — | 1,3 % | 28 окт. 2024 г. |
55В плане | CVE-2024-50498Proof of concept | WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerabilitylubus · wp query console · CWE-94 | Критическая9,8 | — | 52,9 % | 28 окт. 2024 г. |
39Наблюдать | CVE-2024-50478Proof of concept | WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerabilityswoopnow · 1-click login\ · CWE-305 | Критическая9,8 | — | 1,1 % | 28 окт. 2024 г. |
40В плане | CVE-2024-50483Proof of concept | WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerabilitytareqhasan · meetup · CWE-639 | Критическая9,8 | — | 2,3 % | 28 окт. 2024 г. |
35Наблюдать | CVE-2024-50488Proof of concept | WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerabilitypriyabratasarkar · token login · CWE-288 | Высокая8,8 | — | 0,9 % | 28 окт. 2024 г. |
39Наблюдать | CVE-2024-50491Proof of concept | WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerabilitymicahblu · rsvp me · CWE-89 | Критическая9,8 | — | 1,0 % | 28 окт. 2024 г. |
27Наблюдать | CVE-2024-10448Proof of concept | code-projects Blood Bank Management System delete.php cross-site request forgeryfabian · blood bank management system · CWE-352 | Средняя6,9 | — | 0,4 % | 28 окт. 2024 г. |
27Наблюдать | CVE-2024-10449Proof of concept | Codezips Hospital Appointment System loginAction.php sql injectioncodezips · hospital appointment system · CWE-89 | Средняя6,9 | — | 1,4 % | 28 окт. 2024 г. |
44В плане | CVE-2024-45802Эксплойта нет | Squid Denial of Servicesquid-cache · squid · CWE-20 | Высокая7,5 | — | 47,8 % | 28 окт. 2024 г. |
60На этой неделе | CVE-2024-39205Готовый эксплойт | An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request | Критическая9,8 | — | 16,5 % | 28 окт. 2024 г. |
25Наблюдать | CVE-2024-44236Эксплойта нет | An out-of-bounds access issue was addressed with improved bounds checking.apple · macos · CWE-125 | Средняя5,5 | — | 11,4 % | 28 окт. 2024 г. |
28Наблюдать | CVE-2024-44258Proof of concept | This issue was addressed with improved handling of symlinks.apple · ipados · CWE-59 | Высокая7,1 | — | 0,7 % | 28 окт. 2024 г. |
31Наблюдать | CVE-2024-44285Proof of concept | A use-after-free issue was addressed with improved memory management.apple · ipados · CWE-416 | Высокая7,8 | — | 0,6 % | 28 окт. 2024 г. |
40В плане | CVE-2024-48594Готовый эксплойт | File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload componentfast5 · prison management system · CWE-434 | Высокая8,8 | — | 3,3 % | 28 окт. 2024 г. |
40В плане | CVE-2024-50482Proof of concept | WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerabilitychetan khandla · woocommerce product design · CWE-434 | Критическая10,0 | — | 1,0 % | 29 окт. 2024 г. |
40В плане | CVE-2024-50493Proof of concept | WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerabilitymasterhomepage · automatic translation · CWE-434 | Критическая10,0 | — | 1,0 % | 29 окт. 2024 г. |
- CVE-2012-1001833Наблюдать
Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting
ВысокаяCVSS 8,3Proof of conceptEPSS 1 %mapplic · mapplic16 окт. 2024 г.
- CVE-2016-1504124Наблюдать
MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting
СредняяCVSS 6,1Proof of conceptEPSS 1 %mainwp · mainwp dashboard16 окт. 2024 г.
- CVE-2017-2019224Наблюдать
Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting
СредняяCVSS 6,1Proof of conceptEPSS 1 %strategy11 · formidable form builder16 окт. 2024 г.
- CVE-2019-2521331Наблюдать
Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %vasyltech · advanced access manager16 окт. 2024 г.
- CVE-2020-3683632Наблюдать
WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion
ВысокаяCVSS 8,0Proof of conceptEPSS 1 %wpfastestcache · wp fastest cache16 окт. 2024 г.
- CVE-2021-444839Наблюдать
Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization
КритическаяCVSS 9,8Proof of conceptEPSS 1 %kaswara project · kaswara16 окт. 2024 г.
- CVE-2021-444941В плане
ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 5 %digitalzoomstudio · zoomsounds16 окт. 2024 г.
- CVE-2022-497129Наблюдать
Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting
СредняяCVSS 6,1Proof of conceptEPSS 17 %heateor · sassy social share16 окт. 2024 г.
- CVE-2016-1504241В плане
Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 5 %najeebmedia · frontend file manager16 окт. 2024 г.
- CVE-2017-2019421Наблюдать
Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
СредняяCVSS 5,3Proof of conceptEPSS 1 %strategy11 · formidable form builder16 окт. 2024 г.
- CVE-2020-3684235Наблюдать
Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %wpvivid · migration\, backup\, staging16 окт. 2024 г.
- CVE-2023-2264940В плане
Rancher 'Audit Log' leaks sensitive information
ВысокаяCVSS 8,4Готовый эксплойтEPSS 2 %suse · rancher16 окт. 2024 г.
- CVE-2024-4521667На этой неделе
Apache Solr: Authentication bypass possible using a fake URL Path ending
КритическаяCVSS 9,8Proof of conceptEPSS 92 %apache · solr16 окт. 2024 г.
- CVE-2024-906155В плане
WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add
КритическаяCVSS 9,8Proof of conceptEPSS 52 %themehunk · wp popup builder16 окт. 2024 г.
- CVE-2024-4584437Наблюдать
BIG-IP monitors vulnerability
ВысокаяCVSS 8,6Эксплойта нетEPSS 10 %f5 · big-ip access policy manager16 окт. 2024 г.
- CVE-2024-3881440В плане
An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware.
ВысокаяCVSS 8,8Эксплойта нетEPSS 15 %vmware · vmware hcx16 окт. 2024 г.
- CVE-2024-4476222Наблюдать
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
СредняяCVSS 5,3Proof of conceptEPSS 2 %webmin · usermin16 окт. 2024 г.
- CVE-2024-633328Наблюдать
Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %xerox · altalink® b8045 / b8055 / b8065 / b8075 / b8090 | c8030 / c8035 / c8045 / c8055 / c80717 окт. 2024 г.
- CVE-2024-4863437Наблюдать
D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in t
ВысокаяCVSS 8,0Эксплойта нетEPSS 17 %dlink · dir-882 firmware17 окт. 2024 г.
- CVE-2023-3959322Наблюдать
Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated pr
СредняяCVSS 5,6Proof of conceptEPSS 0 %mariadb · mariadb17 окт. 2024 г.
- CVE-2024-2776622Наблюдать
An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function.
СредняяCVSS 5,7Proof of conceptEPSS 1 %mariadb · mariadb17 окт. 2024 г.
- CVE-2024-3345332Наблюдать
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %espressif · esp-idf17 окт. 2024 г.
- CVE-2024-926466На этой неделе
Grafana SQL Expressions allow for remote code execution
КритическаяCVSS 9,4Готовый эксплойтEPSS 97 %grafana · grafana18 окт. 2024 г.
- CVE-2024-3882021Наблюдать
CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
СредняяCVSS 5,3Proof of conceptEPSS 0 %vmware · spring framework18 окт. 2024 г.
- CVE-2024-953768На этой неделе
ScienceLogic SL1 unspecified vulnerability
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 3 %sciencelogic · sl118 окт. 2024 г.
- CVE-2024-959337Наблюдать
Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution
ВысокаяCVSS 8,3Proof of conceptEPSS 12 %wpplugin · time clock18 окт. 2024 г.
- CVE-2024-3740456В плане
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1
ВысокаяCVSS 8,8Готовый эксплойтEPSS 70 %ivanti · connect secure18 окт. 2024 г.
- CVE-2024-1014021Наблюдать
code-projects Pharmacy Management System manage_supplier.php sql injection
СредняяCVSS 5,3Proof of conceptEPSS 1 %code-projects · pharmacy management system19 окт. 2024 г.
- CVE-2024-1019325Наблюдать
WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping_ddns command injection
СредняяCVSS 5,1Эксплойта нетEPSS 15 %wavlink · wn530h4 firmware20 окт. 2024 г.
- CVE-2024-4932839Наблюдать
WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %vivektamrakar · wp rest api fns20 окт. 2024 г.
- CVE-2024-4960739Наблюдать
WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %redwanhilali · wp dropbox dropins20 окт. 2024 г.
- CVE-2024-4400064На этой неделе
WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability
КритическаяCVSS 9,8Готовый эксплойтEPSS 82 %litespeedtech · litespeed cache20 окт. 2024 г.
- CVE-2024-862529Наблюдать
TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injection
ВысокаяCVSS 7,2Proof of conceptEPSS 2 %total-soft · ts poll21 окт. 2024 г.
- CVE-2024-4530960На этой неделе
OneDev vulnerable to arbitrary file reading for unauthenticated user
ВысокаяCVSS 8,7Готовый эксплойтEPSS 24 %onedev project · onedev21 окт. 2024 г.
- CVE-2024-4936843В плане
Unchecked logrotate settings lead to arbitrary command execution
ВысокаяCVSS 8,9Proof of conceptEPSS 27 %nginxui · nginx ui21 окт. 2024 г.
- CVE-2024-4988231Наблюдать
ext4: fix double brelse() the buffer of the extents path
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %linux · linux kernel21 окт. 2024 г.
- CVE-2024-3528659В плане
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection
КритическаяCVSS 9,8Proof of conceptEPSS 65 %mitel · micollab21 окт. 2024 г.
- CVE-2024-3531522Наблюдать
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2
СредняяCVSS 5,6Proof of conceptEPSS 0 %mitel · micollab21 окт. 2024 г.
- CVE-2024-4171395Срочно
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenti
КритическаяCVSS 9,1KEVГотовый эксплойтEPSS 97 %mitel · micollab21 окт. 2024 г.
- CVE-2024-885221Наблюдать
All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs
СредняяCVSS 5,3Proof of conceptEPSS 1 %servmask · all-in-one wp migration22 окт. 2024 г.
- CVE-2022-2386121Наблюдать
Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53.
СредняяCVSS 5,4Proof of conceptEPSS 0 %ysoft · safeq22 окт. 2024 г.
- CVE-2022-2386231Наблюдать
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %ysoft · safeq22 окт. 2024 г.
- CVE-2024-4860531Наблюдать
An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %helakuru · helakuru22 окт. 2024 г.
- CVE-2024-4551841В плане
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before P
ВысокаяCVSS 8,8Эксплойта нетEPSS 20 %zimbra · collaboration22 окт. 2024 г.
- CVE-2024-4653843В плане
A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
СредняяCVSS 4,8Proof of conceptEPSS 80 %netgate · pfsense22 окт. 2024 г.
- CVE-2024-4481239Наблюдать
SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password par
КритическаяCVSS 9,8Proof of conceptEPSS 1 %janobe · online complaint site22 окт. 2024 г.
- CVE-2024-4648339Наблюдать
Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap ov
КритическаяCVSS 9,8Proof of conceptEPSS 1 %22 окт. 2024 г.
- CVE-2024-4841520Наблюдать
itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middl
СредняяCVSS 5,0Proof of conceptEPSS 0 %razormist · loan management system22 окт. 2024 г.
- CVE-2024-4864421Наблюдать
Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote
СредняяCVSS 5,3Proof of conceptEPSS 0 %22 окт. 2024 г.
- CVE-2024-4865219Наблюдать
Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field
СредняяCVSS 4,8Proof of conceptEPSS 1 %tuzitio · camaleon cms22 окт. 2024 г.
- CVE-2024-5005025Наблюдать
Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, poten
СредняяCVSS 6,3Proof of conceptEPSS 0 %meta platforms, inc · llama stack23 окт. 2024 г.
- CVE-2024-4757597Срочно
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fo
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 94 %fortinet · fortimanager23 окт. 2024 г.
- CVE-2024-576423Наблюдать
Nexus Repository 3 - Static hard-coded encryption passphrase used by default
СредняяCVSS 5,9Proof of conceptEPSS 0 %sonatype · nexus repository manager23 окт. 2024 г.
- CVE-2024-4965339Наблюдать
WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,9Proof of conceptEPSS 1 %james-eggers · portfolleo23 окт. 2024 г.
- CVE-2024-4966840В плане
WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %christopherdewese1099 · verbalize wp23 окт. 2024 г.
- CVE-2024-2038423Наблюдать
A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat De
СредняяCVSS 5,8Эксплойта нетEPSS 0 %cisco · adaptive security appliance software23 окт. 2024 г.
- CVE-2024-2048160На этой неделе
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defe
СредняяCVSS 5,8KEVГотовый эксплойтEPSS 15 %cisco · secure firewall threat defense23 окт. 2024 г.
- CVE-2024-4043135Наблюдать
A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUG
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %23 окт. 2024 г.
- CVE-2024-4043226Наблюдать
A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_C
СредняяCVSS 6,5Proof of conceptEPSS 0 %23 окт. 2024 г.
- CVE-2024-604931Наблюдать
Unauthenticated Path Traversal
ВысокаяCVSS 7,5Proof of conceptEPSS 4 %lawo ag · vsm ltc time sync (vtimesync)24 окт. 2024 г.
- CVE-2024-4968137Наблюдать
WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %activity-log.com · wp sessions time monitoring full automatic24 окт. 2024 г.
- CVE-2024-4813930Наблюдать
A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %24 окт. 2024 г.
- CVE-2024-4842735Наблюдать
A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbit
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %oretnom23 · packers and movers management system24 окт. 2024 г.
- CVE-2024-4524242В плане
EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping o
ВысокаяCVSS 7,8Эксплойта нетEPSS 35 %24 окт. 2024 г.
- CVE-2024-4820834Наблюдать
pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow.
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %pureftpd · pure-ftpd24 окт. 2024 г.
- CVE-2024-4935737Наблюдать
ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak
ВысокаяCVSS 7,5Proof of conceptEPSS 23 %zimaspace · zimaos24 окт. 2024 г.
- CVE-2024-1035420Наблюдать
SourceCodester Petrol Pump Management Software print.php sql injection
СредняяCVSS 5,1Proof of conceptEPSS 0 %mayurik · petrol pump management24 окт. 2024 г.
- CVE-2024-1035520Наблюдать
SourceCodester Petrol Pump Management Software invoice.php sql injection
СредняяCVSS 5,1Proof of conceptEPSS 0 %mayurik · petrol pump management24 окт. 2024 г.
- CVE-2024-4938036Наблюдать
Plenti arbitrary file write vulnerability
ВысокаяCVSS 8,9Proof of conceptEPSS 2 %plenti · plenti25 окт. 2024 г.
- CVE-2024-4975720Наблюдать
Zitadel User Registration Bypass Vulnerability
СредняяCVSS 4,9Proof of conceptEPSS 2 %zitadel · zitadel25 окт. 2024 г.
- CVE-2024-1038643В плане
Rockwell Automation FactoryTalk ThinManager Authentication Vulnerability
КритическаяCVSS 9,3Эксплойта нетEPSS 19 %rockwellautomation · thinmanager25 окт. 2024 г.
- CVE-2024-989035Наблюдать
User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %deryck · user toolkit25 окт. 2024 г.
- CVE-2024-993250В плане
Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 36 %jurredeklijn · wux blog editor25 окт. 2024 г.
- CVE-2024-993340В плане
WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check
КритическаяCVSS 9,8Proof of conceptEPSS 1 %watchtowerhq · watchtowerhq25 окт. 2024 г.
- CVE-2024-977229Наблюдать
Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution
ВысокаяCVSS 7,3Proof of conceptEPSS 1 %uiux · uix shortcodes26 окт. 2024 г.
- CVE-2024-1041021Наблюдать
SourceCodester Online Hotel Reservation System controller.php upload unrestricted upload
СредняяCVSS 5,3Proof of conceptEPSS 1 %janobe · online hotel reservation system27 окт. 2024 г.
- CVE-2024-5060223Наблюдать
An issue was discovered in libexpat before 2.6.4.
СредняяCVSS 5,9Proof of conceptEPSS 1 %netapp · active iq unified manager27 окт. 2024 г.
- CVE-2024-1042838Наблюдать
WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injection
ВысокаяCVSS 8,6Эксплойта нетEPSS 14 %wavlink · wn530h4 firmware27 окт. 2024 г.
- CVE-2024-1042939Наблюдать
WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set_ipv6 command injection
ВысокаяCVSS 8,6Эксплойта нетEPSS 18 %wavlink · wn530h4 firmware27 окт. 2024 г.
- CVE-2024-5062399Срочно
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download th
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 98 %cleo · harmony28 окт. 2024 г.
- CVE-2024-916229Наблюдать
All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection
ВысокаяCVSS 7,2Proof of conceptEPSS 2 %servmask · all-in-one wp migration and backup28 окт. 2024 г.
- CVE-2024-3882137Наблюдать
Authorization Bypass of Static Resources in WebFlux Applications
КритическаяCVSS 9,1Proof of conceptEPSS 1 %spring · spring28 окт. 2024 г.
- CVE-2024-5045039Наблюдать
WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %pluginus · wordpress meta data and taxonomies filter28 окт. 2024 г.
- CVE-2024-5047741В плане
WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 8 %stacksmarket · stacks mobile app builder28 окт. 2024 г.
- CVE-2024-5049239Наблюдать
WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %wpplugin · scottcart28 окт. 2024 г.
- CVE-2024-5049855В плане
WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 52 %lubus · wp query console28 окт. 2024 г.
- CVE-2024-5047839Наблюдать
WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %swoopnow · 1-click login\28 окт. 2024 г.
- CVE-2024-5048340В плане
WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 2 %tareqhasan · meetup28 окт. 2024 г.
- CVE-2024-5048835Наблюдать
WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %priyabratasarkar · token login28 окт. 2024 г.
- CVE-2024-5049139Наблюдать
WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %micahblu · rsvp me28 окт. 2024 г.
- CVE-2024-1044827Наблюдать
code-projects Blood Bank Management System delete.php cross-site request forgery
СредняяCVSS 6,9Proof of conceptEPSS 0 %fabian · blood bank management system28 окт. 2024 г.
- CVE-2024-1044927Наблюдать
Codezips Hospital Appointment System loginAction.php sql injection
СредняяCVSS 6,9Proof of conceptEPSS 1 %codezips · hospital appointment system28 окт. 2024 г.
- CVE-2024-4580244В плане
Squid Denial of Service
ВысокаяCVSS 7,5Эксплойта нетEPSS 47 %squid-cache · squid28 окт. 2024 г.
- CVE-2024-3920560На этой неделе
An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request
КритическаяCVSS 9,8Готовый эксплойтEPSS 16 %28 окт. 2024 г.
- CVE-2024-4423625Наблюдать
An out-of-bounds access issue was addressed with improved bounds checking.
СредняяCVSS 5,5Эксплойта нетEPSS 11 %apple · macos28 окт. 2024 г.
- CVE-2024-4425828Наблюдать
This issue was addressed with improved handling of symlinks.
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %apple · ipados28 окт. 2024 г.
- CVE-2024-4428531Наблюдать
A use-after-free issue was addressed with improved memory management.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %apple · ipados28 окт. 2024 г.
- CVE-2024-4859440В плане
File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component
ВысокаяCVSS 8,8Готовый эксплойтEPSS 3 %fast5 · prison management system28 окт. 2024 г.
- CVE-2024-5048240В плане
WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %chetan khandla · woocommerce product design29 окт. 2024 г.
- CVE-2024-5049340В плане
WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %masterhomepage · automatic translation29 окт. 2024 г.