По дате публикации
Эксплуатируемые и новые серьёзные CVE: октябрь 2024 г.
238 записей · 17 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 3 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
39Наблюдать | CVE-2024-50427Proof of concept | WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerabilitydevsoftbaltic · surveyjs · CWE-434 | Критическая9,9 | — | 1,0 % | 29 окт. 2024 г. |
40В плане | CVE-2024-50473Proof of concept | WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerabilityajar productions · ajar in5 embed · CWE-434 | Критическая10,0 | — | 1,0 % | 29 окт. 2024 г. |
39Наблюдать | CVE-2024-50475Proof of concept | WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerabilityscott gamon · signup page · CWE-862 | Критическая9,8 | — | 1,2 % | 29 окт. 2024 г. |
39Наблюдать | CVE-2024-50476Proof of concept | WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerabilitygrün software group gmbh · grün spendino spendenformular · CWE-862 | Критическая9,8 | — | 1,2 % | 29 окт. 2024 г. |
39Наблюдать | CVE-2024-50485Proof of concept | WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerabilityudit rawat · exam matrix · CWE-266 | Критическая9,8 | — | 0,9 % | 29 окт. 2024 г. |
39Наблюдать | CVE-2024-50490Proof of concept | WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerabilitylowcage · pegapoll · CWE-862 | Критическая9,8 | — | 0,9 % | 29 окт. 2024 г. |
26Наблюдать | CVE-2024-10465Эксплойта нет | A clipboard "paste" button could persist across tabs which allowed a spoofing attack.mozilla · firefox · CWE-290 | Средняя6,5 | — | 0,5 % | 29 окт. 2024 г. |
48В плане | CVE-2024-5982Эксплойта нет | Path Traversal in gaizhenbiao/chuanhuchatgptgaizhenbiao · chuanhuchatgpt · CWE-22 | Критическая9,8 | — | 31,3 % | 29 окт. 2024 г. |
43В плане | CVE-2024-8309Proof of concept | SQL Injection in langchain-ai/langchainlangchain · langchain · CWE-89 | Критическая9,8 | — | 13,7 % | 29 окт. 2024 г. |
34Наблюдать | CVE-2024-50334Proof of concept | Semicolon Path Injection on API /api;/configerudika · scoold · CWE-288 | Высокая8,7 | — | 1,0 % | 29 окт. 2024 г. |
36Наблюдать | CVE-2024-7985Proof of concept | FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Uploadfileorganizer · fileorganizer · CWE-434 | Высокая8,8 | — | 2,3 % | 29 окт. 2024 г. |
41В плане | CVE-2024-9989Proof of concept | Crypto <= 2.18 - Authentication Bypass via log_inodude · crypto tool · CWE-288 | Критическая9,8 | — | 7,1 % | 29 окт. 2024 г. |
32Наблюдать | CVE-2024-48955Proof of concept | Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, theCWE-284 | Высокая8,1 | — | 0,6 % | 29 окт. 2024 г. |
39Наблюдать | CVE-2024-48573Proof of concept | A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account pasaquila-cms · aquilacms · CWE-89 | Критическая9,8 | — | 1,0 % | 29 окт. 2024 г. |
97Срочно | CVE-2024-51378Готовый эксплойт | getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticatcyberpanel · cyberpanel · CWE-78 | Критическая9,8 | KEV | 94,7 % | 29 окт. 2024 г. |
94Срочно | CVE-2024-51567Готовый эксплойт | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication andcyberpanel · cyberpanel · CWE-306 | Критическая9,8 | KEV | 84,4 % | 29 окт. 2024 г. |
60На этой неделе | CVE-2024-51568Готовый эксплойт | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.cyberpanel · cyberpanel · CWE-78 | Критическая9,8 | — | 47,6 % | 29 окт. 2024 г. |
39Наблюдать | CVE-2024-50507Proof of concept | WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerabilitydaschmi · ds.downloadlist · CWE-502 | Критическая9,8 | — | 1,0 % | 30 окт. 2024 г. |
30Наблюдать | CVE-2024-50508Proof of concept | WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerabilitychetan khandla · woocommerce product design · CWE-22 | Высокая7,5 | — | 1,0 % | 30 окт. 2024 г. |
34Наблюдать | CVE-2024-50509Proof of concept | WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerabilitychetan khandla · woocommerce product design · CWE-22 | Высокая8,6 | — | 1,3 % | 30 окт. 2024 г. |
40В плане | CVE-2024-50510Proof of concept | WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerabilitywebandprint · ar for woocommerce · CWE-434 | Критическая10,0 | — | 1,0 % | 30 окт. 2024 г. |
46В плане | CVE-2024-10525Эксплойта нет | Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callbackeclipse · mosquitto · CWE-122 | Высокая7,2 | — | 59,2 % | 30 окт. 2024 г. |
35Наблюдать | CVE-2024-31152Эксплойта нет | The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series level1 · wbr-6012 firmware · CWE-400 | Высокая7,5 | — | 17,8 % | 30 окт. 2024 г. |
34Наблюдать | CVE-2024-33623Эксплойта нет | A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6.level1 · wbr-6012 firmware · CWE-835 | Высокая7,5 | — | 11,8 % | 30 окт. 2024 г. |
38Наблюдать | CVE-2024-33699Эксплойта нет | The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminislevel1 · wbr-6012 firmware · CWE-620 | Высокая8,8 | — | 11,2 % | 30 окт. 2024 г. |
42В плане | CVE-2024-10456Эксплойта нет | Delta Electronics InfraSuite Device Master Deserialization of Untrusted Datadelta electronics · infrasuite device master · CWE-502 | Критическая9,3 | — | 17,5 % | 30 окт. 2024 г. |
23Наблюдать | CVE-2024-10005Proof of concept | Consul L7 Intentions Vulnerable To URL Path Bypasshashicorp · consul · CWE-22 | Средняя5,8 | — | 0,7 % | 30 окт. 2024 г. |
27Наблюдать | CVE-2024-10557Proof of concept | code-projects Blood Bank Management System updateprofile.php cross-site request forgeryfabian · blood bank management system · CWE-352 | Средняя6,9 | — | 0,6 % | 30 окт. 2024 г. |
54В плане | CVE-2024-48307Proof of concept | JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.jeecg · jeecg boot · CWE-89 | Критическая9,8 | — | 50,0 % | 30 окт. 2024 г. |
43В плане | CVE-2024-10392Эксплойта нет | AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Uploadsenols · ai puffer – your ai engine for wordpress (formerly ai power) · CWE-434 | Критическая9,8 | — | 14,9 % | 31 окт. 2024 г. |
39Наблюдать | CVE-2024-48910Proof of concept | DOMPurify vulnerable to tampering by prototype polutioncure53 · dompurify · CWE-1321 | Критическая9,8 | — | 1,1 % | 31 окт. 2024 г. |
25Наблюдать | CVE-2024-51430Proof of concept | Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary CWE-79 | Средняя6,4 | — | 0,5 % | 31 окт. 2024 г. |
50В плане | CVE-2024-51482Proof of concept | Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64zoneminder · zoneminder · CWE-89 | Критическая9,9 | — | 36,6 % | 31 окт. 2024 г. |
31Наблюдать | CVE-2024-39719Proof of concept | An issue was discovered in Ollama through 0.3.14.ollama · ollama · CWE-209 | Высокая7,5 | — | 4,2 % | 31 окт. 2024 г. |
31Наблюдать | CVE-2024-39722Proof of concept | An issue was discovered in Ollama before 0.1.46.ollama · ollama · CWE-22 | Высокая7,5 | — | 3,9 % | 31 окт. 2024 г. |
40В плане | CVE-2024-48359Proof of concept | Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.qualitor · qualitor · CWE-94 | Критическая9,8 | — | 2,2 % | 31 окт. 2024 г. |
31Наблюдать | CVE-2024-48360Proof of concept | Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.qualitor · qualitor · CWE-918 | Высокая7,5 | — | 3,9 % | 31 окт. 2024 г. |
27Наблюдать | CVE-2024-10605Proof of concept | code-projects Blood Bank Management System request.php cross-site request forgeryfabian · blood bank management system · CWE-352 | Средняя6,9 | — | 0,4 % | 31 окт. 2024 г. |
- CVE-2024-5042739Наблюдать
WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,9Proof of conceptEPSS 1 %devsoftbaltic · surveyjs29 окт. 2024 г.
- CVE-2024-5047340В плане
WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %ajar productions · ajar in5 embed29 окт. 2024 г.
- CVE-2024-5047539Наблюдать
WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %scott gamon · signup page29 окт. 2024 г.
- CVE-2024-5047639Наблюдать
WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %grün software group gmbh · grün spendino spendenformular29 окт. 2024 г.
- CVE-2024-5048539Наблюдать
WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %udit rawat · exam matrix29 окт. 2024 г.
- CVE-2024-5049039Наблюдать
WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %lowcage · pegapoll29 окт. 2024 г.
- CVE-2024-1046526Наблюдать
A clipboard "paste" button could persist across tabs which allowed a spoofing attack.
СредняяCVSS 6,5Эксплойта нетEPSS 0 %mozilla · firefox29 окт. 2024 г.
- CVE-2024-598248В плане
Path Traversal in gaizhenbiao/chuanhuchatgpt
КритическаяCVSS 9,8Эксплойта нетEPSS 31 %gaizhenbiao · chuanhuchatgpt29 окт. 2024 г.
- CVE-2024-830943В плане
SQL Injection in langchain-ai/langchain
КритическаяCVSS 9,8Proof of conceptEPSS 13 %langchain · langchain29 окт. 2024 г.
- CVE-2024-5033434Наблюдать
Semicolon Path Injection on API /api;/config
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %erudika · scoold29 окт. 2024 г.
- CVE-2024-798536Наблюдать
FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %fileorganizer · fileorganizer29 окт. 2024 г.
- CVE-2024-998941В плане
Crypto <= 2.18 - Authentication Bypass via log_in
КритическаяCVSS 9,8Proof of conceptEPSS 7 %odude · crypto tool29 окт. 2024 г.
- CVE-2024-4895532Наблюдать
Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %29 окт. 2024 г.
- CVE-2024-4857339Наблюдать
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account pas
КритическаяCVSS 9,8Proof of conceptEPSS 1 %aquila-cms · aquilacms29 окт. 2024 г.
- CVE-2024-5137897Срочно
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticat
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 94 %cyberpanel · cyberpanel29 окт. 2024 г.
- CVE-2024-5156794Срочно
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 84 %cyberpanel · cyberpanel29 окт. 2024 г.
- CVE-2024-5156860На этой неделе
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.
КритическаяCVSS 9,8Готовый эксплойтEPSS 47 %cyberpanel · cyberpanel29 окт. 2024 г.
- CVE-2024-5050739Наблюдать
WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %daschmi · ds.downloadlist30 окт. 2024 г.
- CVE-2024-5050830Наблюдать
WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %chetan khandla · woocommerce product design30 окт. 2024 г.
- CVE-2024-5050934Наблюдать
WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %chetan khandla · woocommerce product design30 окт. 2024 г.
- CVE-2024-5051040В плане
WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %webandprint · ar for woocommerce30 окт. 2024 г.
- CVE-2024-1052546В плане
Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
ВысокаяCVSS 7,2Эксплойта нетEPSS 59 %eclipse · mosquitto30 окт. 2024 г.
- CVE-2024-3115235Наблюдать
The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series
ВысокаяCVSS 7,5Эксплойта нетEPSS 17 %level1 · wbr-6012 firmware30 окт. 2024 г.
- CVE-2024-3362334Наблюдать
A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6.
ВысокаяCVSS 7,5Эксплойта нетEPSS 11 %level1 · wbr-6012 firmware30 окт. 2024 г.
- CVE-2024-3369938Наблюдать
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminis
ВысокаяCVSS 8,8Эксплойта нетEPSS 11 %level1 · wbr-6012 firmware30 окт. 2024 г.
- CVE-2024-1045642В плане
Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
КритическаяCVSS 9,3Эксплойта нетEPSS 17 %delta electronics · infrasuite device master30 окт. 2024 г.
- CVE-2024-1000523Наблюдать
Consul L7 Intentions Vulnerable To URL Path Bypass
СредняяCVSS 5,8Proof of conceptEPSS 0 %hashicorp · consul30 окт. 2024 г.
- CVE-2024-1055727Наблюдать
code-projects Blood Bank Management System updateprofile.php cross-site request forgery
СредняяCVSS 6,9Proof of conceptEPSS 0 %fabian · blood bank management system30 окт. 2024 г.
- CVE-2024-4830754В плане
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
КритическаяCVSS 9,8Proof of conceptEPSS 50 %jeecg · jeecg boot30 окт. 2024 г.
- CVE-2024-1039243В плане
AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %senols · ai puffer – your ai engine for wordpress (formerly ai power)31 окт. 2024 г.
- CVE-2024-4891039Наблюдать
DOMPurify vulnerable to tampering by prototype polution
КритическаяCVSS 9,8Proof of conceptEPSS 1 %cure53 · dompurify31 окт. 2024 г.
- CVE-2024-5143025Наблюдать
Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary
СредняяCVSS 6,4Proof of conceptEPSS 0 %31 окт. 2024 г.
- CVE-2024-5148250В плане
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
КритическаяCVSS 9,9Proof of conceptEPSS 36 %zoneminder · zoneminder31 окт. 2024 г.
- CVE-2024-3971931Наблюдать
An issue was discovered in Ollama through 0.3.14.
ВысокаяCVSS 7,5Proof of conceptEPSS 4 %ollama · ollama31 окт. 2024 г.
- CVE-2024-3972231Наблюдать
An issue was discovered in Ollama before 0.1.46.
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %ollama · ollama31 окт. 2024 г.
- CVE-2024-4835940В плане
Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.
КритическаяCVSS 9,8Proof of conceptEPSS 2 %qualitor · qualitor31 окт. 2024 г.
- CVE-2024-4836031Наблюдать
Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %qualitor · qualitor31 окт. 2024 г.
- CVE-2024-1060527Наблюдать
code-projects Blood Bank Management System request.php cross-site request forgery
СредняяCVSS 6,9Proof of conceptEPSS 0 %fabian · blood bank management system31 окт. 2024 г.