По дате публикации
Эксплуатируемые и новые серьёзные CVE: ноябрь 2024 г.
203 записей · 16 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
35Наблюдать | CVE-2024-0105Эксплойта нет | NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue.nvidia · connectx4 · CWE-274 | Высокая8,9 | — | 0,2 % | 1 нояб. 2024 г. |
27Наблюдать | CVE-2024-10654Proof of concept | TOTOLINK LR350 formLoginAuth.htm authorizationtotolink · lr350 firmware · CWE-266 | Средняя6,9 | — | 1,5 % | 1 нояб. 2024 г. |
39Наблюдать | CVE-2024-7456Proof of concept | SQL Injection in lunary-ai/lunarylunary · lunary · CWE-89 | Критическая9,8 | — | 1,4 % | 1 нояб. 2024 г. |
52В плане | CVE-2024-43919Proof of concept | WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerabilityyarpp · yet another related posts plugin · CWE-862 | Критическая9,8 | — | 44,8 % | 1 нояб. 2024 г. |
39Наблюдать | CVE-2024-43998Proof of concept | WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerabilitywebsiteinwp · blogpoet · CWE-862 | Критическая9,8 | — | 1,4 % | 1 нояб. 2024 г. |
40В плане | CVE-2024-47308Proof of concept | WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerabilitytemplately · templately · CWE-862 | Критическая9,8 | — | 1,7 % | 1 нояб. 2024 г. |
35Наблюдать | CVE-2024-48217Proof of concept | An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.CWE-639 | Высокая8,8 | — | 0,7 % | 1 нояб. 2024 г. |
28Наблюдать | CVE-2024-51483Proof of concept | changedetection.io Path Traversal vulnerabilitydgtlmoon · changedetection.io · CWE-22 | Средняя6,9 | — | 2,2 % | 1 нояб. 2024 г. |
33Наблюдать | CVE-2024-51774Proof of concept | qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.qbittorrent · qbittorrent · CWE-295 | Высокая8,1 | — | 3,3 % | 2 нояб. 2024 г. |
29Наблюдать | CVE-2024-10697Эксплойта нет | Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injectiontenda · ac6 firmware · CWE-74 | Средняя5,3 | — | 26,1 % | 2 нояб. 2024 г. |
27Наблюдать | CVE-2024-10758Proof of concept | code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injectionanirbandutta9 · news-buzz · CWE-89 | Средняя6,9 | — | 1,4 % | 4 нояб. 2024 г. |
39Наблюдать | CVE-2024-50526Proof of concept | WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerabilitylindeni · multi purpose mail form · CWE-434 | Критическая9,8 | — | 0,6 % | 4 нояб. 2024 г. |
17Наблюдать | CVE-2024-51665Proof of concept | WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerabilitywpthemespace · magical addons for elementor · CWE-918 | Средняя4,3 | — | 0,5 % | 4 нояб. 2024 г. |
19Наблюдать | CVE-2024-34887Эксплойта нет | Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDAbitrix24 · bitrix24 · CWE-522 | Средняя4,9 | — | 0,3 % | 4 нояб. 2024 г. |
33Наблюдать | CVE-2024-48336Proof of concept | The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, whCWE-829 | Высокая8,4 | — | 0,5 % | 4 нояб. 2024 г. |
27Наблюдать | CVE-2024-34885Эксплойта нет | Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP accobitrix24 · bitrix24 · CWE-522 | Средняя6,8 | — | 0,4 % | 4 нояб. 2024 г. |
39Наблюдать | CVE-2024-48061Proof of concept | langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on thlangflow · langflow · CWE-94 | Критическая9,8 | — | 1,5 % | 4 нояб. 2024 г. |
23Наблюдать | CVE-2024-32870Proof of concept | iTop hub connector Information disclosurecombodo · itop · CWE-200 | Средняя5,8 | — | 0,7 % | 4 нояб. 2024 г. |
40В плане | CVE-2024-51132Proof of concept | An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary CWE-611 | Критическая9,8 | — | 1,9 % | 5 нояб. 2024 г. |
21Наблюдать | CVE-2024-51739Proof of concept | Users enumeration allowed through Rest API in Combodo iTopcombodo · itop · CWE-200 | Средняя5,3 | — | 1,2 % | 5 нояб. 2024 г. |
21Наблюдать | CVE-2024-50335Proof of concept | Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRMsalesagility · suitecrm · CWE-79 | Средняя5,4 | — | 0,3 % | 5 нояб. 2024 г. |
39Наблюдать | CVE-2024-51358Proof of concept | An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new applicationCWE-918 | Критическая9,8 | — | 0,9 % | 5 нояб. 2024 г. |
25Наблюдать | CVE-2024-9902Proof of concept | Ansible-core: ansible-core user may read/write unauthorized contentred hat · ansible automation platform execution environments · CWE-863 | Средняя6,3 | — | 0,2 % | 6 нояб. 2024 г. |
65На этой неделе | CVE-2024-10914Proof of concept | D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectiondlink · dns-320 firmware · CWE-74 | Критическая9,2 | — | 96,2 % | 6 нояб. 2024 г. |
60На этой неделе | CVE-2024-10915Proof of concept | D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectiondlink · dns-320 firmware · CWE-74 | Критическая9,2 | — | 79,6 % | 6 нояб. 2024 г. |
52В плане | CVE-2024-10081Proof of concept | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.ericsson · codechecker · CWE-288 | Критическая10,0 | — | 39,9 % | 6 нояб. 2024 г. |
48В плане | CVE-2024-50340Proof of concept | Ability to change environment from query in symfony/runtimesymfony · symfony · CWE-74 | Высокая7,3 | — | 63,6 % | 6 нояб. 2024 г. |
32Наблюдать | CVE-2024-48325Proof of concept | Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class.portabilis · i-educar · CWE-89 | Высокая8,1 | — | 0,9 % | 6 нояб. 2024 г. |
60На этой неделе | CVE-2024-43425Готовый эксплойт | Moodle: remote code execution via calculated question typesmoodle · moodle · CWE-94 | Высокая8,1 | — | 87,5 % | 7 нояб. 2024 г. |
17Наблюдать | CVE-2024-9926Proof of concept | Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Accessautomattic · jetpack · CWE-863 | Средняя4,3 | — | 1,2 % | 7 нояб. 2024 г. |
37Наблюдать | CVE-2024-47073Proof of concept | Dataease arbitrary interface access vulnerabilitydataease · dataease · CWE-347 | Критическая9,3 | — | 1,2 % | 7 нояб. 2024 г. |
30Наблюдать | CVE-2024-51428Proof of concept | An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.espressif · esp-idf · CWE-770 | Высокая7,5 | — | 0,5 % | 7 нояб. 2024 г. |
43В плане | CVE-2024-50599Эксплойта нет | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the wesynacor · zimbra collaboration suite · CWE-79 | Средняя6,1 | — | 63,5 % | 7 нояб. 2024 г. |
37Наблюдать | CVE-2024-24409Proof of concept | Privilege Escalationzohocorp · manageengine admanager plus · CWE-269 | Высокая8,8 | — | 6,1 % | 8 нояб. 2024 г. |
26Наблюдать | CVE-2024-51030Proof of concept | A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to eoretnom23 · cab management system · CWE-89 | Средняя6,5 | — | 0,6 % | 8 нояб. 2024 г. |
21Наблюдать | CVE-2024-51031Proof of concept | A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated useoretnom23 · cab management system · CWE-79 | Средняя5,4 | — | 0,4 % | 8 нояб. 2024 г. |
21Наблюдать | CVE-2024-51032Proof of concept | A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticaoretnom23 · toll tax management system · CWE-79 | Средняя5,4 | — | 0,4 % | 8 нояб. 2024 г. |
26Наблюдать | CVE-2024-44765Proof of concept | An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilCWE-863 | Средняя6,5 | — | 0,6 % | 8 нояб. 2024 г. |
40В плане | CVE-2024-51211Proof of concept | SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.os4ed · opensis · CWE-89 | Критическая9,8 | — | 2,2 % | 8 нояб. 2024 г. |
35Наблюдать | CVE-2024-52002Proof of concept | Cross-Site Request Forgery (CSRF) in several iTop pagescombodo · itop · CWE-352 | Высокая8,8 | — | 0,7 % | 8 нояб. 2024 г. |
40В плане | CVE-2024-10586Proof of concept | Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creationeugenbobrowski · debug tool · CWE-862 | Критическая9,8 | — | 2,1 % | 8 нояб. 2024 г. |
35Наблюдать | CVE-2024-10673Proof of concept | Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationthemehunk · top store · CWE-862 | Высокая8,8 | — | 1,1 % | 9 нояб. 2024 г. |
36Наблюдать | CVE-2024-10674Proof of concept | Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationthemehunk · th shop mania · CWE-862 | Высокая8,8 | — | 1,7 % | 9 нояб. 2024 г. |
49В плане | CVE-2024-10470Proof of concept | WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletionvibethemes · wordpress learning management system · CWE-22 | Критическая9,8 | — | 34,7 % | 9 нояб. 2024 г. |
39Наблюдать | CVE-2024-10508Proof of concept | RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recoverymetagauss · registrationmagic · CWE-230 | Критическая9,8 | — | 1,5 % | 9 нояб. 2024 г. |
24Наблюдать | CVE-2024-50251Proof of concept | netfilter: nft_payload: sanitize offset and length before calling skb_checksum()linux · linux kernel | Средняя6,2 | — | 0,5 % | 9 нояб. 2024 г. |
29Наблюдать | CVE-2024-10958Proof of concept | WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelaywppa · wp photo album plus · CWE-94 | Высокая7,3 | — | 1,6 % | 10 нояб. 2024 г. |
36Наблюдать | CVE-2024-41992Proof of concept | Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library functCWE-78 | Высокая8,8 | — | 2,5 % | 10 нояб. 2024 г. |
40В плане | CVE-2024-51788Proof of concept | WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerabilityjoshua wolfe · the novel design store directory · CWE-434 | Критическая10,0 | — | 1,4 % | 11 нояб. 2024 г. |
40В плане | CVE-2024-51791Proof of concept | WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerabilitymade i.t. · forms · CWE-434 | Критическая10,0 | — | 0,6 % | 11 нояб. 2024 г. |
40В плане | CVE-2024-51793Proof of concept | WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerabilitywebfulcreations · computer repair shop · CWE-434 | Критическая9,8 | — | 1,8 % | 11 нояб. 2024 г. |
32Наблюдать | CVE-2024-48322Proof of concept | UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.CWE-367 | Высокая8,1 | — | 0,8 % | 11 нояб. 2024 г. |
28Наблюдать | CVE-2024-51747Proof of concept | Arbitrary File Read and Delete in kanboardkanboard · kanboard · CWE-22 | Высокая7,2 | — | 0,8 % | 11 нояб. 2024 г. |
21Наблюдать | CVE-2024-51026Proof of concept | The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is poCWE-79 | Средняя5,4 | — | 0,3 % | 11 нояб. 2024 г. |
39Наблюдать | CVE-2024-10245Proof of concept | Relais 2FA <= 1.0 - Authentication Bypassmobisoft974 · relais 2fa · CWE-288 | Критическая9,8 | — | 1,1 % | 12 нояб. 2024 г. |
42В плане | CVE-2024-50320Эксплойта нет | An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.ivanti · avalanche · CWE-835 | Высокая7,5 | — | 39,6 % | 12 нояб. 2024 г. |
34Наблюдать | CVE-2024-50324Эксплойта нет | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentiivanti · endpoint manager · CWE-22 | Высокая7,2 | — | 18,6 % | 12 нояб. 2024 г. |
36Наблюдать | CVE-2024-50326Эксплойта нет | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 26,4 % | 12 нояб. 2024 г. |
51В плане | CVE-2024-50330Proof of concept | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthentivanti · endpoint manager · CWE-89 | Критическая9,8 | — | 40,2 % | 12 нояб. 2024 г. |
40В плане | CVE-2024-49369Proof of concept | Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connectionsicinga · icinga · CWE-295 | Критическая9,8 | — | 2,9 % | 12 нояб. 2024 г. |
34Наблюдать | CVE-2024-52010Proof of concept | Zoraxy has an authenticated command injection in the Web SSH featuretobychui · zoraxy · CWE-78 | Высокая8,6 | — | 1,5 % | 12 нояб. 2024 г. |
82Срочно | CVE-2024-43451Готовый эксплойт | NTLM Hash Disclosure Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-73 | Средняя6,5 | KEV | 85,4 % | 12 нояб. 2024 г. |
39Наблюдать | CVE-2024-43452Эксплойта нет | Windows Registry Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1809 · CWE-367 | Высокая7,5 | — | 28,3 % | 12 нояб. 2024 г. |
32Наблюдать | CVE-2024-43630Proof of concept | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 10 21h2 · CWE-121 | Высокая7,8 | — | 3,7 % | 12 нояб. 2024 г. |
49В плане | CVE-2024-43642Эксплойта нет | Windows SMB Denial of Service Vulnerabilitymicrosoft · windows 11 22h2 · CWE-416 | Высокая7,5 | — | 63,0 % | 12 нояб. 2024 г. |
32Наблюдать | CVE-2024-49019Proof of concept | Active Directory Certificate Services Elevation of Privilege Vulnerabilitymicrosoft · windows server 2008 · CWE-1390 | Высокая7,8 | — | 1,9 % | 12 нояб. 2024 г. |
69На этой неделе | CVE-2024-49039Готовый эксплойт | Windows Task Scheduler Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-287 | Высокая8,8 | KEV | 14,1 % | 12 нояб. 2024 г. |
51В плане | CVE-2024-8068Готовый эксплойт | Privilege escalation to NetworkService Account accesscitrix · session recording · CWE-269 | Средняя5,1 | KEV | 3,4 % | 12 нояб. 2024 г. |
54В плане | CVE-2024-8069Готовый эксплойт | Limited remote code execution with privilege of a NetworkService Account accesscitrix · session recording · CWE-502 | Средняя5,1 | KEV | 14,6 % | 12 нояб. 2024 г. |
36Наблюдать | CVE-2023-52268Proof of concept | The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session tCWE-384 | Критическая9,1 | — | 0,6 % | 12 нояб. 2024 г. |
36Наблюдать | CVE-2024-23666Proof of concept | A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0fortinet · fortianalyzer · CWE-602 | Высокая8,8 | — | 2,7 % | 12 нояб. 2024 г. |
47В плане | CVE-2024-52301Proof of concept | Laravel allows environment manipulation via query stringlaravel · framework · CWE-88 | Высокая8,7 | — | 44,7 % | 12 нояб. 2024 г. |
30Наблюдать | CVE-2024-51179Proof of concept | An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as topen5gs · open5gs · CWE-404 | Высокая7,5 | — | 1,0 % | 12 нояб. 2024 г. |
35Наблюдать | CVE-2024-10629Proof of concept | GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creationaxelkeller · gpx viewer · CWE-862 | Высокая8,8 | — | 1,6 % | 12 нояб. 2024 г. |
49В плане | CVE-2024-34781Эксплойта нет | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 68,4 % | 12 нояб. 2024 г. |
36Наблюдать | CVE-2024-34787Эксплойта нет | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthentivanti · endpoint manager · CWE-22 | Высокая7,8 | — | 17,7 % | 12 нояб. 2024 г. |
40В плане | CVE-2024-48510Proof of concept | Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Sharedmihula · prodotnetzip · CWE-22 | Критическая9,8 | — | 2,0 % | 13 нояб. 2024 г. |
24Наблюдать | CVE-2024-50969Proof of concept | A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbianisha · jonnys liquor · CWE-79 | Средняя6,1 | — | 0,5 % | 13 нояб. 2024 г. |
35Наблюдать | CVE-2024-50970Proof of concept | A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbnikoarroyocuraza · online furniture shopping project · CWE-89 | Высокая8,8 | — | 0,5 % | 13 нояб. 2024 г. |
28Наблюдать | CVE-2024-50971Proof of concept | A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary Sangeljudesuarez · construction management system · CWE-89 | Высокая7,2 | — | 0,7 % | 13 нояб. 2024 г. |
28Наблюдать | CVE-2024-50972Proof of concept | A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitraangeljudesuarez · construction management system · CWE-89 | Высокая7,2 | — | 0,7 % | 13 нояб. 2024 г. |
30Наблюдать | CVE-2024-51996Proof of concept | Symphony has an Authentication Bypass via RememberMesymfony · symfony · CWE-287 | Высокая7,5 | — | 0,6 % | 13 нояб. 2024 г. |
59В плане | CVE-2024-43093Готовый эксплойт | In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitgoogle · android · CWE-176 | Высокая7,3 | KEV | 0,7 % | 13 нояб. 2024 г. |
21Наблюдать | CVE-2024-49379Proof of concept | Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrelgetumbrel · umbrel · CWE-79 | Средняя5,3 | — | 1,2 % | 13 нояб. 2024 г. |
17Наблюдать | CVE-2024-40443Proof of concept | SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of soretnom23 · computer laboratory management system · CWE-89 | Средняя4,3 | — | 0,7 % | 13 нояб. 2024 г. |
21Наблюдать | CVE-2024-42834Proof of concept | A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows aCWE-79 | Средняя5,4 | — | 0,4 % | 13 нояб. 2024 г. |
32Наблюдать | CVE-2024-52550Proof of concept | Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfilejenkins · pipeline\ · CWE-354 | Высокая8,0 | — | 0,4 % | 13 нояб. 2024 г. |
20Наблюдать | CVE-2024-5083Proof of concept | Nexus Repository 2 - Stored XSSsonatype · nexus repository · CWE-79 | Средняя5,1 | — | 0,4 % | 13 нояб. 2024 г. |
29Наблюдать | CVE-2024-5082Proof of concept | Nexus Repository 2 - Remote Code Executionsonatype · nexus repository · CWE-94 | Высокая7,1 | — | 2,6 % | 13 нояб. 2024 г. |
21Наблюдать | CVE-2024-10146Proof of concept | Simple File List < 6.1.13 - Reflected Cross-Site Scriptingsimplefilelist · simple file list · CWE-79 | Средняя5,4 | — | 0,5 % | 14 нояб. 2024 г. |
35Наблюдать | CVE-2024-9186Proof of concept | Automation By Autonami < 3.3.0 - Unauthenticated SQLifunnelkit · funnelkit automations · CWE-89 | Высокая8,6 | — | 2,2 % | 14 нояб. 2024 г. |
40В плане | CVE-2024-10571Proof of concept | Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via sourceays-pro · chartify · CWE-98 | Критическая9,8 | — | 4,8 % | 14 нояб. 2024 г. |
21Наблюдать | CVE-2024-7124Proof of concept | Reflected XSS in DInGO dLibrapoznan supercomputing and networking center · dingo dlibra · CWE-79 | Средняя5,3 | — | 1,0 % | 14 нояб. 2024 г. |
35Наблюдать | CVE-2024-52302Proof of concept | common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)osamataher · java-springboot-codebase · CWE-434 | Высокая8,7 | — | 3,3 % | 14 нояб. 2024 г. |
40В плане | CVE-2024-52375Proof of concept | WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerabilityarttia creative · datasets manager by arttia creative · CWE-434 | Критическая10,0 | — | 1,3 % | 14 нояб. 2024 г. |
40В плане | CVE-2024-52380Proof of concept | WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerabilitysoftpulseinfotech · picsmize · CWE-434 | Критическая10,0 | — | 1,5 % | 14 нояб. 2024 г. |
39Наблюдать | CVE-2024-52382Proof of concept | WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerabilitymedmatech · matix popup builder · CWE-862 | Критическая9,8 | — | 0,9 % | 14 нояб. 2024 г. |
30Наблюдать | CVE-2024-50968Proof of concept | A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remoadonesevangelista · agri-trading online shopping system | Высокая7,5 | — | 0,8 % | 14 нояб. 2024 г. |
78На этой неделе | CVE-2024-11120Готовый эксплойт | GeoVision EOL devices - OS Command Injectiongeovision · gv-vs12 firmware · CWE-78 | Критическая9,8 | KEV | 28,3 % | 14 нояб. 2024 г. |
64На этой неделе | CVE-2024-10924Готовый эксплойт | Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypassreally-simple-plugins · really simple security · CWE-288 | Критическая9,8 | — | 82,2 % | 15 нояб. 2024 г. |
- CVE-2024-010535Наблюдать
NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue.
ВысокаяCVSS 8,9Эксплойта нетEPSS 0 %nvidia · connectx41 нояб. 2024 г.
- CVE-2024-1065427Наблюдать
TOTOLINK LR350 formLoginAuth.htm authorization
СредняяCVSS 6,9Proof of conceptEPSS 1 %totolink · lr350 firmware1 нояб. 2024 г.
- CVE-2024-745639Наблюдать
SQL Injection in lunary-ai/lunary
КритическаяCVSS 9,8Proof of conceptEPSS 1 %lunary · lunary1 нояб. 2024 г.
- CVE-2024-4391952В плане
WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 44 %yarpp · yet another related posts plugin1 нояб. 2024 г.
- CVE-2024-4399839Наблюдать
WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %websiteinwp · blogpoet1 нояб. 2024 г.
- CVE-2024-4730840В плане
WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %templately · templately1 нояб. 2024 г.
- CVE-2024-4821735Наблюдать
An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %1 нояб. 2024 г.
- CVE-2024-5148328Наблюдать
changedetection.io Path Traversal vulnerability
СредняяCVSS 6,9Proof of conceptEPSS 2 %dgtlmoon · changedetection.io1 нояб. 2024 г.
- CVE-2024-5177433Наблюдать
qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.
ВысокаяCVSS 8,1Proof of conceptEPSS 3 %qbittorrent · qbittorrent2 нояб. 2024 г.
- CVE-2024-1069729Наблюдать
Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection
СредняяCVSS 5,3Эксплойта нетEPSS 26 %tenda · ac6 firmware2 нояб. 2024 г.
- CVE-2024-1075827Наблюдать
code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection
СредняяCVSS 6,9Proof of conceptEPSS 1 %anirbandutta9 · news-buzz4 нояб. 2024 г.
- CVE-2024-5052639Наблюдать
WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %lindeni · multi purpose mail form4 нояб. 2024 г.
- CVE-2024-5166517Наблюдать
WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability
СредняяCVSS 4,3Proof of conceptEPSS 0 %wpthemespace · magical addons for elementor4 нояб. 2024 г.
- CVE-2024-3488719Наблюдать
Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDA
СредняяCVSS 4,9Эксплойта нетEPSS 0 %bitrix24 · bitrix244 нояб. 2024 г.
- CVE-2024-4833633Наблюдать
The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %4 нояб. 2024 г.
- CVE-2024-3488527Наблюдать
Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP acco
СредняяCVSS 6,8Эксплойта нетEPSS 0 %bitrix24 · bitrix244 нояб. 2024 г.
- CVE-2024-4806139Наблюдать
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on th
КритическаяCVSS 9,8Proof of conceptEPSS 1 %langflow · langflow4 нояб. 2024 г.
- CVE-2024-3287023Наблюдать
iTop hub connector Information disclosure
СредняяCVSS 5,8Proof of conceptEPSS 0 %combodo · itop4 нояб. 2024 г.
- CVE-2024-5113240В плане
An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary
КритическаяCVSS 9,8Proof of conceptEPSS 1 %5 нояб. 2024 г.
- CVE-2024-5173921Наблюдать
Users enumeration allowed through Rest API in Combodo iTop
СредняяCVSS 5,3Proof of conceptEPSS 1 %combodo · itop5 нояб. 2024 г.
- CVE-2024-5033521Наблюдать
Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM
СредняяCVSS 5,4Proof of conceptEPSS 0 %salesagility · suitecrm5 нояб. 2024 г.
- CVE-2024-5135839Наблюдать
An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application
КритическаяCVSS 9,8Proof of conceptEPSS 0 %5 нояб. 2024 г.
- CVE-2024-990225Наблюдать
Ansible-core: ansible-core user may read/write unauthorized content
СредняяCVSS 6,3Proof of conceptEPSS 0 %red hat · ansible automation platform execution environments6 нояб. 2024 г.
- CVE-2024-1091465На этой неделе
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
КритическаяCVSS 9,2Proof of conceptEPSS 96 %dlink · dns-320 firmware6 нояб. 2024 г.
- CVE-2024-1091560На этой неделе
D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
КритическаяCVSS 9,2Proof of conceptEPSS 79 %dlink · dns-320 firmware6 нояб. 2024 г.
- CVE-2024-1008152В плане
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
КритическаяCVSS 10,0Proof of conceptEPSS 39 %ericsson · codechecker6 нояб. 2024 г.
- CVE-2024-5034048В плане
Ability to change environment from query in symfony/runtime
ВысокаяCVSS 7,3Proof of conceptEPSS 63 %symfony · symfony6 нояб. 2024 г.
- CVE-2024-4832532Наблюдать
Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class.
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %portabilis · i-educar6 нояб. 2024 г.
- CVE-2024-4342560На этой неделе
Moodle: remote code execution via calculated question types
ВысокаяCVSS 8,1Готовый эксплойтEPSS 87 %moodle · moodle7 нояб. 2024 г.
- CVE-2024-992617Наблюдать
Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
СредняяCVSS 4,3Proof of conceptEPSS 1 %automattic · jetpack7 нояб. 2024 г.
- CVE-2024-4707337Наблюдать
Dataease arbitrary interface access vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %dataease · dataease7 нояб. 2024 г.
- CVE-2024-5142830Наблюдать
An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %espressif · esp-idf7 нояб. 2024 г.
- CVE-2024-5059943В плане
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the we
СредняяCVSS 6,1Эксплойта нетEPSS 63 %synacor · zimbra collaboration suite7 нояб. 2024 г.
- CVE-2024-2440937Наблюдать
Privilege Escalation
ВысокаяCVSS 8,8Proof of conceptEPSS 6 %zohocorp · manageengine admanager plus8 нояб. 2024 г.
- CVE-2024-5103026Наблюдать
A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to e
СредняяCVSS 6,5Proof of conceptEPSS 0 %oretnom23 · cab management system8 нояб. 2024 г.
- CVE-2024-5103121Наблюдать
A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated use
СредняяCVSS 5,4Proof of conceptEPSS 0 %oretnom23 · cab management system8 нояб. 2024 г.
- CVE-2024-5103221Наблюдать
A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authentica
СредняяCVSS 5,4Proof of conceptEPSS 0 %oretnom23 · toll tax management system8 нояб. 2024 г.
- CVE-2024-4476526Наблюдать
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privil
СредняяCVSS 6,5Proof of conceptEPSS 0 %8 нояб. 2024 г.
- CVE-2024-5121140В плане
SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.
КритическаяCVSS 9,8Proof of conceptEPSS 2 %os4ed · opensis8 нояб. 2024 г.
- CVE-2024-5200235Наблюдать
Cross-Site Request Forgery (CSRF) in several iTop pages
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %combodo · itop8 нояб. 2024 г.
- CVE-2024-1058640В плане
Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation
КритическаяCVSS 9,8Proof of conceptEPSS 2 %eugenbobrowski · debug tool8 нояб. 2024 г.
- CVE-2024-1067335Наблюдать
Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %themehunk · top store9 нояб. 2024 г.
- CVE-2024-1067436Наблюдать
Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %themehunk · th shop mania9 нояб. 2024 г.
- CVE-2024-1047049В плане
WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion
КритическаяCVSS 9,8Proof of conceptEPSS 34 %vibethemes · wordpress learning management system9 нояб. 2024 г.
- CVE-2024-1050839Наблюдать
RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery
КритическаяCVSS 9,8Proof of conceptEPSS 1 %metagauss · registrationmagic9 нояб. 2024 г.
- CVE-2024-5025124Наблюдать
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
СредняяCVSS 6,2Proof of conceptEPSS 0 %linux · linux kernel9 нояб. 2024 г.
- CVE-2024-1095829Наблюдать
WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
ВысокаяCVSS 7,3Proof of conceptEPSS 1 %wppa · wp photo album plus10 нояб. 2024 г.
- CVE-2024-4199236Наблюдать
Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library funct
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %10 нояб. 2024 г.
- CVE-2024-5178840В плане
WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %joshua wolfe · the novel design store directory11 нояб. 2024 г.
- CVE-2024-5179140В плане
WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 0 %made i.t. · forms11 нояб. 2024 г.
- CVE-2024-5179340В плане
WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %webfulcreations · computer repair shop11 нояб. 2024 г.
- CVE-2024-4832232Наблюдать
UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %11 нояб. 2024 г.
- CVE-2024-5174728Наблюдать
Arbitrary File Read and Delete in kanboard
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %kanboard · kanboard11 нояб. 2024 г.
- CVE-2024-5102621Наблюдать
The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is po
СредняяCVSS 5,4Proof of conceptEPSS 0 %11 нояб. 2024 г.
- CVE-2024-1024539Наблюдать
Relais 2FA <= 1.0 - Authentication Bypass
КритическаяCVSS 9,8Proof of conceptEPSS 1 %mobisoft974 · relais 2fa12 нояб. 2024 г.
- CVE-2024-5032042В плане
An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
ВысокаяCVSS 7,5Эксплойта нетEPSS 39 %ivanti · avalanche12 нояб. 2024 г.
- CVE-2024-5032434Наблюдать
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenti
ВысокаяCVSS 7,2Эксплойта нетEPSS 18 %ivanti · endpoint manager12 нояб. 2024 г.
- CVE-2024-5032636Наблюдать
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic
ВысокаяCVSS 7,2Эксплойта нетEPSS 26 %ivanti · endpoint manager12 нояб. 2024 г.
- CVE-2024-5033051В плане
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthent
КритическаяCVSS 9,8Proof of conceptEPSS 40 %ivanti · endpoint manager12 нояб. 2024 г.
- CVE-2024-4936940В плане
Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections
КритическаяCVSS 9,8Proof of conceptEPSS 2 %icinga · icinga12 нояб. 2024 г.
- CVE-2024-5201034Наблюдать
Zoraxy has an authenticated command injection in the Web SSH feature
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %tobychui · zoraxy12 нояб. 2024 г.
- CVE-2024-4345182Срочно
NTLM Hash Disclosure Spoofing Vulnerability
СредняяCVSS 6,5KEVГотовый эксплойтEPSS 85 %microsoft · windows 10 150712 нояб. 2024 г.
- CVE-2024-4345239Наблюдать
Windows Registry Elevation of Privilege Vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 28 %microsoft · windows 10 180912 нояб. 2024 г.
- CVE-2024-4363032Наблюдать
Windows Kernel Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 3 %microsoft · windows 10 21h212 нояб. 2024 г.
- CVE-2024-4364249В плане
Windows SMB Denial of Service Vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 63 %microsoft · windows 11 22h212 нояб. 2024 г.
- CVE-2024-4901932Наблюдать
Active Directory Certificate Services Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %microsoft · windows server 200812 нояб. 2024 г.
- CVE-2024-4903969На этой неделе
Windows Task Scheduler Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 14 %microsoft · windows 10 150712 нояб. 2024 г.
- CVE-2024-806851В плане
Privilege escalation to NetworkService Account access
СредняяCVSS 5,1KEVГотовый эксплойтEPSS 3 %citrix · session recording12 нояб. 2024 г.
- CVE-2024-806954В плане
Limited remote code execution with privilege of a NetworkService Account access
СредняяCVSS 5,1KEVГотовый эксплойтEPSS 14 %citrix · session recording12 нояб. 2024 г.
- CVE-2023-5226836Наблюдать
The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session t
КритическаяCVSS 9,1Proof of conceptEPSS 0 %12 нояб. 2024 г.
- CVE-2024-2366636Наблюдать
A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %fortinet · fortianalyzer12 нояб. 2024 г.
- CVE-2024-5230147В плане
Laravel allows environment manipulation via query string
ВысокаяCVSS 8,7Proof of conceptEPSS 44 %laravel · framework12 нояб. 2024 г.
- CVE-2024-5117930Наблюдать
An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as t
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %open5gs · open5gs12 нояб. 2024 г.
- CVE-2024-1062935Наблюдать
GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %axelkeller · gpx viewer12 нояб. 2024 г.
- CVE-2024-3478149В плане
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic
ВысокаяCVSS 7,2Эксплойта нетEPSS 68 %ivanti · endpoint manager12 нояб. 2024 г.
- CVE-2024-3478736Наблюдать
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthent
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %ivanti · endpoint manager12 нояб. 2024 г.
- CVE-2024-4851040В плане
Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared
КритическаяCVSS 9,8Proof of conceptEPSS 2 %mihula · prodotnetzip13 нояб. 2024 г.
- CVE-2024-5096924Наблюдать
A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbi
СредняяCVSS 6,1Proof of conceptEPSS 0 %anisha · jonnys liquor13 нояб. 2024 г.
- CVE-2024-5097035Наблюдать
A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arb
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %nikoarroyocuraza · online furniture shopping project13 нояб. 2024 г.
- CVE-2024-5097128Наблюдать
A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary S
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %angeljudesuarez · construction management system13 нояб. 2024 г.
- CVE-2024-5097228Наблюдать
A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitra
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %angeljudesuarez · construction management system13 нояб. 2024 г.
- CVE-2024-5199630Наблюдать
Symphony has an Authentication Bypass via RememberMe
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %symfony · symfony13 нояб. 2024 г.
- CVE-2024-4309359В плане
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensit
ВысокаяCVSS 7,3KEVГотовый эксплойтEPSS 0 %google · android13 нояб. 2024 г.
- CVE-2024-4937921Наблюдать
Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel
СредняяCVSS 5,3Proof of conceptEPSS 1 %getumbrel · umbrel13 нояб. 2024 г.
- CVE-2024-4044317Наблюдать
SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of s
СредняяCVSS 4,3Proof of conceptEPSS 0 %oretnom23 · computer laboratory management system13 нояб. 2024 г.
- CVE-2024-4283421Наблюдать
A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows a
СредняяCVSS 5,4Proof of conceptEPSS 0 %13 нояб. 2024 г.
- CVE-2024-5255032Наблюдать
Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile
ВысокаяCVSS 8,0Proof of conceptEPSS 0 %jenkins · pipeline\13 нояб. 2024 г.
- CVE-2024-508320Наблюдать
Nexus Repository 2 - Stored XSS
СредняяCVSS 5,1Proof of conceptEPSS 0 %sonatype · nexus repository13 нояб. 2024 г.
- CVE-2024-508229Наблюдать
Nexus Repository 2 - Remote Code Execution
ВысокаяCVSS 7,1Proof of conceptEPSS 2 %sonatype · nexus repository13 нояб. 2024 г.
- CVE-2024-1014621Наблюдать
Simple File List < 6.1.13 - Reflected Cross-Site Scripting
СредняяCVSS 5,4Proof of conceptEPSS 0 %simplefilelist · simple file list14 нояб. 2024 г.
- CVE-2024-918635Наблюдать
Automation By Autonami < 3.3.0 - Unauthenticated SQLi
ВысокаяCVSS 8,6Proof of conceptEPSS 2 %funnelkit · funnelkit automations14 нояб. 2024 г.
- CVE-2024-1057140В плане
Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source
КритическаяCVSS 9,8Proof of conceptEPSS 4 %ays-pro · chartify14 нояб. 2024 г.
- CVE-2024-712421Наблюдать
Reflected XSS in DInGO dLibra
СредняяCVSS 5,3Proof of conceptEPSS 1 %poznan supercomputing and networking center · dingo dlibra14 нояб. 2024 г.
- CVE-2024-5230235Наблюдать
common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)
ВысокаяCVSS 8,7Proof of conceptEPSS 3 %osamataher · java-springboot-codebase14 нояб. 2024 г.
- CVE-2024-5237540В плане
WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %arttia creative · datasets manager by arttia creative14 нояб. 2024 г.
- CVE-2024-5238040В плане
WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %softpulseinfotech · picsmize14 нояб. 2024 г.
- CVE-2024-5238239Наблюдать
WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %medmatech · matix popup builder14 нояб. 2024 г.
- CVE-2024-5096830Наблюдать
A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remo
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %adonesevangelista · agri-trading online shopping system14 нояб. 2024 г.
- CVE-2024-1112078На этой неделе
GeoVision EOL devices - OS Command Injection
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 28 %geovision · gv-vs12 firmware14 нояб. 2024 г.
- CVE-2024-1092464На этой неделе
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
КритическаяCVSS 9,8Готовый эксплойтEPSS 82 %really-simple-plugins · really simple security15 нояб. 2024 г.