По дате публикации
Эксплуатируемые и новые серьёзные CVE: ноябрь 2024 г.
203 записей · 16 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
24Наблюдать | CVE-2024-10793Proof of concept | WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parametermelapress · wp activity log · CWE-79 | Средняя6,1 | — | 1,3 % | 15 нояб. 2024 г. |
47В плане | CVE-2024-10443Proof of concept | Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolosynology · photos · CWE-78 | Критическая9,8 | — | 28,0 % | 15 нояб. 2024 г. |
60На этой неделе | CVE-2024-11182Готовый эксплойт | Stored XSS vulnerability in MDaemon Email Servermdaemon · mdaemon · CWE-79 | Средняя5,3 | KEV | 31,3 % | 15 нояб. 2024 г. |
36Наблюдать | CVE-2024-11237Proof of concept | TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflowtp-link · vn020-f3v\(t\) firmware · CWE-119 | Высокая8,7 | — | 5,3 % | 15 нояб. 2024 г. |
29Наблюдать | CVE-2024-11238Proof of concept | Landray EKP sysUiComponent.do delPreviewFile path traversallandray · landray ekp · CWE-22 | Средняя6,9 | — | 5,7 % | 15 нояб. 2024 г. |
29Наблюдать | CVE-2024-50986Proof of concept | An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.clementine-player · clementine · CWE-426 | Высокая7,3 | — | 0,9 % | 15 нояб. 2024 г. |
36Наблюдать | CVE-2022-20649Эксплойта нет | Cisco Redundancy Configuration Manager Debug Remote Code Execution Vulnerabilitycisco · cisco redundancy configuration manager · CWE-489 | Высокая8,1 | — | 11,9 % | 15 нояб. 2024 г. |
43В плане | CVE-2023-20036Эксплойта нет | Cisco Industrial Network Director Command Injection Vulnerabilitycisco · industrial network director · CWE-78 | Критическая9,9 | — | 13,7 % | 15 нояб. 2024 г. |
43В плане | CVE-2024-49754Эксплойта нет | LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.phplibrenms · librenms · CWE-79 | Средняя5,4 | — | 72,3 % | 15 нояб. 2024 г. |
33Наблюдать | CVE-2024-50352Эксплойта нет | LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.phplibrenms · librenms · CWE-79 | Средняя5,4 | — | 39,2 % | 15 нояб. 2024 г. |
40В плане | CVE-2024-44625Proof of concept | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.gogs · gogs · CWE-22 | Высокая8,8 | — | 16,5 % | 15 нояб. 2024 г. |
21Наблюдать | CVE-2024-24450Proof of concept | Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 alloCWE-120 | Средняя5,3 | — | 1,4 % | 15 нояб. 2024 г. |
46В плане | CVE-2024-40638Эксплойта нет | GLPI allows account takeover via SQL Injection in AJAX scriptsglpi-project · glpi · CWE-89 | Высокая8,8 | — | 38,2 % | 15 нояб. 2024 г. |
9Наблюдать | CVE-2024-46383Proof of concept | Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintextCWE-312 | Низкая2,4 | — | 0,2 % | 15 нояб. 2024 г. |
30Наблюдать | CVE-2024-52510Proof of concept | Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is emptynextcloud · desktop · CWE-295 | Высокая7,5 | — | 0,7 % | 15 нояб. 2024 г. |
32Наблюдать | CVE-2024-9935Proof of concept | PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Downloadredefiningtheweb · pdf generator for wordpress elementor · CWE-22 | Высокая7,5 | — | 7,4 % | 16 нояб. 2024 г. |
47В плане | CVE-2024-10728Proof of concept | PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activationwpxpo · postx · CWE-862 | Высокая8,8 | — | 39,0 % | 16 нояб. 2024 г. |
67На этой неделе | CVE-2024-8856Готовый эксплойт | Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Uploadrevmakx · backup and staging by wp time capsule · CWE-434 | Критическая9,8 | — | 94,1 % | 16 нояб. 2024 г. |
22Наблюдать | CVE-2024-11305Proof of concept | Altenergy Power Control Software status_zigbee get_status_zigbee sql injectionaltenergy · power control software · CWE-74 | Средняя5,3 | — | 3,6 % | 17 нояб. 2024 г. |
21Наблюдать | CVE-2024-38828Proof of concept | CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameterspring · spring · CWE-400 | Средняя5,3 | — | 0,7 % | 18 нояб. 2024 г. |
30Наблюдать | CVE-2024-52940Proof of concept | AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network trafficCWE-532 | Высокая7,5 | — | 1,2 % | 18 нояб. 2024 г. |
41В плане | CVE-2024-52316Proof of concept | Apache Tomcat: Authentication bypass when using Jakarta Authentication APIapache · tomcat · CWE-391 | Критическая9,8 | — | 6,2 % | 18 нояб. 2024 г. |
27Наблюдать | CVE-2024-52317Proof of concept | Apache Tomcat: Request/response mix-up with HTTP/2apache · tomcat · CWE-326 | Средняя6,5 | — | 2,0 % | 18 нояб. 2024 г. |
25Наблюдать | CVE-2024-52318Proof of concept | Apache Tomcat: Incorrect JSP tag recycling leads to XSSapache · tomcat · CWE-326 | Средняя6,1 | — | 1,7 % | 18 нояб. 2024 г. |
35Наблюдать | CVE-2024-11303Proof of concept | The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.korenix · jetport 5601 · CWE-22 | Высокая8,7 | — | 1,7 % | 18 нояб. 2024 г. |
30Наблюдать | CVE-2024-11318Proof of concept | IDOR vulnerability in AbsysNetbaratz innovación · absysnet · CWE-639 | Высокая7,5 | — | 0,9 % | 18 нояб. 2024 г. |
35Наблюдать | CVE-2024-52429Proof of concept | WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerabilityantonhoelstad · wp quick setup · CWE-434 | Высокая8,8 | — | 0,9 % | 18 нояб. 2024 г. |
39Наблюдать | CVE-2024-52430Proof of concept | WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerabilitylis · video gallery · CWE-502 | Критическая9,8 | — | 1,0 % | 18 нояб. 2024 г. |
40В плане | CVE-2024-52433Proof of concept | WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerabilitymindstien · my geo posts free · CWE-502 | Критическая9,8 | — | 3,0 % | 18 нояб. 2024 г. |
34Наблюдать | CVE-2020-26073Proof of concept | Cisco SD-WAN vManage Directory Traversal Vulnerabilitycisco · catalyst sd-wan manager · CWE-35 | Высокая7,5 | — | 12,5 % | 18 нояб. 2024 г. |
97Срочно | CVE-2024-0012Готовый эксплойт | PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)paloaltonetworks · pan-os · CWE-306 | Критическая9,3 | KEV | 99,8 % | 18 нояб. 2024 г. |
85Срочно | CVE-2024-9474Готовый эксплойт | PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interfacepaloaltonetworks · pan-os · CWE-78 | Средняя6,9 | KEV | 94,8 % | 18 нояб. 2024 г. |
21Наблюдать | CVE-2024-43416Proof of concept | GLPI vulnerable to enumeration of users' email addresses by unauthenticated userglpi-project · glpi · CWE-200 | Средняя5,3 | — | 1,2 % | 18 нояб. 2024 г. |
40В плане | CVE-2024-47533Proof of concept | Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changescobbler · cobbler · CWE-287 | Критическая9,8 | — | 4,0 % | 18 нояб. 2024 г. |
31Наблюдать | CVE-2024-50804Proof of concept | Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code viaCWE-94 | Высокая7,8 | — | 0,6 % | 18 нояб. 2024 г. |
26Наблюдать | CVE-2024-50848Proof of concept | An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to accerws · worldserver · CWE-611 | Средняя6,5 | — | 1,2 % | 18 нояб. 2024 г. |
19Наблюдать | CVE-2024-50849Proof of concept | A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attackerrws · worldserver · CWE-79 | Средняя4,8 | — | 0,4 % | 18 нояб. 2024 г. |
21Наблюдать | CVE-2024-10486Proof of concept | Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info Filewoocommerce · google for woocommerce · CWE-862 | Средняя5,3 | — | 0,9 % | 18 нояб. 2024 г. |
61На этой неделе | CVE-2024-21287Готовый эксплойт | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).oracle · agile product lifecycle management · CWE-863 | Высокая7,5 | KEV | 1,7 % | 18 нояб. 2024 г. |
21Наблюдать | CVE-2024-33231Proof of concept | Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to thCWE-79 | Средняя5,4 | — | 0,4 % | 18 нояб. 2024 г. |
52В плане | CVE-2024-50302Готовый эксплойт | HID: core: zero-initialize the report bufferlinux · linux kernel · CWE-908 | Средняя5,5 | KEV | 0,8 % | 19 нояб. 2024 г. |
22Наблюдать | CVE-2024-52711Proof of concept | DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.dlink · di-8100 firmware · CWE-120 | Средняя5,7 | — | 0,6 % | 19 нояб. 2024 г. |
21Наблюдать | CVE-2024-50803Proof of concept | The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker redaxo · redaxo · CWE-79 | Средняя5,4 | — | 0,5 % | 19 нояб. 2024 г. |
38Наблюдать | CVE-2024-52402Proof of concept | WordPress Exclusive Content Password Protect plugin <= 1.1.0 - CSRF to Arbitrary File Upload vulnerabilitygunghoinc · exclusive content password protect · CWE-352 | Критическая9,6 | — | 0,8 % | 19 нояб. 2024 г. |
31Наблюдать | CVE-2018-9338Proof of concept | In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check.google · android · CWE-787 | Высокая7,8 | — | 0,1 % | 19 нояб. 2024 г. |
35Наблюдать | CVE-2024-11003Proof of concept | Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input.needrestart project · needrestart · CWE-78 | Высокая7,8 | — | 12,0 % | 19 нояб. 2024 г. |
40В плане | CVE-2024-48990Готовый эксплойт | Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart intneedrestart project · needrestart · CWE-427 | Высокая7,8 | — | 21,2 % | 19 нояб. 2024 г. |
21Наблюдать | CVE-2024-52762Proof of concept | A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arbganglia · ganglia-web · CWE-79 | Средняя5,4 | — | 0,7 % | 19 нояб. 2024 г. |
21Наблюдать | CVE-2024-52763Proof of concept | A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to executeganglia · ganglia-web · CWE-79 | Средняя5,4 | — | 0,6 % | 19 нояб. 2024 г. |
35Наблюдать | CVE-2018-9411Proof of concept | In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check.google · android · CWE-787 | Высокая8,8 | — | 0,5 % | 19 нояб. 2024 г. |
68На этой неделе | CVE-2024-44308Готовый эксплойт | The issue was addressed with improved checks.debian · debian linux | Высокая8,8 | KEV | 10,1 % | 19 нояб. 2024 г. |
62На этой неделе | CVE-2024-44309Готовый эксплойт | A cookie management issue was addressed with improved state management.debian · debian linux · CWE-79 | Средняя6,3 | KEV | 22,5 % | 19 нояб. 2024 г. |
28Наблюдать | CVE-2018-9468Proof of concept | In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass.google · android | Высокая7,1 | — | 0,2 % | 20 нояб. 2024 г. |
42В плане | CVE-2024-52765Эксплойта нет | H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.h3c · gr-1800ax firmware · CWE-94 | Критическая9,8 | — | 11,6 % | 20 нояб. 2024 г. |
48В плане | CVE-2024-51151Эксплойта нет | D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.dlink · di-8200 firmware · CWE-77 | Критическая9,8 | — | 31,2 % | 21 нояб. 2024 г. |
55В плане | CVE-2024-10400Proof of concept | Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterthemeum · tutor lms · CWE-89 | Высокая7,5 | — | 83,1 % | 21 нояб. 2024 г. |
54В плане | CVE-2024-11320Готовый эксплойт | Command Injection leading to RCE via LDAP Misconfigurationpandorafms · pandora fms · CWE-77 | Средняя6,9 | — | 91,2 % | 21 нояб. 2024 г. |
38Наблюдать | CVE-2024-30896Proof of concept | InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with rCWE-922 | Критическая9,1 | — | 5,3 % | 21 нояб. 2024 г. |
21Наблюдать | CVE-2024-11587Proof of concept | idcCMS classProvCity.php GetCityOptionJs cross site scriptingidccms · idccms · CWE-79 | Средняя5,3 | — | 0,9 % | 21 нояб. 2024 г. |
31Наблюдать | CVE-2024-21786Эксплойта нет | An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5.mc-technologies · mc lr router firmware · CWE-78 | Высокая7,2 | — | 10,4 % | 21 нояб. 2024 г. |
36Наблюдать | CVE-2024-48286Эксплойта нет | Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.linksys · e3000 firmware · CWE-77 | Высокая8,0 | — | 13,1 % | 21 нояб. 2024 г. |
35Наблюдать | CVE-2024-48288Эксплойта нет | TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontentp-link · tl-ipc42c firmware · CWE-77 | Высокая8,0 | — | 10,9 % | 21 нояб. 2024 г. |
31Наблюдать | CVE-2024-53333Эксплойта нет | TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function.totolink · ex200 firmware · CWE-77 | Средняя6,3 | — | 19,9 % | 21 нояб. 2024 г. |
27Наблюдать | CVE-2024-50395Proof of concept | Media Streaming add-onqnap · media streaming add-on · CWE-639 | Средняя6,9 | — | 1,3 % | 22 нояб. 2024 г. |
33Наблюдать | CVE-2024-10220Proof of concept | Arbitrary command execution through gitRepo volumekubernetes · kubelet · CWE-22 | Высокая8,1 | — | 3,0 % | 22 нояб. 2024 г. |
27Наблюдать | CVE-2024-50657Proof of concept | An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specCWE-276 | Средняя6,8 | — | 0,4 % | 22 нояб. 2024 г. |
19Наблюдать | CVE-2023-51646Эксплойта нет | Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerabilityalltena · allegra · CWE-22 | Средняя4,7 | — | 1,8 % | 22 нояб. 2024 г. |
60На этой неделе | CVE-2024-5721Готовый эксплойт | Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerabilitylogsign · unified secops platform · CWE-306 | Высокая8,1 | — | 5,9 % | 22 нояб. 2024 г. |
38Наблюдать | CVE-2024-11477Proof of concept | 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability7-zip · 7-zip · CWE-191 | Высокая7,8 | — | 22,3 % | 22 нояб. 2024 г. |
37Наблюдать | CVE-2024-11392Proof of concept | Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerabilityhuggingface · transformers · CWE-502 | Высокая8,8 | — | 7,2 % | 22 нояб. 2024 г. |
36Наблюдать | CVE-2024-11393Proof of concept | Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerabilityhuggingface · transformers · CWE-502 | Высокая8,8 | — | 3,0 % | 22 нояб. 2024 г. |
36Наблюдать | CVE-2024-11394Proof of concept | Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerabilityhuggingface · transformers · CWE-502 | Высокая8,8 | — | 2,5 % | 22 нояб. 2024 г. |
60На этой неделе | CVE-2024-47407Готовый эксплойт | mySCADA myPRO OS Command Injectionmyscada · mypro manager · CWE-78 | Критическая10,0 | — | 63,7 % | 22 нояб. 2024 г. |
28Наблюдать | CVE-2024-11651Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT wifi_schedule command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 27,4 % | 24 нояб. 2024 г. |
29Наблюдать | CVE-2024-11652Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 30,2 % | 24 нояб. 2024 г. |
29Наблюдать | CVE-2024-11653Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 29,1 % | 25 нояб. 2024 г. |
29Наблюдать | CVE-2024-11654Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 29,1 % | 25 нояб. 2024 г. |
29Наблюдать | CVE-2024-11655Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 28,7 % | 25 нояб. 2024 г. |
29Наблюдать | CVE-2024-11656Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_ping6 command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 28,7 % | 25 нояб. 2024 г. |
29Наблюдать | CVE-2024-11657Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 29,1 % | 25 нояб. 2024 г. |
29Наблюдать | CVE-2024-11658Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 29,1 % | 25 нояб. 2024 г. |
29Наблюдать | CVE-2024-11659Эксплойта нет | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injectionengeniustech · enh1350ext firmware · CWE-74 | Средняя5,1 | — | 29,1 % | 25 нояб. 2024 г. |
21Наблюдать | CVE-2024-53255Proof of concept | Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMSboidcms · boidcms · CWE-79 | Средняя5,3 | — | 0,8 % | 25 нояб. 2024 г. |
39Наблюдать | CVE-2024-50672Proof of concept | A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administCWE-89 | Критическая9,8 | — | 1,5 % | 25 нояб. 2024 г. |
35Наблюдать | CVE-2024-10542Proof of concept | Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installationcleantalk · anti-spam · CWE-862 | Высокая7,5 | — | 15,3 % | 26 нояб. 2024 г. |
32Наблюдать | CVE-2024-33605Proof of concept | Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability.sharp corporation · multiple mfps (multifunction printers) · CWE-22 | Высокая7,5 | — | 6,0 % | 26 нояб. 2024 г. |
51В плане | CVE-2024-33610Proof of concept | "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.sharp corporation · multiple mfps (multifunction printers) · CWE-288 | Критическая9,1 | — | 50,4 % | 26 нояб. 2024 г. |
97Срочно | CVE-2024-11680Готовый эксплойт | ProjectSend Unauthenticated Configuration Modificationprojectsend · projectsend · CWE-306 | Критическая9,8 | KEV | 91,8 % | 26 нояб. 2024 г. |
31Наблюдать | CVE-2023-1521Proof of concept | Local Privilege Escalation in sccachemozilla · sccache · CWE-426 | Высокая7,8 | — | 0,3 % | 26 нояб. 2024 г. |
42В плане | CVE-2024-32965Эксплойта нет | ssrf vulnerability in lobe-chatlobehub · lobe chat · CWE-918 | Высокая8,6 | — | 26,1 % | 26 нояб. 2024 г. |
69На этой неделе | CVE-2024-49035Готовый эксплойт | Partner.Microsoft.Com Elevation of Privilege Vulnerabilitymicrosoft · partner center · CWE-269 | Критическая9,8 | KEV | 1,3 % | 26 нояб. 2024 г. |
44В плане | CVE-2024-53674Эксплойта нет | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainhpe · insight remote support · CWE-91 | Высокая7,5 | — | 46,6 % | 26 нояб. 2024 г. |
55В плане | CVE-2024-53675Эксплойта нет | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainhpe · insight remote support · CWE-91 | Высокая7,5 | — | 83,6 % | 26 нояб. 2024 г. |
56В плане | CVE-2024-53676Эксплойта нет | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.hpe · insight remote support · CWE-552 | Критическая9,8 | — | 56,2 % | 26 нояб. 2024 г. |
70На этой неделе | CVE-2024-11667Готовый эксплойт | A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX serizyxel · zld · CWE-22 | Критическая9,8 | KEV | 2,9 % | 27 нояб. 2024 г. |
63На этой неделе | CVE-2024-42327Proof of concept | SQL injection in user.get APIzabbix · zabbix · CWE-89 | Критическая9,9 | — | 79,1 % | 27 нояб. 2024 г. |
28Наблюдать | CVE-2024-51228Proof of concept | An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1CWE-78 | Средняя6,8 | — | 3,8 % | 27 нояб. 2024 г. |
56В плане | CVE-2024-54003Эксплойта нет | Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability jenkins · simple queue · CWE-79 | Высокая8,0 | — | 80,1 % | 27 нояб. 2024 г. |
53В плане | CVE-2024-8672Proof of concept | Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Executionmarketingfire · widget options – advanced conditional visibility for gutenberg blocks & classic widgets · CWE-94 | Критическая9,9 | — | 45,3 % | 28 нояб. 2024 г. |
40В плане | CVE-2024-52475Proof of concept | WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerabilityinformation technology · wawp · CWE-288 | Критическая9,8 | — | 1,8 % | 28 нояб. 2024 г. |
- CVE-2024-1079324Наблюдать
WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter
СредняяCVSS 6,1Proof of conceptEPSS 1 %melapress · wp activity log15 нояб. 2024 г.
- CVE-2024-1044347В плане
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolo
КритическаяCVSS 9,8Proof of conceptEPSS 28 %synology · photos15 нояб. 2024 г.
- CVE-2024-1118260На этой неделе
Stored XSS vulnerability in MDaemon Email Server
СредняяCVSS 5,3KEVГотовый эксплойтEPSS 31 %mdaemon · mdaemon15 нояб. 2024 г.
- CVE-2024-1123736Наблюдать
TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow
ВысокаяCVSS 8,7Proof of conceptEPSS 5 %tp-link · vn020-f3v\(t\) firmware15 нояб. 2024 г.
- CVE-2024-1123829Наблюдать
Landray EKP sysUiComponent.do delPreviewFile path traversal
СредняяCVSS 6,9Proof of conceptEPSS 5 %landray · landray ekp15 нояб. 2024 г.
- CVE-2024-5098629Наблюдать
An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %clementine-player · clementine15 нояб. 2024 г.
- CVE-2022-2064936Наблюдать
Cisco Redundancy Configuration Manager Debug Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Эксплойта нетEPSS 11 %cisco · cisco redundancy configuration manager15 нояб. 2024 г.
- CVE-2023-2003643В плане
Cisco Industrial Network Director Command Injection Vulnerability
КритическаяCVSS 9,9Эксплойта нетEPSS 13 %cisco · industrial network director15 нояб. 2024 г.
- CVE-2024-4975443В плане
LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php
СредняяCVSS 5,4Эксплойта нетEPSS 72 %librenms · librenms15 нояб. 2024 г.
- CVE-2024-5035233Наблюдать
LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php
СредняяCVSS 5,4Эксплойта нетEPSS 39 %librenms · librenms15 нояб. 2024 г.
- CVE-2024-4462540В плане
Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.
ВысокаяCVSS 8,8Proof of conceptEPSS 16 %gogs · gogs15 нояб. 2024 г.
- CVE-2024-2445021Наблюдать
Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allo
СредняяCVSS 5,3Proof of conceptEPSS 1 %15 нояб. 2024 г.
- CVE-2024-4063846В плане
GLPI allows account takeover via SQL Injection in AJAX scripts
ВысокаяCVSS 8,8Эксплойта нетEPSS 38 %glpi-project · glpi15 нояб. 2024 г.
- CVE-2024-463839Наблюдать
Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext
НизкаяCVSS 2,4Proof of conceptEPSS 0 %15 нояб. 2024 г.
- CVE-2024-5251030Наблюдать
Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %nextcloud · desktop15 нояб. 2024 г.
- CVE-2024-993532Наблюдать
PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download
ВысокаяCVSS 7,5Proof of conceptEPSS 7 %redefiningtheweb · pdf generator for wordpress elementor16 нояб. 2024 г.
- CVE-2024-1072847В плане
PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
ВысокаяCVSS 8,8Proof of conceptEPSS 39 %wpxpo · postx16 нояб. 2024 г.
- CVE-2024-885667На этой неделе
Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Готовый эксплойтEPSS 94 %revmakx · backup and staging by wp time capsule16 нояб. 2024 г.
- CVE-2024-1130522Наблюдать
Altenergy Power Control Software status_zigbee get_status_zigbee sql injection
СредняяCVSS 5,3Proof of conceptEPSS 3 %altenergy · power control software17 нояб. 2024 г.
- CVE-2024-3882821Наблюдать
CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter
СредняяCVSS 5,3Proof of conceptEPSS 0 %spring · spring18 нояб. 2024 г.
- CVE-2024-5294030Наблюдать
AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %18 нояб. 2024 г.
- CVE-2024-5231641В плане
Apache Tomcat: Authentication bypass when using Jakarta Authentication API
КритическаяCVSS 9,8Proof of conceptEPSS 6 %apache · tomcat18 нояб. 2024 г.
- CVE-2024-5231727Наблюдать
Apache Tomcat: Request/response mix-up with HTTP/2
СредняяCVSS 6,5Proof of conceptEPSS 2 %apache · tomcat18 нояб. 2024 г.
- CVE-2024-5231825Наблюдать
Apache Tomcat: Incorrect JSP tag recycling leads to XSS
СредняяCVSS 6,1Proof of conceptEPSS 1 %apache · tomcat18 нояб. 2024 г.
- CVE-2024-1130335Наблюдать
The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %korenix · jetport 560118 нояб. 2024 г.
- CVE-2024-1131830Наблюдать
IDOR vulnerability in AbsysNet
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %baratz innovación · absysnet18 нояб. 2024 г.
- CVE-2024-5242935Наблюдать
WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %antonhoelstad · wp quick setup18 нояб. 2024 г.
- CVE-2024-5243039Наблюдать
WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %lis · video gallery18 нояб. 2024 г.
- CVE-2024-5243340В плане
WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 3 %mindstien · my geo posts free18 нояб. 2024 г.
- CVE-2020-2607334Наблюдать
Cisco SD-WAN vManage Directory Traversal Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 12 %cisco · catalyst sd-wan manager18 нояб. 2024 г.
- CVE-2024-001297Срочно
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 99 %paloaltonetworks · pan-os18 нояб. 2024 г.
- CVE-2024-947485Срочно
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
СредняяCVSS 6,9KEVГотовый эксплойтEPSS 94 %paloaltonetworks · pan-os18 нояб. 2024 г.
- CVE-2024-4341621Наблюдать
GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
СредняяCVSS 5,3Proof of conceptEPSS 1 %glpi-project · glpi18 нояб. 2024 г.
- CVE-2024-4753340В плане
Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
КритическаяCVSS 9,8Proof of conceptEPSS 4 %cobbler · cobbler18 нояб. 2024 г.
- CVE-2024-5080431Наблюдать
Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %18 нояб. 2024 г.
- CVE-2024-5084826Наблюдать
An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to acce
СредняяCVSS 6,5Proof of conceptEPSS 1 %rws · worldserver18 нояб. 2024 г.
- CVE-2024-5084919Наблюдать
A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker
СредняяCVSS 4,8Proof of conceptEPSS 0 %rws · worldserver18 нояб. 2024 г.
- CVE-2024-1048621Наблюдать
Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
СредняяCVSS 5,3Proof of conceptEPSS 0 %woocommerce · google for woocommerce18 нояб. 2024 г.
- CVE-2024-2128761На этой неделе
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 1 %oracle · agile product lifecycle management18 нояб. 2024 г.
- CVE-2024-3323121Наблюдать
Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to th
СредняяCVSS 5,4Proof of conceptEPSS 0 %18 нояб. 2024 г.
- CVE-2024-5030252В плане
HID: core: zero-initialize the report buffer
СредняяCVSS 5,5KEVГотовый эксплойтEPSS 0 %linux · linux kernel19 нояб. 2024 г.
- CVE-2024-5271122Наблюдать
DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.
СредняяCVSS 5,7Proof of conceptEPSS 0 %dlink · di-8100 firmware19 нояб. 2024 г.
- CVE-2024-5080321Наблюдать
The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker
СредняяCVSS 5,4Proof of conceptEPSS 0 %redaxo · redaxo19 нояб. 2024 г.
- CVE-2024-5240238Наблюдать
WordPress Exclusive Content Password Protect plugin <= 1.1.0 - CSRF to Arbitrary File Upload vulnerability
КритическаяCVSS 9,6Proof of conceptEPSS 0 %gunghoinc · exclusive content password protect19 нояб. 2024 г.
- CVE-2018-933831Наблюдать
In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check.
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android19 нояб. 2024 г.
- CVE-2024-1100335Наблюдать
Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input.
ВысокаяCVSS 7,8Proof of conceptEPSS 12 %needrestart project · needrestart19 нояб. 2024 г.
- CVE-2024-4899040В плане
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart int
ВысокаяCVSS 7,8Готовый эксплойтEPSS 21 %needrestart project · needrestart19 нояб. 2024 г.
- CVE-2024-5276221Наблюдать
A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arb
СредняяCVSS 5,4Proof of conceptEPSS 0 %ganglia · ganglia-web19 нояб. 2024 г.
- CVE-2024-5276321Наблюдать
A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute
СредняяCVSS 5,4Proof of conceptEPSS 0 %ganglia · ganglia-web19 нояб. 2024 г.
- CVE-2018-941135Наблюдать
In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %google · android19 нояб. 2024 г.
- CVE-2024-4430868На этой неделе
The issue was addressed with improved checks.
ВысокаяCVSS 8,8KEVГотовый эксплойтEPSS 10 %debian · debian linux19 нояб. 2024 г.
- CVE-2024-4430962На этой неделе
A cookie management issue was addressed with improved state management.
СредняяCVSS 6,3KEVГотовый эксплойтEPSS 22 %debian · debian linux19 нояб. 2024 г.
- CVE-2018-946828Наблюдать
In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass.
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %google · android20 нояб. 2024 г.
- CVE-2024-5276542В плане
H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.
КритическаяCVSS 9,8Эксплойта нетEPSS 11 %h3c · gr-1800ax firmware20 нояб. 2024 г.
- CVE-2024-5115148В плане
D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.
КритическаяCVSS 9,8Эксплойта нетEPSS 31 %dlink · di-8200 firmware21 нояб. 2024 г.
- CVE-2024-1040055В плане
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
ВысокаяCVSS 7,5Proof of conceptEPSS 83 %themeum · tutor lms21 нояб. 2024 г.
- CVE-2024-1132054В плане
Command Injection leading to RCE via LDAP Misconfiguration
СредняяCVSS 6,9Готовый эксплойтEPSS 91 %pandorafms · pandora fms21 нояб. 2024 г.
- CVE-2024-3089638Наблюдать
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with r
КритическаяCVSS 9,1Proof of conceptEPSS 5 %21 нояб. 2024 г.
- CVE-2024-1158721Наблюдать
idcCMS classProvCity.php GetCityOptionJs cross site scripting
СредняяCVSS 5,3Proof of conceptEPSS 0 %idccms · idccms21 нояб. 2024 г.
- CVE-2024-2178631Наблюдать
An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5.
ВысокаяCVSS 7,2Эксплойта нетEPSS 10 %mc-technologies · mc lr router firmware21 нояб. 2024 г.
- CVE-2024-4828636Наблюдать
Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.
ВысокаяCVSS 8,0Эксплойта нетEPSS 13 %linksys · e3000 firmware21 нояб. 2024 г.
- CVE-2024-4828835Наблюдать
TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the fronten
ВысокаяCVSS 8,0Эксплойта нетEPSS 10 %tp-link · tl-ipc42c firmware21 нояб. 2024 г.
- CVE-2024-5333331Наблюдать
TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function.
СредняяCVSS 6,3Эксплойта нетEPSS 19 %totolink · ex200 firmware21 нояб. 2024 г.
- CVE-2024-5039527Наблюдать
Media Streaming add-on
СредняяCVSS 6,9Proof of conceptEPSS 1 %qnap · media streaming add-on22 нояб. 2024 г.
- CVE-2024-1022033Наблюдать
Arbitrary command execution through gitRepo volume
ВысокаяCVSS 8,1Proof of conceptEPSS 3 %kubernetes · kubelet22 нояб. 2024 г.
- CVE-2024-5065727Наблюдать
An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, spec
СредняяCVSS 6,8Proof of conceptEPSS 0 %22 нояб. 2024 г.
- CVE-2023-5164619Наблюдать
Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability
СредняяCVSS 4,7Эксплойта нетEPSS 1 %alltena · allegra22 нояб. 2024 г.
- CVE-2024-572160На этой неделе
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Готовый эксплойтEPSS 5 %logsign · unified secops platform22 нояб. 2024 г.
- CVE-2024-1147738Наблюдать
7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability
ВысокаяCVSS 7,8Proof of conceptEPSS 22 %7-zip · 7-zip22 нояб. 2024 г.
- CVE-2024-1139237Наблюдать
Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 7 %huggingface · transformers22 нояб. 2024 г.
- CVE-2024-1139336Наблюдать
Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 3 %huggingface · transformers22 нояб. 2024 г.
- CVE-2024-1139436Наблюдать
Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %huggingface · transformers22 нояб. 2024 г.
- CVE-2024-4740760На этой неделе
mySCADA myPRO OS Command Injection
КритическаяCVSS 10,0Готовый эксплойтEPSS 63 %myscada · mypro manager22 нояб. 2024 г.
- CVE-2024-1165128Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT wifi_schedule command injection
СредняяCVSS 5,1Эксплойта нетEPSS 27 %engeniustech · enh1350ext firmware24 нояб. 2024 г.
- CVE-2024-1165229Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injection
СредняяCVSS 5,1Эксплойта нетEPSS 30 %engeniustech · enh1350ext firmware24 нояб. 2024 г.
- CVE-2024-1165329Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute command injection
СредняяCVSS 5,1Эксплойта нетEPSS 29 %engeniustech · enh1350ext firmware25 нояб. 2024 г.
- CVE-2024-1165429Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injection
СредняяCVSS 5,1Эксплойта нетEPSS 29 %engeniustech · enh1350ext firmware25 нояб. 2024 г.
- CVE-2024-1165529Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injection
СредняяCVSS 5,1Эксплойта нетEPSS 28 %engeniustech · enh1350ext firmware25 нояб. 2024 г.
- CVE-2024-1165629Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_ping6 command injection
СредняяCVSS 5,1Эксплойта нетEPSS 28 %engeniustech · enh1350ext firmware25 нояб. 2024 г.
- CVE-2024-1165729Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injection
СредняяCVSS 5,1Эксплойта нетEPSS 29 %engeniustech · enh1350ext firmware25 нояб. 2024 г.
- CVE-2024-1165829Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injection
СредняяCVSS 5,1Эксплойта нетEPSS 29 %engeniustech · enh1350ext firmware25 нояб. 2024 г.
- CVE-2024-1165929Наблюдать
EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injection
СредняяCVSS 5,1Эксплойта нетEPSS 29 %engeniustech · enh1350ext firmware25 нояб. 2024 г.
- CVE-2024-5325521Наблюдать
Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
СредняяCVSS 5,3Proof of conceptEPSS 0 %boidcms · boidcms25 нояб. 2024 г.
- CVE-2024-5067239Наблюдать
A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administ
КритическаяCVSS 9,8Proof of conceptEPSS 1 %25 нояб. 2024 г.
- CVE-2024-1054235Наблюдать
Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation
ВысокаяCVSS 7,5Proof of conceptEPSS 15 %cleantalk · anti-spam26 нояб. 2024 г.
- CVE-2024-3360532Наблюдать
Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability.
ВысокаяCVSS 7,5Proof of conceptEPSS 6 %sharp corporation · multiple mfps (multifunction printers)26 нояб. 2024 г.
- CVE-2024-3361051В плане
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.
КритическаяCVSS 9,1Proof of conceptEPSS 50 %sharp corporation · multiple mfps (multifunction printers)26 нояб. 2024 г.
- CVE-2024-1168097Срочно
ProjectSend Unauthenticated Configuration Modification
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 91 %projectsend · projectsend26 нояб. 2024 г.
- CVE-2023-152131Наблюдать
Local Privilege Escalation in sccache
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %mozilla · sccache26 нояб. 2024 г.
- CVE-2024-3296542В плане
ssrf vulnerability in lobe-chat
ВысокаяCVSS 8,6Эксплойта нетEPSS 26 %lobehub · lobe chat26 нояб. 2024 г.
- CVE-2024-4903569На этой неделе
Partner.Microsoft.Com Elevation of Privilege Vulnerability
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 1 %microsoft · partner center26 нояб. 2024 г.
- CVE-2024-5367444В плане
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain
ВысокаяCVSS 7,5Эксплойта нетEPSS 46 %hpe · insight remote support26 нояб. 2024 г.
- CVE-2024-5367555В плане
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain
ВысокаяCVSS 7,5Эксплойта нетEPSS 83 %hpe · insight remote support26 нояб. 2024 г.
- CVE-2024-5367656В плане
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
КритическаяCVSS 9,8Эксплойта нетEPSS 56 %hpe · insight remote support26 нояб. 2024 г.
- CVE-2024-1166770На этой неделе
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX seri
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 2 %zyxel · zld27 нояб. 2024 г.
- CVE-2024-4232763На этой неделе
SQL injection in user.get API
КритическаяCVSS 9,9Proof of conceptEPSS 79 %zabbix · zabbix27 нояб. 2024 г.
- CVE-2024-5122828Наблюдать
An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1
СредняяCVSS 6,8Proof of conceptEPSS 3 %27 нояб. 2024 г.
- CVE-2024-5400356В плане
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability
ВысокаяCVSS 8,0Эксплойта нетEPSS 80 %jenkins · simple queue27 нояб. 2024 г.
- CVE-2024-867253В плане
Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution
КритическаяCVSS 9,9Proof of conceptEPSS 45 %marketingfire · widget options – advanced conditional visibility for gutenberg blocks & classic widgets28 нояб. 2024 г.
- CVE-2024-5247540В плане
WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %information technology · wawp28 нояб. 2024 г.