По дате публикации
Эксплуатируемые и новые серьёзные CVE: декабрь 2024 г.
154 записей · 11 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
30Наблюдать | CVE-2024-20137Proof of concept | In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions.mediatek, inc. · mt6890, mt7622, mt7915, mt7916, mt7981, mt7986 · CWE-248 | Высокая7,5 | — | 1,2 % | 2 дек. 2024 г. |
62На этой неделе | CVE-2024-53104Готовый эксплойт | media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatlinux · linux kernel · CWE-787 | Высокая7,8 | KEV | 3,3 % | 2 дек. 2024 г. |
47В плане | CVE-2024-46906Эксплойта нет | WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerabilityprogress · whatsup gold · CWE-89 | Высокая8,8 | — | 40,3 % | 2 дек. 2024 г. |
54В плане | CVE-2024-46909Эксплойта нет | WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerabilityprogress · whatsup gold · CWE-16 | Критическая9,8 | — | 48,9 % | 2 дек. 2024 г. |
33Наблюдать | CVE-2024-52806Proof of concept | SimpleSAMLphp SAML2 has an XXE in parsing SAML messagessimplesamlphp · saml2 · CWE-611 | Высокая8,3 | — | 0,4 % | 2 дек. 2024 г. |
26Наблюдать | CVE-2024-53259Proof of concept | quic-go affected by an ICMP Packet Too Large Injection Attack on Linuxquic-go · quic-go · CWE-345 | Средняя6,5 | — | 0,6 % | 2 дек. 2024 г. |
19Наблюдать | CVE-2024-53617Proof of concept | A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file CWE-79 | Средняя4,8 | — | 0,5 % | 2 дек. 2024 г. |
37Наблюдать | CVE-2024-53900Proof of concept | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.mongoosejs · mongoose · CWE-89 | Критическая9,1 | — | 3,9 % | 2 дек. 2024 г. |
45В плане | CVE-2024-53375Proof of concept | An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series.CWE-78 | Высокая8,0 | — | 42,0 % | 2 дек. 2024 г. |
31Наблюдать | CVE-2024-29404Proof of concept | An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export paCWE-77 | Высокая7,8 | — | 0,4 % | 3 дек. 2024 г. |
37Наблюдать | CVE-2024-42455Эксплойта нет | A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserializatveeam · veeam backup \& replication · CWE-306 | Высокая8,1 | — | 15,7 % | 3 дек. 2024 г. |
35Наблюдать | CVE-2024-11643Proof of concept | Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Updateallaccessible · accessibility by allaccessible · CWE-862 | Высокая8,8 | — | 0,7 % | 4 дек. 2024 г. |
38Наблюдать | CVE-2024-48839Proof of concept | Remote Code Execution, RCEabb · aspect-ent-2 firmware · CWE-94 | Критическая9,3 | — | 2,8 % | 5 дек. 2024 г. |
38Наблюдать | CVE-2024-48840Proof of concept | Unauthorized Access vulnerabilities allow Remote Code Execution.abb · aspect-ent-2 firmware · CWE-94 | Критическая9,3 | — | 2,0 % | 5 дек. 2024 г. |
28Наблюдать | CVE-2024-48844Proof of concept | Denial of Service, DoSabb · aspect-ent-2 firmware · CWE-770 | Высокая7,2 | — | 0,8 % | 5 дек. 2024 г. |
38Наблюдать | CVE-2024-48845Proof of concept | Weak Password Rules/Strengthabb · aspect-ent-2 firmware · CWE-521 | Критическая9,3 | — | 1,8 % | 5 дек. 2024 г. |
28Наблюдать | CVE-2024-48846Proof of concept | Cross Side Request Forgery, CSRFabb · aspect-ent-2 firmware · CWE-352 | Высокая7,1 | — | 0,6 % | 5 дек. 2024 г. |
39Наблюдать | CVE-2024-51544Эксплойта нет | Service Control vulnerabilities allow access to service restart requests and vm configuration settings.abb · aspect-ent-12 firmware · CWE-15 | Высокая8,8 | — | 13,2 % | 5 дек. 2024 г. |
34Наблюдать | CVE-2024-51546Proof of concept | Credentails Disclosureabb · aspect-ent-12 firmware · CWE-1287 | Высокая8,7 | — | 1,4 % | 5 дек. 2024 г. |
38Наблюдать | CVE-2024-51550Proof of concept | Data Validation / Sanitizationabb · aspect-ent-12 firmware · CWE-1287 | Критическая9,3 | — | 1,8 % | 5 дек. 2024 г. |
37Наблюдать | CVE-2024-6516Proof of concept | Cross Site Scripting XSSabb · aspect-ent-2 firmware · CWE-79 | Критическая9,3 | — | 1,0 % | 5 дек. 2024 г. |
27Наблюдать | CVE-2024-12227Proof of concept | MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereferencemsi · dragon center · CWE-404 | Средняя6,8 | — | 0,1 % | 5 дек. 2024 г. |
36Наблюдать | CVE-2024-53703Proof of concept | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web servsonicwall · sma 200 firmware · CWE-121 | Высокая8,1 | — | 12,6 % | 5 дек. 2024 г. |
26Наблюдать | CVE-2024-54679Proof of concept | CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.cyberpanel · cyberpanel · CWE-862 | Средняя6,5 | — | 0,9 % | 5 дек. 2024 г. |
35Наблюдать | CVE-2024-53457Эксплойта нет | A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to executelibrenms · librenms · CWE-79 | Средняя5,4 | — | 46,4 % | 5 дек. 2024 г. |
35Наблюдать | CVE-2024-10578Proof of concept | Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installationblazethemes · pubnews · CWE-434 | Высокая8,8 | — | 1,3 % | 6 дек. 2024 г. |
25Наблюдать | CVE-2024-11201Proof of concept | myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcodesaadiqbal · points management system for gamification, ranks, badges, and loyalty rewards program – mycred · CWE-79 | Средняя6,4 | — | 0,8 % | 6 дек. 2024 г. |
34Наблюдать | CVE-2024-11728Proof of concept | KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injectioniqonic · kivicare · CWE-89 | Высокая7,5 | — | 13,6 % | 6 дек. 2024 г. |
34Наблюдать | CVE-2024-10516Proof of concept | Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'swte · swift performance lite · CWE-22 | Высокая8,1 | — | 6,4 % | 6 дек. 2024 г. |
24Наблюдать | CVE-2024-50677Proof of concept | A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted poroinc · oroplatform · CWE-79 | Средняя6,1 | — | 0,5 % | 6 дек. 2024 г. |
27Наблюдать | CVE-2024-50404Proof of concept | A link following vulnerability has been reported to affect Qsync Central.qnap · qsync central · CWE-59 | Средняя6,8 | — | 1,4 % | 6 дек. 2024 г. |
41В плане | CVE-2024-53691Proof of concept | A link following vulnerability has been reported to affect several QNAP operating system versions.qnap · qts · CWE-59 | Высокая8,7 | — | 22,8 % | 6 дек. 2024 г. |
31Наблюдать | CVE-2024-12270Proof of concept | Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injectionjonathandejong · beautiful taxonomy filters · CWE-89 | Высокая7,5 | — | 3,7 % | 7 дек. 2024 г. |
46В плане | CVE-2024-12209Proof of concept | WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusionwphealth · wp umbrella: update backup restore & monitoring · CWE-98 | Критическая9,8 | — | 23,2 % | 8 дек. 2024 г. |
31Наблюдать | CVE-2024-12342Proof of concept | TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of servicetp-link · vn020 f3v(t) · CWE-404 | Высокая7,1 | — | 9,2 % | 8 дек. 2024 г. |
22Наблюдать | CVE-2024-12344Proof of concept | TP-Link VN020 F3v(T) FTP USER Command memory corruptiontp-link · vn020 f3v firmware · CWE-119 | Средняя5,3 | — | 1,8 % | 8 дек. 2024 г. |
17Наблюдать | CVE-2023-30486Proof of concept | WordPress Square theme <= 2.0.0 - Broken Access Controlhashthemes · square · CWE-862 | Средняя4,3 | — | 0,7 % | 9 дек. 2024 г. |
41В плане | CVE-2023-32117Proof of concept | WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerabilitysoftlab · integrate google drive · CWE-862 | Критическая9,8 | — | 7,3 % | 9 дек. 2024 г. |
26Наблюдать | CVE-2024-21542Proof of concept | Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destinatCWE-29 | Средняя6,6 | — | 1,1 % | 10 дек. 2024 г. |
20Наблюдать | CVE-2024-10708Proof of concept | System Dashboard < 2.8.15 - Admin+ Path Traversalbowo · system dashboard · CWE-22 | Средняя4,9 | — | 2,0 % | 10 дек. 2024 г. |
21Наблюдать | CVE-2024-11868Proof of concept | LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST APIthimpress · learnpress · CWE-284 | Средняя5,3 | — | 1,1 % | 10 дек. 2024 г. |
38Наблюдать | CVE-2024-54152Proof of concept | Angular Expressions - Remote Code Execution when using localspeerigon · angular-expressions · CWE-94 | Критическая9,3 | — | 2,2 % | 10 дек. 2024 г. |
38Наблюдать | CVE-2024-55544Эксплойта нет | Authenticated Command Injectionoringnet · iap-420 firmware · CWE-77 | Высокая8,7 | — | 12,0 % | 10 дек. 2024 г. |
42В плане | CVE-2024-55547Эксплойта нет | Remote Command Execution via SNMPoringnet · iap-420 firmware · CWE-77 | Критическая9,3 | — | 17,4 % | 10 дек. 2024 г. |
35Наблюдать | CVE-2024-11773Эксплойта нет | SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to ruivanti · cloud services appliance · CWE-89 | Высокая7,2 | — | 23,4 % | 10 дек. 2024 г. |
51В плане | CVE-2024-55550Готовый эксплойт | Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insumitel · micollab · CWE-22 | Низкая2,7 | KEV | 38,1 % | 10 дек. 2024 г. |
25Наблюдать | CVE-2024-10511Proof of concept | CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwoschneider electric · powerchute serial shutdown · CWE-287 | Средняя6,3 | — | 0,9 % | 11 дек. 2024 г. |
59В плане | CVE-2024-53677Proof of concept | Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checksapache · struts · CWE-434 | Критическая9,5 | — | 70,1 % | 11 дек. 2024 г. |
36Наблюдать | CVE-2024-12381Proof of concept | Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a craftedgoogle · chrome · CWE-843 | Высокая8,8 | — | 4,8 % | 11 дек. 2024 г. |
26Наблюдать | CVE-2024-12483Proof of concept | Dromara UJCMS User ID id authorizationujcms · ujcms · CWE-285 | Средняя6,3 | — | 3,5 % | 11 дек. 2024 г. |
27Наблюдать | CVE-2024-12484Proof of concept | Codezips Technical Discussion Forum signuppost.php sql injectioncodezips · technical discussion forum · CWE-74 | Средняя6,9 | — | 0,9 % | 11 дек. 2024 г. |
45В плане | CVE-2024-42448Proof of concept | From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remveeam · service provider console · CWE-94 | Критическая9,9 | — | 19,9 % | 11 дек. 2024 г. |
37Наблюдать | CVE-2024-45337Proof of concept | Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptogolang.org/x/crypto · golang.org/x/crypto/ssh · CWE-1108 | Критическая9,1 | — | 3,1 % | 11 дек. 2024 г. |
61На этой неделе | CVE-2024-49112Proof of concept | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-190 | Критическая9,8 | — | 71,8 % | 11 дек. 2024 г. |
55В плане | CVE-2024-49113Proof of concept | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerabilitymicrosoft · windows 10 1507 · CWE-125 | Высокая7,5 | — | 83,5 % | 11 дек. 2024 г. |
35Наблюдать | CVE-2024-49116Эксплойта нет | Windows Remote Desktop Services Remote Code Execution Vulnerabilitymicrosoft · windows server 2016 · CWE-416 | Высокая8,1 | — | 10,1 % | 11 дек. 2024 г. |
35Наблюдать | CVE-2024-49117Proof of concept | Windows Hyper-V Remote Code Execution Vulnerabilitymicrosoft · windows 11 22h2 · CWE-393 | Высокая8,8 | — | 1,0 % | 11 дек. 2024 г. |
38Наблюдать | CVE-2024-49122Эксплойта нет | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 | Высокая8,1 | — | 20,6 % | 11 дек. 2024 г. |
69На этой неделе | CVE-2024-49138Готовый эксплойт | Windows Common Log File System Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 | Высокая7,8 | KEV | 26,2 % | 11 дек. 2024 г. |
43В плане | CVE-2024-50339Эксплойта нет | GLPI vulnerable to unauthenticated session hijackingglpi-project · glpi · CWE-79 | Критическая9,3 | — | 18,7 % | 11 дек. 2024 г. |
36Наблюдать | CVE-2024-55587Proof of concept | python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extractCWE-22 | Высокая8,8 | — | 2,1 % | 11 дек. 2024 г. |
35Наблюдать | CVE-2024-54498Proof of concept | A path handling issue was addressed with improved validation.apple · macos | Высокая8,8 | — | 1,1 % | 11 дек. 2024 г. |
31Наблюдать | CVE-2024-54502Эксплойта нет | The issue was addressed with improved checks.apple · safari · CWE-125 | Средняя6,5 | — | 17,0 % | 11 дек. 2024 г. |
31Наблюдать | CVE-2024-54515Эксплойта нет | A logic issue was addressed with improved restrictions.apple · macos · CWE-281 | Высокая7,8 | — | 0,2 % | 11 дек. 2024 г. |
34Наблюдать | CVE-2024-55659Эксплойта нет | SiYuan has an arbitrary file write in the host via /api/asset/uploadb3log · siyuan · CWE-22 | Высокая8,7 | — | 0,3 % | 11 дек. 2024 г. |
49В плане | CVE-2024-10124Proof of concept | Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activationthemehunk · vayu blocks – website builder for the block editor · CWE-284 | Критическая9,8 | — | 32,7 % | 12 дек. 2024 г. |
30Наблюдать | CVE-2024-12172Proof of concept | WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+)hookandhook · wp courses lms – online courses builder, elearning courses, courses solution, education courses · CWE-862 | Высокая7,5 | — | 0,7 % | 12 дек. 2024 г. |
39Наблюдать | CVE-2024-55099Proof of concept | A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to phpgurukul · online nurse hiring system · CWE-89 | Критическая9,8 | — | 1,0 % | 12 дек. 2024 г. |
40В плане | CVE-2024-55875Proof of concept | http4k has a potential XXE (XML External Entity Injection) vulnerabilityhttp4k · http4k · CWE-200 | Критическая9,8 | — | 1,9 % | 12 дек. 2024 г. |
33Наблюдать | CVE-2024-10783Proof of concept | MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalationmainwp · mainwp child – securely connects to the mainwp dashboard to manage multiple sites · CWE-862 | Высокая8,1 | — | 2,3 % | 13 дек. 2024 г. |
40В плане | CVE-2024-9290Proof of concept | Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Uploadazzaroco · super backup & clone - migrate for wordpress · CWE-434 | Критическая9,8 | — | 3,5 % | 13 дек. 2024 г. |
29Наблюдать | CVE-2024-55889Proof of concept | phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Framesphpmyfaq · phpmyfaq · CWE-451 | Высокая7,2 | — | 2,1 % | 13 дек. 2024 г. |
17Наблюдать | CVE-2023-36531Proof of concept | WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerabilityliquidpoll · liquidpoll – advanced polls for creators and brands · CWE-862 | Средняя4,3 | — | 1,0 % | 13 дек. 2024 г. |
39Наблюдать | CVE-2024-54239Proof of concept | WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerabilitydugudlabs · eyewear prescription form · CWE-862 | Критическая9,8 | — | 0,9 % | 13 дек. 2024 г. |
39Наблюдать | CVE-2024-54262Proof of concept | WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerabilitysidngr · import export for woocommerce · CWE-434 | Критическая9,9 | — | 1,4 % | 13 дек. 2024 г. |
37Наблюдать | CVE-2024-54292Proof of concept | WordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerabilityappsplate · appsplate · CWE-89 | Критическая9,3 | — | 0,8 % | 13 дек. 2024 г. |
28Наблюдать | CVE-2024-54330Proof of concept | WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerabilityhurraki · hurrakify · CWE-918 | Высокая7,2 | — | 1,4 % | 13 дек. 2024 г. |
43В плане | CVE-2024-55661Proof of concept | Laravel Pulse Allows Remote Code Execution via Unprotected Query Methodlaravel · pulse · CWE-94 | Высокая8,7 | — | 29,5 % | 13 дек. 2024 г. |
28Наблюдать | CVE-2024-55890Proof of concept | D-Tale allows Remote Code Execution through the Custom Filter Inputman-group · dtale · CWE-79 | Средняя6,9 | — | 2,4 % | 13 дек. 2024 г. |
97Срочно | CVE-2024-55956Готовый эксплойт | In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitcleo · harmony · CWE-77 | Критическая9,8 | KEV | 93,9 % | 13 дек. 2024 г. |
29Наблюдать | CVE-2024-9698Proof of concept | Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_filesaruphash · crafthemes demo import · CWE-434 | Высокая7,2 | — | 1,7 % | 14 дек. 2024 г. |
38Наблюдать | CVE-2024-53376Proof of concept | CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field tcyberpanel · cyberpanel · CWE-78 | Высокая8,8 | — | 10,8 % | 16 дек. 2024 г. |
21Наблюдать | CVE-2024-5333Proof of concept | The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosurestellarwp · the events calendar · CWE-639 | Средняя5,3 | — | 1,1 % | 16 дек. 2024 г. |
38Наблюдать | CVE-2024-12641Proof of concept | Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCEcht · tenderdoctransfer · CWE-79 | Критическая9,6 | — | 1,4 % | 16 дек. 2024 г. |
40В плане | CVE-2024-54363Proof of concept | WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerabilitysaiful.total · wp nssuser register · CWE-266 | Критическая9,8 | — | 1,9 % | 16 дек. 2024 г. |
36Наблюдать | CVE-2024-54369Proof of concept | WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerabilitythemehunk · zita site builder · CWE-862 | Критическая9,1 | — | 1,6 % | 16 дек. 2024 г. |
30Наблюдать | CVE-2024-54374Proof of concept | WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerabilitysabri · sogrid · CWE-22 | Высокая7,5 | — | 1,2 % | 16 дек. 2024 г. |
35Наблюдать | CVE-2024-54378Proof of concept | WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerabilityquietly · quietly insights · CWE-862 | Высокая8,8 | — | 0,7 % | 16 дек. 2024 г. |
35Наблюдать | CVE-2024-54379Proof of concept | WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerabilityblokhauswp · minterpress · CWE-862 | Высокая8,8 | — | 0,7 % | 16 дек. 2024 г. |
30Наблюдать | CVE-2024-54385Proof of concept | WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerabilityprinceahmed · radio player · CWE-918 | Высокая7,2 | — | 5,5 % | 16 дек. 2024 г. |
37Наблюдать | CVE-2024-55972Proof of concept | WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerabilitychriscarvache · etemplates · CWE-89 | Критическая9,3 | — | 1,2 % | 16 дек. 2024 г. |
37Наблюдать | CVE-2024-55976Proof of concept | WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerabilitymikeleembruggen · critical site intel · CWE-89 | Критическая9,3 | — | 1,2 % | 16 дек. 2024 г. |
37Наблюдать | CVE-2024-55978Proof of concept | WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerabilitywalletstation · code generator pro · CWE-89 | Критическая9,3 | — | 0,7 % | 16 дек. 2024 г. |
37Наблюдать | CVE-2024-55980Proof of concept | WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerabilityrobindkumar · wr age verification · CWE-89 | Критическая9,3 | — | 0,7 % | 16 дек. 2024 г. |
37Наблюдать | CVE-2024-55981Proof of concept | WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerabilitynabajit roy · nabz image gallery · CWE-89 | Критическая9,3 | — | 1,0 % | 16 дек. 2024 г. |
38Наблюдать | CVE-2024-55982Proof of concept | WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerabilityrichteam · share buttons – social media · CWE-89 | Критическая9,3 | — | 1,7 % | 16 дек. 2024 г. |
37Наблюдать | CVE-2024-55988Proof of concept | WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerabilityamol nirmala waman · navayan csv export · CWE-89 | Критическая9,3 | — | 1,1 % | 16 дек. 2024 г. |
39Наблюдать | CVE-2024-55557Proof of concept | ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.CWE-798 | Критическая9,8 | — | 1,3 % | 16 дек. 2024 г. |
46В плане | CVE-2024-29671Proof of concept | Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request hCWE-120 | Критическая9,8 | — | 24,5 % | 16 дек. 2024 г. |
95Срочно | CVE-2024-12356Готовый эксплойт | Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)beyondtrust · privileged remote access · CWE-77 | Критическая9,8 | KEV | 87,2 % | 17 дек. 2024 г. |
- CVE-2024-2013730Наблюдать
In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions.
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %mediatek, inc. · mt6890, mt7622, mt7915, mt7916, mt7981, mt79862 дек. 2024 г.
- CVE-2024-5310462На этой неделе
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 3 %linux · linux kernel2 дек. 2024 г.
- CVE-2024-4690647В плане
WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability
ВысокаяCVSS 8,8Эксплойта нетEPSS 40 %progress · whatsup gold2 дек. 2024 г.
- CVE-2024-4690954В плане
WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
КритическаяCVSS 9,8Эксплойта нетEPSS 48 %progress · whatsup gold2 дек. 2024 г.
- CVE-2024-5280633Наблюдать
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
ВысокаяCVSS 8,3Proof of conceptEPSS 0 %simplesamlphp · saml22 дек. 2024 г.
- CVE-2024-5325926Наблюдать
quic-go affected by an ICMP Packet Too Large Injection Attack on Linux
СредняяCVSS 6,5Proof of conceptEPSS 0 %quic-go · quic-go2 дек. 2024 г.
- CVE-2024-5361719Наблюдать
A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file
СредняяCVSS 4,8Proof of conceptEPSS 0 %2 дек. 2024 г.
- CVE-2024-5390037Наблюдать
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
КритическаяCVSS 9,1Proof of conceptEPSS 3 %mongoosejs · mongoose2 дек. 2024 г.
- CVE-2024-5337545В плане
An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series.
ВысокаяCVSS 8,0Proof of conceptEPSS 42 %2 дек. 2024 г.
- CVE-2024-2940431Наблюдать
An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export pa
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %3 дек. 2024 г.
- CVE-2024-4245537Наблюдать
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserializat
ВысокаяCVSS 8,1Эксплойта нетEPSS 15 %veeam · veeam backup \& replication3 дек. 2024 г.
- CVE-2024-1164335Наблюдать
Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %allaccessible · accessibility by allaccessible4 дек. 2024 г.
- CVE-2024-4883938Наблюдать
Remote Code Execution, RCE
КритическаяCVSS 9,3Proof of conceptEPSS 2 %abb · aspect-ent-2 firmware5 дек. 2024 г.
- CVE-2024-4884038Наблюдать
Unauthorized Access vulnerabilities allow Remote Code Execution.
КритическаяCVSS 9,3Proof of conceptEPSS 2 %abb · aspect-ent-2 firmware5 дек. 2024 г.
- CVE-2024-4884428Наблюдать
Denial of Service, DoS
ВысокаяCVSS 7,2Proof of conceptEPSS 0 %abb · aspect-ent-2 firmware5 дек. 2024 г.
- CVE-2024-4884538Наблюдать
Weak Password Rules/Strength
КритическаяCVSS 9,3Proof of conceptEPSS 1 %abb · aspect-ent-2 firmware5 дек. 2024 г.
- CVE-2024-4884628Наблюдать
Cross Side Request Forgery, CSRF
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %abb · aspect-ent-2 firmware5 дек. 2024 г.
- CVE-2024-5154439Наблюдать
Service Control vulnerabilities allow access to service restart requests and vm configuration settings.
ВысокаяCVSS 8,8Эксплойта нетEPSS 13 %abb · aspect-ent-12 firmware5 дек. 2024 г.
- CVE-2024-5154634Наблюдать
Credentails Disclosure
ВысокаяCVSS 8,7Proof of conceptEPSS 1 %abb · aspect-ent-12 firmware5 дек. 2024 г.
- CVE-2024-5155038Наблюдать
Data Validation / Sanitization
КритическаяCVSS 9,3Proof of conceptEPSS 1 %abb · aspect-ent-12 firmware5 дек. 2024 г.
- CVE-2024-651637Наблюдать
Cross Site Scripting XSS
КритическаяCVSS 9,3Proof of conceptEPSS 1 %abb · aspect-ent-2 firmware5 дек. 2024 г.
- CVE-2024-1222727Наблюдать
MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereference
СредняяCVSS 6,8Proof of conceptEPSS 0 %msi · dragon center5 дек. 2024 г.
- CVE-2024-5370336Наблюдать
A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web serv
ВысокаяCVSS 8,1Proof of conceptEPSS 12 %sonicwall · sma 200 firmware5 дек. 2024 г.
- CVE-2024-5467926Наблюдать
CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions.
СредняяCVSS 6,5Proof of conceptEPSS 0 %cyberpanel · cyberpanel5 дек. 2024 г.
- CVE-2024-5345735Наблюдать
A stored cross-site scripting (XSS) vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute
СредняяCVSS 5,4Эксплойта нетEPSS 46 %librenms · librenms5 дек. 2024 г.
- CVE-2024-1057835Наблюдать
Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %blazethemes · pubnews6 дек. 2024 г.
- CVE-2024-1120125Наблюдать
myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode
СредняяCVSS 6,4Proof of conceptEPSS 0 %saadiqbal · points management system for gamification, ranks, badges, and loyalty rewards program – mycred6 дек. 2024 г.
- CVE-2024-1172834Наблюдать
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 13 %iqonic · kivicare6 дек. 2024 г.
- CVE-2024-1051634Наблюдать
Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'
ВысокаяCVSS 8,1Proof of conceptEPSS 6 %swte · swift performance lite6 дек. 2024 г.
- CVE-2024-5067724Наблюдать
A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p
СредняяCVSS 6,1Proof of conceptEPSS 0 %oroinc · oroplatform6 дек. 2024 г.
- CVE-2024-5040427Наблюдать
A link following vulnerability has been reported to affect Qsync Central.
СредняяCVSS 6,8Proof of conceptEPSS 1 %qnap · qsync central6 дек. 2024 г.
- CVE-2024-5369141В плане
A link following vulnerability has been reported to affect several QNAP operating system versions.
ВысокаяCVSS 8,7Proof of conceptEPSS 22 %qnap · qts6 дек. 2024 г.
- CVE-2024-1227031Наблюдать
Beautiful Taxonomy Filters <= 2.4.3 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 3 %jonathandejong · beautiful taxonomy filters7 дек. 2024 г.
- CVE-2024-1220946В плане
WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
КритическаяCVSS 9,8Proof of conceptEPSS 23 %wphealth · wp umbrella: update backup restore & monitoring8 дек. 2024 г.
- CVE-2024-1234231Наблюдать
TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service
ВысокаяCVSS 7,1Proof of conceptEPSS 9 %tp-link · vn020 f3v(t)8 дек. 2024 г.
- CVE-2024-1234422Наблюдать
TP-Link VN020 F3v(T) FTP USER Command memory corruption
СредняяCVSS 5,3Proof of conceptEPSS 1 %tp-link · vn020 f3v firmware8 дек. 2024 г.
- CVE-2023-3048617Наблюдать
WordPress Square theme <= 2.0.0 - Broken Access Control
СредняяCVSS 4,3Proof of conceptEPSS 0 %hashthemes · square9 дек. 2024 г.
- CVE-2023-3211741В плане
WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 7 %softlab · integrate google drive9 дек. 2024 г.
- CVE-2024-2154226Наблюдать
Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destinat
СредняяCVSS 6,6Proof of conceptEPSS 1 %10 дек. 2024 г.
- CVE-2024-1070820Наблюдать
System Dashboard < 2.8.15 - Admin+ Path Traversal
СредняяCVSS 4,9Proof of conceptEPSS 2 %bowo · system dashboard10 дек. 2024 г.
- CVE-2024-1186821Наблюдать
LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
СредняяCVSS 5,3Proof of conceptEPSS 1 %thimpress · learnpress10 дек. 2024 г.
- CVE-2024-5415238Наблюдать
Angular Expressions - Remote Code Execution when using locals
КритическаяCVSS 9,3Proof of conceptEPSS 2 %peerigon · angular-expressions10 дек. 2024 г.
- CVE-2024-5554438Наблюдать
Authenticated Command Injection
ВысокаяCVSS 8,7Эксплойта нетEPSS 12 %oringnet · iap-420 firmware10 дек. 2024 г.
- CVE-2024-5554742В плане
Remote Command Execution via SNMP
КритическаяCVSS 9,3Эксплойта нетEPSS 17 %oringnet · iap-420 firmware10 дек. 2024 г.
- CVE-2024-1177335Наблюдать
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to ru
ВысокаяCVSS 7,2Эксплойта нетEPSS 23 %ivanti · cloud services appliance10 дек. 2024 г.
- CVE-2024-5555051В плане
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insu
НизкаяCVSS 2,7KEVГотовый эксплойтEPSS 38 %mitel · micollab10 дек. 2024 г.
- CVE-2024-1051125Наблюдать
CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someone on the local netwo
СредняяCVSS 6,3Proof of conceptEPSS 0 %schneider electric · powerchute serial shutdown11 дек. 2024 г.
- CVE-2024-5367759В плане
Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
КритическаяCVSS 9,5Proof of conceptEPSS 70 %apache · struts11 дек. 2024 г.
- CVE-2024-1238136Наблюдать
Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted
ВысокаяCVSS 8,8Proof of conceptEPSS 4 %google · chrome11 дек. 2024 г.
- CVE-2024-1248326Наблюдать
Dromara UJCMS User ID id authorization
СредняяCVSS 6,3Proof of conceptEPSS 3 %ujcms · ujcms11 дек. 2024 г.
- CVE-2024-1248427Наблюдать
Codezips Technical Discussion Forum signuppost.php sql injection
СредняяCVSS 6,9Proof of conceptEPSS 0 %codezips · technical discussion forum11 дек. 2024 г.
- CVE-2024-4244845В плане
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Rem
КритическаяCVSS 9,9Proof of conceptEPSS 19 %veeam · service provider console11 дек. 2024 г.
- CVE-2024-4533737Наблюдать
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
КритическаяCVSS 9,1Proof of conceptEPSS 3 %golang.org/x/crypto · golang.org/x/crypto/ssh11 дек. 2024 г.
- CVE-2024-4911261На этой неделе
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 71 %microsoft · windows 10 150711 дек. 2024 г.
- CVE-2024-4911355В плане
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 83 %microsoft · windows 10 150711 дек. 2024 г.
- CVE-2024-4911635Наблюдать
Windows Remote Desktop Services Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Эксплойта нетEPSS 10 %microsoft · windows server 201611 дек. 2024 г.
- CVE-2024-4911735Наблюдать
Windows Hyper-V Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %microsoft · windows 11 22h211 дек. 2024 г.
- CVE-2024-4912238Наблюдать
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Эксплойта нетEPSS 20 %microsoft · windows 10 150711 дек. 2024 г.
- CVE-2024-4913869На этой неделе
Windows Common Log File System Driver Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 26 %microsoft · windows 10 150711 дек. 2024 г.
- CVE-2024-5033943В плане
GLPI vulnerable to unauthenticated session hijacking
КритическаяCVSS 9,3Эксплойта нетEPSS 18 %glpi-project · glpi11 дек. 2024 г.
- CVE-2024-5558736Наблюдать
python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %11 дек. 2024 г.
- CVE-2024-5449835Наблюдать
A path handling issue was addressed with improved validation.
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %apple · macos11 дек. 2024 г.
- CVE-2024-5450231Наблюдать
The issue was addressed with improved checks.
СредняяCVSS 6,5Эксплойта нетEPSS 17 %apple · safari11 дек. 2024 г.
- CVE-2024-5451531Наблюдать
A logic issue was addressed with improved restrictions.
ВысокаяCVSS 7,8Эксплойта нетEPSS 0 %apple · macos11 дек. 2024 г.
- CVE-2024-5565934Наблюдать
SiYuan has an arbitrary file write in the host via /api/asset/upload
ВысокаяCVSS 8,7Эксплойта нетEPSS 0 %b3log · siyuan11 дек. 2024 г.
- CVE-2024-1012449В плане
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
КритическаяCVSS 9,8Proof of conceptEPSS 32 %themehunk · vayu blocks – website builder for the block editor12 дек. 2024 г.
- CVE-2024-1217230Наблюдать
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+)
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %hookandhook · wp courses lms – online courses builder, elearning courses, courses solution, education courses12 дек. 2024 г.
- CVE-2024-5509939Наблюдать
A SQL Injection vulnerability was found in /admin/index.php in phpgurukul Online Nurse Hiring System v1.0, which allows remote attackers to
КритическаяCVSS 9,8Proof of conceptEPSS 1 %phpgurukul · online nurse hiring system12 дек. 2024 г.
- CVE-2024-5587540В плане
http4k has a potential XXE (XML External Entity Injection) vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %http4k · http4k12 дек. 2024 г.
- CVE-2024-1078333Наблюдать
MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation
ВысокаяCVSS 8,1Proof of conceptEPSS 2 %mainwp · mainwp child – securely connects to the mainwp dashboard to manage multiple sites13 дек. 2024 г.
- CVE-2024-929040В плане
Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload
КритическаяCVSS 9,8Proof of conceptEPSS 3 %azzaroco · super backup & clone - migrate for wordpress13 дек. 2024 г.
- CVE-2024-5588929Наблюдать
phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames
ВысокаяCVSS 7,2Proof of conceptEPSS 2 %phpmyfaq · phpmyfaq13 дек. 2024 г.
- CVE-2023-3653117Наблюдать
WordPress LiquidPoll plugin <= 3.3.68 - Broken Access Control vulnerability
СредняяCVSS 4,3Proof of conceptEPSS 1 %liquidpoll · liquidpoll – advanced polls for creators and brands13 дек. 2024 г.
- CVE-2024-5423939Наблюдать
WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %dugudlabs · eyewear prescription form13 дек. 2024 г.
- CVE-2024-5426239Наблюдать
WordPress Import Export For WooCommerce plugin <= 1.6.2 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,9Proof of conceptEPSS 1 %sidngr · import export for woocommerce13 дек. 2024 г.
- CVE-2024-5429237Наблюдать
WordPress Appsplate plugin <= 2.1.3 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 0 %appsplate · appsplate13 дек. 2024 г.
- CVE-2024-5433028Наблюдать
WordPress Hurrakify plugin <= 2.4 - Server Side Request Forgery (SSRF) vulnerability
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %hurraki · hurrakify13 дек. 2024 г.
- CVE-2024-5566143В плане
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
ВысокаяCVSS 8,7Proof of conceptEPSS 29 %laravel · pulse13 дек. 2024 г.
- CVE-2024-5589028Наблюдать
D-Tale allows Remote Code Execution through the Custom Filter Input
СредняяCVSS 6,9Proof of conceptEPSS 2 %man-group · dtale13 дек. 2024 г.
- CVE-2024-5595697Срочно
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbit
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 93 %cleo · harmony13 дек. 2024 г.
- CVE-2024-969829Наблюдать
Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %aruphash · crafthemes demo import14 дек. 2024 г.
- CVE-2024-5337638Наблюдать
CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field t
ВысокаяCVSS 8,8Proof of conceptEPSS 10 %cyberpanel · cyberpanel16 дек. 2024 г.
- CVE-2024-533321Наблюдать
The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
СредняяCVSS 5,3Proof of conceptEPSS 1 %stellarwp · the events calendar16 дек. 2024 г.
- CVE-2024-1264138Наблюдать
Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE
КритическаяCVSS 9,6Proof of conceptEPSS 1 %cht · tenderdoctransfer16 дек. 2024 г.
- CVE-2024-5436340В плане
WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %saiful.total · wp nssuser register16 дек. 2024 г.
- CVE-2024-5436936Наблюдать
WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability
КритическаяCVSS 9,1Proof of conceptEPSS 1 %themehunk · zita site builder16 дек. 2024 г.
- CVE-2024-5437430Наблюдать
WordPress Sogrid plugin <= 1.5.6 - Local File Inclusion vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %sabri · sogrid16 дек. 2024 г.
- CVE-2024-5437835Наблюдать
WordPress Quietly Insights plugin <= 1.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %quietly · quietly insights16 дек. 2024 г.
- CVE-2024-5437935Наблюдать
WordPress Minterpress plugin <= 1.0.5 - Arbitrary Option Update to Privilege Escalation vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %blokhauswp · minterpress16 дек. 2024 г.
- CVE-2024-5438530Наблюдать
WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability
ВысокаяCVSS 7,2Proof of conceptEPSS 5 %princeahmed · radio player16 дек. 2024 г.
- CVE-2024-5597237Наблюдать
WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %chriscarvache · etemplates16 дек. 2024 г.
- CVE-2024-5597637Наблюдать
WordPress Critical Site Intel plugin <= 1.0 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %mikeleembruggen · critical site intel16 дек. 2024 г.
- CVE-2024-5597837Наблюдать
WordPress Code Generator Pro plugin <= 1.2 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 0 %walletstation · code generator pro16 дек. 2024 г.
- CVE-2024-5598037Наблюдать
WordPress Wr Age Verification plugin <= 2.0.0 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 0 %robindkumar · wr age verification16 дек. 2024 г.
- CVE-2024-5598137Наблюдать
WordPress Nabz Image Gallery plugin <= v1.00 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %nabajit roy · nabz image gallery16 дек. 2024 г.
- CVE-2024-5598238Наблюдать
WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %richteam · share buttons – social media16 дек. 2024 г.
- CVE-2024-5598837Наблюдать
WordPress Navayan CSV Export Plugin <= 1.0.9 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 1 %amol nirmala waman · navayan csv export16 дек. 2024 г.
- CVE-2024-5555739Наблюдать
ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %16 дек. 2024 г.
- CVE-2024-2967146В плане
Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request h
КритическаяCVSS 9,8Proof of conceptEPSS 24 %16 дек. 2024 г.
- CVE-2024-1235695Срочно
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 87 %beyondtrust · privileged remote access17 дек. 2024 г.