По дате публикации
Эксплуатируемые и новые серьёзные CVE: декабрь 2024 г.
155 записей · 11 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 2
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
95Срочно | CVE-2024-12356Готовый эксплойт | Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)beyondtrust · privileged remote access · CWE-77 | Критическая9,8 | KEV | 87,2 % | 17 дек. 2024 г. |
49В плане | CVE-2024-50379Proof of concept | Apache Tomcat: RCE due to TOCTOU issue in JSP compilationapache · tomcat · CWE-367 | Критическая9,8 | — | 31,8 % | 17 дек. 2024 г. |
31Наблюдать | CVE-2024-12025Proof of concept | Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injectionrobfelty · collapsing categories · CWE-89 | Высокая7,5 | — | 2,6 % | 18 дек. 2024 г. |
35Наблюдать | CVE-2024-21546Proof of concept | Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetyCWE-94 | Высокая8,9 | — | 1,3 % | 18 дек. 2024 г. |
40В плане | CVE-2024-56058Proof of concept | WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerabilitydenniskravetstns · vrpconnector · CWE-502 | Критическая9,8 | — | 1,7 % | 18 дек. 2024 г. |
40В плане | CVE-2024-56059Proof of concept | WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerabilityfarinspace · partners · CWE-1321 | Критическая9,8 | — | 1,7 % | 18 дек. 2024 г. |
46В плане | CVE-2023-34990Proof of concept | A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized cfortinet · fortiwlm · CWE-23 | Критическая9,8 | — | 24,7 % | 18 дек. 2024 г. |
39Наблюдать | CVE-2024-54383Proof of concept | WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerabilitywpwebelite · woocommerce pdf vouchers · CWE-266 | Критическая9,8 | — | 1,1 % | 18 дек. 2024 г. |
62На этой неделе | CVE-2024-12686Готовый эксплойт | Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)beyondtrust · privileged remote access · CWE-78 | Высокая7,2 | KEV | 13,7 % | 18 дек. 2024 г. |
96Срочно | CVE-2024-56145Готовый эксплойт | RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmscraftcms · craft cms · CWE-94 | Критическая9,3 | KEV | 97,4 % | 18 дек. 2024 г. |
24Наблюдать | CVE-2024-56115Proof of concept | A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements.amiro · amiro.cms · CWE-79 | Средняя6,1 | — | 0,4 % | 18 дек. 2024 г. |
35Наблюдать | CVE-2024-56116Proof of concept | A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account.amiro · amiro.cms · CWE-352 | Высокая8,8 | — | 0,3 % | 18 дек. 2024 г. |
30Наблюдать | CVE-2024-11740Proof of concept | Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Executionw3eden · download manager · CWE-94 | Высокая7,3 | — | 1,8 % | 19 дек. 2024 г. |
22Наблюдать | CVE-2024-11616Proof of concept | Double-fetch heap overflownetskope inc. · endpoint dlp · CWE-125 | Средняя5,6 | — | 0,3 % | 19 дек. 2024 г. |
42В плане | CVE-2021-26102Proof of concept | A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated fortinet · fortiwan · CWE-305 | Критическая9,1 | — | 19,7 % | 19 дек. 2024 г. |
47В плане | CVE-2024-38819Proof of concept | Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacksCWE-22 | Высокая7,5 | — | 56,0 % | 19 дек. 2024 г. |
31Наблюдать | CVE-2024-56159Proof of concept | Server source code is exposed to the public if sourcemaps are enabledastro · astro · CWE-219 | Высокая7,8 | — | 1,5 % | 19 дек. 2024 г. |
24Наблюдать | CVE-2024-52794Proof of concept | Magnific lightbox susceptible to Cross-site Scripting in Discoursediscourse · discourse · CWE-79 | Средняя6,1 | — | 0,2 % | 19 дек. 2024 г. |
32Наблюдать | CVE-2024-53991Proof of concept | Potential Backup file leaked via Nginx in Discoursediscourse · discourse · CWE-200 | Средняя5,9 | — | 29,8 % | 19 дек. 2024 г. |
35Наблюдать | CVE-2024-12729Эксплойта нет | A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older thasophos · firewall firmware · CWE-94 | Высокая8,8 | — | 1,3 % | 19 дек. 2024 г. |
17Наблюдать | CVE-2024-56348Proof of concept | In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agentsjetbrains · teamcity · CWE-863 | Средняя4,3 | — | 0,2 % | 20 дек. 2024 г. |
28Наблюдать | CVE-2024-56331Proof of concept | Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitorlouislam · uptime-kuma · CWE-22 | Средняя6,8 | — | 1,8 % | 20 дек. 2024 г. |
26Наблюдать | CVE-2024-12558Proof of concept | WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_expopuckrobin · wp base booking of appointments, services and events · CWE-862 | Средняя6,5 | — | 1,2 % | 21 дек. 2024 г. |
21Наблюдать | CVE-2024-51463Proof of concept | IBM i server-side request forgeryibm · i · CWE-918 | Средняя5,4 | — | 0,8 % | 21 дек. 2024 г. |
17Наблюдать | CVE-2024-51464Proof of concept | IBM i authentication bypassibm · i · CWE-288 | Средняя4,3 | — | 1,4 % | 21 дек. 2024 г. |
48В плане | CVE-2024-45387Эксплойта нет | Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsapache · traffic control · CWE-89 | Высокая8,8 | — | 42,2 % | 23 дек. 2024 г. |
57В плане | CVE-2024-55947Proof of concept | Gogs has a Path Traversal in file update APIgogs · gogs · CWE-22 | Высокая8,7 | — | 77,8 % | 23 дек. 2024 г. |
36Наблюдать | CVE-2024-53961Эксплойта нет | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)adobe · coldfusion · CWE-22 | Высокая8,1 | — | 14,0 % | 23 дек. 2024 г. |
35Наблюдать | CVE-2024-12594Proof of concept | ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalationzia-imtiaz · login page styler – custom wordpress login page customizer & security · CWE-862 | Высокая8,8 | — | 0,7 % | 24 дек. 2024 г. |
61На этой неделе | CVE-2024-43441Proof of concept | Apache HugeGraph-Server: Fixed JWT Token(Secret)apache · hugegraph · CWE-302 | Критическая9,8 | — | 72,7 % | 24 дек. 2024 г. |
58В плане | CVE-2024-53150Готовый эксплойт | ALSA: usb-audio: Fix out of bounds reads when finding clock sourceslinux · linux kernel · CWE-125 | Высокая7,1 | KEV | 1,3 % | 24 дек. 2024 г. |
24Наблюдать | CVE-2024-10858Proof of concept | Jetpack 13.0-14.0 - Unauthenticated DOM-XSSautomattic · jetpack · CWE-79 | Средняя6,1 | — | 0,3 % | 25 дек. 2024 г. |
47В плане | CVE-2024-52046Эксплойта нет | Apache MINA: MINA applications using unbounded deserialization may allow RCEapache · mina · CWE-502 | Критическая10,0 | — | 24,3 % | 25 дек. 2024 г. |
40В плане | CVE-2024-56431Proof of concept | oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.xiph · theora · CWE-863 | Критическая9,8 | — | 1,8 % | 25 дек. 2024 г. |
14Наблюдать | CVE-2024-56433Proof of concept | shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user shadow-maint · shadow-utils · CWE-1188 | Низкая3,6 | — | 0,4 % | 26 дек. 2024 г. |
27Наблюдать | CVE-2024-12955Proof of concept | PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgeryphpgurukul · blood bank \& donor management system · CWE-352 | Средняя6,9 | — | 0,8 % | 26 дек. 2024 г. |
19Наблюдать | CVE-2024-11605Proof of concept | WP Publications <= 1.2 - Admin+ Stored XSSwp-publications project · wp-publications · CWE-79 | Средняя4,8 | — | 1,2 % | 27 дек. 2024 г. |
19Наблюдать | CVE-2024-11921Proof of concept | Give < 3.19.0 - Reflected XSSgivewp · givewp · CWE-79 | Средняя4,8 | — | 0,7 % | 27 дек. 2024 г. |
73На этой неделе | CVE-2024-3393Готовый эксплойт | PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packetpaloaltonetworks · pan-os · CWE-754 | Высокая8,7 | KEV | 29,1 % | 27 дек. 2024 г. |
62На этой неделе | CVE-2024-53197Готовый эксплойт | ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox deviceslinux · linux kernel · CWE-787 | Высокая7,8 | KEV | 4,1 % | 27 дек. 2024 г. |
53В плане | CVE-2024-12856Proof of concept | Four-Faith Industrial Router adjust_sys_time OS Command Injectionfour-faith · f3x36 firmware · CWE-78 | Высокая7,2 | — | 84,1 % | 27 дек. 2024 г. |
38Наблюдать | CVE-2024-12986Proof of concept | DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injectiondraytek · vigor300b firmware · CWE-77 | Средняя6,9 | — | 35,3 % | 27 дек. 2024 г. |
86Срочно | CVE-2024-12987Готовый эксплойт | DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injectiondraytek · vigor300b firmware · CWE-77 | Средняя6,9 | KEV | 98,1 % | 27 дек. 2024 г. |
39Наблюдать | CVE-2024-50944Proof of concept | Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionalityCWE-190 | Критическая9,8 | — | 1,0 % | 27 дек. 2024 г. |
30Наблюдать | CVE-2024-50945Proof of concept | An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submiCWE-284 | Высокая7,5 | — | 0,6 % | 27 дек. 2024 г. |
23Наблюдать | CVE-2024-53476Proof of concept | A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restCWE-362 | Средняя5,9 | — | 0,6 % | 27 дек. 2024 г. |
9Наблюдать | CVE-2024-56512Proof of concept | Apache NiFi: Missing Complete Authorization for Parameter and Service Referencesapache · nifi · CWE-638 | Низкая2,1 | — | 3,2 % | 28 дек. 2024 г. |
45В плане | CVE-2024-12828Proof of concept | Webmin CGI Command Injection Remote Code Execution Vulnerabilitywebmin · webmin · CWE-78 | Высокая8,8 | — | 33,2 % | 30 дек. 2024 г. |
29Наблюдать | CVE-2024-56800Proof of concept | Firecrawl has SSRF Vulnerability via malicious scrape targetmendableai · firecrawl · CWE-918 | Высокая7,4 | — | 0,3 % | 30 дек. 2024 г. |
27Наблюдать | CVE-2024-56801Proof of concept | Tasklists has Blind SQL Injection in /ajax/reorder.phpinfotel · tasklists · CWE-89 | Средняя6,9 | — | 0,7 % | 30 дек. 2024 г. |
57В плане | CVE-2024-11972Proof of concept | Hunk Companion < 1.9.0 - Unauthenticated Plugin Installationthemehunk · hunk companion · CWE-862 | Критическая9,8 | — | 59,0 % | 31 дек. 2024 г. |
39Наблюдать | CVE-2024-12105Эксплойта нет | WhatsUp Gold - SnmpExtendedActiveMonitor path traversalprogress · whatsup gold · CWE-22 | Средняя6,5 | — | 41,6 % | 31 дек. 2024 г. |
50В плане | CVE-2024-56064Proof of concept | WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerabilityazzaroco · wp superbackup · CWE-434 | Критическая10,0 | — | 33,1 % | 31 дек. 2024 г. |
34Наблюдать | CVE-2024-56067Proof of concept | WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerabilityazzaroco · wp superbackup · CWE-862 | Высокая7,5 | — | 11,7 % | 31 дек. 2024 г. |
39Наблюдать | CVE-2024-56071Proof of concept | WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerabilitymikeleembruggen · simple dashboard · CWE-266 | Критическая9,8 | — | 0,6 % | 31 дек. 2024 г. |
- CVE-2024-1235695Срочно
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 87 %beyondtrust · privileged remote access17 дек. 2024 г.
- CVE-2024-5037949В плане
Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
КритическаяCVSS 9,8Proof of conceptEPSS 31 %apache · tomcat17 дек. 2024 г.
- CVE-2024-1202531Наблюдать
Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %robfelty · collapsing categories18 дек. 2024 г.
- CVE-2024-2154635Наблюдать
Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimety
ВысокаяCVSS 8,9Proof of conceptEPSS 1 %18 дек. 2024 г.
- CVE-2024-5605840В плане
WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %denniskravetstns · vrpconnector18 дек. 2024 г.
- CVE-2024-5605940В плане
WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %farinspace · partners18 дек. 2024 г.
- CVE-2023-3499046В плане
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized c
КритическаяCVSS 9,8Proof of conceptEPSS 24 %fortinet · fortiwlm18 дек. 2024 г.
- CVE-2024-5438339Наблюдать
WordPress WooCommerce - PDF Vouchers plugin < 4.9.9 - Broken Authentication vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 1 %wpwebelite · woocommerce pdf vouchers18 дек. 2024 г.
- CVE-2024-1268662На этой неделе
Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 13 %beyondtrust · privileged remote access18 дек. 2024 г.
- CVE-2024-5614596Срочно
RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
КритическаяCVSS 9,3KEVГотовый эксплойтEPSS 97 %craftcms · craft cms18 дек. 2024 г.
- CVE-2024-5611524Наблюдать
A vulnerability in Amiro.CMS before 7.8.4 exists due to the failure to take measures to neutralize special elements.
СредняяCVSS 6,1Proof of conceptEPSS 0 %amiro · amiro.cms18 дек. 2024 г.
- CVE-2024-5611635Наблюдать
A Cross-Site Request Forgery vulnerability in Amiro.CMS before 7.8.4 allows remote attackers to create an administrator account.
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %amiro · amiro.cms18 дек. 2024 г.
- CVE-2024-1174030Наблюдать
Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Execution
ВысокаяCVSS 7,3Proof of conceptEPSS 1 %w3eden · download manager19 дек. 2024 г.
- CVE-2024-1161622Наблюдать
Double-fetch heap overflow
СредняяCVSS 5,6Proof of conceptEPSS 0 %netskope inc. · endpoint dlp19 дек. 2024 г.
- CVE-2021-2610242В плане
A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated
КритическаяCVSS 9,1Proof of conceptEPSS 19 %fortinet · fortiwan19 дек. 2024 г.
- CVE-2024-3881947В плане
Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks
ВысокаяCVSS 7,5Proof of conceptEPSS 56 %19 дек. 2024 г.
- CVE-2024-5615931Наблюдать
Server source code is exposed to the public if sourcemaps are enabled
ВысокаяCVSS 7,8Proof of conceptEPSS 1 %astro · astro19 дек. 2024 г.
- CVE-2024-5279424Наблюдать
Magnific lightbox susceptible to Cross-site Scripting in Discourse
СредняяCVSS 6,1Proof of conceptEPSS 0 %discourse · discourse19 дек. 2024 г.
- CVE-2024-5399132Наблюдать
Potential Backup file leaked via Nginx in Discourse
СредняяCVSS 5,9Proof of conceptEPSS 29 %discourse · discourse19 дек. 2024 г.
- CVE-2024-1272935Наблюдать
A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older tha
ВысокаяCVSS 8,8Эксплойта нетEPSS 1 %sophos · firewall firmware19 дек. 2024 г.
- CVE-2024-5634817Наблюдать
In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
СредняяCVSS 4,3Proof of conceptEPSS 0 %jetbrains · teamcity20 дек. 2024 г.
- CVE-2024-5633128Наблюдать
Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor
СредняяCVSS 6,8Proof of conceptEPSS 1 %louislam · uptime-kuma20 дек. 2024 г.
- CVE-2024-1255826Наблюдать
WP BASE Booking of Appointments, Services and Events <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_expo
СредняяCVSS 6,5Proof of conceptEPSS 1 %puckrobin · wp base booking of appointments, services and events21 дек. 2024 г.
- CVE-2024-5146321Наблюдать
IBM i server-side request forgery
СредняяCVSS 5,4Proof of conceptEPSS 0 %ibm · i21 дек. 2024 г.
- CVE-2024-5146417Наблюдать
IBM i authentication bypass
СредняяCVSS 4,3Proof of conceptEPSS 1 %ibm · i21 дек. 2024 г.
- CVE-2024-4538748В плане
Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
ВысокаяCVSS 8,8Эксплойта нетEPSS 42 %apache · traffic control23 дек. 2024 г.
- CVE-2024-5594757В плане
Gogs has a Path Traversal in file update API
ВысокаяCVSS 8,7Proof of conceptEPSS 77 %gogs · gogs23 дек. 2024 г.
- CVE-2024-5396136Наблюдать
ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
ВысокаяCVSS 8,1Эксплойта нетEPSS 14 %adobe · coldfusion23 дек. 2024 г.
- CVE-2024-1259435Наблюдать
ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %zia-imtiaz · login page styler – custom wordpress login page customizer & security24 дек. 2024 г.
- CVE-2024-4344161На этой неделе
Apache HugeGraph-Server: Fixed JWT Token(Secret)
КритическаяCVSS 9,8Proof of conceptEPSS 72 %apache · hugegraph24 дек. 2024 г.
- CVE-2024-5315058В плане
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
ВысокаяCVSS 7,1KEVГотовый эксплойтEPSS 1 %linux · linux kernel24 дек. 2024 г.
- CVE-2024-1085824Наблюдать
Jetpack 13.0-14.0 - Unauthenticated DOM-XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %automattic · jetpack25 дек. 2024 г.
- CVE-2024-5204647В плане
Apache MINA: MINA applications using unbounded deserialization may allow RCE
КритическаяCVSS 10,0Эксплойта нетEPSS 24 %apache · mina25 дек. 2024 г.
- CVE-2024-5643140В плане
oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %xiph · theora25 дек. 2024 г.
- CVE-2024-5643314Наблюдать
shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user
НизкаяCVSS 3,6Proof of conceptEPSS 0 %shadow-maint · shadow-utils26 дек. 2024 г.
- CVE-2024-1295527Наблюдать
PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery
СредняяCVSS 6,9Proof of conceptEPSS 0 %phpgurukul · blood bank \& donor management system26 дек. 2024 г.
- CVE-2024-1160519Наблюдать
WP Publications <= 1.2 - Admin+ Stored XSS
СредняяCVSS 4,8Proof of conceptEPSS 1 %wp-publications project · wp-publications27 дек. 2024 г.
- CVE-2024-1192119Наблюдать
Give < 3.19.0 - Reflected XSS
СредняяCVSS 4,8Proof of conceptEPSS 0 %givewp · givewp27 дек. 2024 г.
- CVE-2024-339373На этой неделе
PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
ВысокаяCVSS 8,7KEVГотовый эксплойтEPSS 29 %paloaltonetworks · pan-os27 дек. 2024 г.
- CVE-2024-5319762На этой неделе
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 4 %linux · linux kernel27 дек. 2024 г.
- CVE-2024-1285653В плане
Four-Faith Industrial Router adjust_sys_time OS Command Injection
ВысокаяCVSS 7,2Proof of conceptEPSS 84 %four-faith · f3x36 firmware27 дек. 2024 г.
- CVE-2024-1298638Наблюдать
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection
СредняяCVSS 6,9Proof of conceptEPSS 35 %draytek · vigor300b firmware27 дек. 2024 г.
- CVE-2024-1298786Срочно
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
СредняяCVSS 6,9KEVГотовый эксплойтEPSS 98 %draytek · vigor300b firmware27 дек. 2024 г.
- CVE-2024-5094439Наблюдать
Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality
КритическаяCVSS 9,8Proof of conceptEPSS 1 %27 дек. 2024 г.
- CVE-2024-5094530Наблюдать
An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submi
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %27 дек. 2024 г.
- CVE-2024-5347623Наблюдать
A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory rest
СредняяCVSS 5,9Proof of conceptEPSS 0 %27 дек. 2024 г.
- CVE-2024-565129Наблюдать
Apache NiFi: Missing Complete Authorization for Parameter and Service References
НизкаяCVSS 2,1Proof of conceptEPSS 3 %apache · nifi28 дек. 2024 г.
- CVE-2024-1282845В плане
Webmin CGI Command Injection Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 33 %webmin · webmin30 дек. 2024 г.
- CVE-2024-5680029Наблюдать
Firecrawl has SSRF Vulnerability via malicious scrape target
ВысокаяCVSS 7,4Proof of conceptEPSS 0 %mendableai · firecrawl30 дек. 2024 г.
- CVE-2024-5680127Наблюдать
Tasklists has Blind SQL Injection in /ajax/reorder.php
СредняяCVSS 6,9Proof of conceptEPSS 0 %infotel · tasklists30 дек. 2024 г.
- CVE-2024-1197257В плане
Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
КритическаяCVSS 9,8Proof of conceptEPSS 59 %themehunk · hunk companion31 дек. 2024 г.
- CVE-2024-1210539Наблюдать
WhatsUp Gold - SnmpExtendedActiveMonitor path traversal
СредняяCVSS 6,5Эксплойта нетEPSS 41 %progress · whatsup gold31 дек. 2024 г.
- CVE-2024-5606450В плане
WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 33 %azzaroco · wp superbackup31 дек. 2024 г.
- CVE-2024-5606734Наблюдать
WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability
ВысокаяCVSS 7,5Proof of conceptEPSS 11 %azzaroco · wp superbackup31 дек. 2024 г.
- CVE-2024-5607139Наблюдать
WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %mikeleembruggen · simple dashboard31 дек. 2024 г.