По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2025 г.
219 записей · 17 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 1 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
17Наблюдать | CVE-2025-22214Proof of concept | Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.CWE-89 | Средняя4,3 | — | 1,3 % | 2 янв. 2025 г. |
28Наблюдать | CVE-2024-12912Proof of concept | An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution.asus · router · CWE-20 | Высокая7,2 | — | 1,2 % | 2 янв. 2025 г. |
21Наблюдать | CVE-2023-45828Proof of concept | WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerabilityrumbletalk · rumbletalk live group chat · CWE-862 | Средняя5,4 | — | 0,9 % | 2 янв. 2025 г. |
35Наблюдать | CVE-2023-47179Proof of concept | WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerabilitybyconsole · wooodt lite · CWE-862 | Высокая8,8 | — | 0,9 % | 2 янв. 2025 г. |
35Наблюдать | CVE-2024-13106Эксплойта нет | D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access controldlink · dir-816 firmware · CWE-266 | Средняя6,9 | — | 26,0 % | 2 янв. 2025 г. |
36Наблюдать | CVE-2024-56249Proof of concept | WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerabilityludwig you · wpmastertoolkit · CWE-434 | Критическая9,1 | — | 1,2 % | 2 янв. 2025 г. |
26Наблюдать | CVE-2024-56264Proof of concept | WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerabilitybeee · acf city selector · CWE-434 | Средняя6,6 | — | 0,9 % | 2 янв. 2025 г. |
34Наблюдать | CVE-2024-9950Proof of concept | Abuse of Unauthenticated Compliance Recheck in SecureConnectorforescout · secureconnector · CWE-379 | Высокая8,5 | — | 0,3 % | 2 янв. 2025 г. |
24Наблюдать | CVE-2024-11716Эксплойта нет | While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation alctfd · ctfd · CWE-837 | Средняя5,3 | — | 11,5 % | 2 янв. 2025 г. |
18Наблюдать | CVE-2024-48197Proof of concept | Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the wCWE-79 | Средняя4,7 | — | 0,4 % | 2 янв. 2025 г. |
39Наблюдать | CVE-2024-13129Эксплойта нет | Roxy-WI roxy.py action_service os command injectionCWE-77 | Высокая8,7 | — | 17,6 % | 3 янв. 2025 г. |
39Наблюдать | CVE-2024-12583Proof of concept | Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injectionalexacrm · dynamics 365 integration · CWE-1336 | Критическая9,9 | — | 1,3 % | 4 янв. 2025 г. |
36Наблюдать | CVE-2024-20154Proof of concept | In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek · lr12a · CWE-121 | Высокая8,8 | — | 3,9 % | 6 янв. 2025 г. |
15Наблюдать | CVE-2024-12970Proof of concept | OS Command Injection in TUBITAK BILGEM's Pardus OS My Computertubitak bilgem · pardus os my computer · CWE-78 | Низкая3,9 | — | 1,3 % | 6 янв. 2025 г. |
36Наблюдать | CVE-2024-54879Proof of concept | SeaCMS V13.1 is vulnerable to Incorrect Access Control.seacms · seacms · CWE-281 | Критическая9,1 | — | 0,9 % | 6 янв. 2025 г. |
36Наблюдать | CVE-2024-54880Proof of concept | SeaCMS V13.1 is vulnerable to Incorrect Access Control.seacms · seacms · CWE-281 | Критическая9,1 | — | 0,9 % | 6 янв. 2025 г. |
21Наблюдать | CVE-2024-46209Proof of concept | A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrredaxo · redaxo · CWE-79 | Средняя5,4 | — | 0,4 % | 6 янв. 2025 г. |
33Наблюдать | CVE-2021-27285Proof of concept | An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commandsinspur · clusterengine · CWE-276 | Высокая8,4 | — | 0,3 % | 6 янв. 2025 г. |
41В плане | CVE-2024-46981Proof of concept | Redis' Lua library commands may lead to remote code executionredis · redis · CWE-416 | Критическая9,8 | — | 8,1 % | 6 янв. 2025 г. |
40В плане | CVE-2024-48455Готовый эксплойт | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0 | Низкая2,7 | — | 6,2 % | 6 янв. 2025 г. |
60На этой неделе | CVE-2024-48456Готовый эксплойт | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0CWE-125 | Высокая7,5 | — | 16,9 % | 6 янв. 2025 г. |
60На этой неделе | CVE-2024-48457Готовый эксплойт | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0CWE-125 | Высокая7,5 | — | 3,0 % | 6 янв. 2025 г. |
26Наблюдать | CVE-2024-54763Proof of concept | An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information witho | Средняя6,5 | — | 0,7 % | 6 янв. 2025 г. |
26Наблюдать | CVE-2024-54764Proof of concept | An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information with | Средняя6,5 | — | 1,0 % | 6 янв. 2025 г. |
31Наблюдать | CVE-2024-54767Proof of concept | An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information wCWE-203 | Высокая7,5 | — | 1,8 % | 6 янв. 2025 г. |
30Наблюдать | CVE-2024-12157Proof of concept | Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injectionarrowplugins · popup – mailchimp, getresponse and activecampaign intergrations · CWE-89 | Высокая7,5 | — | 1,0 % | 7 янв. 2025 г. |
40В плане | CVE-2024-12252Proof of concept | SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)seobeginner · seo lat auto post · CWE-94 | Критическая9,8 | — | 3,2 % | 7 янв. 2025 г. |
35Наблюдать | CVE-2024-12471Proof of concept | Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbpostsaint · post saint: chatgpt, gpt4, dall-e, stable diffusion, pexels, dezgo ai text & image generator · CWE-94 | Высокая8,8 | — | 1,5 % | 7 янв. 2025 г. |
34Наблюдать | CVE-2024-12535Proof of concept | Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosureeflyjason · host php info · CWE-862 | Высокая8,6 | — | 0,5 % | 7 янв. 2025 г. |
44В плане | CVE-2024-12849Proof of concept | Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Readwpguruin · error log viewer by wp guru · CWE-22 | Высокая7,5 | — | 48,0 % | 7 янв. 2025 г. |
37Наблюдать | CVE-2024-56278Proof of concept | WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerabilitysmackcoders inc., · wp ultimate exporter · CWE-94 | Критическая9,1 | — | 1,9 % | 7 янв. 2025 г. |
28Наблюдать | CVE-2024-56289Proof of concept | WordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityadrian tobey · groundhogg · CWE-79 | Высокая7,1 | — | 0,7 % | 7 янв. 2025 г. |
30Наблюдать | CVE-2025-22352Proof of concept | WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerabilityelextensions · elex woocommerce advanced bulk edit products, prices & attributes · CWE-89 | Высокая7,6 | — | 0,7 % | 7 янв. 2025 г. |
28Наблюдать | CVE-2024-48245Proof of concept | Vehicle Management System 1.0 is vulnerable to SQL Injection.janobe · vehicle management system · CWE-89 | Высокая7,2 | — | 1,0 % | 7 янв. 2025 г. |
35Наблюдать | CVE-2024-53345Proof of concept | An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary codeCWE-434 | Высокая8,8 | — | 1,3 % | 7 янв. 2025 г. |
60На этой неделе | CVE-2024-55556Готовый эксплойт | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on thCWE-502 | Критическая9,8 | — | 43,9 % | 7 янв. 2025 г. |
28Наблюдать | CVE-2025-22294Proof of concept | WordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitytheme funda · custom field for wp job manager · CWE-79 | Высокая7,1 | — | 0,4 % | 7 янв. 2025 г. |
40В плане | CVE-2024-55555Готовый эксплойт | Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY.CWE-502 | Высокая8,8 | — | 6,6 % | 7 янв. 2025 г. |
21Наблюдать | CVE-2024-44450Proof of concept | Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew.CWE-639 | Средняя5,4 | — | 0,4 % | 7 янв. 2025 г. |
30Наблюдать | CVE-2024-53522Proof of concept | Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI coCWE-331 | Высокая7,5 | — | 0,7 % | 7 янв. 2025 г. |
42В плане | CVE-2024-54819Proof of concept | I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/secCWE-918 | Критическая9,1 | — | 20,8 % | 7 янв. 2025 г. |
24Наблюдать | CVE-2024-55218Proof of concept | IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.icewarp · icewarp · CWE-79 | Средняя6,1 | — | 0,7 % | 7 янв. 2025 г. |
30Наблюдать | CVE-2025-0242Эксплойта нет | Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6mozilla · firefox · CWE-787 | Средняя6,5 | — | 14,7 % | 7 янв. 2025 г. |
42В плане | CVE-2025-0247Эксплойта нет | Memory safety bugs fixed in Firefox 134 and Thunderbird 134mozilla · firefox · CWE-787 | Критическая9,8 | — | 10,6 % | 7 янв. 2025 г. |
99Срочно | CVE-2024-50603Готовый эксплойт | An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996.aviatrix · controller · CWE-78 | Критическая9,8 | KEV | 98,5 % | 7 янв. 2025 г. |
24Наблюдать | CVE-2024-12585Proof of concept | PropertyHive < 2.1.1 - Reflected XSSwp-property-hive · propertyhive · CWE-79 | Средняя6,1 | — | 0,6 % | 8 янв. 2025 г. |
40В плане | CVE-2024-11613Proof of concept | WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletioniptanus · wordpress file upload · CWE-94 | Критическая9,8 | — | 4,4 % | 8 янв. 2025 г. |
39Наблюдать | CVE-2024-11635Proof of concept | WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Executioniptanus · wordpress file upload · CWE-94 | Критическая9,8 | — | 1,4 % | 8 янв. 2025 г. |
60На этой неделе | CVE-2024-54676Эксплойта нет | Apache OpenMeetings: Deserialisation of untrusted data in cluster modeapache · openmeetings · CWE-502 | Критическая9,8 | — | 68,7 % | 8 янв. 2025 г. |
30Наблюдать | CVE-2024-11423Proof of concept | Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitchwp swings · gift cards for woocommerce pro · CWE-862 | Высокая7,5 | — | 0,8 % | 8 янв. 2025 г. |
40В плане | CVE-2024-55656Proof of concept | RedisBloom Integer Overflow Remote Code Execution Vulnerabilityredisbloom · redisbloom · CWE-190 | Высокая8,8 | — | 17,1 % | 8 янв. 2025 г. |
36Наблюдать | CVE-2024-51442Proof of concept | Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlnaCWE-77 | Высокая8,8 | — | 2,3 % | 8 янв. 2025 г. |
7Наблюдать | CVE-2024-53995Proof of concept | GHSL-2024-288: SickChill open redirect in loginsickchill · sickchill · CWE-601 | Низкая1,9 | — | 1,0 % | 8 янв. 2025 г. |
33Наблюдать | CVE-2025-0283Proof of concept | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neuivanti · connect secure · CWE-121 | Высокая7,0 | — | 17,4 % | 8 янв. 2025 г. |
96Срочно | CVE-2025-0282Готовый эксплойт | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neuivanti · connect secure · CWE-121 | Критическая9,0 | KEV | 99,9 % | 8 янв. 2025 г. |
98Срочно | CVE-2024-53704Готовый эксплойт | An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.sonicwall · sonicos · CWE-287 | Критическая9,8 | KEV | 95,3 % | 9 янв. 2025 г. |
34Наблюдать | CVE-2024-12542Proof of concept | linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposurelinkid · linkid · CWE-862 | Высокая8,6 | — | 1,3 % | 9 янв. 2025 г. |
32Наблюдать | CVE-2023-24012Proof of concept | Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDSopendds · dds · CWE-200 | Высокая8,2 | — | 0,2 % | 9 янв. 2025 г. |
28Наблюдать | CVE-2025-22510Proof of concept | WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerabilitykkarpieszuk · wc price history for omnibus · CWE-502 | Высокая7,2 | — | 1,2 % | 9 янв. 2025 г. |
26Наблюдать | CVE-2024-54761Proof of concept | BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.bigantsoft · bigant office messenger 5 · CWE-89 | Средняя6,3 | — | 1,7 % | 9 янв. 2025 г. |
34Наблюдать | CVE-2024-54887Proof of concept | TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /usertp-link · tl-wr940n firmware · CWE-120 | Высокая8,0 | — | 6,5 % | 9 янв. 2025 г. |
39Наблюдать | CVE-2023-28354Proof of concept | An issue was discovered in Opsview Monitor Agent 6.8.CWE-94 | Критическая9,8 | — | 1,2 % | 9 янв. 2025 г. |
34Наблюдать | CVE-2025-21385Proof of concept | Microsoft Purview Information Disclosure Vulnerabilitymicrosoft · purview · CWE-918 | Средняя6,5 | — | 28,0 % | 9 янв. 2025 г. |
52В плане | CVE-2024-56511Proof of concept | DataEase has an unauthorized vulnerabilitydataease · dataease · CWE-289 | Критическая9,3 | — | 50,2 % | 10 янв. 2025 г. |
18Наблюдать | CVE-2024-54910Proof of concept | Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.CWE-732 | Средняя4,7 | — | 0,4 % | 10 янв. 2025 г. |
60На этой неделе | CVE-2024-12847Готовый эксплойт | NETGEAR DGN setup.cgi OS Command Injectionnetgear · dgn1000 firmware · CWE-78 | Критическая9,8 | — | 30,3 % | 10 янв. 2025 г. |
18Наблюдать | CVE-2024-33297Proof of concept | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal microweber · microweber · CWE-79 | Средняя4,7 | — | 1,1 % | 10 янв. 2025 г. |
24Наблюдать | CVE-2024-33298Proof of concept | Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new bamicroweber · microweber · CWE-79 | Средняя6,1 | — | 0,8 % | 10 янв. 2025 г. |
18Наблюдать | CVE-2024-33299Proof of concept | Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Namemicroweber · microweber · CWE-79 | Средняя4,7 | — | 1,1 % | 10 янв. 2025 г. |
30Наблюдать | CVE-2024-12404Proof of concept | CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injectioncrowdfavorite · cf internal link shortcode · CWE-89 | Высокая7,5 | — | 0,8 % | 10 янв. 2025 г. |
31Наблюдать | CVE-2025-0105Эксплойта нет | Expedition: Arbitrary File Deletion Vulnerabilitypaloaltonetworks · expedition · CWE-73 | Средняя6,9 | — | 13,1 % | 10 янв. 2025 г. |
54В плане | CVE-2025-0107Proof of concept | Expedition: OS Command Injection Vulnerabilitypaloaltonetworks · expedition · CWE-78 | Высокая7,7 | — | 78,4 % | 10 янв. 2025 г. |
39Наблюдать | CVE-2024-12877Proof of concept | GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injectiongivewp · givewp · CWE-502 | Критическая9,8 | — | 1,2 % | 11 янв. 2025 г. |
27Наблюдать | CVE-2025-0401Proof of concept | 1902756969 reggie CommonController.java download path traversal1902756969 · reggie · CWE-22 | Средняя6,9 | — | 1,2 % | 12 янв. 2025 г. |
18Наблюдать | CVE-2025-22828Proof of concept | Apache CloudStack: Unauthorised access to annotationsapache · cloudstack · CWE-200 | Средняя4,3 | — | 2,0 % | 13 янв. 2025 г. |
39Наблюдать | CVE-2025-22777Proof of concept | WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerabilitygivewp · givewp · CWE-502 | Критическая9,8 | — | 0,9 % | 13 янв. 2025 г. |
30Наблюдать | CVE-2025-22963Proof of concept | Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.sismics · teedy · CWE-352 | Высокая7,5 | — | 0,2 % | 13 янв. 2025 г. |
60На этой неделе | CVE-2024-57487Готовый эксплойт | In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker code-projects · online car rental system · CWE-94 | Средняя6,5 | — | 2,4 % | 13 янв. 2025 г. |
37Наблюдать | CVE-2024-46310Proof of concept | Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposeCWE-281 | Критическая9,1 | — | 2,5 % | 13 янв. 2025 г. |
22Наблюдать | CVE-2024-11396Proof of concept | Event monster <= 1.4.3 - Information Exposure Via Visitors List Exportawplife · event monster · CWE-359 | Средняя5,3 | — | 2,1 % | 13 янв. 2025 г. |
31Наблюдать | CVE-2024-12008Proof of concept | W3 Total Cache <= 2.8.1 Information Exposure via Log Filesboldgrid · w3 total cache · CWE-200 | Высокая7,5 | — | 2,2 % | 14 янв. 2025 г. |
35Наблюдать | CVE-2024-12365Proof of concept | W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgeryboldgrid · w3 total cache · CWE-862 | Высокая8,5 | — | 1,8 % | 14 янв. 2025 г. |
41В плане | CVE-2024-48884Эксплойта нет | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1,fortinet · fortimanager · CWE-22 | Критическая9,1 | — | 15,3 % | 14 янв. 2025 г. |
97Срочно | CVE-2024-55591Готовый эксплойт | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and Fortifortinet · fortiproxy · CWE-288 | Критическая9,8 | KEV | 94,1 % | 14 янв. 2025 г. |
32Наблюдать | CVE-2024-7344Proof of concept | Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.howyar · sysreturn · CWE-347 | Высокая8,2 | — | 1,0 % | 14 янв. 2025 г. |
34Наблюдать | CVE-2024-21797Эксплойта нет | A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-74 | Высокая7,2 | — | 20,7 % | 14 янв. 2025 г. |
44В плане | CVE-2024-34166Эксплойта нет | An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-77 | Критическая9,8 | — | 15,7 % | 14 янв. 2025 г. |
43В плане | CVE-2024-36258Эксплойта нет | A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210wavlink · wl-wn533a8 firmware · CWE-121 | Критическая9,8 | — | 12,4 % | 14 янв. 2025 г. |
34Наблюдать | CVE-2024-36295Эксплойта нет | A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-74 | Высокая7,2 | — | 20,7 % | 14 янв. 2025 г. |
35Наблюдать | CVE-2024-37186Эксплойта нет | An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-77 | Высокая7,2 | — | 22,8 % | 14 янв. 2025 г. |
42В плане | CVE-2024-38666Эксплойта нет | An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505wavlink · wl-wn533a8 firmware · CWE-15 | Критическая9,1 | — | 18,8 % | 14 янв. 2025 г. |
46В плане | CVE-2024-39280Эксплойта нет | An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-15 | Критическая9,1 | — | 34,1 % | 14 янв. 2025 г. |
32Наблюдать | CVE-2024-39288Эксплойта нет | A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-120 | Высокая7,2 | — | 13,4 % | 14 янв. 2025 г. |
32Наблюдать | CVE-2024-39360Эксплойта нет | An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-77 | Высокая7,2 | — | 11,7 % | 14 янв. 2025 г. |
38Наблюдать | CVE-2024-39363Эксплойта нет | A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505wavlink · wl-wn533a8 firmware · CWE-80 | Средняя6,1 | — | 48,0 % | 14 янв. 2025 г. |
44В плане | CVE-2024-39760Эксплойта нет | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505.wavlink · wl-wn533a8 firmware · CWE-77 | Критическая9,8 | — | 17,3 % | 14 янв. 2025 г. |
58В плане | CVE-2024-13179Эксплойта нет | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.ivanti · avalanche · CWE-22 | Критическая9,8 | — | 62,9 % | 14 янв. 2025 г. |
38Наблюдать | CVE-2024-13180Эксплойта нет | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information.ivanti · avalanche · CWE-22 | Высокая7,5 | — | 27,7 % | 14 янв. 2025 г. |
49В плане | CVE-2024-13181Эксплойта нет | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.ivanti · avalanche · CWE-22 | Критическая9,8 | — | 32,4 % | 14 янв. 2025 г. |
90Срочно | CVE-2024-13159Готовый эксплойт | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteivanti · endpoint manager · CWE-36 | Высокая7,5 | KEV | 99,9 % | 14 янв. 2025 г. |
- CVE-2025-2221417Наблюдать
Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.
СредняяCVSS 4,3Proof of conceptEPSS 1 %2 янв. 2025 г.
- CVE-2024-1291228Наблюдать
An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution.
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %asus · router2 янв. 2025 г.
- CVE-2023-4582821Наблюдать
WordPress RumbleTalk Live Group Chat plugin <= 6.2.5 - Broken Access Control vulnerability
СредняяCVSS 5,4Proof of conceptEPSS 0 %rumbletalk · rumbletalk live group chat2 янв. 2025 г.
- CVE-2023-4717935Наблюдать
WordPress WooODT Lite plugin <= 2.4.6 - Arbitrary Site Option Update vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %byconsole · wooodt lite2 янв. 2025 г.
- CVE-2024-1310635Наблюдать
D-Link DIR-816 A2 IP QoS form2IPQoSTcAdd access control
СредняяCVSS 6,9Эксплойта нетEPSS 26 %dlink · dir-816 firmware2 янв. 2025 г.
- CVE-2024-5624936Наблюдать
WordPress WPMasterToolKit plugin <= 1.13.1 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,1Proof of conceptEPSS 1 %ludwig you · wpmastertoolkit2 янв. 2025 г.
- CVE-2024-5626426Наблюдать
WordPress ACF City Selector plugin <= 1.14.0 - Arbitrary File Upload vulnerability
СредняяCVSS 6,6Proof of conceptEPSS 0 %beee · acf city selector2 янв. 2025 г.
- CVE-2024-995034Наблюдать
Abuse of Unauthenticated Compliance Recheck in SecureConnector
ВысокаяCVSS 8,5Proof of conceptEPSS 0 %forescout · secureconnector2 янв. 2025 г.
- CVE-2024-1171624Наблюдать
While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation al
СредняяCVSS 5,3Эксплойта нетEPSS 11 %ctfd · ctfd2 янв. 2025 г.
- CVE-2024-4819718Наблюдать
Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the w
СредняяCVSS 4,7Proof of conceptEPSS 0 %2 янв. 2025 г.
- CVE-2024-1312939Наблюдать
Roxy-WI roxy.py action_service os command injection
ВысокаяCVSS 8,7Эксплойта нетEPSS 17 %3 янв. 2025 г.
- CVE-2024-1258339Наблюдать
Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection
КритическаяCVSS 9,9Proof of conceptEPSS 1 %alexacrm · dynamics 365 integration4 янв. 2025 г.
- CVE-2024-2015436Наблюдать
In Modem, there is a possible out of bounds write due to a missing bounds check.
ВысокаяCVSS 8,8Proof of conceptEPSS 3 %mediatek · lr12a6 янв. 2025 г.
- CVE-2024-1297015Наблюдать
OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer
НизкаяCVSS 3,9Proof of conceptEPSS 1 %tubitak bilgem · pardus os my computer6 янв. 2025 г.
- CVE-2024-5487936Наблюдать
SeaCMS V13.1 is vulnerable to Incorrect Access Control.
КритическаяCVSS 9,1Proof of conceptEPSS 0 %seacms · seacms6 янв. 2025 г.
- CVE-2024-5488036Наблюдать
SeaCMS V13.1 is vulnerable to Incorrect Access Control.
КритическаяCVSS 9,1Proof of conceptEPSS 0 %seacms · seacms6 янв. 2025 г.
- CVE-2024-4620921Наблюдать
A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitr
СредняяCVSS 5,4Proof of conceptEPSS 0 %redaxo · redaxo6 янв. 2025 г.
- CVE-2021-2728533Наблюдать
An issue was discovered in Inspur ClusterEngine v4.0 that allows attackers to gain escalated Local privileges and execute arbitrary commands
ВысокаяCVSS 8,4Proof of conceptEPSS 0 %inspur · clusterengine6 янв. 2025 г.
- CVE-2024-4698141В плане
Redis' Lua library commands may lead to remote code execution
КритическаяCVSS 9,8Proof of conceptEPSS 8 %redis · redis6 янв. 2025 г.
- CVE-2024-4845540В плане
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
НизкаяCVSS 2,7Готовый эксплойтEPSS 6 %6 янв. 2025 г.
- CVE-2024-4845660На этой неделе
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
ВысокаяCVSS 7,5Готовый эксплойтEPSS 16 %6 янв. 2025 г.
- CVE-2024-4845760На этой неделе
An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
ВысокаяCVSS 7,5Готовый эксплойтEPSS 3 %6 янв. 2025 г.
- CVE-2024-5476326Наблюдать
An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information witho
СредняяCVSS 6,5Proof of conceptEPSS 0 %6 янв. 2025 г.
- CVE-2024-5476426Наблюдать
An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information with
СредняяCVSS 6,5Proof of conceptEPSS 1 %6 янв. 2025 г.
- CVE-2024-5476731Наблюдать
An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information w
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %6 янв. 2025 г.
- CVE-2024-1215730Наблюдать
Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 1 %arrowplugins · popup – mailchimp, getresponse and activecampaign intergrations7 янв. 2025 г.
- CVE-2024-1225240В плане
SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)
КритическаяCVSS 9,8Proof of conceptEPSS 3 %seobeginner · seo lat auto post7 янв. 2025 г.
- CVE-2024-1247135Наблюдать
Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Arb
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %postsaint · post saint: chatgpt, gpt4, dall-e, stable diffusion, pexels, dezgo ai text & image generator7 янв. 2025 г.
- CVE-2024-1253534Наблюдать
Host PHP Info <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure
ВысокаяCVSS 8,6Proof of conceptEPSS 0 %eflyjason · host php info7 янв. 2025 г.
- CVE-2024-1284944В плане
Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read
ВысокаяCVSS 7,5Proof of conceptEPSS 48 %wpguruin · error log viewer by wp guru7 янв. 2025 г.
- CVE-2024-5627837Наблюдать
WordPress WP Ultimate Exporter plugin <= 2.9.1 - Remote Code Execution (RCE) vulnerability
КритическаяCVSS 9,1Proof of conceptEPSS 1 %smackcoders inc., · wp ultimate exporter7 янв. 2025 г.
- CVE-2024-5628928Наблюдать
WordPress Groundhogg plugin <= 3.7.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %adrian tobey · groundhogg7 янв. 2025 г.
- CVE-2025-2235230Наблюдать
WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin <= 1.4.9 - SQL Injection vulnerability
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %elextensions · elex woocommerce advanced bulk edit products, prices & attributes7 янв. 2025 г.
- CVE-2024-4824528Наблюдать
Vehicle Management System 1.0 is vulnerable to SQL Injection.
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %janobe · vehicle management system7 янв. 2025 г.
- CVE-2024-5334535Наблюдать
An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %7 янв. 2025 г.
- CVE-2024-5555660На этой неделе
A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on th
КритическаяCVSS 9,8Готовый эксплойтEPSS 43 %7 янв. 2025 г.
- CVE-2025-2229428Наблюдать
WordPress Custom Field For WP Job Manager plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %theme funda · custom field for wp job manager7 янв. 2025 г.
- CVE-2024-5555540В плане
Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY.
ВысокаяCVSS 8,8Готовый эксплойтEPSS 6 %7 янв. 2025 г.
- CVE-2024-4445021Наблюдать
Multiple functions are vulnerable to Authorization Bypass in AIMS eCrew.
СредняяCVSS 5,4Proof of conceptEPSS 0 %7 янв. 2025 г.
- CVE-2024-5352230Наблюдать
Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI co
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %7 янв. 2025 г.
- CVE-2024-5481942В плане
I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/sec
КритическаяCVSS 9,1Proof of conceptEPSS 20 %7 янв. 2025 г.
- CVE-2024-5521824Наблюдать
IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter.
СредняяCVSS 6,1Proof of conceptEPSS 0 %icewarp · icewarp7 янв. 2025 г.
- CVE-2025-024230Наблюдать
Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6
СредняяCVSS 6,5Эксплойта нетEPSS 14 %mozilla · firefox7 янв. 2025 г.
- CVE-2025-024742В плане
Memory safety bugs fixed in Firefox 134 and Thunderbird 134
КритическаяCVSS 9,8Эксплойта нетEPSS 10 %mozilla · firefox7 янв. 2025 г.
- CVE-2024-5060399Срочно
An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 98 %aviatrix · controller7 янв. 2025 г.
- CVE-2024-1258524Наблюдать
PropertyHive < 2.1.1 - Reflected XSS
СредняяCVSS 6,1Proof of conceptEPSS 0 %wp-property-hive · propertyhive8 янв. 2025 г.
- CVE-2024-1161340В плане
WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
КритическаяCVSS 9,8Proof of conceptEPSS 4 %iptanus · wordpress file upload8 янв. 2025 г.
- CVE-2024-1163539Наблюдать
WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
КритическаяCVSS 9,8Proof of conceptEPSS 1 %iptanus · wordpress file upload8 янв. 2025 г.
- CVE-2024-5467660На этой неделе
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
КритическаяCVSS 9,8Эксплойта нетEPSS 68 %apache · openmeetings8 янв. 2025 г.
- CVE-2024-1142330Наблюдать
Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %wp swings · gift cards for woocommerce pro8 янв. 2025 г.
- CVE-2024-5565640В плане
RedisBloom Integer Overflow Remote Code Execution Vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 17 %redisbloom · redisbloom8 янв. 2025 г.
- CVE-2024-5144236Наблюдать
Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna
ВысокаяCVSS 8,8Proof of conceptEPSS 2 %8 янв. 2025 г.
- CVE-2024-539957Наблюдать
GHSL-2024-288: SickChill open redirect in login
НизкаяCVSS 1,9Proof of conceptEPSS 1 %sickchill · sickchill8 янв. 2025 г.
- CVE-2025-028333Наблюдать
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu
ВысокаяCVSS 7,0Proof of conceptEPSS 17 %ivanti · connect secure8 янв. 2025 г.
- CVE-2025-028296Срочно
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu
КритическаяCVSS 9,0KEVГотовый эксплойтEPSS 99 %ivanti · connect secure8 янв. 2025 г.
- CVE-2024-5370498Срочно
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 95 %sonicwall · sonicos9 янв. 2025 г.
- CVE-2024-1254234Наблюдать
linkID <= 0.1.2 - Missing Authorization to Unauthenticated Sensitive Information Exposure
ВысокаяCVSS 8,6Proof of conceptEPSS 1 %linkid · linkid9 янв. 2025 г.
- CVE-2023-2401232Наблюдать
Data Distribution Service (DDS) Chain of Trust (CoT) violation vulnerability in Open DDS
ВысокаяCVSS 8,2Proof of conceptEPSS 0 %opendds · dds9 янв. 2025 г.
- CVE-2025-2251028Наблюдать
WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability
ВысокаяCVSS 7,2Proof of conceptEPSS 1 %kkarpieszuk · wc price history for omnibus9 янв. 2025 г.
- CVE-2024-5476126Наблюдать
BigAnt Office Messenger 5.6.06 is vulnerable to SQL Injection via the 'dev_code' parameter.
СредняяCVSS 6,3Proof of conceptEPSS 1 %bigantsoft · bigant office messenger 59 янв. 2025 г.
- CVE-2024-5488734Наблюдать
TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /user
ВысокаяCVSS 8,0Proof of conceptEPSS 6 %tp-link · tl-wr940n firmware9 янв. 2025 г.
- CVE-2023-2835439Наблюдать
An issue was discovered in Opsview Monitor Agent 6.8.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %9 янв. 2025 г.
- CVE-2025-2138534Наблюдать
Microsoft Purview Information Disclosure Vulnerability
СредняяCVSS 6,5Proof of conceptEPSS 28 %microsoft · purview9 янв. 2025 г.
- CVE-2024-5651152В плане
DataEase has an unauthorized vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 50 %dataease · dataease10 янв. 2025 г.
- CVE-2024-5491018Наблюдать
Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.
СредняяCVSS 4,7Proof of conceptEPSS 0 %10 янв. 2025 г.
- CVE-2024-1284760На этой неделе
NETGEAR DGN setup.cgi OS Command Injection
КритическаяCVSS 9,8Готовый эксплойтEPSS 30 %netgear · dgn1000 firmware10 янв. 2025 г.
- CVE-2024-3329718Наблюдать
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name (Internal
СредняяCVSS 4,7Proof of conceptEPSS 1 %microweber · microweber10 янв. 2025 г.
- CVE-2024-3329824Наблюдать
Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new ba
СредняяCVSS 6,1Proof of conceptEPSS 0 %microweber · microweber10 янв. 2025 г.
- CVE-2024-3329918Наблюдать
Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last Name
СредняяCVSS 4,7Proof of conceptEPSS 1 %microweber · microweber10 янв. 2025 г.
- CVE-2024-1240430Наблюдать
CF Internal Link Shortcode <= 1.1.0 - Unauthenticated SQL Injection
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %crowdfavorite · cf internal link shortcode10 янв. 2025 г.
- CVE-2025-010531Наблюдать
Expedition: Arbitrary File Deletion Vulnerability
СредняяCVSS 6,9Эксплойта нетEPSS 13 %paloaltonetworks · expedition10 янв. 2025 г.
- CVE-2025-010754В плане
Expedition: OS Command Injection Vulnerability
ВысокаяCVSS 7,7Proof of conceptEPSS 78 %paloaltonetworks · expedition10 янв. 2025 г.
- CVE-2024-1287739Наблюдать
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection
КритическаяCVSS 9,8Proof of conceptEPSS 1 %givewp · givewp11 янв. 2025 г.
- CVE-2025-040127Наблюдать
1902756969 reggie CommonController.java download path traversal
СредняяCVSS 6,9Proof of conceptEPSS 1 %1902756969 · reggie12 янв. 2025 г.
- CVE-2025-2282818Наблюдать
Apache CloudStack: Unauthorised access to annotations
СредняяCVSS 4,3Proof of conceptEPSS 2 %apache · cloudstack13 янв. 2025 г.
- CVE-2025-2277739Наблюдать
WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 0 %givewp · givewp13 янв. 2025 г.
- CVE-2025-2296330Наблюдать
Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %sismics · teedy13 янв. 2025 г.
- CVE-2024-5748760На этой неделе
In Code-Projects Online Car Rental System 1.0, the file upload feature does not validate file extensions or MIME types allowing an attacker
СредняяCVSS 6,5Готовый эксплойтEPSS 2 %code-projects · online car rental system13 янв. 2025 г.
- CVE-2024-4631037Наблюдать
Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via expose
КритическаяCVSS 9,1Proof of conceptEPSS 2 %13 янв. 2025 г.
- CVE-2024-1139622Наблюдать
Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
СредняяCVSS 5,3Proof of conceptEPSS 2 %awplife · event monster13 янв. 2025 г.
- CVE-2024-1200831Наблюдать
W3 Total Cache <= 2.8.1 Information Exposure via Log Files
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %boldgrid · w3 total cache14 янв. 2025 г.
- CVE-2024-1236535Наблюдать
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
ВысокаяCVSS 8,5Proof of conceptEPSS 1 %boldgrid · w3 total cache14 янв. 2025 г.
- CVE-2024-4888441В плане
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1,
КритическаяCVSS 9,1Эксплойта нетEPSS 15 %fortinet · fortimanager14 янв. 2025 г.
- CVE-2024-5559197Срочно
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and Forti
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 94 %fortinet · fortiproxy14 янв. 2025 г.
- CVE-2024-734432Наблюдать
Howyar UEFI Application "Reloader" (32-bit and 64-bit) is vulnerable to execution of unsigned software in a hardcoded path.
ВысокаяCVSS 8,2Proof of conceptEPSS 1 %howyar · sysreturn14 янв. 2025 г.
- CVE-2024-2179734Наблюдать
A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505.
ВысокаяCVSS 7,2Эксплойта нетEPSS 20 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3416644В плане
An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505.
КритическаяCVSS 9,8Эксплойта нетEPSS 15 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3625843В плане
A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210
КритическаяCVSS 9,8Эксплойта нетEPSS 12 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3629534Наблюдать
A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505.
ВысокаяCVSS 7,2Эксплойта нетEPSS 20 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3718635Наблюдать
An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505.
ВысокаяCVSS 7,2Эксплойта нетEPSS 22 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3866642В плане
An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505
КритическаяCVSS 9,1Эксплойта нетEPSS 18 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3928046В плане
An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505.
КритическаяCVSS 9,1Эксплойта нетEPSS 34 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3928832Наблюдать
A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505.
ВысокаяCVSS 7,2Эксплойта нетEPSS 13 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3936032Наблюдать
An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505.
ВысокаяCVSS 7,2Эксплойта нетEPSS 11 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3936338Наблюдать
A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505
СредняяCVSS 6,1Эксплойта нетEPSS 48 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-3976044В плане
Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505.
КритическаяCVSS 9,8Эксплойта нетEPSS 17 %wavlink · wl-wn533a8 firmware14 янв. 2025 г.
- CVE-2024-1317958В плане
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.
КритическаяCVSS 9,8Эксплойта нетEPSS 62 %ivanti · avalanche14 янв. 2025 г.
- CVE-2024-1318038Наблюдать
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information.
ВысокаяCVSS 7,5Эксплойта нетEPSS 27 %ivanti · avalanche14 янв. 2025 г.
- CVE-2024-1318149В плане
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.
КритическаяCVSS 9,8Эксплойта нетEPSS 32 %ivanti · avalanche14 янв. 2025 г.
- CVE-2024-1315990Срочно
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 99 %ivanti · endpoint manager14 янв. 2025 г.