По дате публикации
Эксплуатируемые и новые серьёзные CVE: январь 2025 г.
219 записей · 17 KEV. В порядке публикации.
В списке: записи из каталога CISA KEV, с боевым эксплойтом, с EPSS от 10%, с публичным PoC и датой публикации в последние 3 года, а также записи с CVSS от 7, опубликованные за последние 90 дней. Остальные записи доступны через поиск и страницы производителей.
Границы месяца считаются по UTC, как и дата публикации на странице записи.
Страница 2 из 3
| Срочность | CVE | Уязвимость | Критичность | KEV | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
87Срочно | CVE-2024-13161Готовый эксплойт | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remoteivanti · endpoint manager · CWE-36 | Высокая7,5 | KEV | 89,8 % | 14 янв. 2025 г. |
48В плане | CVE-2024-13162Эксплойта нет | SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticivanti · endpoint manager · CWE-89 | Высокая7,2 | — | 65,0 % | 14 янв. 2025 г. |
36Наблюдать | CVE-2024-13171Эксплойта нет | Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allowsivanti · endpoint manager · CWE-434 | Высокая7,8 | — | 17,5 % | 14 янв. 2025 г. |
41В плане | CVE-2024-48884Эксплойта нет | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1,fortinet · fortimanager · CWE-22 | Критическая9,1 | — | 15,2 % | 14 янв. 2025 г. |
42В плане | CVE-2025-21277Эксплойта нет | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1507 · CWE-126 | Высокая7,5 | — | 39,0 % | 14 янв. 2025 г. |
47В плане | CVE-2025-21285Эксплойта нет | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1507 · CWE-476 | Высокая7,5 | — | 56,1 % | 14 янв. 2025 г. |
40В плане | CVE-2025-21293Готовый эксплойт | Active Directory Domain Services Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-284 | Высокая8,8 | — | 14,9 % | 14 янв. 2025 г. |
61На этой неделе | CVE-2025-21298Proof of concept | Windows OLE Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-416 | Критическая9,8 | — | 74,3 % | 14 янв. 2025 г. |
37Наблюдать | CVE-2025-21309Эксплойта нет | Windows Remote Desktop Services Remote Code Execution Vulnerabilitymicrosoft · windows server 2012 · CWE-591 | Высокая8,1 | — | 15,0 % | 14 янв. 2025 г. |
64На этой неделе | CVE-2025-21333Готовый эксплойт | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerabilitymicrosoft · windows 10 21h2 · CWE-122 | Высокая7,8 | KEV | 10,0 % | 14 янв. 2025 г. |
61На этой неделе | CVE-2025-21334Готовый эксплойт | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerabilitymicrosoft · windows 10 21h2 · CWE-416 | Высокая7,8 | KEV | 1,5 % | 14 янв. 2025 г. |
61На этой неделе | CVE-2025-21335Готовый эксплойт | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerabilitymicrosoft · windows 10 21h2 · CWE-416 | Высокая7,8 | KEV | 1,4 % | 14 янв. 2025 г. |
22Наблюдать | CVE-2025-21340Proof of concept | Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerabilitymicrosoft · windows 10 1809 · CWE-284 | Средняя5,5 | — | 0,4 % | 14 янв. 2025 г. |
36Наблюдать | CVE-2024-49375Proof of concept | Remote Code Execution via Remote Model Loading in Rasarasahq · rasa-pro-security-advisories · CWE-94 | Критическая9,0 | — | 0,9 % | 14 янв. 2025 г. |
33Наблюдать | CVE-2024-12085Proof of concept | Rsync: info leak via uninitialized stack contentssamba · rsync · CWE-908 | Высокая7,5 | — | 8,6 % | 14 янв. 2025 г. |
60На этой неделе | CVE-2024-48760Готовый эксплойт | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.gestioip · gestioip · CWE-434 | Критическая9,8 | — | 46,0 % | 14 янв. 2025 г. |
19Наблюдать | CVE-2024-50857Proof of concept | The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS).gestioip · gestioip · CWE-79 | Средняя4,8 | — | 1,2 % | 14 янв. 2025 г. |
36Наблюдать | CVE-2024-50858Proof of concept | Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF).gestioip · gestioip · CWE-352 | Высокая8,8 | — | 1,7 % | 14 янв. 2025 г. |
19Наблюдать | CVE-2024-50859Proof of concept | The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS.gestioip · gestioip · CWE-79 | Средняя4,8 | — | 0,9 % | 14 янв. 2025 г. |
24Наблюдать | CVE-2024-50861Proof of concept | The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS.gestioip · gestioip · CWE-79 | Средняя6,1 | — | 0,8 % | 14 янв. 2025 г. |
21Наблюдать | CVE-2024-47605Proof of concept | Cross-site Scripting via insert media remote file oembed in silverstripe-asset-adminsilverstripe · silverstripe-asset-admin · CWE-79 | Средняя5,4 | — | 1,1 % | 14 янв. 2025 г. |
41В плане | CVE-2025-23061Proof of concept | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.mongoosejs · mongoose · CWE-94 | Критическая9,8 | — | 7,2 % | 15 янв. 2025 г. |
32Наблюдать | CVE-2024-11848Proof of concept | NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Updatenitropack · nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimization · CWE-862 | Высокая8,1 | — | 0,6 % | 15 янв. 2025 г. |
26Наблюдать | CVE-2024-47002Эксплойта нет | A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528.observium · observium · CWE-79 | Средняя5,4 | — | 15,3 % | 15 янв. 2025 г. |
38Наблюдать | CVE-2025-22785Proof of concept | WordPress Course Booking System plugin <= 6.0.6 - SQL Injection vulnerabilitycommotion · course booking system · CWE-89 | Критическая9,3 | — | 2,9 % | 15 янв. 2025 г. |
40В плане | CVE-2025-22968Proof of concept | An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictionsdlink · dwr-m972v firmware · CWE-94 | Критическая9,8 | — | 2,4 % | 15 янв. 2025 г. |
30Наблюдать | CVE-2024-52005Proof of concept | The sideband payload is passed unfiltered to the terminal in gitgit · git · CWE-116 | Высокая7,5 | — | 0,5 % | 15 янв. 2025 г. |
26Наблюдать | CVE-2025-23040Proof of concept | Maliciously crafted remote URLs could lead to credential leak in GitHub Desktopdesktop · desktop · CWE-522 | Средняя6,6 | — | 0,7 % | 15 янв. 2025 г. |
61На этой неделе | CVE-2024-12084Proof of concept | Rsync: heap buffer overflow in rsync due to improper checksum length handlingsamba · rsync · CWE-122 | Критическая9,8 | — | 72,0 % | 15 янв. 2025 г. |
19Наблюдать | CVE-2024-41453Proof of concept | A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HCWE-79 | Средняя4,8 | — | 0,3 % | 15 янв. 2025 г. |
13Наблюдать | CVE-2024-53407Proof of concept | In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote contphiewer · phiewer · CWE-426 | Низкая3,3 | — | 0,5 % | 15 янв. 2025 г. |
13Наблюдать | CVE-2024-55503Proof of concept | An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES compotermius · termius · CWE-426 | Низкая3,3 | — | 0,4 % | 15 янв. 2025 г. |
89Срочно | CVE-2024-57726Готовый эксплойт | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excesimple-help · simplehelp · CWE-862 | Критическая9,9 | KEV | 66,6 % | 15 янв. 2025 г. |
89Срочно | CVE-2024-57727Готовый эксплойт | SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated resimple-help · simplehelp · CWE-22 | Высокая7,5 | KEV | 96,5 % | 15 янв. 2025 г. |
77На этой неделе | CVE-2024-57728Готовый эксплойт | SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading asimple-help · simplehelp · CWE-59 | Высокая7,2 | KEV | 64,6 % | 15 янв. 2025 г. |
32Наблюдать | CVE-2025-22964Proof of concept | DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient inpddsn · cm3 acora content management system · CWE-89 | Высокая8,1 | — | 0,9 % | 15 янв. 2025 г. |
40В плане | CVE-2025-22912Proof of concept | RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.edimax · re11s firmware · CWE-77 | Критическая9,8 | — | 1,9 % | 15 янв. 2025 г. |
30Наблюдать | CVE-2024-50633Proof of concept | A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted Pcern · indico · CWE-201 | Высокая7,5 | — | 0,6 % | 16 янв. 2025 г. |
43В плане | CVE-2024-57684Эксплойта нет | An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the Ddlink · dir-816 firmware · CWE-276 | Критическая9,8 | — | 14,3 % | 16 янв. 2025 г. |
40В плане | CVE-2025-23922Proof of concept | WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerabilityharsh · ispring embedder · CWE-352 | Критическая10,0 | — | 1,0 % | 16 янв. 2025 г. |
31Наблюдать | CVE-2024-55511Proof of concept | A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentiallyCWE-476 | Высокая7,8 | — | 0,3 % | 16 янв. 2025 г. |
22Наблюдать | CVE-2024-57784Proof of concept | An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal.CWE-22 | Средняя5,5 | — | 0,9 % | 16 янв. 2025 г. |
19Наблюдать | CVE-2024-57785Proof of concept | Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.CWE-706 | Средняя4,9 | — | 0,6 % | 16 янв. 2025 г. |
30Наблюдать | CVE-2025-23200Эксплойта нет | Stored XSS-LibreNMS-Misc Section in librenmslibrenms · librenms · CWE-79 | Средняя5,4 | — | 30,8 % | 16 янв. 2025 г. |
27Наблюдать | CVE-2024-50967Proof of concept | The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability.CWE-862 | Средняя6,5 | — | 1,6 % | 17 янв. 2025 г. |
31Наблюдать | CVE-2018-9375Proof of concept | In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confusgoogle · android · CWE-269 | Высокая7,8 | — | 0,2 % | 17 янв. 2025 г. |
35Наблюдать | CVE-2023-50739Эксплойта нет | A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices.lexmark · printer firmware · CWE-122 | Высокая8,8 | — | 0,6 % | 17 янв. 2025 г. |
69На этой неделе | CVE-2025-23209Готовый эксплойт | Potential RCE with a compromised security key in craft/cmscraftcms · craft cms · CWE-94 | Высокая8,1 | KEV | 21,7 % | 17 янв. 2025 г. |
30Наблюдать | CVE-2024-13184Proof of concept | The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Modulewpextended · the ultimate wordpress toolkit – wp extended · CWE-89 | Высокая7,5 | — | 0,5 % | 18 янв. 2025 г. |
16Наблюдать | CVE-2024-13176Proof of concept | Timing side-channel in ECDSA signature computationopenssl · openssl · CWE-385 | Средняя4,1 | — | 0,6 % | 20 янв. 2025 г. |
20Наблюдать | CVE-2025-22131Proof of concept | Cross-Site Scripting (XSS) vulnerability in generateNavigation() functionphpoffice · phpspreadsheet · CWE-79 | Средняя5,1 | — | 0,4 % | 20 янв. 2025 г. |
20Наблюдать | CVE-2025-22620Proof of concept | gix-worktree-state nonexclusive checkout sets executable files world-writablegitoxidelabs · gitoxide · CWE-281 | Средняя5,0 | — | 0,3 % | 20 янв. 2025 г. |
35Наблюдать | CVE-2024-49699Proof of concept | WordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerabilityreputeinfosystems · arprice · CWE-502 | Высокая8,8 | — | 0,7 % | 21 янв. 2025 г. |
42В плане | CVE-2024-51818Proof of concept | WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerabilityradykal · fancy product designer · CWE-89 | Критическая9,3 | — | 16,2 % | 21 янв. 2025 г. |
30Наблюдать | CVE-2025-22710Proof of concept | WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerabilitystoreapps · smart manager · CWE-89 | Высокая7,6 | — | 0,8 % | 21 янв. 2025 г. |
28Наблюдать | CVE-2025-24001Proof of concept | WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerabilityngô thắng it · ppo call to actions · CWE-352 | Высокая7,1 | — | 0,1 % | 21 янв. 2025 г. |
21Наблюдать | CVE-2025-24011Proof of concept | Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codesumbraco · umbraco cms · CWE-200 | Средняя5,3 | — | 1,5 % | 21 янв. 2025 г. |
40В плане | CVE-2024-54794Эксплойта нет | The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.eng · spagobi · CWE-77 | Критическая9,1 | — | 12,8 % | 21 янв. 2025 г. |
22Наблюдать | CVE-2024-55504Proof of concept | An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote coCWE-94 | Средняя5,5 | — | 0,5 % | 21 янв. 2025 г. |
30Наблюдать | CVE-2025-23369Proof of concept | Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validationgithub · enterprise server · CWE-347 | Высокая7,6 | — | 1,6 % | 21 янв. 2025 г. |
21Наблюдать | CVE-2024-48392Proof of concept | OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS).orangescrum · orangescrum · CWE-79 | Средняя5,4 | — | 0,8 % | 21 янв. 2025 г. |
30Наблюдать | CVE-2024-24451Proof of concept | A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackerCWE-120 | Высокая7,5 | — | 0,9 % | 21 янв. 2025 г. |
31Наблюдать | CVE-2024-13496Proof of concept | GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parametergamipress · gamipress · CWE-89 | Высокая7,5 | — | 2,2 % | 22 янв. 2025 г. |
37Наблюдать | CVE-2025-23942Proof of concept | WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerabilityngocuct0912 · wp load gallery · CWE-434 | Критическая9,1 | — | 2,7 % | 22 янв. 2025 г. |
35Наблюдать | CVE-2024-31903Proof of concept | IBM Sterling B2B Integrator Standard Edition code executionibm · sterling b2b integrator · CWE-502 | Высокая8,8 | — | 0,9 % | 22 янв. 2025 г. |
29Наблюдать | CVE-2024-56924Proof of concept | A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary Jcodeastro · internet banking system · CWE-352 | Высокая7,3 | — | 0,4 % | 22 янв. 2025 г. |
76На этой неделе | CVE-2025-23006Готовый эксплойт | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) andsonicwall · sma8200v · CWE-502 | Критическая9,8 | KEV | 23,4 % | 23 янв. 2025 г. |
39Наблюдать | CVE-2024-55192Эксплойта нет | OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char consopenimageio · openimageio · CWE-787 | Критическая9,8 | — | 0,6 % | 23 янв. 2025 г. |
21Наблюдать | CVE-2025-24582Proof of concept | WordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerabilityaa web servant · 12 step meeting list · CWE-201 | Средняя5,3 | — | 0,9 % | 24 янв. 2025 г. |
40В плане | CVE-2025-24587Proof of concept | WordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerabilitynks · email subscription popup · CWE-89 | Высокая7,6 | — | 32,2 % | 24 янв. 2025 г. |
30Наблюдать | CVE-2025-24659Proof of concept | WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerabilityshahjada · wpdm – premium packages · CWE-89 | Высокая7,6 | — | 0,9 % | 24 янв. 2025 г. |
30Наблюдать | CVE-2024-57041Эксплойта нет | A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' senodebb · nodebb · CWE-79 | Средняя4,6 | — | 39,2 % | 24 янв. 2025 г. |
78На этой неделе | CVE-2025-0411Готовый эксплойт | 7-Zip Mark-of-the-Web Bypass Vulnerability7-zip · 7-zip · CWE-693 | Высокая7,0 | KEV | 67,0 % | 25 янв. 2025 г. |
28Наблюдать | CVE-2024-13055Proof of concept | Dyn Business Panel <= 1.0.0 - Reflected XSSphycticio · dyn business panel · CWE-79 | Высокая7,1 | — | 0,5 % | 27 янв. 2025 г. |
28Наблюдать | CVE-2024-13094Proof of concept | WP Triggers Lite <= 2.5.3 - Reflected XSSwptriggers · wp triggers lite · CWE-79 | Высокая7,1 | — | 0,5 % | 27 янв. 2025 г. |
34Наблюдать | CVE-2024-52012Эксплойта нет | Apache Solr: Configset upload on Windows allows arbitrary path write-accessapache · solr · CWE-23 | Средняя5,4 | — | 44,9 % | 27 янв. 2025 г. |
49В плане | CVE-2024-54146Эксплойта нет | Cacti has a SQL Injection vulnerability when view host templatecacti · cacti · CWE-89 | Высокая8,8 | — | 46,1 % | 27 янв. 2025 г. |
30Наблюдать | CVE-2025-22604Proof of concept | Cacti has Authenticated RCE via multi-line SNMP responsescacti · cacti · CWE-78 | Высокая7,2 | — | 5,3 % | 27 янв. 2025 г. |
21Наблюдать | CVE-2025-24354Proof of concept | imgproxy is vulnerable to SSRF against 0.0.0.0imgproxy · imgproxy · CWE-918 | Средняя5,3 | — | 0,8 % | 27 янв. 2025 г. |
50В плане | CVE-2025-24367Готовый эксплойт | Cacti allows Arbitrary File Creation leading to RCEcacti · cacti · CWE-144 | Высокая8,7 | — | 54,0 % | 27 янв. 2025 г. |
41В плане | CVE-2024-48841Proof of concept | Remote Code Execution (RCE) Vulnerabilitiesabb · flxeon · CWE-77 | Критическая10,0 | — | 4,4 % | 27 янв. 2025 г. |
22Наблюдать | CVE-2024-54507Proof of concept | A type confusion issue was addressed with improved memory handling.apple · ipados · CWE-843 | Средняя5,5 | — | 0,8 % | 27 янв. 2025 г. |
75На этой неделе | CVE-2025-24085Готовый эксплойт | A use after free issue was addressed with improved memory management.apple · ipados · CWE-416 | Критическая10,0 | KEV | 17,5 % | 27 янв. 2025 г. |
22Наблюдать | CVE-2025-24104Proof of concept | This issue was addressed with improved handling of symlinks.apple · ipados · CWE-59 | Средняя5,5 | — | 1,5 % | 27 янв. 2025 г. |
29Наблюдать | CVE-2025-24118Proof of concept | The issue was addressed with improved memory handling.apple · ipados · CWE-787 | Высокая7,1 | — | 3,7 % | 27 янв. 2025 г. |
32Наблюдать | CVE-2024-57373Proof of concept | Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf ofCWE-352 | Высокая8,1 | — | 0,3 % | 27 янв. 2025 г. |
26Наблюдать | CVE-2022-31749Proof of concept | Authenticated arbitrary file read/write in WatchGuard Fireware OSwatchguard · fireware os · CWE-88 | Средняя6,5 | — | 1,2 % | 27 янв. 2025 г. |
60На этой неделе | CVE-2022-3365Готовый эксплойт | Emote Interactive Remote Mouse Server command injection due to weak encodingemote interactive · remote mouse server · CWE-327 | Критическая9,8 | — | 2,0 % | 27 янв. 2025 г. |
20Наблюдать | CVE-2024-11954Proof of concept | Pimcore Search Document cross site scriptingpimcore · pimcore · CWE-74 | Средняя5,1 | — | 1,0 % | 28 янв. 2025 г. |
20Наблюдать | CVE-2024-11956Proof of concept | Pimcore customer-data-framework list sql injectionpimcore · pimcore · CWE-74 | Средняя5,1 | — | 0,8 % | 28 янв. 2025 г. |
40В плане | CVE-2025-23211Proof of concept | Tandoor Recipes - SSTI - Remote Code Executiontandoor · recipes · CWE-1336 | Критическая9,9 | — | 3,5 % | 28 янв. 2025 г. |
30Наблюдать | CVE-2024-40676Proof of concept | In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to agoogle · android · CWE-843 | Высокая7,7 | — | 0,1 % | 28 янв. 2025 г. |
35Наблюдать | CVE-2024-55968Proof of concept | An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1.CWE-267 | Высокая8,8 | — | 1,0 % | 28 янв. 2025 г. |
36Наблюдать | CVE-2024-57376Proof of concept | Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthenticadlink · dsr-150 firmware · CWE-120 | Высокая8,8 | — | 3,6 % | 28 янв. 2025 г. |
19Наблюдать | CVE-2024-57514Proof of concept | The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web CWE-79 | Средняя4,8 | — | 0,8 % | 28 янв. 2025 г. |
28Наблюдать | CVE-2024-12749Proof of concept | Competition Form <= 2.0 - Reflected XSSraiserweb · competition form · CWE-79 | Высокая7,1 | — | 0,5 % | 29 янв. 2025 г. |
35Наблюдать | CVE-2024-48849Proof of concept | Authentication and Authorization Issuesabb · flxeon · CWE-1385 | Высокая8,8 | — | 0,9 % | 29 янв. 2025 г. |
28Наблюдать | CVE-2024-48852Proof of concept | Information disclosuresabb · flxeon · CWE-532 | Средняя6,9 | — | 2,4 % | 29 янв. 2025 г. |
35Наблюдать | CVE-2024-11187Эксплойта нет | Many records in the additional section cause CPU exhaustionisc · bind 9 · CWE-405 | Высокая7,5 | — | 15,8 % | 29 янв. 2025 г. |
36Наблюдать | CVE-2024-12705Эксплойта нет | DNS-over-HTTPS implementation suffers from multiple issues under heavy query loadisc · bind 9 · CWE-770 | Высокая7,5 | — | 18,3 % | 29 янв. 2025 г. |
- CVE-2024-1316187Срочно
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 89 %ivanti · endpoint manager14 янв. 2025 г.
- CVE-2024-1316248В плане
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authentic
ВысокаяCVSS 7,2Эксплойта нетEPSS 65 %ivanti · endpoint manager14 янв. 2025 г.
- CVE-2024-1317136Наблюдать
Insufficient filename validation in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows
ВысокаяCVSS 7,8Эксплойта нетEPSS 17 %ivanti · endpoint manager14 янв. 2025 г.
- CVE-2024-4888441В плане
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1,
КритическаяCVSS 9,1Эксплойта нетEPSS 15 %fortinet · fortimanager14 янв. 2025 г.
- CVE-2025-2127742В плане
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 39 %microsoft · windows 10 150714 янв. 2025 г.
- CVE-2025-2128547В плане
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
ВысокаяCVSS 7,5Эксплойта нетEPSS 56 %microsoft · windows 10 150714 янв. 2025 г.
- CVE-2025-2129340В плане
Active Directory Domain Services Elevation of Privilege Vulnerability
ВысокаяCVSS 8,8Готовый эксплойтEPSS 14 %microsoft · windows 10 150714 янв. 2025 г.
- CVE-2025-2129861На этой неделе
Windows OLE Remote Code Execution Vulnerability
КритическаяCVSS 9,8Proof of conceptEPSS 74 %microsoft · windows 10 150714 янв. 2025 г.
- CVE-2025-2130937Наблюдать
Windows Remote Desktop Services Remote Code Execution Vulnerability
ВысокаяCVSS 8,1Эксплойта нетEPSS 15 %microsoft · windows server 201214 янв. 2025 г.
- CVE-2025-2133364На этой неделе
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 10 %microsoft · windows 10 21h214 янв. 2025 г.
- CVE-2025-2133461На этой неделе
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 1 %microsoft · windows 10 21h214 янв. 2025 г.
- CVE-2025-2133561На этой неделе
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
ВысокаяCVSS 7,8KEVГотовый эксплойтEPSS 1 %microsoft · windows 10 21h214 янв. 2025 г.
- CVE-2025-2134022Наблюдать
Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability
СредняяCVSS 5,5Proof of conceptEPSS 0 %microsoft · windows 10 180914 янв. 2025 г.
- CVE-2024-4937536Наблюдать
Remote Code Execution via Remote Model Loading in Rasa
КритическаяCVSS 9,0Proof of conceptEPSS 0 %rasahq · rasa-pro-security-advisories14 янв. 2025 г.
- CVE-2024-1208533Наблюдать
Rsync: info leak via uninitialized stack contents
ВысокаяCVSS 7,5Proof of conceptEPSS 8 %samba · rsync14 янв. 2025 г.
- CVE-2024-4876060На этой неделе
An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.
КритическаяCVSS 9,8Готовый эксплойтEPSS 46 %gestioip · gestioip14 янв. 2025 г.
- CVE-2024-5085719Наблюдать
The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS).
СредняяCVSS 4,8Proof of conceptEPSS 1 %gestioip · gestioip14 янв. 2025 г.
- CVE-2024-5085836Наблюдать
Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF).
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %gestioip · gestioip14 янв. 2025 г.
- CVE-2024-5085919Наблюдать
The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS.
СредняяCVSS 4,8Proof of conceptEPSS 0 %gestioip · gestioip14 янв. 2025 г.
- CVE-2024-5086124Наблюдать
The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS.
СредняяCVSS 6,1Proof of conceptEPSS 0 %gestioip · gestioip14 янв. 2025 г.
- CVE-2024-4760521Наблюдать
Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin
СредняяCVSS 5,4Proof of conceptEPSS 1 %silverstripe · silverstripe-asset-admin14 янв. 2025 г.
- CVE-2025-2306141В плане
Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.
КритическаяCVSS 9,8Proof of conceptEPSS 7 %mongoosejs · mongoose15 янв. 2025 г.
- CVE-2024-1184832Наблюдать
NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %nitropack · nitropack – performance, page speed & cache plugin for core web vitals, cdn & image optimization15 янв. 2025 г.
- CVE-2024-4700226Наблюдать
A html code injection vulnerability exists in the vlan management part of Observium CE 24.4.13528.
СредняяCVSS 5,4Эксплойта нетEPSS 15 %observium · observium15 янв. 2025 г.
- CVE-2025-2278538Наблюдать
WordPress Course Booking System plugin <= 6.0.6 - SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 2 %commotion · course booking system15 янв. 2025 г.
- CVE-2025-2296840В плане
An issue in D-Link DWR-M972V 1.05SSG allows a remote attacker to execute arbitrary code via SSH using root account without restrictions
КритическаяCVSS 9,8Proof of conceptEPSS 2 %dlink · dwr-m972v firmware15 янв. 2025 г.
- CVE-2024-5200530Наблюдать
The sideband payload is passed unfiltered to the terminal in git
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %git · git15 янв. 2025 г.
- CVE-2025-2304026Наблюдать
Maliciously crafted remote URLs could lead to credential leak in GitHub Desktop
СредняяCVSS 6,6Proof of conceptEPSS 0 %desktop · desktop15 янв. 2025 г.
- CVE-2024-1208461На этой неделе
Rsync: heap buffer overflow in rsync due to improper checksum length handling
КритическаяCVSS 9,8Proof of conceptEPSS 72 %samba · rsync15 янв. 2025 г.
- CVE-2024-4145319Наблюдать
A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or H
СредняяCVSS 4,8Proof of conceptEPSS 0 %15 янв. 2025 г.
- CVE-2024-5340713Наблюдать
In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote cont
НизкаяCVSS 3,3Proof of conceptEPSS 0 %phiewer · phiewer15 янв. 2025 г.
- CVE-2024-5550313Наблюдать
An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES compo
НизкаяCVSS 3,3Proof of conceptEPSS 0 %termius · termius15 янв. 2025 г.
- CVE-2024-5772689Срочно
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce
КритическаяCVSS 9,9KEVГотовый эксплойтEPSS 66 %simple-help · simplehelp15 янв. 2025 г.
- CVE-2024-5772789Срочно
SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated re
ВысокаяCVSS 7,5KEVГотовый эксплойтEPSS 96 %simple-help · simplehelp15 янв. 2025 г.
- CVE-2024-5772877На этой неделе
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a
ВысокаяCVSS 7,2KEVГотовый эксплойтEPSS 64 %simple-help · simplehelp15 янв. 2025 г.
- CVE-2025-2296432Наблюдать
DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient inp
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %ddsn · cm3 acora content management system15 янв. 2025 г.
- CVE-2025-2291240В плане
RE11S v1.11 was discovered to contain a command injection vulnerability via the component /goform/formAccept.
КритическаяCVSS 9,8Proof of conceptEPSS 1 %edimax · re11s firmware15 янв. 2025 г.
- CVE-2024-5063330Наблюдать
A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted P
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %cern · indico16 янв. 2025 г.
- CVE-2024-5768443В плане
An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the D
КритическаяCVSS 9,8Эксплойта нетEPSS 14 %dlink · dir-816 firmware16 янв. 2025 г.
- CVE-2025-2392240В плане
WordPress iSpring Embedder plugin <= 1.0 - CSRF to Arbitrary File Upload vulnerability
КритическаяCVSS 10,0Proof of conceptEPSS 1 %harsh · ispring embedder16 янв. 2025 г.
- CVE-2024-5551131Наблюдать
A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %16 янв. 2025 г.
- CVE-2024-5778422Наблюдать
An issue in the component /php/script_uploads.php of Zenitel AlphaWeb XE v11.2.3.10 allows attackers to execute a directory traversal.
СредняяCVSS 5,5Proof of conceptEPSS 0 %16 янв. 2025 г.
- CVE-2024-5778519Наблюдать
Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.
СредняяCVSS 4,9Proof of conceptEPSS 0 %16 янв. 2025 г.
- CVE-2025-2320030Наблюдать
Stored XSS-LibreNMS-Misc Section in librenms
СредняяCVSS 5,4Эксплойта нетEPSS 30 %librenms · librenms16 янв. 2025 г.
- CVE-2024-5096727Наблюдать
The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability.
СредняяCVSS 6,5Proof of conceptEPSS 1 %17 янв. 2025 г.
- CVE-2018-937531Наблюдать
In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confus
ВысокаяCVSS 7,8Proof of conceptEPSS 0 %google · android17 янв. 2025 г.
- CVE-2023-5073935Наблюдать
A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices.
ВысокаяCVSS 8,8Эксплойта нетEPSS 0 %lexmark · printer firmware17 янв. 2025 г.
- CVE-2025-2320969На этой неделе
Potential RCE with a compromised security key in craft/cms
ВысокаяCVSS 8,1KEVГотовый эксплойтEPSS 21 %craftcms · craft cms17 янв. 2025 г.
- CVE-2024-1318430Наблюдать
The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %wpextended · the ultimate wordpress toolkit – wp extended18 янв. 2025 г.
- CVE-2024-1317616Наблюдать
Timing side-channel in ECDSA signature computation
СредняяCVSS 4,1Proof of conceptEPSS 0 %openssl · openssl20 янв. 2025 г.
- CVE-2025-2213120Наблюдать
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function
СредняяCVSS 5,1Proof of conceptEPSS 0 %phpoffice · phpspreadsheet20 янв. 2025 г.
- CVE-2025-2262020Наблюдать
gix-worktree-state nonexclusive checkout sets executable files world-writable
СредняяCVSS 5,0Proof of conceptEPSS 0 %gitoxidelabs · gitoxide20 янв. 2025 г.
- CVE-2024-4969935Наблюдать
WordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerability
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %reputeinfosystems · arprice21 янв. 2025 г.
- CVE-2024-5181842В плане
WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated SQL Injection vulnerability
КритическаяCVSS 9,3Proof of conceptEPSS 16 %radykal · fancy product designer21 янв. 2025 г.
- CVE-2025-2271030Наблюдать
WordPress Smart Manager Plugin <= 8.52.0 - SQL Injection vulnerability
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %storeapps · smart manager21 янв. 2025 г.
- CVE-2025-2400128Наблюдать
WordPress PPO Call To Actions plugin <= 0.1.3 - CSRF to Stored XSS vulnerability
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %ngô thắng it · ppo call to actions21 янв. 2025 г.
- CVE-2025-2401121Наблюдать
Umbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes
СредняяCVSS 5,3Proof of conceptEPSS 1 %umbraco · umbraco cms21 янв. 2025 г.
- CVE-2024-5479440В плане
The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.
КритическаяCVSS 9,1Эксплойта нетEPSS 12 %eng · spagobi21 янв. 2025 г.
- CVE-2024-5550422Наблюдать
An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote co
СредняяCVSS 5,5Proof of conceptEPSS 0 %21 янв. 2025 г.
- CVE-2025-2336930Наблюдать
Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation
ВысокаяCVSS 7,6Proof of conceptEPSS 1 %github · enterprise server21 янв. 2025 г.
- CVE-2024-4839221Наблюдать
OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS).
СредняяCVSS 5,4Proof of conceptEPSS 0 %orangescrum · orangescrum21 янв. 2025 г.
- CVE-2024-2445130Наблюдать
A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attacker
ВысокаяCVSS 7,5Proof of conceptEPSS 0 %21 янв. 2025 г.
- CVE-2024-1349631Наблюдать
GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
ВысокаяCVSS 7,5Proof of conceptEPSS 2 %gamipress · gamipress22 янв. 2025 г.
- CVE-2025-2394237Наблюдать
WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability
КритическаяCVSS 9,1Proof of conceptEPSS 2 %ngocuct0912 · wp load gallery22 янв. 2025 г.
- CVE-2024-3190335Наблюдать
IBM Sterling B2B Integrator Standard Edition code execution
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %ibm · sterling b2b integrator22 янв. 2025 г.
- CVE-2024-5692429Наблюдать
A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary J
ВысокаяCVSS 7,3Proof of conceptEPSS 0 %codeastro · internet banking system22 янв. 2025 г.
- CVE-2025-2300676На этой неделе
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and
КритическаяCVSS 9,8KEVГотовый эксплойтEPSS 23 %sonicwall · sma8200v23 янв. 2025 г.
- CVE-2024-5519239Наблюдать
OpenImageIO v3.1.0.0dev was discovered to contain a heap overflow via the component OpenImageIO_v3_1_0::farmhash::inlined::Fetch64(char cons
КритическаяCVSS 9,8Эксплойта нетEPSS 0 %openimageio · openimageio23 янв. 2025 г.
- CVE-2025-2458221Наблюдать
WordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerability
СредняяCVSS 5,3Proof of conceptEPSS 0 %aa web servant · 12 step meeting list24 янв. 2025 г.
- CVE-2025-2458740В плане
WordPress Email Subscription Popup plugin <= 1.2.23 - SQL Injection vulnerability
ВысокаяCVSS 7,6Proof of conceptEPSS 32 %nks · email subscription popup24 янв. 2025 г.
- CVE-2025-2465930Наблюдать
WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerability
ВысокаяCVSS 7,6Proof of conceptEPSS 0 %shahjada · wpdm – premium packages24 янв. 2025 г.
- CVE-2024-5704130Наблюдать
A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' se
СредняяCVSS 4,6Эксплойта нетEPSS 39 %nodebb · nodebb24 янв. 2025 г.
- CVE-2025-041178На этой неделе
7-Zip Mark-of-the-Web Bypass Vulnerability
ВысокаяCVSS 7,0KEVГотовый эксплойтEPSS 67 %7-zip · 7-zip25 янв. 2025 г.
- CVE-2024-1305528Наблюдать
Dyn Business Panel <= 1.0.0 - Reflected XSS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %phycticio · dyn business panel27 янв. 2025 г.
- CVE-2024-1309428Наблюдать
WP Triggers Lite <= 2.5.3 - Reflected XSS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %wptriggers · wp triggers lite27 янв. 2025 г.
- CVE-2024-5201234Наблюдать
Apache Solr: Configset upload on Windows allows arbitrary path write-access
СредняяCVSS 5,4Эксплойта нетEPSS 44 %apache · solr27 янв. 2025 г.
- CVE-2024-5414649В плане
Cacti has a SQL Injection vulnerability when view host template
ВысокаяCVSS 8,8Эксплойта нетEPSS 46 %cacti · cacti27 янв. 2025 г.
- CVE-2025-2260430Наблюдать
Cacti has Authenticated RCE via multi-line SNMP responses
ВысокаяCVSS 7,2Proof of conceptEPSS 5 %cacti · cacti27 янв. 2025 г.
- CVE-2025-2435421Наблюдать
imgproxy is vulnerable to SSRF against 0.0.0.0
СредняяCVSS 5,3Proof of conceptEPSS 0 %imgproxy · imgproxy27 янв. 2025 г.
- CVE-2025-2436750В плане
Cacti allows Arbitrary File Creation leading to RCE
ВысокаяCVSS 8,7Готовый эксплойтEPSS 54 %cacti · cacti27 янв. 2025 г.
- CVE-2024-4884141В плане
Remote Code Execution (RCE) Vulnerabilities
КритическаяCVSS 10,0Proof of conceptEPSS 4 %abb · flxeon27 янв. 2025 г.
- CVE-2024-5450722Наблюдать
A type confusion issue was addressed with improved memory handling.
СредняяCVSS 5,5Proof of conceptEPSS 0 %apple · ipados27 янв. 2025 г.
- CVE-2025-2408575На этой неделе
A use after free issue was addressed with improved memory management.
КритическаяCVSS 10,0KEVГотовый эксплойтEPSS 17 %apple · ipados27 янв. 2025 г.
- CVE-2025-2410422Наблюдать
This issue was addressed with improved handling of symlinks.
СредняяCVSS 5,5Proof of conceptEPSS 1 %apple · ipados27 янв. 2025 г.
- CVE-2025-2411829Наблюдать
The issue was addressed with improved memory handling.
ВысокаяCVSS 7,1Proof of conceptEPSS 3 %apple · ipados27 янв. 2025 г.
- CVE-2024-5737332Наблюдать
Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of
ВысокаяCVSS 8,1Proof of conceptEPSS 0 %27 янв. 2025 г.
- CVE-2022-3174926Наблюдать
Authenticated arbitrary file read/write in WatchGuard Fireware OS
СредняяCVSS 6,5Proof of conceptEPSS 1 %watchguard · fireware os27 янв. 2025 г.
- CVE-2022-336560На этой неделе
Emote Interactive Remote Mouse Server command injection due to weak encoding
КритическаяCVSS 9,8Готовый эксплойтEPSS 2 %emote interactive · remote mouse server27 янв. 2025 г.
- CVE-2024-1195420Наблюдать
Pimcore Search Document cross site scripting
СредняяCVSS 5,1Proof of conceptEPSS 1 %pimcore · pimcore28 янв. 2025 г.
- CVE-2024-1195620Наблюдать
Pimcore customer-data-framework list sql injection
СредняяCVSS 5,1Proof of conceptEPSS 0 %pimcore · pimcore28 янв. 2025 г.
- CVE-2025-2321140В плане
Tandoor Recipes - SSTI - Remote Code Execution
КритическаяCVSS 9,9Proof of conceptEPSS 3 %tandoor · recipes28 янв. 2025 г.
- CVE-2024-4067630Наблюдать
In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a
ВысокаяCVSS 7,7Proof of conceptEPSS 0 %google · android28 янв. 2025 г.
- CVE-2024-5596835Наблюдать
An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1.
ВысокаяCVSS 8,8Proof of conceptEPSS 1 %28 янв. 2025 г.
- CVE-2024-5737636Наблюдать
Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthentica
ВысокаяCVSS 8,8Proof of conceptEPSS 3 %dlink · dsr-150 firmware28 янв. 2025 г.
- CVE-2024-5751419Наблюдать
The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web
СредняяCVSS 4,8Proof of conceptEPSS 0 %28 янв. 2025 г.
- CVE-2024-1274928Наблюдать
Competition Form <= 2.0 - Reflected XSS
ВысокаяCVSS 7,1Proof of conceptEPSS 0 %raiserweb · competition form29 янв. 2025 г.
- CVE-2024-4884935Наблюдать
Authentication and Authorization Issues
ВысокаяCVSS 8,8Proof of conceptEPSS 0 %abb · flxeon29 янв. 2025 г.
- CVE-2024-4885228Наблюдать
Information disclosures
СредняяCVSS 6,9Proof of conceptEPSS 2 %abb · flxeon29 янв. 2025 г.
- CVE-2024-1118735Наблюдать
Many records in the additional section cause CPU exhaustion
ВысокаяCVSS 7,5Эксплойта нетEPSS 15 %isc · bind 929 янв. 2025 г.
- CVE-2024-1270536Наблюдать
DNS-over-HTTPS implementation suffers from multiple issues under heavy query load
ВысокаяCVSS 7,5Эксплойта нетEPSS 18 %isc · bind 929 янв. 2025 г.