Yayın tarihine göre
Ekim 2024: sömürülen ve yeni ciddi CVE kayıtları
238 kayıt · 17 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 3 / 3
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2024-50427Kavram kanıtı | WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerabilitydevsoftbaltic · surveyjs · CWE-434 | Kritik9,9 | — | %1,0 | 29 Eki 2024 |
40Planlayın | CVE-2024-50473Kavram kanıtı | WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerabilityajar productions · ajar in5 embed · CWE-434 | Kritik10,0 | — | %1,0 | 29 Eki 2024 |
39İzleyin | CVE-2024-50475Kavram kanıtı | WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerabilityscott gamon · signup page · CWE-862 | Kritik9,8 | — | %1,2 | 29 Eki 2024 |
39İzleyin | CVE-2024-50476Kavram kanıtı | WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerabilitygrün software group gmbh · grün spendino spendenformular · CWE-862 | Kritik9,8 | — | %1,2 | 29 Eki 2024 |
39İzleyin | CVE-2024-50485Kavram kanıtı | WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerabilityudit rawat · exam matrix · CWE-266 | Kritik9,8 | — | %0,9 | 29 Eki 2024 |
39İzleyin | CVE-2024-50490Kavram kanıtı | WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerabilitylowcage · pegapoll · CWE-862 | Kritik9,8 | — | %0,9 | 29 Eki 2024 |
26İzleyin | CVE-2024-10465İstismar yok | A clipboard "paste" button could persist across tabs which allowed a spoofing attack.mozilla · firefox · CWE-290 | Orta6,5 | — | %0,5 | 29 Eki 2024 |
48Planlayın | CVE-2024-5982İstismar yok | Path Traversal in gaizhenbiao/chuanhuchatgptgaizhenbiao · chuanhuchatgpt · CWE-22 | Kritik9,8 | — | %31,3 | 29 Eki 2024 |
43Planlayın | CVE-2024-8309Kavram kanıtı | SQL Injection in langchain-ai/langchainlangchain · langchain · CWE-89 | Kritik9,8 | — | %13,7 | 29 Eki 2024 |
34İzleyin | CVE-2024-50334Kavram kanıtı | Semicolon Path Injection on API /api;/configerudika · scoold · CWE-288 | Yüksek8,7 | — | %1,0 | 29 Eki 2024 |
36İzleyin | CVE-2024-7985Kavram kanıtı | FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Uploadfileorganizer · fileorganizer · CWE-434 | Yüksek8,8 | — | %2,3 | 29 Eki 2024 |
41Planlayın | CVE-2024-9989Kavram kanıtı | Crypto <= 2.18 - Authentication Bypass via log_inodude · crypto tool · CWE-288 | Kritik9,8 | — | %7,1 | 29 Eki 2024 |
32İzleyin | CVE-2024-48955Kavram kanıtı | Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, theCWE-284 | Yüksek8,1 | — | %0,6 | 29 Eki 2024 |
39İzleyin | CVE-2024-48573Kavram kanıtı | A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account pasaquila-cms · aquilacms · CWE-89 | Kritik9,8 | — | %1,0 | 29 Eki 2024 |
97Hemen | CVE-2024-51378Silahlaştırılmış | getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticatcyberpanel · cyberpanel · CWE-78 | Kritik9,8 | KEV | %94,7 | 29 Eki 2024 |
94Hemen | CVE-2024-51567Silahlaştırılmış | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication andcyberpanel · cyberpanel · CWE-306 | Kritik9,8 | KEV | %84,4 | 29 Eki 2024 |
60Bu hafta | CVE-2024-51568Silahlaştırılmış | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.cyberpanel · cyberpanel · CWE-78 | Kritik9,8 | — | %47,6 | 29 Eki 2024 |
39İzleyin | CVE-2024-50507Kavram kanıtı | WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerabilitydaschmi · ds.downloadlist · CWE-502 | Kritik9,8 | — | %1,0 | 30 Eki 2024 |
30İzleyin | CVE-2024-50508Kavram kanıtı | WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerabilitychetan khandla · woocommerce product design · CWE-22 | Yüksek7,5 | — | %1,0 | 30 Eki 2024 |
34İzleyin | CVE-2024-50509Kavram kanıtı | WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerabilitychetan khandla · woocommerce product design · CWE-22 | Yüksek8,6 | — | %1,3 | 30 Eki 2024 |
40Planlayın | CVE-2024-50510Kavram kanıtı | WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerabilitywebandprint · ar for woocommerce · CWE-434 | Kritik10,0 | — | %1,0 | 30 Eki 2024 |
46Planlayın | CVE-2024-10525İstismar yok | Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callbackeclipse · mosquitto · CWE-122 | Yüksek7,2 | — | %59,2 | 30 Eki 2024 |
35İzleyin | CVE-2024-31152İstismar yok | The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series level1 · wbr-6012 firmware · CWE-400 | Yüksek7,5 | — | %17,8 | 30 Eki 2024 |
34İzleyin | CVE-2024-33623İstismar yok | A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6.level1 · wbr-6012 firmware · CWE-835 | Yüksek7,5 | — | %11,8 | 30 Eki 2024 |
38İzleyin | CVE-2024-33699İstismar yok | The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminislevel1 · wbr-6012 firmware · CWE-620 | Yüksek8,8 | — | %11,2 | 30 Eki 2024 |
42Planlayın | CVE-2024-10456İstismar yok | Delta Electronics InfraSuite Device Master Deserialization of Untrusted Datadelta electronics · infrasuite device master · CWE-502 | Kritik9,3 | — | %17,5 | 30 Eki 2024 |
23İzleyin | CVE-2024-10005Kavram kanıtı | Consul L7 Intentions Vulnerable To URL Path Bypasshashicorp · consul · CWE-22 | Orta5,8 | — | %0,7 | 30 Eki 2024 |
27İzleyin | CVE-2024-10557Kavram kanıtı | code-projects Blood Bank Management System updateprofile.php cross-site request forgeryfabian · blood bank management system · CWE-352 | Orta6,9 | — | %0,6 | 30 Eki 2024 |
54Planlayın | CVE-2024-48307Kavram kanıtı | JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.jeecg · jeecg boot · CWE-89 | Kritik9,8 | — | %50,0 | 30 Eki 2024 |
43Planlayın | CVE-2024-10392İstismar yok | AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Uploadsenols · ai puffer – your ai engine for wordpress (formerly ai power) · CWE-434 | Kritik9,8 | — | %14,9 | 31 Eki 2024 |
39İzleyin | CVE-2024-48910Kavram kanıtı | DOMPurify vulnerable to tampering by prototype polutioncure53 · dompurify · CWE-1321 | Kritik9,8 | — | %1,1 | 31 Eki 2024 |
25İzleyin | CVE-2024-51430Kavram kanıtı | Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary CWE-79 | Orta6,4 | — | %0,5 | 31 Eki 2024 |
50Planlayın | CVE-2024-51482Kavram kanıtı | Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64zoneminder · zoneminder · CWE-89 | Kritik9,9 | — | %36,6 | 31 Eki 2024 |
31İzleyin | CVE-2024-39719Kavram kanıtı | An issue was discovered in Ollama through 0.3.14.ollama · ollama · CWE-209 | Yüksek7,5 | — | %4,2 | 31 Eki 2024 |
31İzleyin | CVE-2024-39722Kavram kanıtı | An issue was discovered in Ollama before 0.1.46.ollama · ollama · CWE-22 | Yüksek7,5 | — | %3,9 | 31 Eki 2024 |
40Planlayın | CVE-2024-48359Kavram kanıtı | Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.qualitor · qualitor · CWE-94 | Kritik9,8 | — | %2,2 | 31 Eki 2024 |
31İzleyin | CVE-2024-48360Kavram kanıtı | Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.qualitor · qualitor · CWE-918 | Yüksek7,5 | — | %3,9 | 31 Eki 2024 |
27İzleyin | CVE-2024-10605Kavram kanıtı | code-projects Blood Bank Management System request.php cross-site request forgeryfabian · blood bank management system · CWE-352 | Orta6,9 | — | %0,4 | 31 Eki 2024 |
- CVE-2024-5042739İzleyin
WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerability
KritikCVSS 9,9Kavram kanıtıEPSS %1devsoftbaltic · surveyjs29 Eki 2024
- CVE-2024-5047340Planlayın
WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerability
KritikCVSS 10,0Kavram kanıtıEPSS %1ajar productions · ajar in5 embed29 Eki 2024
- CVE-2024-5047539İzleyin
WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %1scott gamon · signup page29 Eki 2024
- CVE-2024-5047639İzleyin
WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %1grün software group gmbh · grün spendino spendenformular29 Eki 2024
- CVE-2024-5048539İzleyin
WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0udit rawat · exam matrix29 Eki 2024
- CVE-2024-5049039İzleyin
WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0lowcage · pegapoll29 Eki 2024
- CVE-2024-1046526İzleyin
A clipboard "paste" button could persist across tabs which allowed a spoofing attack.
OrtaCVSS 6,5İstismar yokEPSS %0mozilla · firefox29 Eki 2024
- CVE-2024-598248Planlayın
Path Traversal in gaizhenbiao/chuanhuchatgpt
KritikCVSS 9,8İstismar yokEPSS %31gaizhenbiao · chuanhuchatgpt29 Eki 2024
- CVE-2024-830943Planlayın
SQL Injection in langchain-ai/langchain
KritikCVSS 9,8Kavram kanıtıEPSS %13langchain · langchain29 Eki 2024
- CVE-2024-5033434İzleyin
Semicolon Path Injection on API /api;/config
YüksekCVSS 8,7Kavram kanıtıEPSS %1erudika · scoold29 Eki 2024
- CVE-2024-798536İzleyin
FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload
YüksekCVSS 8,8Kavram kanıtıEPSS %2fileorganizer · fileorganizer29 Eki 2024
- CVE-2024-998941Planlayın
Crypto <= 2.18 - Authentication Bypass via log_in
KritikCVSS 9,8Kavram kanıtıEPSS %7odude · crypto tool29 Eki 2024
- CVE-2024-4895532İzleyin
Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the
YüksekCVSS 8,1Kavram kanıtıEPSS %029 Eki 2024
- CVE-2024-4857339İzleyin
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account pas
KritikCVSS 9,8Kavram kanıtıEPSS %1aquila-cms · aquilacms29 Eki 2024
- CVE-2024-5137897Hemen
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticat
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %94cyberpanel · cyberpanel29 Eki 2024
- CVE-2024-5156794Hemen
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %84cyberpanel · cyberpanel29 Eki 2024
- CVE-2024-5156860Bu hafta
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.
KritikCVSS 9,8SilahlaştırılmışEPSS %47cyberpanel · cyberpanel29 Eki 2024
- CVE-2024-5050739İzleyin
WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %1daschmi · ds.downloadlist30 Eki 2024
- CVE-2024-5050830İzleyin
WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability
YüksekCVSS 7,5Kavram kanıtıEPSS %1chetan khandla · woocommerce product design30 Eki 2024
- CVE-2024-5050934İzleyin
WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerability
YüksekCVSS 8,6Kavram kanıtıEPSS %1chetan khandla · woocommerce product design30 Eki 2024
- CVE-2024-5051040Planlayın
WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerability
KritikCVSS 10,0Kavram kanıtıEPSS %1webandprint · ar for woocommerce30 Eki 2024
- CVE-2024-1052546Planlayın
Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
YüksekCVSS 7,2İstismar yokEPSS %59eclipse · mosquitto30 Eki 2024
- CVE-2024-3115235İzleyin
The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series
YüksekCVSS 7,5İstismar yokEPSS %17level1 · wbr-6012 firmware30 Eki 2024
- CVE-2024-3362334İzleyin
A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6.
YüksekCVSS 7,5İstismar yokEPSS %11level1 · wbr-6012 firmware30 Eki 2024
- CVE-2024-3369938İzleyin
The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminis
YüksekCVSS 8,8İstismar yokEPSS %11level1 · wbr-6012 firmware30 Eki 2024
- CVE-2024-1045642Planlayın
Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
KritikCVSS 9,3İstismar yokEPSS %17delta electronics · infrasuite device master30 Eki 2024
- CVE-2024-1000523İzleyin
Consul L7 Intentions Vulnerable To URL Path Bypass
OrtaCVSS 5,8Kavram kanıtıEPSS %0hashicorp · consul30 Eki 2024
- CVE-2024-1055727İzleyin
code-projects Blood Bank Management System updateprofile.php cross-site request forgery
OrtaCVSS 6,9Kavram kanıtıEPSS %0fabian · blood bank management system30 Eki 2024
- CVE-2024-4830754Planlayın
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
KritikCVSS 9,8Kavram kanıtıEPSS %50jeecg · jeecg boot30 Eki 2024
- CVE-2024-1039243Planlayın
AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload
KritikCVSS 9,8İstismar yokEPSS %14senols · ai puffer – your ai engine for wordpress (formerly ai power)31 Eki 2024
- CVE-2024-4891039İzleyin
DOMPurify vulnerable to tampering by prototype polution
KritikCVSS 9,8Kavram kanıtıEPSS %1cure53 · dompurify31 Eki 2024
- CVE-2024-5143025İzleyin
Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary
OrtaCVSS 6,4Kavram kanıtıEPSS %031 Eki 2024
- CVE-2024-5148250Planlayın
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
KritikCVSS 9,9Kavram kanıtıEPSS %36zoneminder · zoneminder31 Eki 2024
- CVE-2024-3971931İzleyin
An issue was discovered in Ollama through 0.3.14.
YüksekCVSS 7,5Kavram kanıtıEPSS %4ollama · ollama31 Eki 2024
- CVE-2024-3972231İzleyin
An issue was discovered in Ollama before 0.1.46.
YüksekCVSS 7,5Kavram kanıtıEPSS %3ollama · ollama31 Eki 2024
- CVE-2024-4835940Planlayın
Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.
KritikCVSS 9,8Kavram kanıtıEPSS %2qualitor · qualitor31 Eki 2024
- CVE-2024-4836031İzleyin
Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.
YüksekCVSS 7,5Kavram kanıtıEPSS %3qualitor · qualitor31 Eki 2024
- CVE-2024-1060527İzleyin
code-projects Blood Bank Management System request.php cross-site request forgery
OrtaCVSS 6,9Kavram kanıtıEPSS %0fabian · blood bank management system31 Eki 2024