CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA compromised content process could have allowed for the arbitrary loading of cross-origin pages....9.8 Critical
- decidimDecidim has a cross-site scripting vulnerability in the version control page7.1 High
- elabftweLabFTW contains a direct and indirect information disclosure7.5 High
- elabftwUnauthorised granting of administrator privileges over arbitrary teams under certain circumstances8.6 High
- kiteworks owncloudCross Site Request Forgery in Kiteworks OwnCloud6.8 Medium
- hcl software nomad server on dominoMissing default HTTP security headers affect HCL Nomad server on Domino3.7 Low
- hyperium tonicRemotely exploitable DoS in Tonic `<=v0.12.2`6.9 Medium
- pluck cms cms, pluck-cms pluckcms +1 moreAn incorrect limitation of a path to a restricted directory (path traversal) has been detected in...5.3 Medium
- gitlabExposure of Sensitive Information Due to Incompatible Policies in GitLab6.6 Medium
- quomodosoft qs dark mode pluginQS Dark Mode Plugin <= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- grandplugins avif uploaderAVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- redefiningtheweb affiliate pro, wordpress & woocommerce affiliate program +1 moreWordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation9.8 Critical
- spicethemes spice starter sitesSpice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import5.3 Medium
- coderevolution echo rss feed post generatorEcho RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege Escalation9.8 Critical
- brochris auto featured image from titleAuto Featured Image from Title <= 2.3 - Reflected Cross-Site Scripting6.1 Medium
- ishitaka xo sliderXO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- petershaw lh copy media fileLH Copy Media File <= 1.08 - Reflected Cross-Site Scripting6.1 Medium
- hahncgdev wp easy gallery – wordpress gallery plugin, plugingarden wp easy gallery, hahncgdev wp easy gallery wordpress gallery plugin +2 moreWP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter8.8 High
- visser store exporter for woocommerce, jkohlbach store exporter – export woocommerce products, orders, subscriptions, customers +1 moreStore Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scripting6.1 Medium
- adreastrian guten post layout – an advanced post grid collectionGuten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute6.4 Medium
- duckdev loggedin, joelcj91 loggedin – limit concurrent sessions +1 moreLoggedin – Limit Active Logins <= 1.3.1 - Reflected Cross-Site Scripting6.1 Medium
- ghuger custom bannersCustom Banners <= 3.3 - Reflected Cross-Site Scripting6.1 Medium
- kau-boy hello worldHello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- cornelraiu wp search analytics, cornelraiu-1 search analytics for wp +1 moreWP Search Analytics <= 1.4.10 - Reflected Cross-Site Scripting6.1 Medium
- contempo pdf image generatorPDF Image Generator <= 1.5.6 - Reflected Cross-Site Scripting6.1 Medium
- brianbrey easy load moreEasy Load More <= 1.0.3 - Reflected Cross-Site Scripting6.1 Medium
- torstenbulk dk pdf – wordpress pdf generatorDK PDF <= 1.9.6 - Reflected Cross-Site Scripting6.1 Medium
- ultrapressUltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection8.8 High
- optinhound easy wordpress subscribe – optin houndEasy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter6.1 Medium
- premio stars testimonials — responsive reviews & star ratingsStars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode6.4 Medium
- dgamoni locateandfilterLocateAndFilter <= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- soumettre soumettre.frSoumettre.fr <= 2.1.3 - Missing Authorization4.3 Medium
- cyberhobo geo mashupGeo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode6.4 Medium
- logon kb support, cagdasdag kb support wordpress help desk and knowledge base, logoninc kb support – customer support ticket & helpdesk plugin, knowledge base plugin +2 moreKB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure6.5 Medium
- mascotdevelopers r animated icon pluginR Animated Icon Plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- logon kb support, cagdasdag kb support wordpress help desk and knowledge base, logoninc kb support – customer support ticket & helpdesk plugin, knowledge base plugin +2 moreKB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions8.1 High
- rumbletalk live group chat – html5RumbleTalk Live Group Chat – HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- daveshine gravity forms toolbarGravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scripting6.1 Medium
- azexo elastik page builderElastik Page Builder <= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- ultrapress empowerment, empowerment theme for wordpress +1 moreEmpowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection8.8 High
- xunhuweb wechat social login, wechat social login 微信qq钉钉登录插件 +1 moreWechat Social login <= 1.3.0 - Authentication Bypass9.8 Critical
- 123.chat, 123.chat - video chat +1 more123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- cconover relogoRelogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- ultrapress unseen blogUnseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection8.8 High
- automatic-rock svg completeSVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- xunhuweb wechat social login, wechat social login 微信qq钉钉登录插件 +1 moreWechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- wiz code visual studio code extensionLocal command injection in Wiz Code Visual Studio Code extension7.1 High
- revolution slider slider revolutionSlider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- red hat nbde tang server, openshift developer tools and services, openshift pipelines +34 more +36 moreGolang-fips: golang fips zeroed buffer6.5 Medium
- Show moreLoading…