CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- seopress, rainbowgeek seopress – on-site seo & analytics +1 moreSEOPress – On-site SEO <= 8.1.1 - Reflected Cross-Site Scripting6.1 Medium
- kraft plugins demo importer plusDemo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- iworks pwa, pwa — easy way to progressive web app +1 morePWA — easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 moreEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4 Medium
- unknown migration, backup, staging, wpvivid migration\, backup\, staging, wpvivid team migration backup staging +2 moreMigration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure7.5 High
- m-files corporation connector for copilotPermission bypass in M-Files Connector for Copilot5.3 Medium
- m-files hubshareStored HTML Injection in Hubshare social module6.9 Medium
- linux, linux kernel +1 morenet: asix: add proper error handling of usb read errors5.5 Medium
- linuxnet: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()6.8 Medium
- linux, linux kernel +1 morecifs: fix mid leak during reconnection after timeout threshold7.5 High
- thimpress wp hotel bookingWP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
libultrahdrOSS-FuzzUse-of-uninitialized-value in format_messageNo score- os4ed opensisOS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted...8.8 High
- contaoDuplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript6.4 Medium
- tribalsystems zenarioZenario Cross Site Scripting in the Image library4.8 Medium
- octobercms octoberOctober allows an admin account to upload PDF containing malicious JavaScript4.7 Medium
- tribalsystems zenarioZenario allows authenticated admin users to upload PDF files containing malicious code4.8 Medium
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite +1 moreThe postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0...10.0 Critical
- filesenderFileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials.9.8 Critical
- flatpressFlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via...8.1 High
- portainerPortainer improperly uses an encryption algorithm in the AesEncrypt function7.5 High
- flatpressA cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. This...5.4 Medium
- flatpressFlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious...5.4 Medium
- wanxingtechnology yitu project management software, wondershare edraw +1 moreA remote code execution vulnerability in the project management of Wanxing Technology's Yitu...3.3 Low
- ruijie rg-nbs2009g-p firmwareInsecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows...9.8 Critical
- ruijie rg-nbs2009g-p firmwareAn issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain...9.8 Critical
- librenmsLibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature7.5 High
- librenmsLibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name7.2 High
- librenmsStored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php7.5 High
- librenmsLibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.php3.5 Low
- librenmsLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php7.5 High
- librenmsLibreNMS Contains a Stored XSS via File Upload4.6 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreBuildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction4.7 Medium
- ofcms project ofcmsOFCMS add.json add cross site scripting5.3 Medium
- containers common, red hat enterprise linux 10, enterprise linux 8 +10 more +12 morePodman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library5.4 Medium
- definetlynotai logicyticsLogicytics vulnerable to shell injections6.9 Medium
- freepbx endpoint manager, endpointman +1 moreOSS Endpoint Manager allows unauthorized access to read system files6.8 Medium
- microsoft nugetgalleryXSS vulnerability in NuGetGallery HTML attributes handling8.2 High
- theupdateframework go-tufIncorrect delegation lookups can make go-tuf download the wrong artifact8.2 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory...7.3 High
- mozilla firefoxA specially crafted filename containing a large number of spaces could obscure the file's...5.3 Medium
- mozilla firefoxA user who enables full-screen mode on a specially crafted web page could potentially be...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA potential memory corruption vulnerability could be triggered if an attacker had the ability to...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA website configured to initiate a specially crafted WebTransport session could crash the Firefox...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreBy checking the result of calls to `window.open` with specifically set protocol handlers, an...5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA missing delay in directory upload UI could have made it possible for an attacker to trick a...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIt is currently unknown if this issue is exploitable but a condition may arise where the...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under...7.5 High
- Show moreLoading…