CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- shilpi computers client dashboardUnrestricted File Upload Vulnerability8.6 High
- shilpi computers client dashboardNo Rate Limiting vulnerability7.1 High
- shilpi computers client dashboardMissing Authorization Vulnerability7.1 High
- avast antivirusOut of Bounds write on scan of malformed eml file may crash the application5.1 Medium
- shilpi computers client dashboardInsecure Authentication Vulnerability7.6 High
- shilpi client dashboardParameter Pollution Vulnerability7.1 High
- finrota, finrota netahsilat +1 moreCleartext Storage of Username and Password in Finrota's Netahsilat8.2 High
- remydcf re:wp, remilia re\ +1 moreRe:WP <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- sigmadevs easy demo importer – a modern one-click demo import solution, easy demo importer +1 moreEasy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- plainware shiftcontroller, shiftcontroller employee shift scheduling +1 moreShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site Scripting6.1 Medium
- wpbookingcalendar wp booking calendar, wpdevelop booking calendar +1 moreWP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- zephyrproject zephyrBluetooth: ots: missing buffer length check6.3 Medium
- zephyrproject zephyrzephyr: out-of-bound read in utf8_trunc6.3 Medium
- zephyrproject zephyrBluetooth: ASCS Unchecked tailroom of the response buffer6.3 Medium
- memberful, memberful – membership plugin +1 moreMemberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting6.4 Medium
- dartiss code embedCode Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- fileorganizer, softaculous fileorganizer – wordpress file manager +1 moreFileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
- ultimatewpsms joy of text, unknown joy of text lite +1 moreJoy Of Text Lite – SMS messaging for WordPress <= 2.3.1 - Settings Update via CSRF4.3 Medium
- open-webui open-webui/open-webui, openwebui open webui +1 moreDenial of Service in open-webui/open-webui7.5 High
- roundupwp registrations for the events calendarRegistrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS9.6 Critical
- wp-centrics fish and ships, wpcentrics advanced shipping rates for woocommerce: flexible table rate shipping rules +1 moreFish and Ships <= 1.5.9 - Reflected Cross-Site Scripting6.1 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership plugin, ultimate member +1 moreUltimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Change5.3 Medium
- wpcodefactory price by quantity & bulk quantity discounts for woocommerce, wpfactory quantity dynamic pricing \& bulk discounts for woocommerce +1 moreQuantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting6.1 Medium
- acekyd display medium postsDisplay Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode6.4 Medium
- contact-banker wordpress captcha plugin by captcha bank, tech-banker captcha bank +1 moreWordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting6.1 Medium
- nerdpress smart custom 404 error pageSmart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site Scripting6.1 Medium
- prontotools login logout shortcodeLogin Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter6.4 Medium
- miguelmello aggregator advanced settingsAggregator Advanced Settings <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- wpblockshub wp blocks hubWP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- michaeluno auto amazon links, miunosoft auto amazon links – amazon associates affiliate plugin +1 moreAuto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site Scripting6.1 Medium
- themes4wp popularis extraPopularis Extra <= 1.2.6 - Reflected Cross-Site Scripting6.1 Medium
- tychesoftwares product delivery date for woocommerce – lite, product delivery date for woocommerce +1 moreProduct Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scripting6.1 Medium
- clio grow, cliogrow clio grow form +1 moreClio Grow <= 1.0.2 - Reflected Cross-Site Scripting6.1 Medium
mrubyOSS-FuzzUse-of-uninitialized-value in mark_contextNo score- mediawikiImproper permissions handling in MediaWiki AbuseFilter5.3 Medium
- sonarsource sonarqubeIn SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the...6.7 Medium
- sonarsource sonarqubeAn issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A...7.2 High
json-libopenEuler,jenkinsRed Hat,jenkins-2-pluginsRed Hat +3 more +5 moreJSON-lib mishandles an unbalanced comment string5.3 Medium- veritas data insightA vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to...6.1 Medium
ironicDebian,openstack-ironicRed Hat,openstack-ironic-apiRed Hat +2 more +4 moreOpenStack Ironic fails to verify checksums of supplied image_source URLs5.3 Medium- nongnu oath toolkitpam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation...7.1 High
- tp-link tl-wdr5620 firmwareTP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via...8.0 High
- seeddmsA stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute...5.4 Medium
- adonesevangelista sports management system, sports management system project management system +1 moreitsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function...7.5 High
- mayurik online tours and travels management system, online tours and travels management system project tours and travels management system +1 moreitsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site...5.4 Medium
- shanghai zhouma network technology co intelligent manufacturing collaborative internet of thingsAn issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing...5.9 Medium
- 4pace cadclickA Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0...5.4 Medium
- 4pace cadclickA reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1...5.4 Medium
- 4pace cadclickA reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0...5.4 Medium
- Show moreLoading…