CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- hashthemes hash form – drag & drop form builder, hash form +1 moreHash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload6.1 Medium
- d-link dir-605l, dlink dir-605l firmware +1 moreD-Link DIR-605L formAdvanceSetup buffer overflow8.7 High
- averta shortcodes and extra features for phlox themeShortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets6.4 Medium
- bitapps file managerBit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload6.8 Medium
- fluentforms contact form, techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builder +1 moreContact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting4.9 Medium
- themify builder, themifyme themify builder +1 moreThemify Builder <= 7.6.2 - Reflected Cross-Site Scripting6.1 Medium
- guillaume-lostweb wp cleanup and basic functionsWP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- the wikimedia foundation mediawiki - css extension, wikimedia mediawiki-extensions-css, wikimedia-extensions-css +2 morePath traversal when loading stylesheets6.9 Medium
- the wikimedia foundation mediawiki - apex skin, wikimedia apex, mediawiki-apex skin +2 moreStored XSS through sidebar in Apex skin6.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 moreVarious XSSes found in Cargo6.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 moreSpecial:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection6.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 moreBackticks can allow the usage of not-allowed SQL functions8.8 High
- the wikimedia foundation mediawiki - css extension, wikimedia mediawiki-extensions-css, wikimedia-extensions-css +2 moreCSS sanitizer used incorrectly, and is easily bypassed6.9 Medium
- the wikimedia foundation mediawiki - pagetriage, wikimedia pagetriage +1 moreUser can review/unreview articles while blocked6.9 Medium
- microchip timeprovider 4100, timeprovider 4100 firmware +1 moreImproper verification of the Host header in TimeProvider 41008.7 High
- microchip timeprovider 4100, timeprovider 4100 firmware +1 moreCross-Site Request Forgery vulnerability in TimeProvider 41008.7 High
- microchip timeprovider 4100, timeprovider 4100 firmware +1 moreSession token fixation in TimeProvider 41008.7 High
- microchip timeprovider 4100, timeprovider 4100 firmware +1 moreReflected XSS in TimeProvider 4100 chart component5.4 Medium
- microchip timeprovider 4100, timeprovider 4100 firmware +1 moreRemote code Execution inTimeProvider® 41008.5 High
- microchip timeprovider 4100, timeprovider 4100 firmware +1 moreXSS vulnerability in bannerconfig endpoint in TimeProvider 41007.7 High
- microchip timeprovider 4100, timeprovider 4100 firmware +1 moreSQL injection in get_chart_data in TimeProvider 41006.3 Medium
- jshttp cookiecookie accepts cookie name, path, and domain with out of bounds characters6.9 Medium
- esri portal for arcgis, liferay portal +1 moreBUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability7.5 High
- esri portal for arcgisBUG-000165732 - Reflected XSS in Portal for ArcGIS6.1 Medium
- esri portal for arcgisBUG-000165286 - Reflected XSS in Portal for ArcGIS6.1 Medium
- esri portal for arcgis, enterprise web app builder +1 moreBUG-000163019 - Stored XSS in Portal for ArcGIS4.8 Medium
- esri portal for arcgis enterprise experience builder, portal for arcgis +1 moreBUG-000160765 - Stored XSS in ArcGIS Experience Builder4.8 Medium
- esri portal for arcgis, arcgis enterprise web app builder, enterprise web app builder +2 moreBUG-000160599 - Stored XSS in Portal for ArcGIS Web App Builder4.8 Medium
- esri portal for arcgisBUG-000160241 - Reflected XSS in Portal for ArcGIS4.8 Medium
- esri portal for arcgis, portal for arcgis enterprise experience builder +1 moreBUG-000154827 - Reflected XSS in ArcGIS Experience Builder5.4 Medium
- esri portal for arcgisBUG-000168624 - Unvalidated redirect in Portal for ArcGIS.4.6 Medium
- esri portal for arcgisBUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.5.4 Medium
- esri portal for arcgisBUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)6.1 Medium
- esri portal for arcgisBUG-000167983 - Unvalidated redirect in Portal for ArcGIS6.1 Medium
- parse community server, parse-community parse-server +1 moreParse Server's custom object ID allows to acquire role privileges8.1 High
- idurar project idurar, idurar idurar-erp-crm +1 moreIDURAR has a Path Traversal (unauthenticated user can read sensitive data)7.5 High
- lifplatforms lif authentication server, lif-platforms lif-auth-server +1 moreLif Authentication Server Has No Auth Check When Updating Password In Account Recovery6.9 Medium
- jgniecki minecraft motd parser, minecraftmotdparser +1 moreMinecraft MOTD Parser's HtmlGenerator vulnerable to XSS6.9 Medium
- d-link dir-605l, dlink dir-605l firmware +1 moreD-Link DIR-605L formSetQoS buffer overflow8.7 High
- d-link dir-605l, dlink dir-605l firmware +1 moreD-Link DIR-605L formSetDomainFilter buffer overflow8.7 High
- ada, ada ada.cx sentry, ada support ada.cx sentry component +2 moreAda.cx SSRF via Sentry Misconfiguration5.3 Medium
- themehigh checkout field editor (checkout manager) for woocommerce, checkout field editor for woocommerce +1 moreCheckout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_notice4.7 Medium
- d3d security ip camera d8801, d3dsecurity d8801 +1 moreMissing Authorization Vulnerability8.7 High
- avast antivirusAn null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400...5.1 Medium
- d3d security ip camera d8801, d3dsecurity d8801 +1 moreCredential Leakage Vulnerability8.7 High
- netadmin iamNetadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposure6.3 Medium
- shilpi computers net back officeImproper Access Control Vulnerability7.1 High
- avast antivirusUninitialized variable in digital signiture verification may crash the application5.1 Medium
- shilpi computers client dashboardUser Enumeration vulnerability9.3 Critical
- avast antivirusOut of Bounds write on scan of malformed Mach-O file may crash the application5.1 Medium
- Show moreLoading…