CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- zte zxr10 1800-2s series ,zxr10 2800-4,zxr10 3800-8,zxr10 160 series, zxr10 160 firmware, zxr10 1800-2s firmware +2 more +4 moreWeak Password Vulnerability in ZTE ZSR V2 Intelligent Multi Service Router6.0 Medium
- checkmkInformation leak in mknotifyd5.3 Medium
- linuxfoundation zowe api mediation layer, open mainframe project zowe +1 moreConformance validation endpoint discloses detail about service to unauthenticated users5.3 Medium
- internet-formation wp-advanced-searchWP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection9.8 Critical
- linuxfoundation zowe api mediation layer, open mainframe project zowe +1 moreHealth endpoint offers list of onboarded services to unauthenticated users5.3 Medium
- wiresharkImproper Handling of Missing Values in Wireshark7.8 High
- wiresharkMissing Initialization of a Variable in Wireshark7.8 High
- templateinvaders ti woocommerce wishlistTI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection via lang parameters7.5 High
- wpuserplus userplus, userplus user registration & user profile – userplus +1 moreUserPlus <= 2.0 - Missing Authorization via Multiple Functions6.3 Medium
- essamamdani advanced blocks proAdvanced Blocks Pro <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- kainelabs youzify, youzify – buddypress community, user profile, social network & membership plugin for wordpress +1 moreYouzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion4.3 Medium
- brevo newsletter\, smtp\, email marketing and subscribe, neeraj slit brevo – email, sms, web push, chat, and more. +1 moreNewsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.87 - Cross-Site Request Forgery4.3 Medium
- total-soft ts poll, totalsoft ts poll – survey, versus poll, image poll, video poll, poll survey +2 moreTS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter7.2 High
- andreamarinucci notification for telegramNotification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message4.3 Medium
- appscreo easy social share buttonsEasy Social Share Buttons <= 1.4.5 - Reflected Cross-Site Scripting6.1 Medium
- happyplugins shortcodes anywhereShortcodes AnyWhere <= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- curator curator.ioCurator.io: Show all your social media posts in a beautiful feed. <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via feed_id Attribute6.4 Medium
- wpcodefactory export products, orders & customers for woocommerce, wpfactory products\, order \& customers export for woocommerce +1 moreProducts, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site Scripting6.1 Medium
- mat bao corporation wp helper premiumWP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test5.3 Medium
- namogo elementor inline svgElementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- lagunaisw wp users masqueradeWP Users Masquerade <= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass8.8 High
- dale668 marketing and seo boosterMarketing and SEO Booster <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- wpuserplus userplus, userplus user registration & user profile – userplus, user registration and user profile +2 moreUserPlus <= 2.0 - Unauthenticated Privilege Escalation9.8 Critical
- kainelabs youzify, youzify – buddypress community, user profile, social network & membership plugin for wordpress +1 moreYouzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode6.4 Medium
- wpcodefactory maximum products per user for woocommerceMaximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site Scripting6.1 Medium
- quarka qa analytics, qa assistants – driven by data +1 moreQA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- wpuserplus userplus, userplus user registration & user profile – userplus, user registration and user profile +2 moreUserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation7.2 High
- gdpr-extensions consent manager, gdprextensionscom gdpr-extensions-com – consent manager +1 moreGDPR-Extensions-com – Consent Manager <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- cssjockey wp builderWP Builder <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- open-webui, open-webui open-webui/open-webui, openwebui open webui +2 moreIDOR in open-webui/open-webui6.3 Medium
- libarchiveexecute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out...7.8 High
- libarchiveexecute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out...7.8 High
- indutny ellipticElliptic's verify function omits uniqueness validation9.1 Critical
- bitcoin, bitcoin core +1 moreBitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message...7.5 High
- fortra robot schedule enterprise, robot schedule +1 moreSensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.055.5 Medium
- hcl software connectionsHCL Connections is susceptible to a sensitive information disclosure vulnerability3.5 Low
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: When BGP traceoptions is enabled, receipt of specially crafted BGP packet causes RPD crash8.7 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash8.7 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: With BGP traceoptions enabled, receipt of specifically malformed BGP update causes RPD crash8.7 High
- open-webui, open-webui open-webui/open-webui, openwebui open webui +2 moreIDOR in open-webui/open-webui6.5 Medium
- vmware nsx, cloud foundation, nsx-t +2 moreVMware NSX contains a content spoofing vulnerability. An unauthenticated malicious actor may be...4.3 Medium
- vmware nsx, cloud foundation, nsx-t +2 moreVMware NSX contains a local privilege escalation vulnerability. An authenticated malicious...6.7 Medium
- vmware nsx, cloud foundation, nsx-t +2 moreMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX...6.7 Medium
- ampacheCross-Site Request Forgery in ampache5.3 Medium
- ssoreadyXML Signature Bypass via differential XML parsing in ssoready9.3 Critical
- miraheze incidentreportingCross-site Scripting in IncidentReporting6.0 Medium
- miraheze importdumpUsers can impersonate import requesters if their actor IDs coincide in ImportDump6.4 Medium
- miraheze importdumpCross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDump6.0 Medium
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Local Privilege Escalation (PE) Vulnerability5.2 Medium
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Privilege Escalation (PE) Vulnerability in XML API5.1 Medium
- Show moreLoading…