CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- sonicwall connect tunnelThe Improper link resolution before file access ('Link Following') vulnerability in SonicWall...5.5 Medium
- brechtvds wp ultimate post gridWP Ultimate Post Grid <= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode6.4 Medium
- bitpressadmin bit form – custom contact form, multi step, conversational form & payment form builderContact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpl…4.9 Medium
- fullservices full – clienteFULL – Cliente <= 3.1.22 - Reflected Cross-Site Scripting6.1 Medium
- rafasashi language switcherLanguage Switcher <= 3.7.13 - Reflected Cross-Site Scripting6.1 Medium
- ataurr gutenkit – page builder blocks, patterns, and templates for gutenberg block editor, wpmet gutenkit +1 moreGutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- wpcodefactory download plugins and themes in zip from dashboardDownload Plugins and Themes in ZIP from Dashboard <= 1.9.1 - Reflected Cross-Site Scripting6.1 Medium
- themehunk hunk companionHunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation9.8 Critical
- kevinb publishpress revisions: duplicate posts, submit, approve and schedule content changes, publishpress revisions: duplicate posts, submit, approve and schedule content changes +1 morePublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting6.1 Medium
- leogermani tainacanTainacan <= 0.21.10 - Reflected Cross-Site Scripting6.1 Medium
- blockmeister – block pattern builderBlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting6.1 Medium
- ttodua increase upload file size & maximum execution time limitIncrease upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site Scripting6.1 Medium
- michaelzangl embed videos and respect privacyEmbed videos and respect privacy <= 1.2 - Reflected Cross-Site Scripting6.1 Medium
- linkz.ai, vittor1o linkz.ai – automatic link previews on hover +1 moreLinkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX5.4 Medium
- linkz.ai, vittor1o linkz.ai – automatic link previews on hover +1 moreLinkz.ai <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update6.5 Medium
- blubrry powerpress podcasting plugin by blubrryPowerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode6.4 Medium
- jsonpath-plus jsonpathJSONPath Plus Remote Code Execution (RCE) Vulnerability9.8 Critical
- pedalo connector, pedaloagency pedalo connector +1 morePedalo Connector <= 2.0.5 - Authentication Bypass to Administrator9.8 Critical
htslibOSS-FuzzHeap-buffer-overflow in cram_encode_containerNo scorekamailioOSS-FuzzHeap-buffer-overflow in parse_mixed_contentNo scorelibxml2OSS-FuzzHeap-use-after-free in xmlValidateOneElementNo scorekamailioOSS-FuzzHeap-buffer-overflow in extract_sendrecv_modeNo scoreclamavOSS-FuzzMemcpy-param-overlap in repeatNo scoreespeak-ngOSS-FuzzGlobal-buffer-overflow in AnnouncePunctuationNo scoreh3OSS-FuzzHeap-buffer-overflow in polygonToCellsExperimentalNo scorekamailioOSS-FuzzUNKNOWN READ in eat_lineNo score- snipeitapp snipe-itSnipe-IT remote code execution6.6 Medium
- znunyZnuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email....7.5 High
- znunyZnuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the...6.1 Medium
- sbond watcharrAn issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and...8.8 High
- employee management system project management systemSQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html...8.8 High
- yescam firmwareAn issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive...7.5 High
- revic optics ops firmwareAn issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain...9.1 Critical
- switchbot firmwareAn issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker...9.1 Critical
- sampmax firmwareAn Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker...9.8 Critical
- giant manufacturing ridelink firmwareAn issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote...9.1 Critical
- ledvance smartplus firmwareLEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive...7.5 High
- shelly home firmwareAn issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information...7.5 High
- starvedia ezset firmwareAn issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain...7.5 High
- fermax vidaAn issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain...7.5 High
- wo-smart morepro firmwareAn issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the...7.5 High
- c-chip firmwareAn issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive...9.1 Critical
- almando play firmwareAn issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to...7.5 High
- starvedia com.wisdomcity.zwaveAn issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain...8.2 High
- burg-wchter kg firmwareAn issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain...9.1 Critical
- almando control firmwareAn issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to...7.5 High
- kancloud openhisSQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the...9.8 Critical
- jpressA Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be...7.5 High
- mercury km08-708h firmwareA vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC()...6.5 Medium
- zhejiang university entersoft customer resource managementAn arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang...9.8 Critical
- Show moreLoading…