CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop sql injection5.3 Medium
- 07fly 07flycms, zero takeoff 07fly-cms, 07flycrm +1 more +3 more07FLYCMS/07FLY-CMS/07FlyCRM pictureUpload unrestricted upload5.1 Medium
pocoOSS-FuzzUse-of-uninitialized-value in Poco::Net::NTLMCredentials::parseChallengeMessageNo score- 07fly 07flycms, zero takeoff 07fly-cms, 07flycrm +1 more +3 more07FLYCMS/07FLY-CMS/07FlyCRM fileUpload unrestricted upload5.1 Medium
- blood bank system project bank system, code-projects blood bank system +1 morecode-projects Blood Bank System reset.php sql injection5.3 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +1 more +3 morePyo3: risk of use-after-free in `borrowed` reads from python weak references5.3 Medium
- afthemes wp post author, wp post author – author box, multiple authors, guest authors & custom avatars +1 moreBoost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection7.2 High
- webtechstreet elementor addon elements, wpvibes addon elements for elementor (formerly elementor addon elements) +1 moreElementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections4.3 Medium
- tablepress, tobiasbg tablepress – tables in wordpress made easy +1 moreTablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- rescue themes shortcodes, rescuethemes rescue shortcodes +1 moreRescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- bfintal stackable – page builder gutenberg blocksStackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection5.3 Medium
- pixelgrade category iconCategory Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- dvankooten social sharing (by danny), ibericode social sharing +1 moreSocial Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- iptanus wordpress file upload, nickboss iptanus file upload +1 moreWordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php9.8 Critical
- directsoftware order attachments for woocommerceOrder Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload4.3 Medium
- sujin2f 2d tag cloud2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter6.1 Medium
- butterflymedia imagepress – image gallery, getbutterfly imagepress +1 moreImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings4.4 Medium
- azexo mynx page builderMynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- fatcatapps forms for mailchimp by optin cat – grow your mailchimp listForms for Mailchimp by Optin Cat <= 2.5.7 - Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters4.4 Medium
- butterflymedia imagepress – image galleryImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update4.3 Medium
- adamskaat read more by adamRead more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion4.3 Medium
- butterflymedia imagepress – image gallery, getbutterfly imagepress +1 moreImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- guru team bot for telegram on woocommerceBot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass8.8 High
- notfound bridge coreBridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import5.4 Medium
- scottpaterson easy paypal gift certificateEasy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options6.1 Medium
- zendeskZendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing,...7.5 High
- zefr0x foxmarksInsecure Temporary File in `foxmarks`2.4 Low
- creativemindssolutions cm tooltip glossaryWordPress CM Tooltip Glossary plugin <= 4.3.9 - Stored Cross-Site Scripting vulnerability6.5 Medium
- tainacanWordPress Tainacan plugin <= 0.21.8 - SQL Injection vulnerability8.5 High
- google looker, cloud looker +1 moreHTTP Request Smuggling in Looker8.9 High
- baptiste.gourdin talkbackWordPress Talkback plugin <= 1.0 - PHP Object Injection vulnerability9.8 Critical
- ninja team multi step for contact form, ninjateam multi step for contact form 7 +1 moreWordPress Multi Step for Contact Form plugin <= 2.7.7 - Unauthenticated SQL Injection vulnerability9.3 Critical
- revmakx backup and staging by wp time capsuleWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - SQL Injection vulnerability8.5 High
- quomodosoft elementsready, elementsready addons for elementor +1 moreWordPress ElementsReady Addons for Elementor plugin <= 6.4.2 - Open Redirection vulnerability4.7 Medium
- github enterprise serverAn information disclosure vulnerability was identified in GitHub Enterprise Server via attacker...5.7 Medium
- apple tv, itunes, itunes for windows +2 moreA stack buffer overflow was addressed through improved input validation. This issue is fixed in...5.5 Medium
- codeclysm extractExtract has insufficient checks allowing attacker to create symlinks outside the extraction directory.6.9 Medium
- juniper junos, junos os evolved, juniper networks junos os +1 more +3 moreJunos OS and Junos OS Evolved: BGP update message containing aggregator attribute with an ASN value of zero (0) is accepted6.9 Medium
- lollms, parisneo parisneo/lollms +1 morePath Traversal in api open_personality_folder in parisneo/lollms-webui4.4 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: A large amount of traffic being processed by ATP Cloud can lead to a PFE crash8.2 High
- juniper junos os evolvedJunos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #37.1 High
- juniper junos os evolvedJunos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #27.1 High
- juniper junos os evolvedJunos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #17.1 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crash8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX4600 and SRX5000 Series: Sequence of specific PIM packets causes a flowd crash7.1 High
- juniper junos os evolved, junos evolved +1 moreJunos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C: In a VPLS or Junos Fusion scenario specific show commands cause FPCs to crash6.8 Medium
- juniper junos, junos os evolved, juniper networks junos os +1 more +3 moreJunos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crash8.7 High
- juniper junos os evolvedJunos OS Evolved: QFX5000 Series: Configured MAC learning and move limits are not in effect7.1 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series, QFX Series, MX Series and EX Series: Receiving specific HTTPS traffic causes resource exhaustion8.7 High
- Show moreLoading…