CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- struktur libheif, debian linux +1 moreIn Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing...8.1 High
- opensisSQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions...8.8 High
- No product listedAn issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass...4.9 Medium
- zoneminderRCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while executing a crafted payload and escalate privileges allowing ex…6.6 Medium
- veronalabs slimstat analyticsSlimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting7.2 High
- xplodedthemes wpide, wpide – file manager & code editor, wpide - file manager \& code editor +2 moreWPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure5.3 Medium
- hcl software bigfix platformHCL BigFix Platform is affected by a DLL Hijack vulnerability2.5 Low
- cert vince, cert/cc vince - vulnerability information and coordination environment +1 morePotential DoS Vulnerability in CERT VINCE Software Before Version 3.0.84.9 Medium
- rockwell automation compact guardlogix 5380 sil 2, compact guardlogix 5380 sil 3, compactlogix 5380 +15 more +17 moreCVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory...8.7 High
- thinkst opencanaryOpenCanary Executes Commands From Potentially Writable Config File5.8 Medium
github.com/landlock-lsm/go-landlockGoGo-Landlock in best-effort mode did not restrict TCP bind and connect operations correctlyNo score- authzed spicedbSpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not2.0 Low
- astroastro's client-side router has DOM Clobbering Gadget that leads to XSS5.9 Medium
- vercel next.jsNext.js image optimization has Denial of Service condition5.9 Medium
- elabftweLabFTW vulnerable to HTML Injection in extended search error message3.5 Low
- enalean tuleap, tuleap enterprise +1 moreTuleap lists trackers in the quick add actions of the backlog without any permissions check4.3 Medium
- enalean tuleapPermissions are incorrectly verified for project administrators in the cross tracker search widget4.9 Medium
- enalean tuleap, tuleap enterprise +1 moreTuleap does not properly check permissions for email notifications in trackers4.8 Medium
- enalean tuleapTuleap vulnerable to XSS in the HTML mail content of the cross reference field4.8 Medium
- splunk, splunk enterprise +1 moreSensitive information disclosure in AdminManager logging channel4.9 Medium
- splunk, splunk enterprise +1 moreSensitive information disclosure in REST_Calls logging channel4.9 Medium
- splunk, splunk cloud platform, enterprise +2 moreMaintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)4.3 Medium
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows8.8 High
- splunk, splunk cloud platform, enterprise +2 moreLow-privileged user could run search as nobody in SplunkDeploymentServerConfig app7.1 High
- splunk, splunk cloud platform, enterprise +2 moreImproperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon6.5 Medium
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise5.4 Medium
- splunk, splunk enterprise +1 moreLow Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard4.3 Medium
- splunk, splunk cloud platform, enterprise +2 morePersistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise5.4 Medium
- splunk, splunk enterprise +1 morePotential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk8.0 High
- splunk, splunk enterprise, secure gateway +1 more +3 moreImproper Access Control for low-privileged user in Splunk Secure Gateway App4.3 Medium
- apache artemis, apache software foundation activemq artemis +1 moreApache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans8.8 High
- eclipse jettyJetty URI parsing of invalid authority3.7 Low
- rockwell automation rslogix 500®, rslogix™ 5, rockwellautomation rslogix 5 +5 more +7 moreRSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script8.8 High
- mozilla firefoxWhen manipulating the selection node cache, an attacker may have been able to cause unexpected...6.5 Medium
- schweizerische steuerkonferenz library taxstatement.jarXML Eternal Entity Attack in the Software Library taxstatement.jar6.3 Medium
- moxa edf-g1002-bp series, edf-g1002-bp firmware, edr-8010 series +13 more +15 moreOS Command Injection in Restricted Command8.6 High
- imagination technologies graphics ddkGPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices7.8 High
- apache rollerApache Roller: Weakness in CSRF protection allows privilege escalation4.7 Medium
- moxa edf-g1002-bp, edf-g1002-bp series, edr-8010 +64 more +66 moreMoxa Service Missing Authentication for Critical Function8.8 High
- checkmkCSRF token leaked in URL parameters2.0 Low
- checkmkSNMP and IMPI secrets written to audit log5.1 Medium
- hgiga oakloudsHgiga OAKlouds - Arbitrary File Read And Delete9.8 Critical
- teamplus technology team+, teamplus team\+ pro +1 moreTEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path Traversal4.9 Medium
- teamplus technology team+, teamplus team\+, team\+ pro +2 moreTEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal7.5 High
- teamplus technology team+, teamplus team\+, team\+ pro +2 moreTEAMPLUS TECHNOLOGY Team+ - SQL Injection9.8 Critical
assimpOSS-FuzzUNKNOWN READ in Assimp::NDOImporter::InternReadFileNo scorepocoOSS-FuzzUNKNOWN READ in Poco::UTF16Encoding::queryConvertNo score- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved checks. This issue is fixed in Safari 26.1, visionOS 26.1,...8.1 High
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved memory handling. This issue is fixed in watchOS 11.2,...9.8 Critical
haproxyAzure LinuxQUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening...5.3 Medium- Show moreLoading…