CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- wordpress woocommerce order proposalWooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal7.2 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- botan project botanBotan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent...5.9 Medium
- botan project botanBotan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent...5.9 Medium
- rockoa xinhuRockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.4.3 Medium
- realtek sd card reader driverA lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the...6.5 Medium
- realtek sd card reader driverA lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the...8.8 High
- iconics genesis64, mitsubishi electric corporation genesis32, iconics suite +1 more +3 moreInformation Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS327.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to...8.8 High
- google chromeInappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a...8.1 High
- kieback&peter ddc4002, ddc4002e, ddc4020e +17 more +19 moreKieback&Peter DDC4000 Series Use of Weak Credentials9.3 Critical
- kieback&peter ddc4002, ddc4002e, ddc4020e +17 more +19 moreKieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials8.6 High
- kieback & peter ddc4040e, kieback&peter ddc4002, ddc4002e +17 more +19 moreKieback&Peter DDC4000 Series Path Traversal9.3 Critical
- cursorRCE via Prompt Injection Into Cursor's Terminal Cmd-K9.2 Critical
- trend micro, inc. micro cloud edge, trendmicro cloud edge +1 moreAn command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to...9.8 Critical
- trend micro, inc. micro deep security agent, trend micro inc deep security agent +1 moreAn improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a...7.8 High
- trend micro, inc. micro deep discovery inspector, trendmicro deep discovery inspector +1 moreA vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow...6.5 Medium
- trend micro, inc. micro deep discovery inspector, trendmicro deep discovery inspector +1 moreA vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow...4.9 Medium
- trend micro, inc. micro antivirus one, trend micro inc antivirus one +1 moreTrend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an...8.4 High
- trend micro, inc. micro antivirus one, trend micro inc antivirus one +1 moreTrend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary...7.8 High
- trendmicro vpn, trend micro, inc. micro vpn (consumer), trend micro inc vpn consumer +2 moreTrend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreAn modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to...7.5 High
mermaidnpmPrototype pollution vulnerability found in Mermaid's bundled version of DOMPurify7.0 Highcurl-cffiPyPIcurl_cffi bundles a version of libcurl affected by High Severity vulnerabilityNo score- emlog proArbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege Escalation5.2 Medium
- zend serverFormat String Injection in Zend Server9.3 Critical
- python, python software foundation cpython +1 moreVirtual environment (venv) activation scripts don't quote paths5.3 Medium
- nofusscomputing centurion erpCenturion ERP user can view projects from organizations they're not apart of4.1 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Has Incomplete Server Termination During Explicit Sign-Out4.2 Medium
- umbraco umbraco-cms, cms +1 morePotential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice4.6 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS logout page displayed before session expiration4.2 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API0.0 None
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section4.2 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions9.3 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor8.8 High
- ibm concertIBM Concert improper certificate validation5.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor8.8 High
- ibm concertIBM Concert information disclosure3.7 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console9.6 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget8.8 High
- red hat openshift container platform 4.16, openshift container platform 4.17, openshift container platform 4.18 +1 more +3 moreGraphql: information disclosure via graphql introspection in openshift5.3 Medium
- red hat openshift container platform 4.18, redhat openshift container platform +1 moreGraphql: denial of service (dos) vulnerability via graphql batching6.5 Medium
- red hat build of keycloak, fuse 7, jboss data grid 7 +14 more +16 moreWildfly: wildfly vulnerable to cross-site scripting (xss)6.1 Medium
- red hat enterprise linux 10, enterprise linux 7 extended lifecycle support, enterprise linux 7.7 advanced update support +13 more +15 moreNetworkmanager-libreswan: local privilege escalation via leftupdown7.8 High
- jeswd anchor episodes index (spotify for podcasters), jesweb anchor episodes index +1 moreAnchor Episodes Index (Spotify for Podcasters) <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode6.4 Medium
- butlerblog wp-members, cbutlerjr wp-members membership plugin +1 moreWP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scripting6.1 Medium
- pandora fms fms, pandorafms pandora fms +1 morePost-auth Arbitrary File Read in the Server Plugins Section8.3 High
- pandora fms fms, pandorafms pandora fms +1 moreSQL Injection in CSV Module Data Collection8.6 High
- linux, linux kernel +1 morenfc: nci: fix possible NULL pointer dereference in send_acknowledge()5.5 Medium
- Show moreLoading…