CVEs published in October 2024
3,640 vulnerabilities, 364 critical, 17 exploited.
- formfacade, manidoraisamy formfacade – embed google forms in your website +1 moreFormFacade – WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting6.1 Medium
- miyabe priprePriPre <= 0.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- roxnor elementskit elementor addons – advanced widgets & templates addons for elementor, wpmet elements kit elementor addons +1 moreElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget6.4 Medium
- hocwp extensions, skylarkcob extensions by hocwp team +1 moreExtensions by HocWP Team <= 0.2.3.2 - Authentication Bypass9.8 Critical
- jurre de klijn wux blog editorWux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload9.8 Critical
- ays-pro poll maker – versus polls, anonymous polls, image polls, poll maker +1 morePoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings5.5 Medium
- zemanta editorial assistant by sovrnEditorial Assistant by Sovrn <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image4.3 Medium
- ays-pro poll maker – versus polls, anonymous polls, image polls, poll maker +1 morePoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by Parameter4.9 Medium
- watchtowerhq watchtower, watchtowerhq +1 moreWatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check9.8 Critical
- deryck user toolkitUser Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass8.8 High
- jurre de klijn wux blog editorWux Blog Editor <= 3.0.0 - Authentication Bypass to Administrator9.8 Critical
- pyloadpyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API9.1 Critical
github.com/crossplane/crossplaneGogithub.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses9.8 Critical- pallets werkzeug, quart +1 moreWerkzeug possible resource exhaustion when parsing file data in forms6.9 Medium
github.com/rancher/rke2GoRKE2 allows privilege escalation in Windows nodes due to Insecure Access Control Lists9.1 Critical- suse rancherRancher Remote Code Execution via Cluster/Node Drivers9.1 Critical
- suse rancherExposure of vSphere's CPI and CSI credentials in Rancher8.5 High
- pallets werkzeugWerkzeug safe_join not safe on Windows6.3 Medium
- webcraftplugins image map pro, imagemappro image map pro – drag-and-drop builder for interactive images +1 moreImage Map Pro <= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webcraftplugins image map pro, imagemappro image map pro – drag-and-drop builder for interactive images +1 moreImage Map Pro <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete5.4 Medium
- rockwell automation factorytalk thinmanager, rockwellautomation thinmanager +1 moreRockwell Automation FactoryTalk ThinManager Denial-of-Service Vulnerability8.7 High
- rockwell automation factorytalk thinmanager, rockwellautomation thinmanager +1 moreRockwell Automation FactoryTalk ThinManager Authentication Vulnerability9.3 Critical
- abb 620 series iec/cn, arg600/arp600 dual sim, arg600/arp600/arr600/arc600 single sim +28 more +30 moreUnauthorized Modifications of Firmware and Configuration4.6 Medium
- zitadelZitadel User Registration Bypass Vulnerability7.5 High
- zitadelDenied Host Validation Bypass in Zitadel Actions5.9 Medium
- plenti, plenti plentico +1 morePlenti arbitrary file deletion vulnerability7.7 High
- plenti, plenti plentico +1 morePlenti arbitrary file write vulnerability8.9 High
- mayurik petrol pump management, sourcecodester petrol pump management software +1 moreSourceCodester Petrol Pump Management Software ajax_product.php sql injection5.3 Medium
- zimocode smartupsmartUp Cross-site Scripting vulnerability5.8 Medium
- autolabAutolab Has Misconfigured Reset Password Permissions7.1 High
- matrix comsec door controller cosec vega faxq, door controller cosec vega faxq firmware, matrixcomsec cosec vega faxq firmware +2 moreAuthentication Bypass Vulnerability in Matrix Door Controller9.3 Critical
- philips lighting (signify innovations india) smart bulb 9,10,12-watt, smart t-bulb 10,12-watt, smart wi-fi led batten 24-watt +8 more +10 moreCleartext Storage of Sensitive Information Vulnerability in Philips Lighting Devices7.0 High
- esafenet cdgESAFENET CDG DecryptApplicationService.java actionViewDecyptFile path traversal5.3 Medium
- esafenet cdgESAFENET CDG CDGRenewApplicationService.java actionViewCDGRenewFile sql injection5.3 Medium
- butlerblog wp-members, cbutlerjr wp-members membership plugin +1 moreWP-Members <= 3.4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode6.4 Medium
- esafenet cdgESAFENET CDG DecryptApplicationService.java actionPassDecryptApplication1 sql injection5.3 Medium
- esafenet cdgESAFENET CDG AutoSignService.java actionPassOrNotAutoSign sql injection5.3 Medium
- dell data lakehouseDell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of...2.9 Low
- dell data lakehouseDell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control...6.5 Medium
- svnlabs shoutcast icecast html5 radio playerShoutcast Icecast HTML5 Radio Player <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mortenpeterandersen simple newsSimple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode6.4 Medium
- beekyoshida beek widget extentionBeek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- jaredatch file upload types by wpformsFile Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- neumann n-lineN-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is...7.4 High
- neumann musasiMUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability...7.5 High
- 10web wps telegram chatWPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure5.4 Medium
- 10web wps telegram chatWPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API6.3 Medium
- ampforwp accelerated mobile pages, magazine3 amp for wp, mohammed kaludi amp for wp – accelerated mobile pages +2 moreAMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation8.8 High
- bamazoo – button generator, button generator +1 moreBamazoo – Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode6.4 Medium
- tezzeract league of legends shortcodesLeague of Legends Shortcodes <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- Show moreLoading…