CVEs published October 15, 2024
188 CVEs were published on October 15, 2024: 20 critical, 72 high.
- Published
- 188
- Critical
- 20
- High
- 72
- Medium
- 76
- Low
- 20
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- Oracle MySQL Server
- 21
- Google Chrome
- 13
- Acronis Cyber Protect
- 5
- Oracle VM VirtualBox
- 5
- Oracle WebLogic Server
- 5
- MB connect line mbNET.mini · Helmholz REX100
- 4
- Oracle Java SE
- 4
- Oracle MySQL Cluster · Oracle MySQL Server
- 4
- Oracle Banking Liquidity Management
- 3
- Oracle Database Server
- 3
Critical 20
- CVE-2024-10004Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in tMozilla Firefox for iOS
- CVE-2024-9486VM images built with Image Builder and Proxmox provider use default credentialsKubernetes Image Builder · github.com/kubernetes-sigs/image…
- CVE-2024-21216Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2024-21172Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet).Oracle Hospitality OPERA
- CVE-2024-48914Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyvendure-ecommerce vendure · @vendure/asset-server-plugin
- CVE-2024-45275MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwordsMB connect line mbNET.mini · Helmholz REX100
- CVE-2024-45274MB connect line/Helmholz: Remote code execution via confnet serviceMB connect line mbNET.mini · Helmholz REX100
- CVE-2024-47945Predictable Session IDRITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit
- CVE-2024-47943Improper signature verification of firmware upgrade filesRITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit
- CVE-2024-9925SQL injection in QPLANT by TAI Smart FactoryTAI Smart Factory QPLANT SF
- CVE-2024-9985Ragic Enterprise Cloud Database - Arbitrary File UploadRagic Enterprise Cloud Database
- CVE-2024-9984Ragic Enterprise Cloud Database - Missing AuthenticationRagic Enterprise Cloud Database
- CVE-2024-9982ESi Technology AIM LINE Marketing Platform - SQL InjectionESi Technology AIM LINE Marketing Platform
- CVE-2024-9972ChanGate Property Management System - SQL InjectionChanGate Property Management System
- CVE-2024-48283Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-result.php via the sear
- CVE-2024-48411itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email pa
- CVE-2024-48779An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformp
- CVE-2024-48781An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a speciall
- CVE-2024-48782File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application only
- CVE-2024-49195Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair
High 72
- CVE-2024-38190Power Platform Information Disclosure VulnerabilityMicrosoft Power Platform
- CVE-2024-38204Imagine Cup site Information Disclosure VulnerabilityMicrosoft Azure Functions
- CVE-2024-38139Microsoft Dataverse Elevation of Privilege VulnerabilityMicrosoft Dataverse
- CVE-2024-9965Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2024-9961Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in Google Chrome
- CVE-2024-9960Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2024-9959Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2024-9957Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI Google Chrome
- CVE-2024-9956Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform priGoogle Chrome
- CVE-2024-9955Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2024-9954Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-21285Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports).Oracle Banking Liquidity Management
- CVE-2024-21284Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports).Oracle Banking Liquidity Management
- CVE-2024-21283Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core).Oracle PeopleSoft Enterprise HCM Global Payroll Core
- CVE-2024-21282Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components).Oracle Financials
- CVE-2024-21280Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring).Oracle Service Contracts
- CVE-2024-21279Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions).Oracle Sourcing
- CVE-2024-21278Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes).Oracle Contract Lifecycle Management for Public Sector
- CVE-2024-21277Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration).Oracle MES for Process Manufacturing
- CVE-2024-21276Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages).Oracle Work in Process
- CVE-2024-21275Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface).Oracle Quoting
- CVE-2024-21274Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).Oracle WebLogic Server
- CVE-2024-21272Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).Oracle MySQL Connectors · mysql-connector-python
- CVE-2024-21271Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal).Oracle Field Service
- CVE-2024-21270Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks).Oracle Common Applications Calendar
- CVE-2024-21269Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan).Oracle Incentive Compensation
- CVE-2024-21268Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).Oracle Applications Manager
- CVE-2024-21267Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).Oracle Cost Management
- CVE-2024-21266Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List).Oracle Advanced Pricing
- CVE-2024-21265Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows).Oracle Site Hub
- CVE-2024-21260Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2024-21259Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2024-21255Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2024-21254Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).Oracle BI Publisher
- CVE-2024-21252Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).Oracle Product Hub
- CVE-2024-21250Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager SpecifiOracle Process Manufacturing Product Development
- CVE-2024-21246Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality).Oracle Service Bus
- CVE-2024-21234Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2024-21215Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).Oracle WebLogic Server
- CVE-2024-21214Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2024-21195Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates).Oracle BI Publisher
- CVE-2024-21191Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control Plugin)Oracle Enterprise Manager Fusion Middleware Control
- CVE-2024-21190Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning).Oracle Global Lifecycle Management FMW Installer
- CVE-2024-5749Certain HP DesignJet products – Credential reflectionCertain HP DesignJet products
- CVE-2024-48915Agent Dart missing certificate verification checksAstroxNetwork agent_dart
- CVE-2024-47876Sakai: Kernel users created with type roleview can login as a normal usersakaiproject sakai · org.sakaiproject.kernel:sakai-kernel-i…
- CVE-2024-47874Starlette Denial of service (DoS) via multipart/form-dataencode starlette · starlette
- CVE-2024-47824Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a roommatrix-org matrix-react-sdk · matrix-react-sdk
- CVE-2024-47779Element Web vulnerable to potential exposure of access token via authenticated mediaelement-hq element-web
- CVE-2024-47771Element Desktop vulnerable to potential exposure of access token via authenticated mediaelement-hq element-desktop
- CVE-2024-47080matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeservermatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2024-47674mm: avoid leaving partial pfn mappings around in error caseLinux
- CVE-2024-45276MB connect line/Helmholz: tmp directory exposed via webserviceMB connect line mbNET.mini · Helmholz REX100
- CVE-2024-45273MB connect line/Helmholz: Weak encryption of configuration fileMB connect line mbNET.mini · MB connect line mbNET/mbNET… +9
- CVE-2024-45272MB connect line/Helmholz: Generation of weak passwords vulnerabilityMB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2
- CVE-2024-45271MB connect line/Helmholz: Remote code execution due to improper input validationMB connect line mbNET.mini · Helmholz REX100
- CVE-2024-9983Ragic Enterprise Cloud Database - Arbitrary File Read through Path TraversalRagic Enterprise Cloud Database
- CVE-2024-9981FormosaSoft ee-class - Local File InclusionFormosaSoft ee-class
- CVE-2024-9980FormosaSoft ee-class - SQL InjectionFormosaSoft ee-class
- CVE-2024-9837AADMY – Add Auto Date Month Year Into Posts <= 2.0.1 - Unauthenticated Arbitrary Shortcode Executionnumanrki AADMY – Add Auto Date Month Year Into Posts
- CVE-2024-46898SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability.SHIRASAGI Project SHIRASAGI
- CVE-2024-9971NewType FlowMaster BPM Plus - SQL InjectionNewType FlowMaster BPM Plus
- CVE-2024-9970NewType FlowMaster BPM Plus - Privilege EscalationNewType FlowMaster BPM Plus
- CVE-2024-9968NewType WebEIP v3.0 - SQL injectionNewType WebEIP
- CVE-2024-9687WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypassdueclic AuthPress
- CVE-2024-35584SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis
- CVE-2024-41311In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lea
- CVE-2024-41344A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate pri
- CVE-2024-44775kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception.
- CVE-2024-48279A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2.
- CVE-2024-48280A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which
- CVE-2024-48282A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, wh
Medium, low and unrated 96
- CVE-2024-49340IBM Watson Studio Local cross-site request forgeryIBM Watson Studio Local
- CVE-2024-45085IBM WebSphere Application Server denial of serviceIBM WebSphere Application Server
- CVE-2024-9594VM images built with Image Builder with some providers use default credentials during buildsKubernetes Image Builder · github.com/kubernetes-sigs/image…
- CVE-2024-9966Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security polGoogle Chrome
- CVE-2024-9964Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2024-9963Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage iGoogle Chrome
- CVE-2024-9962Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engageGoogle Chrome
- CVE-2024-9958Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing viGoogle Chrome
- CVE-2024-21286Vulnerability in the PeopleSoft Enterprise ELM Enterprise Learning Management product of Oracle PeopleSoft (component: Enterprise Learning MOracle PeopleSoft Enterprise ELM Enterprise Learning Manage…
- CVE-2024-21281Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure).Oracle Banking Liquidity Management
- CVE-2024-21273Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2024-21264Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Activity Guide Composer).Oracle PeopleSoft Enterprise CC Common Application Objects
- CVE-2024-21263Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2024-21262Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).Oracle MySQL Connectors
- CVE-2024-21261Vulnerability in Oracle Application Express (component: General).Oracle Application Express
- CVE-2024-21258Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface).Oracle Installed Base
- CVE-2024-21257Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization).Oracle Hyperion BI+
- CVE-2024-21253Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2024-21251Vulnerability in the Java VM component of Oracle Database Server.Oracle Database Server
- CVE-2024-21249Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses).Oracle PeopleSoft Enterprise FIN Expenses
- CVE-2024-21248Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).Oracle VM VirtualBox
- CVE-2024-21247Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump).Oracle MySQL Cluster · Oracle MySQL Client
- CVE-2024-21244Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry).Oracle MySQL Server
- CVE-2024-21243Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry).Oracle MySQL Server
- CVE-2024-21242Vulnerability in the XML Database component of Oracle Database Server.Oracle Database Server
- CVE-2024-21241Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-21239Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2024-21238Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2024-21237Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS).Oracle MySQL Server
- CVE-2024-21236Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2024-21235Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotOracle Java SE
- CVE-2024-21233Vulnerability in the Oracle Database Core component of Oracle Database Server.Oracle Database Server
- CVE-2024-21232Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).Oracle MySQL Server
- CVE-2024-21231Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs).Oracle MySQL Server
- CVE-2024-21230Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2024-21219Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Oracle MySQL Server
- CVE-2024-21218Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2024-21217Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SerialiOracle Java SE
- CVE-2024-21213Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2024-21212Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor).Oracle MySQL Server
- CVE-2024-21211Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CompileOracle GraalVM · Oracle Java SE
- CVE-2024-21210Vulnerability in Oracle Java SE (component: Hotspot).Oracle Java SE
- CVE-2024-21209Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump).Oracle MySQL Client
- CVE-2024-21208Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: NetworkOracle Java SE
- CVE-2024-21207Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2024-21206Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics).Oracle Enterprise Command Center Framework
- CVE-2024-21205Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality).Oracle Service Bus
- CVE-2024-21204Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).Oracle MySQL Server
- CVE-2024-21203Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS).Oracle MySQL Cluster · Oracle MySQL Server
- CVE-2024-21202Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).Oracle PeopleSoft Enterprise PeopleTools
- CVE-2024-21201Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-21200Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-21199Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2024-21198Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2024-21197Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema).Oracle MySQL Server
- CVE-2024-21196Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin).Oracle MySQL Server
- CVE-2024-21194Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).Oracle MySQL Server
- CVE-2024-21193Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS).Oracle MySQL Server
- CVE-2024-21192Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt).Oracle Enterprise Manager for Fusion Middleware
- CVE-2024-48913Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.honojs hono · hono
- CVE-2024-9506Regular Expression Denial of Service (ReDoS)vue
- CVE-2024-9676Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)containers/storage · Red Hat Enterprise Linux +3
- CVE-2024-9979Pyo3: risk of use-after-free in `borrowed` reads from python weak referencespyo3 · Red Hat Ansible Automation Platform +1
- CVE-2024-9986code-projects Blood Bank Management System member_register.php sql injectioncode-projects Blood Bank Management System
- CVE-2024-9977MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injectionMitraStar GPT-2541GNAC
- CVE-2024-9976code-projects Pharmacy Management System manage_customer.php sql injectioncode-projects Pharmacy Management System
- CVE-2024-9975SourceCodester Drag and Drop Image Upload upload.php unrestricted uploadSourceCodester Drag and Drop Image Upload
- CVE-2024-49388Sensitive information manipulation due to improper authorization.Acronis Cyber Protect
- CVE-2024-49387Cleartext transmission of sensitive information in acep-collector service.Acronis Cyber Protect
- CVE-2024-49384Excessive attack surface in acep-collector service due to binding to an unrestricted IP address.Acronis Cyber Protect
- CVE-2024-49383Excessive attack surface in acep-importer service due to binding to an unrestricted IP address.Acronis Cyber Protect
- CVE-2024-49382Excessive attack surface in archive-server service due to binding to an unrestricted IP address.Acronis Cyber Protect
- CVE-2024-9974SourceCodester Online Eyewear Shop POST Request Master.php sql injectionSourceCodester Online Eyewear Shop
- CVE-2024-9973SourceCodester Online Eyewear Shop Report Viewing Page page sql injectionSourceCodester Online Eyewear Shop
- CVE-2024-47944Missing Protection Mechanism for Alternate Hardware InterfaceRITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit
- CVE-2024-9895Smart Online Order for Clover <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcodeelbanyaoui Smart Online Order for Clover
- CVE-2024-0129NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extractioNVIDIA NeMo
- CVE-2024-9944WooCommerce <= 9.0.2 - Unauthenticated HTML Injectionautomattic WooCommerce
- CVE-2024-21535Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper inputmarkdown-to-jsx
- CVE-2024-9969NewType WebEIP v3.0 - Reflected XSSNewType WebEIP
- CVE-2024-9820WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypassdueclic AuthPress
- CVE-2024-6757Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Functionelemntor Elementor Website Builder – more than just a page…
- CVE-2024-9952SourceCodester Online Eyewear Shop Contact Information Page contact_info cross site scriptingSourceCodester Online Eyewear Shop
- CVE-2023-31493RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while exe
- CVE-2024-31955An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware.
- CVE-2024-44337The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML.github.com/gomarkdown/markdown
- CVE-2024-48278Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) via /edit-profile.php
- CVE-2024-48622A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit
- CVE-2024-48623In queue\index.php of DomainMOD below v4.12.0, the list_id and domain_id parameters in the GET request can be exploited to cause a reflected
- CVE-2024-48624In segments\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scr
- CVE-2024-48710In TP-Link TL-WDR7660 1.0, the wlanTimerRuleJsonToBin function handles the parameter string name without checking it, which can lead to stac
- CVE-2024-48712In TP-Link TL-WDR7660 1.0, the rtRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overf
- CVE-2024-48713In TP-Link TL-WDR7660 1.0, the wacWhitelistJsonToBin function handles the parameter string name without checking it, which can lead to stack
- CVE-2024-48714In TP-Link TL-WDR7660 v1.0, the guestRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack o
- CVE-2024-48783An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component
- CVE-2024-48948The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at elliptic