CVEs published October 28, 2024
193 CVEs were published on October 28, 2024: 19 critical, 53 high.
- Published
- 193
- Critical
- 19
- High
- 53
- Medium
- 106
- Low
- 15
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 103
Most affected products
- Apple macOS
- 36
- Apple iOS and iPadOS · Apple macOS +3
- 10
- JetBrains YouTrack
- 9
- Apple iOS and iPadOS
- 8
- Apple iOS and iPadOS · Apple macOS
- 4
- Apple iOS and iPadOS · Apple macOS +2
- 4
- Apple Safari · Apple iOS and iPadOS +2
- 3
- Sunnet eHRD CTMS
- 3
- Apple iOS and iPadOS · Apple macOS +1
- 2
- Apple iOS and iPadOS · Apple tvOS +1
- 2
Critical 19
- CVE-2024-44217A permissions issue was addressed by removing vulnerable code and adding additional checks.Apple iOS and iPadOS
- CVE-2024-44256The issue was addressed with improved input sanitization.Apple macOS
- CVE-2024-50495WordPress Plugin Propagator plugin <= 0.1 - Arbitrary File Upload vulnerabilitynunomorgadinho Plugin Propagator
- CVE-2024-50496WordPress AR For WordPress plugin <= 6.6 - Arbitrary File Upload vulnerabilitywebandprint AR For WordPress
- CVE-2024-50479WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerabilitychenyenming Woocommerce Quote Calculator
- CVE-2024-50491WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerabilityMicahBlu RSVP ME
- CVE-2024-50478WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerabilitySwoop 1-Click Login: Passwordless Authentication
- CVE-2024-50483WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerabilityTareq Hasan Meetup
- CVE-2024-50498WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerabilityAjit Bohra WP Query Console
- CVE-2024-50477WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerabilityStacks Mobile App Builder
- CVE-2024-50486WordPress Acnoo Flutter API plugin <= 1.0.5 - Account Takeover vulnerabilityAcnoo Flutter API
- CVE-2024-50487WordPress MaanStore API plugin <= 1.0.1 - Account Takeover vulnerabilityAcnoo MaanStore API
- CVE-2024-50489WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerabilityrealtyworkstation Realty Workstation
- CVE-2024-38821Authorization Bypass of Static Resources in WebFlux ApplicationsSpring · org.springframework.security:spring-security-web
- CVE-2024-10440Sunnet eHRD CTMS - SQL InjectionSunnet eHRD CTMS
- CVE-2024-39205An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP requestpyload-ng
- CVE-2024-48356LyLme Spage <=1.6.0 is vulnerable to SQL Injection via /admin/group.php.
- CVE-2024-48357LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php.
- CVE-2024-48465The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter
High 53
- CVE-2024-44295This issue was addressed with additional entitlement checks.Apple macOS
- CVE-2024-44277The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-44285A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44196A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44159A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.Apple macOS
- CVE-2024-44270A logic issue was addressed with improved validation.Apple macOS
- CVE-2024-44289A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-44122A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-44175This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2024-44252A logic issue was addressed with improved file handling.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2024-44213An issue existed in the parsing of URLs.Apple macOS
- CVE-2024-44264This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2024-44265The issue was addressed by restricting options offered on a locked device.Apple macOS
- CVE-2024-44208This issue was addressed through improved state management.Apple macOS
- CVE-2024-44228This issue was addressed with improved permissions checking.Apple Xcode
- CVE-2024-44156A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.Apple macOS
- CVE-2024-44258This issue was addressed with improved handling of symlinks.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2024-44126The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-44280A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.Apple macOS
- CVE-2024-44255A path handling issue was addressed with improved logic.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44218This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-40867A custom URL scheme handling issue was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2024-44259This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-50434WordPress NewsCard theme <= 1.3 - Local File Inclusion vulnerabilitythemehorse NewsCard
- CVE-2024-50435WordPress Meta News theme <= 1.1.7 - Local File Inclusion vulnerabilitythemehorse Meta News
- CVE-2024-50436WordPress Clean Retina theme <= 3.0.6 - Local File Inclusion vulnerabilitythemehorse Clean Retina
- CVE-2024-50453WordPress The Pack Elementor addons plugin <= 2.0.9 - Local File Inclusion vulnerabilitywebangon The Pack Elementor addons
- CVE-2024-50457WordPress Qode Essential Addons plugin <= 1.6.3 - Local File Inclusion vulnerabilityQode Essential Addons
- CVE-2024-50438WordPress Church Admin plugin < 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityandy_moyle Church Admin
- CVE-2024-50448WordPress YITH WooCommerce Product Add-Ons plugin <= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
- CVE-2024-6245Default Credentials in ssh service for SmartPlay in Maruti SuzukiFaurecia Clarion Electronics Co. SmartPlay
- CVE-2024-42028A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and eaUbiquiti UniFi Network Application
- CVE-2024-45802Squid Denial of Servicesquid-cache squid
- CVE-2024-10455Reachable Assertion in µD3TNµD3TN · pyd3tn
- CVE-2024-50465WordPress Premium SEO Pack plugin <= 1.6.001 - SQL Injection vulnerabilityWP SEO – Calin Vingan Premium SEO Pack
- CVE-2024-50497WordPress Advanced Online Ordering and Delivery Platform plugin <= 2.0.0 - Local File Inclusion vulnerabilitywdesco Advanced Online Ordering and Delivery Platform
- CVE-2024-50488WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerabilityyespbs Token Login
- CVE-2024-50408WordPress Namaste! LMS plugin <= 2.6.3 - PHP Object Injection vulnerabilityBob Namaste! LMS
- CVE-2024-50416WordPress WPC Shop as a Customer for WooCommerce plugin <= 1.2.6 - PHP Object Injection vulnerabilityWPClever WPC Shop as a Customer for WooCommerce
- CVE-2024-50450WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerabilityRealMag777 MDTF
- CVE-2024-50492WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerabilityScott Paterson ScottCart
- CVE-2024-9162All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injectionservmask All-in-One WP Migration and Backup
- CVE-2024-10438Sunnet eHRD CTMS - Authentication BypassSunnet eHRD CTMS
- CVE-2024-50067uprobe: avoid out-of-bounds memory access of fetching argsLinux
- CVE-2024-10434Tenda AC1206 ate ate_Tenda_mfg_check_usb3 stack-based overflowTenda AC1206
- CVE-2024-42011The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat.
- CVE-2024-48074An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into t
- CVE-2024-48177MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.
- CVE-2024-48178newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter.
- CVE-2024-48196An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter.
- CVE-2024-48594File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component
- CVE-2024-48825Tenda AC7 v.15.03.06.44 ate_ifconfig_set has pre-authentication command injection allowing remote attackers to execute arbitrary code.
- CVE-2024-48826Tenda AC7 v.15.03.06.44 ate_iwpriv_set has pre-authentication command injection allowing remote attackers to execute arbitrary code.
Medium, low and unrated 121
- CVE-2024-30106HCL Connections is vulnerable to an information disclosure vulnerabilityHCL Software Connections
- CVE-2024-44260This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2024-44237An out-of-bounds access issue was addressed with improved bounds checking.Apple macOS
- CVE-2024-44283An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2024-44145This issue was addressed through improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2024-44240The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44257This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2024-44216An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2024-40853This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2024-44144A buffer overflow was addressed with improved size validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44282An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44294A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges.Apple macOS
- CVE-2024-44236An out-of-bounds access issue was addressed with improved bounds checking.Apple macOS
- CVE-2024-44261This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2024-40792A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44155A custom URL scheme handling issue was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-44174The issue was addressed with improved checks.Apple macOS
- CVE-2024-44123A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2024-44267The issue was addressed with improved checks.Apple macOS
- CVE-2024-44197The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-44251This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2024-44247The issue was addressed with improved checks.Apple macOS
- CVE-2024-44302The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-40855The issue was addressed with improved checks.Apple macOS · Apple visionOS
- CVE-2024-44284An out-of-bounds write issue was addressed with improved input validation.Apple macOS
- CVE-2024-44194This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-44301The issue was addressed with improved checks.Apple macOS
- CVE-2024-44244A memory corruption issue was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-44287The issue was addressed with improved checks.Apple macOS
- CVE-2024-44229An information leakage was addressed with additional validation.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-44273This issue was addressed with improved handling of symlinks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44137The issue was addressed with improved checks.Apple macOS
- CVE-2024-44269A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-44253The issue was addressed with improved checks.Apple macOS
- CVE-2024-27849A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-44235The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2024-44262This issue was addressed with improved redaction of sensitive information.Apple visionOS
- CVE-2024-44274The issue was addressed with improved authentication.Apple iOS and iPadOS · Apple watchOS
- CVE-2024-44254This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-44203A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44215This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44239An information disclosure issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44281An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2024-44278An information disclosure issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-44297The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44279An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2024-44296The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-40851This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2024-44222This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2024-44275The issue was addressed with improved checks.Apple macOS
- CVE-2024-44263A logic issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2024-49755Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIsDuendeSoftware IdentityServer · Duende.IdentityServer
- CVE-2024-5532A stored XSS vulnerability has been discovered on OpenText™ Operations Agent (OA).OpenText™ Operations Agent
- CVE-2024-9825The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access tokenProgress Software Chef Habitat Builder
- CVE-2024-50429WordPress Magazine Blocks plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerabilityBlockArt Magazine Blocks
- CVE-2024-50431WordPress Breeze plugin <= 2.1.14 - Cross Site Scripting (XSS) vulnerabilityCloudways Breeze
- CVE-2024-50432WordPress Post Grid and Gutenberg Blocks plugin <= 2.2.93 - Cross Site Scripting (XSS) vulnerabilityPickPlugins Post Grid and Gutenberg Blocks
- CVE-2024-50433WordPress Sky Addons for Elementor plugin <= 2.5.15 - Cross Site Scripting (XSS) vulnerabilitywowDevs Sky Addons for Elementor
- CVE-2024-50437WordPress GeoDirectory plugin <= 2.3.80 - Cross Site Scripting (XSS) vulnerabilityPaolo GeoDirectory
- CVE-2024-50439WordPress Astra Widgets plugin <= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Astra Widgets
- CVE-2024-50440WordPress CodePen Embedded Pens Shortcode plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityChris Coyier CodePen Embedded Pens Shortcode
- CVE-2024-50441WordPress Cozy Blocks plugin <= 2.0.15 - Cross Site Scripting (XSS) vulnerabilityCozyThemes Cozy Blocks
- CVE-2024-50445WordPress Selection Lite plugin <= 1.13 - Cross Site Scripting (XSS) vulnerabilitymerkulove Selection Lite
- CVE-2024-50446WordPress Futurio Extra plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerabilityFuturioWP Futurio Extra
- CVE-2024-50447WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin <= 1.4.19 - Cross Site Scripting (XSS) vulnerabilityEnvoThemes Envo's Elementor Templates & Widgets for WooComm…
- CVE-2024-50449WordPress PDF Generator Addon for Elementor Page Builder plugin <= 1.7.4 - Cross Site Scripting (XSS) vulnerabilityRedefiningTheWeb PDF Generator Addon for Elementor Page Bui…
- CVE-2024-50451WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Cross Site Scripting (XSS) vulnerabilityRealMag777 MDTF
- CVE-2024-50458WordPress Advanced Sermons plugin <= 3.4 - Cross Site Scripting (XSS) vulnerabilityWP CodeUs Advanced Sermons
- CVE-2024-50460WordPress Firelight Lightbox plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerabilityFirelight Lightbox
- CVE-2024-50461WordPress EmbedPress plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper EmbedPress
- CVE-2024-50462WordPress Interactive World Map plugin <= 3.4.4 - Cross Site Scripting (XSS) vulnerabilityhtml5maps Interactive World Map
- CVE-2024-50464WordPress Kodex Posts likes plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityPierre Lebedel Kodex Posts likes
- CVE-2024-50467WordPress Scrollbar by webxapp plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitysiteengineai Scrollbar by webxapp – Best vertical/horizonta…
- CVE-2024-50468WordPress Raptor Editor plugin <= 1.0.20 - Cross Site Scripting (XSS) vulnerabilityfaceleg Raptor Editor
- CVE-2024-50469WordPress Textboxes plugin <= 0.1.3.1 - Cross Site Scripting (XSS) vulnerabilitybrightvesseldev Textboxes
- CVE-2024-9629Contact Form 7 + Telegram <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refusehokku Message Bridge for Contact Form 7 and Telegram
- CVE-2024-49771MPXJ has a Potential Path Traversal Vulnerabilityjoniles mpxj · mpxj +5
- CVE-2024-10469CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.CERT/CC VINCE
- CVE-2024-47827Argo Workflows Controller: Denial of Service via malicious daemon Workflowsargoproj argo-workflows · github.com/argoproj/argo-workf… +2
- CVE-2024-10450SourceCodester Kortex Lite Advocate Office Management System POST Parameter edit_profile.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-10449Codezips Hospital Appointment System loginAction.php sql injectionCodezips Hospital Appointment System
- CVE-2024-10214Incorrect Session Creation with Desktop SSOMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-49761REXML ReDoS vulnerabilityruby rexml · rexml
- CVE-2024-10448code-projects Blood Bank Management System delete.php cross-site request forgerycode-projects Blood Bank Management System
- CVE-2024-50443WordPress PostX plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerabilityWPXPO PostX
- CVE-2024-10447Project Worlds Online Time Table Generator staffdashboard.php sql injectionProject Worlds Online Time Table Generator
- CVE-2024-8013CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelinesMongoDB mongocryptd · MongoDB Mongo_crypt_v1.so
- CVE-2024-50582In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elementsJetBrains YouTrack
- CVE-2024-50581In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tagJetBrains YouTrack
- CVE-2024-50580In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering ruleJetBrains YouTrack
- CVE-2024-50579In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possibleJetBrains YouTrack
- CVE-2024-50578In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards pageJetBrains YouTrack
- CVE-2024-50577In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settingsJetBrains YouTrack
- CVE-2024-50576In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifestJetBrains YouTrack
- CVE-2024-50575In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget APIJetBrains YouTrack
- CVE-2024-50574In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionalityJetBrains YouTrack
- CVE-2024-50573In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized servicesJetBrains Hub
- CVE-2024-50470WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityThemes4WP YouTube External Subtitles
- CVE-2024-50471WordPress Trip Plan plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerabilitychecklistcom Trip Plan
- CVE-2024-50472WordPress Amilia Store plugin <= 2.9.8 - Stored Cross Site Scripting (XSS) vulnerabilitymartindrapeau Amilia Store
- CVE-2024-50501WordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityClimax Themes Kata Plus
- CVE-2024-50502WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerabilityCozyThemes Cozy Blocks
- CVE-2024-50463WordPress Sunshine Photo Cart plugin <= 3.2.9 - Open Redirection vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2024-10446Project Worlds Online Time Table Generator admindashboard.php sql injectionProject Worlds Online Time Table Generator
- CVE-2024-50442WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerabilityWP Royal Royal Elementor Addons
- CVE-2024-50307Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2.kubell Co. Chatwork Desktop Application
- CVE-2024-10439Sunnet eHRD CTMS - Insecure Direct Object ReferenceSunnet eHRD CTMS
- CVE-2024-23843Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Genians Genian NAC V5.0, Genians GeniaGenians Genian NAC
- CVE-2024-10435didi Super-Jacoco triggerEnvCov command injectiondidi Super-Jacoco
- CVE-2024-10433Project Worlds Simple Web-Based Chat Application index.php cross site scriptingProject Worlds Simple Web-Based Chat Application
- CVE-2024-34537TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level typo3/cms-backend
- CVE-2024-42930PbootCMS 3.2.8 is vulnerable to URL Redirect.
- CVE-2024-48107SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF).
- CVE-2024-48191dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=1
- CVE-2024-48195Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the p
- CVE-2024-48291dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17
- CVE-2024-48936SchedMD Slurm before 24.05.4 has Incorrect Authorization.
- CVE-2024-51506Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description.
- CVE-2024-51507Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name.
- CVE-2024-51508Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index.
- CVE-2024-51509Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored XSS payload in the Nam