CVEs published October 29, 2024
207 CVEs were published on October 29, 2024: 32 critical, 92 high. 2 are now in CISA KEV.
- Published
- 207
- Critical
- 32
- High
- 92
- Medium
- 75
- Low
- 3
- Unrated
- 5
- Now in CISA KEV
- 2
- Fix available
- 78
Most affected products
- Linux
- 21
- Autodesk AutoCAD · Autodesk Civil +1
- 16
- Mozilla Firefox · Mozilla Thunderbird
- 11
- Autodesk AutoCAD · Autodesk Civil +3
- 6
- lunary-ai/lunary
- 4
- Benjamin Denis SEOPress
- 3
- Bob Namaste! LMS
- 3
- gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- 3
- LinZhaoguan pb-cms
- 3
- odude Crypto Tool
- 3
Critical 32
- CVE-2024-9989Crypto <= 2.18 - Authentication Bypass via log_inodude Crypto Tool
- CVE-2024-9988Crypto <= 2.19 - Authentication Bypass via registerodude Crypto Tool
- CVE-2024-8923Sandbox Escape in Now PlatformServiceNow Now Platform
- CVE-2024-49768Waitress has request processing race condition in HTTP pipelining with invalid first requestPylons waitress · waitress
- CVE-2024-7474IDOR in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-5982Path Traversal in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-7475Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-10474Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumMozilla Focus for iOS
- CVE-2024-10468Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-10467Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-50475WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerabilityScott Gamon Signup Page
- CVE-2024-50476WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerabilityGRÜN Software Group GRÜN spendino Spendenformular
- CVE-2024-50485WordPress Exam Matrix plugin <= 1.5 - Privilege Escalation vulnerabilityUdit Rawat Exam Matrix
- CVE-2024-50490WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerabilitylowcage PegaPoll
- CVE-2024-50420WordPress aDirectory plugin <= 1.3 - Arbitrary File Upload vulnerabilityaDirectory
- CVE-2024-50427WordPress SurveyJS plugin <= 1.9.136 - Arbitrary File Upload vulnerabilitydevsoftbaltic SurveyJS
- CVE-2024-50473WordPress Ajar in5 Embed plugin <= 3.1.3 - Arbitrary File Upload vulnerabilityAjar Productions Ajar in5 Embed
- CVE-2024-50480WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Arbitrary File Upload vulnerabilityMarketing Automation by AZEXO
- CVE-2024-50482WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityChetan Khandla Woocommerce Product Design
- CVE-2024-50484WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerabilityLindeni Mahlalela Multi Purpose Mail Form
- CVE-2024-50493WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerabilitymasterhomepage Automatic Translation
- CVE-2024-50494WordPress Sudan Payment Gateway for WooCommerce plugin <= 1.2.2 - Arbitrary File Upload vulnerabilityAmin Omer Sudan Payment Gateway for WooCommerce
- CVE-2024-50086ksmbd: fix user-after-free from session log offLinux
- CVE-2024-50085mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflowLinux
- CVE-2024-45656IBM Flexible Service Processor hard coded credentialsIBM Flexible Service Processor
- CVE-2024-44081In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading vide
- CVE-2024-48138A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows at
- CVE-2024-48206A Deserialization of Untrusted Data vulnerability in chainer v7.8.1.post1 leads to execution of arbitrary code.
- CVE-2024-48573A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account pas
- CVE-2024-51378getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authenticat
- CVE-2024-51567upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and
- CVE-2024-51568CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.
High 92
- CVE-2024-10488Use after free in WebRTC in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2024-10487Out of bounds write in Dawn in Google Chrome prior to 130.0.6723.92 allowed a remote attacker to perform out of bounds memory access via a cGoogle Chrome
- CVE-2024-7992Autodesk AutoCAD DWG Stack-Based Buffer Overflow Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +3
- CVE-2024-7991Autodesk AutoCAD DWG Out-of-Bounds Write Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +3
- CVE-2024-9997Autodesk AutoCAD DWG File Parsing Memory Corruption Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +3
- CVE-2024-9996Autodesk AutoCAD DWG File Parsing Out-Of-Bounds Write Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +3
- CVE-2024-9489Autodesk AutoCAD DWG File Parsing Memory Corruption Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +3
- CVE-2024-8896Autodesk AutoCAD DXF File Parsing Unitialized Variable Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +3
- CVE-2024-8592Autodesk AutoCAD CATPART File Parsing Memory Corruption Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-9827Autodesk AutoCAD ACTranslators CATPART File Parsing Out-Of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-9826Autodesk AutoCAD ACTranslators 3DM File Parsing Use-After-Free Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8600A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability.Autodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8599Autodesk AutoCAD ACTranslators STP File Parsing Memory Corruption Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8598Autodesk AutoCAD ACTranslators STEP File Parsing Memory Corruption Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8597Autodesk AutoCAD STEP File Parsing Memory Corruption Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8596Autodesk AutoCAD MODEL File Parsing Out-Of-Bounds Write Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8595Autodesk AutoCAD MODEL File Parsing Use-After-Free Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8594Autodesk AutoCAD MODEL File Parsing Heap-based Buffer Overflow Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8593Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Write Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8591Autodesk AutoCAD 3DM File Parsing Heap-based Buffer Overflow Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8590Autodesk AutoCAD 3DM File Parsing Use-After-Free Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8589Autodesk AutoCAD SLDPRT File Parsing Out-Of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8588Autodesk AutoCAD SLDPRT File Parsing Out-Of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-8587Autodesk AutoCAD SLDPRT File Parsing Heap-based Buffer Overflow Code Execution VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-9990Crypto <= 2.15 - Cross-Site Request Forgery to Authentication Bypassodude Crypto Tool
- CVE-2024-8924Unauthenticated Blind SQL Injection in Core PlatformServiceNow Now Platform
- CVE-2024-7985FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Uploadsoftaculous FileOrganizer – WordPress File Manager
- CVE-2024-50334Semicolon Path Injection on API /api;/configErudika scoold
- CVE-2024-49769Waitress has a denial of service leading to high CPU usage/resource exhaustionPylons waitress · waitress
- CVE-2024-48921Kyverno's PolicyException objects can be created in any namespace by defaultkyverno · github.com/kyverno/kyverno
- CVE-2024-47640WordPress WP ERP plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerabilityweDevs WP ERP
- CVE-2024-49632WordPress CWD 3D Image Gallery plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySenthil Vel CWD 3D Image Gallery
- CVE-2024-49634WordPress BP Member Type Manager plugin <= 1.01 - Reflected Cross Site Scripting (XSS) vulnerabilityRimon Habib BP Member Type Manager
- CVE-2024-49635WordPress Banner Slider plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilitymanjurul.cis Banner Slider
- CVE-2024-49636WordPress Agile Video Player Lite plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityworacal Agile Video Player Lite
- CVE-2024-7473IDOR Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-7010Timing Attack in mudler/localaimudler/localai
- CVE-2024-7807Denial of Service (DOS) in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-49637WordPress Bet WC 2018 Russia plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFoxskav Bet WC 2018 Russia
- CVE-2024-7962Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-6868Arbitrary File Write in mudler/LocalAImudler/localai
- CVE-2024-6674Data Leak through CORS Misconfiguration in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-49638WordPress Risk Warning Bar plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityventureharbour Risk Warning Bar
- CVE-2024-49639WordPress Monitor.chat plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEdward Stoever Monitor.chat
- CVE-2024-49640WordPress ACL Floating Cart for WooCommerce plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityAmaderCode Lab ACL Floating Cart for WooCommerce
- CVE-2024-41153Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commHitachi Energy TRO600
- CVE-2024-49641WordPress Tida URL Screenshot plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityTidaweb Tida URL Screenshot
- CVE-2024-10466By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-10465A clipboard "paste" button could persist across tabs which allowed a spoofing attack.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-10464Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-10463Video frames could have been leaked between origins in some situations.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-10462Truncation of a long URL could have allowed origin spoofing in a permission prompt.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-49643WordPress Whitelist plugin <= 3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityfifthsegment Whitelist
- CVE-2024-49645WordPress Affiliate Platform plugin <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityIlias Gomatos Affiliate Platform
- CVE-2024-49646WordPress Code Generate plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityioannup Code Generate
- CVE-2024-49647WordPress Simple Custom Admin plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCarl Alberto Simple Custom Admin
- CVE-2024-49648WordPress SVG Captcha plugin <= 1.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilityrafasashi SVG Captcha
- CVE-2024-49650WordPress BuddyPress Greeting Message plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityXarbo BuddyPress Greeting Message
- CVE-2024-49651WordPress WooCommerce Maintenance Mode plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMatt Royal WooCommerce Maintenance Mode
- CVE-2024-49654WordPress Extra Privacy for Elementor plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMarian Heddesheimer Extra Privacy for Elementor
- CVE-2024-49656WordPress DocumentPress plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityfifthsegment DocumentPress
- CVE-2024-49660WordPress Campus Explorer Widget plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityCampusExplorer Campus Explorer Widget
- CVE-2024-49661WordPress leenk.me plugin <= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerabilityLew Ayotte leenk.me
- CVE-2024-49662WordPress Simple Load More plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityWebgensis Simple Load More
- CVE-2024-49663WordPress uCAT – Next Story plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityelenkadark uCAT – Next Story
- CVE-2024-49664WordPress chatplusjp plugin <= 1.02 - Cross Site Scripting (XSS) vulnerabilitychatplusjp
- CVE-2024-49670WordPress Client Power Tools Portal plugin <= 1.9.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySam Glover Client Power Tools Portal
- CVE-2024-49672WordPress Google Docs RSVP plugin <= 2.0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilitygiffordcheung Google Docs RSVP
- CVE-2024-49673WordPress LaTeX2HTML plugin <= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityVan Abel LaTeX2HTML
- CVE-2024-49678WordPress js paper theme <= 2.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityJinwen js paper
- CVE-2024-50407WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityBob Namaste! LMS
- CVE-2024-50550WordPress LiteSpeed Cache plugin <= 6.5.1 - Privilege Escalation vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2024-10436WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusionwpclever WPC Smart Messages for WooCommerce
- CVE-2024-22066There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router .ZTE ZXR10 1800-2S
- CVE-2024-49642WordPress Todo Custom Field plugin <= 3.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityrafasashi Todo Custom Field
- CVE-2024-50481WordPress Bstone Demo Importer plugin <= 1.0.1 - Privilege Escalation vulnerabilitystackthemes Bstone Demo Importer
- CVE-2024-10008Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege EscalationMasteriyo LMS – Online Course Builder for eLearning, LMS &…
- CVE-2024-50088btrfs: fix uninitialized pointer free in add_inode_ref()Linux
- CVE-2024-50087btrfs: fix uninitialized pointer free on read_alloc_one_name() errorLinux
- CVE-2024-50084net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()Linux
- CVE-2024-50082blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function raceLinux
- CVE-2024-50078Bluetooth: Call iso_exit() on module unloadLinux
- CVE-2024-50077Bluetooth: ISO: Fix multiple init when debugfs is disabledLinux
- CVE-2024-50075xhci: tegra: fix checked USB2 port numberLinux
- CVE-2024-50074parport: Proper fix for array out-of-bounds accessLinux
- CVE-2024-50073tty: n_gsm: Fix use-after-free in gsm_cleanup_muxLinux
- CVE-2024-50071pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func()Linux
- CVE-2019-25219Asio C++ Library before 1.13.0 lacks a fallback error code in the case of SSL_ERROR_SYSCALL with no associated error information from the SS
- CVE-2024-44080In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients load
- CVE-2024-48955Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the
- CVE-2024-51180A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/index.php in PHPGurukul IFSC Code Finder Project v1.0, which a
- CVE-2024-51181A Reflected Cross Site Scripting (XSS) vulnerability was found in /ifscfinder/admin/profile.php in PHPGurukul IFSC Code Finder Project v1.0,
Medium, low and unrated 83
- CVE-2024-50348InstantCMS has a Cross Site Scripting Vulnerabilityinstantsoft icms2
- CVE-2024-50421WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerabilityWP Overnight WooCommerce PDF Invoices & Packing Slips
- CVE-2024-50422WordPress Breeze plugin <= 2.1.14 - Broken Access Control vulnerabilityCloudways Breeze
- CVE-2024-50423WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerabilityWPDeveloper Templately
- CVE-2024-50424WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerabilityWPDeveloper Templately
- CVE-2024-50425WordPress WP Booking System – Booking Calendar plugin <= 2.0.19.10 - Broken Access Control vulnerabilityRoland Murg WP Booking System
- CVE-2024-10228Vagrant VMWare Utility installation files vulnerable to modification by unprivileged userHashiCorp Vagrant
- CVE-2024-50428WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerabilitymondula2016 Multi Step Form
- CVE-2024-50454WordPress SEOPress plugin <= 8.1.1 - Unauthenticated Broken Access Control vulnerabilityBenjamin Denis SEOPress
- CVE-2024-50455WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerabilityBenjamin Denis SEOPress
- CVE-2024-50456WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerabilityBenjamin Denis SEOPress
- CVE-2024-50459WordPress AidWP plugin <= 3.2.3 - Broken Access Control vulnerabilityHossni Mubarak AidWP
- CVE-2024-50466WordPress DarkMySite – Advanced Dark Mode Plugin for WordPress plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerabilityDarkMySite – Advanced Dark Mode Plugin for WordPress
- CVE-2024-10491Preload arbitrary resources by injecting additional `Link` headersexpress
- CVE-2024-25566Open Redirect in PingAMPing Identity PingAM
- CVE-2024-10452Organization admins can delete pending invites created in an organization they are not part of.Grafana · github.com/grafana/grafana
- CVE-2024-10226Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcodetychesoftwares Arconix Shortcodes
- CVE-2024-9505Beaver Builder – WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widgetbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-6673CSRF Vulnerability in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-8309SQL Injection in langchain-ai/langchainlangchain-ai/langchain · langchain-community +1
- CVE-2024-7042Prompt Injection in langchain-ai/langchainjs Leading to SQL Injectionlangchain-ai/langchainjs · @langchain/community
- CVE-2024-7472Email Injection Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-7783Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-7774Path Traversal in langchain-ai/langchainjslangchain-ai/langchainjs · langchain
- CVE-2024-8143Unauthorized Access to User Chat History in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-6581Remote Code Execution due to Stored XSS in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-5823File Overwrite Vulnerability in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-41156Profile files from TRO600 series radios are extracted in plain-text and encrypted file formats.Hitachi Energy TRO600
- CVE-2024-10461In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a downlMozilla Firefox · Mozilla Thunderbird
- CVE-2024-10460The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-10459An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-10458A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements.Mozilla Firefox · Mozilla Thunderbird
- CVE-2017-20195LUNAD3v AreaLoad request.php sql injectionLUNAD3v AreaLoad
- CVE-2024-49659WordPress Coub plugin <= 1.4 - Cross Site Scripting (XSS) vulnerabilityCoub
- CVE-2024-10181Newsletters <= 4.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcodecontrid Newsletters
- CVE-2024-49665WordPress Web Bricks Addons for Elementor plugin <= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerabilityWeb Bricks Addons for Elementor
- CVE-2024-49667WordPress Local Business Addons For Elementor plugin <= 1.1.5 - Stored Cross Site Scripting (XSS) vulnerabilityAsaduzzaman Abir Local Business Addons For Elementor
- CVE-2024-10360Move Addons for Elementor <= 1.3.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesmoveaddons Move Addons for Elementor
- CVE-2024-10233SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcodecozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2024-10266Premium Addons for Elementor <= 4.10.60 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Box Widgetleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-10185StreamWeasels YouTube Integration <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed ShortcodeStreamWeasels YouTube Integration
- CVE-2024-10184SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed ShortcodeStreamWeasels Kick Integration
- CVE-2024-49679WordPress WPKoi Templates for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilitywpkoithemes WPKoi Templates for Elementor
- CVE-2024-49692WordPress AffiliateX plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityWPCenter AffiliateX
- CVE-2024-50409WordPress Namaste! LMS plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityBob Namaste! LMS
- CVE-2024-50410WordPress Namaste! LMS plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerabilityBob Namaste! LMS
- CVE-2024-10227affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcodecservit affiliate-toolkit – Multi-Network Affiliate & Amazo…
- CVE-2024-10437WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivationwpclever WPC Smart Messages for WooCommerce
- CVE-2024-9376Kata Plus – Addons for Elementor – Widgets, Extensions and Templates <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadclimaxthemes Kata Plus – Addons for Elementor – Widgets, Ex…
- CVE-2024-45477Apache NiFi: Improper Neutralization of Input in Parameter DescriptionApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2024-50411WordPress WP Abstracts plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabilityKevon Adonis WP Abstracts
- CVE-2024-50412WordPress Conditional Fields for Contact Form 7 plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerabilityJules Colle Conditional Fields for Contact Form
- CVE-2024-50413WordPress Import and export users and customers plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerabilityJavier Carazo Import and export users and customers
- CVE-2024-50414WordPress Button contact VR plugin <= 4.7.9.1 - Cross Site Scripting (XSS) vulnerabilityButtonizer Button contact VR
- CVE-2024-50415WordPress Ads.txt & App-ads.txt Manager for WordPress plugin <= 1.1.7.1 - Stored Cross Site Scripting (XSS) vulnerabilityPagup Ads.txt & App-ads.txt Manager for WordPress
- CVE-2024-50418WordPress Time Slot plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityTime Slot Booking Time Slot
- CVE-2024-50426WordPress Survey Maker plugin <= 5.0.2 - Cross Site Scripting (XSS) vulnerabilityAys Pro Survey Maker
- CVE-2024-10048Post Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via pageifeelweb Post Status Notifier · worschtebrot Post Status No…
- CVE-2024-9438SEUR Oficial <= 2.2.11 - Reflected Cross-Site Scriptingseuroficial SEUR Oficial
- CVE-2024-46872Client-Side Path Traversal Leading to CSRF in PlaybooksMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-47401DoS via Amplified GraphQL Response in PlaybooksMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-50052Arbitrary post deletion via Playbooks /ignore-thread endpointMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-10241Private channel names leaked with Ctrl+K when ElasticSearch is enabledMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-10312Exclusive Addons for Elementor <= 2.7.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatestimstrifler Exclusive Addons for Elementor
- CVE-2024-10000Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question FunctionalityMasteriyo LMS – Online Course Builder for eLearning, LMS &…
- CVE-2024-22065ZTE MF258 Pro product has a OS Command injection vulnerabilityZTE MF258 Pro
- CVE-2024-10479LinZhaoguan pb-cms Theme Management Module admin#themes cross site scriptingLinZhaoguan pb-cms
- CVE-2024-50083tcp: fix mptcp DSS corruption due to large pmtu xmitLinux
- CVE-2024-50081blk-mq: setup queue ->tag_set before initializing hctxLinux
- CVE-2024-50080ublk: don't allow user copy for unprivileged deviceLinux
- CVE-2024-50079io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_workLinux
- CVE-2024-50076vt: prevent kernel-infoleak in con_font_get()Linux
- CVE-2024-50072x86/bugs: Use code segment selector for VERW operandLinux
- CVE-2024-50070pinctrl: stm32: check devm_kasprintf() returned valueLinux
- CVE-2024-50069pinctrl: apple: check devm_kasprintf() returned valueLinux
- CVE-2024-50068mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets()Linux
- CVE-2024-10478LinZhaoguan pb-cms Edit Article edit cross site scriptingLinZhaoguan pb-cms
- CVE-2024-10477LinZhaoguan pb-cms Permission Management Page admin#permissions cross site scriptingLinZhaoguan pb-cms
- CVE-2024-48063In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.torch
- CVE-2024-48461Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New
- CVE-2024-48572A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a u
- CVE-2024-51075A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/user-search.php in PHPGurukul Online DJ Booking Management Sys
- CVE-2024-51076A Reflected Cross Site Scripting (XSS) vulnerability was found in /odms/admin/booking-search.php in PHPGurukul Online DJ Booking Management