Latest CVE Feed
-
5.5
CVSS31CVE-2024-45119
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application ... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
6.5
CVSS31CVE-2024-45118
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass secu... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
7.6
CVSS31CVE-2024-45117
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to read files from the... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
8.1
CVSS31CVE-2024-45116
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially craft... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
9.8
CVSS31CVE-2024-45115
Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or ele... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
6.0
CVSS31CVE-2024-22068
Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: V4.00.10 and ear... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
5.3
CVSS31CVE-2024-9802
The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running v... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
9.0
CVSS31CVE-2024-9798
The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
0.0
NONECVE-2024-9796
The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
5.4
CVSS30CVE-2024-7049
In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
5.3
CVSS31CVE-2024-6747
Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
6.7
CVSS31CVE-2024-38817
VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root.... Read more
Affected Products :- Published: Oct. 09, 2024
- Modified: Oct. 10, 2024
-
7.8
CVSS31CVE-2024-9781
AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
7.8
CVSS31CVE-2024-9780
ITS dissector crash in Wireshark 4.4.0 allows denial of service via packet injection or crafted capture file... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
8.1
CVSS31CVE-2024-3656
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or... Read more
Affected Products :- Published: Oct. 09, 2024
- Modified: Oct. 10, 2024
-
0.0
NONECVE-2024-9156
The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
6.3
CVSS31CVE-2024-9520
The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers wi... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
6.4
CVSS31CVE-2024-9074
The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
4.3
CVSS31CVE-2024-9067
The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'delete_attachment' function in all version... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024
-
7.2
CVSS31CVE-2024-9022
The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of s... Read more
Affected Products :- Published: Oct. 10, 2024
- Modified: Oct. 10, 2024