Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,302 results · page 38 of 87
Oct 31, 2024A vulnerability classified as critical has been found in ESAFENET CDG 5.CVE-2024-10597 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in ESAFENET CDG 5. This affects the function delPolicyAction of the file /com/esafenet/servlet/system/PolicyActionService.java. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0.CVE-2024-10556 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pet Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024A vulnerability classified as critical was found in open-scratch Teaching 在线教学平台 up to 2.7.CVE-2024-10546 · Other software · open-scratch · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in open-scratch Teaching 在线教学平台 up to 2.7. This vulnerability affects unknown code of the file /api/sys/ng-alain/getDictItemsByTable/ of the component URL Handler. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Teaching 在线教学平台
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024WPAdverts – Classifieds: Stored Cross-Site ScriptingCVE-2024-10108 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's adverts_add shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WPAdverts – Classifieds
- Affected
- up to 2.1.6
- What to do
- Affects up to 2.1.6. Update WPAdverts – Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Oct 29, 2024A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0.CVE-2024-10509 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Institute Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0.CVE-2024-10507 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Free Exam Hall Seating Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic.CVE-2024-10503 · Other software · Klokan · reported by VulDBMedium 5.3
A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MapTiler tileserver-gl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability has been found in ESAFENET CDG 5 and classified as critical.CVE-2024-10502 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of the file /com/esafenet/servlet/fileManagement/FileDirectoryService.java. The manipulation of the argument directoryId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.CVE-2024-10501 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function findById of the file /com/esafenet/servlet/document/ExamCDGDocService.java. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.CVE-2024-10500 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/policy/HookWhiteListService.java. The manipulation of the argument policyId leads to sql injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A vulnerability, which was classified as problematic, was found in LinZhaoguan pb-cms up to 2.0.1.CVE-2024-10479 · Other software · LinZhaoguan · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in LinZhaoguan pb-cms up to 2.0.1. Affected is an unknown function of the file /admin#themes of the component Theme Management Module. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- pb-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms up to 2.0.1.CVE-2024-10478 · Other software · LinZhaoguan · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, has been found in LinZhaoguan pb-cms up to 2.0.1. This issue affects some unknown processing of the file /admin#article/edit?id=2 of the component Edit Article Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- pb-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A vulnerability classified as problematic was found in LinZhaoguan pb-cms up to 2.0.1.CVE-2024-10477 · Other software · LinZhaoguan · reported by VulDBMedium 5.1
A vulnerability classified as problematic was found in LinZhaoguan pb-cms up to 2.0.1. This vulnerability affects unknown code of the file /admin#permissions of the component Permission Management Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- pb-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0.CVE-2024-10449 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Hospital Appointment System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0.CVE-2024-10447 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely.
- Product
- Online Time Table Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2024A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0.CVE-2024-10446 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable/admin/admindashboard.php?info=add_course. The manipulation of the argument c leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Online Time Table Generator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic.CVE-2024-10433 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability was found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument Name/Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions different parameters to be affected which do not correlate with the screenshots of a successful attack.
- Product
- Simple Web-Based Chat Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024A vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical.CVE-2024-10432 · Other software · Project Worlds · reported by VulDBMedium 6.9
A vulnerability has been found in Project Worlds Simple Web-Based Chat Application 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Simple Web-Based Chat Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0.CVE-2024-10431 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file /deletebird.php. The manipulation of the argument t1 leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pet Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024A vulnerability, which was classified as critical, has been found in Codezips Pet Shop Management System 1.0.CVE-2024-10430 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability, which was classified as critical, has been found in Codezips Pet Shop Management System 1.0. This issue affects some unknown processing of the file /animalsupdate.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- Pet Shop Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028.CVE-2024-10429 · Other software · WAVLINK · reported by VulDBHigh 8.6
A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file internet.cgi. The manipulation of the argument IPv6OpMode/IPv6IPAddr/IPv6WANIPAddr/IPv6GWAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WN530H4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Oct 27, 2024A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical.CVE-2024-10425 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability was found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /student/project_selection/move_up_project.php of the component Project Selection Page. The manipulation of the argument up leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Student Project Allocation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024A vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical.CVE-2024-10424 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability has been found in Project Worlds Student Project Allocation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /student/project_selection/remove_project.php of the component Project Selection Page. The manipulation of the argument no leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Student Project Allocation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2024A vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0.CVE-2024-10423 · Other software · Project Worlds · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, was found in Project Worlds Student Project Allocation System 1.0. Affected is an unknown function of the file /student/project_selection/project_selection.php of the component Project Selection Page. The manipulation of the argument project_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Student Project Allocation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024A vulnerability classified as problematic was found in ESAFENET CDG 5.CVE-2024-10379 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in ESAFENET CDG 5. Affected by this vulnerability is the function actionViewDecyptFile of the file /com/esafenet/servlet/client/DecryptApplicationService.java. The manipulation of the argument decryptFileId with the input ../../../Windows/System32/drivers/etc/hosts leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The affected function has a typo and is missing an R. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2024A vulnerability classified as critical has been found in ESAFENET CDG 5.CVE-2024-10378 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in ESAFENET CDG 5. Affected is the function actionViewCDGRenewFile of the file /com/esafenet/servlet/client/CDGRenewApplicationService.java. The manipulation of the argument CDGRenewFileId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0.CVE-2024-10372 · Other software · chidiwilliams · reported by VulDBLow 2
A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- buzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024A vulnerability classified as critical was found in SourceCodeHero Clothes Recommendation System 1.0.CVE-2024-10338 · Other software · SourceCodeHero · reported by VulDBMedium 5.1
A vulnerability classified as critical was found in SourceCodeHero Clothes Recommendation System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/home.php. The manipulation of the argument view/view1 leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Clothes Recommendation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024A vulnerability classified as critical has been found in SourceCodeHero Clothes Recommendation System 1.0.CVE-2024-10337 · Other software · SourceCodeHero · reported by VulDBMedium 5.1
A vulnerability classified as critical has been found in SourceCodeHero Clothes Recommendation System 1.0. Affected is an unknown function of the file /admin/home.php?con=add. The manipulation of the argument cat/subcat/ t1/t2/text leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Clothes Recommendation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability was found in ZZCMS 2023 and classified as critical.CVE-2024-10292 · Other software · zzcms · reported by VulDBMedium 5.3
A vulnerability was found in ZZCMS 2023 and classified as critical. This issue affects some unknown processing of the file 3/Ebak5.1/upload/ChangeTable.php. The manipulation of the argument savefilename leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability has been found in ZZCMS 2023 and classified as critical.CVE-2024-10291 · Other software · zzcms · reported by VulDBMedium 5.3
A vulnerability has been found in ZZCMS 2023 and classified as critical. This vulnerability affects the function Ebak_DoExecSQL/Ebak_DotranExecutSQL of the file 3/Ebak5.1/upload/phome.php. The manipulation of the argument phome leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability, which was classified as problematic, was found in ZZCMS 2023.CVE-2024-10290 · Other software · Zzcms · reported by VulDBMedium 6.9
A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability, which was classified as critical, has been found in Tenda RX9 and RX9 Pro 22.03.02.20.CVE-2024-10283 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in Tenda RX9 and RX9 Pro 22.03.02.20. Affected by this issue is the function sub_4337EC of the file /goform/SetNetControlList. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- RX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability classified as critical was found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20.CVE-2024-10282 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20. Affected by this vulnerability is the function sub_42EA38 of the file /goform/SetVirtualServerCfg. The manipulation of the argument list leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- RX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability classified as critical has been found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20.CVE-2024-10281 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in Tenda RX9 and RX9 Pro 22.03.02.10/22.03.02.20. Affected is the function sub_42EEE0 of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- RX9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability was found in ESAFENET CDG 5 and classified as critical.CVE-2024-10277 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is some unknown functionality of the file /com/esafenet/servlet/ajax/UsbKeyAjax.java. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2024A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic.CVE-2024-10276 · Other software · Telestream · reported by VulDBMedium 5.3
A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /?page=reports of the component Reports Page. The manipulation of the argument z leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Sentry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2024A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical.CVE-2024-10193 · Other software · WAVLINK · reported by VulDBMedium 5.1
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WN530H4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comvuldb.com
Oct 20, 2024A vulnerability has been found in didi DDMQ 1.0 and classified as critical.CVE-2024-10173 · Other software · didi · reported by VulDBMedium 6.9
A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console Module. The manipulation with the input /;login leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- DDMQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2024A vulnerability classified as critical has been found in Codezips Sales Management System 1.0.CVE-2024-10167 · Other software · Codezips · reported by VulDBMedium 6.9
A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Sales Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2024A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1.CVE-2024-10141 · Other software · jsbroks · reported by VulDBMedium 6.3
A vulnerability, which was classified as problematic, was found in jsbroks COCO Annotator 0.11.1. This affects an unknown part of the component Session Handler. The manipulation of the argument SECRET_KEY leads to predictable from observable state. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- COCO Annotator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2024A vulnerability was found in ESAFENET CDG 5 and classified as critical.CVE-2024-10134 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability was found in ESAFENET CDG 5 and classified as critical. Affected by this issue is the function connectLogout of the file /com/esafenet/servlet/ajax/MultiServerAjax.java. The manipulation of the argument servername leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2024A vulnerability has been found in ESAFENET CDG 5 and classified as critical.CVE-2024-10133 · Other software · ESAFENET · reported by VulDBMedium 5.3
A vulnerability has been found in ESAFENET CDG 5 and classified as critical. Affected by this vulnerability is the function updateNetSecPolicyPriority of the file /com/esafenet/servlet/ajax/NetSecPolicyAjax.java. The manipulation of the argument id/frontId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- CDG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability classified as critical was found in Tenda AC8 16.03.34.06.CVE-2024-10130 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in Tenda AC8 16.03.34.06. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg. The manipulation of the argument rebootTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability classified as critical has been found in HFO4 shudong-share up to 2.4.7.CVE-2024-10129 · Other software · HFO4 · reported by VulDBMedium 5.3
A vulnerability classified as critical has been found in HFO4 shudong-share up to 2.4.7. This affects an unknown part of the file /includes/create_share.php of the component Share Handler. The manipulation of the argument fkey leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- shudong-share
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical.CVE-2024-10121 · Other software · wfh45678 · reported by VulDBMedium 6.9
A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handler. The manipulation with the input /../ leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This appears not to be a path traversal weakness. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Radar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability has been found in wfh45678 Radar up to 1.0.8 and classified as critical.CVE-2024-10120 · Other software · wfh45678 · reported by VulDBMedium 6.9
A vulnerability has been found in wfh45678 Radar up to 1.0.8 and classified as critical. This vulnerability affects unknown code of the file /services/v1/common/upload. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Radar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83.CVE-2024-10093 · Other software · VSO · reported by VulDBHigh 8.5
A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83. Affected is an unknown function in the library avcodec.dll of the file ConvertXtoDvd.exe. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ConvertXtoDvd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.CVE-2024-33453 · Other software · espressif · reported by MITREHigh 8.1
Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.
- Product
- esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0.CVE-2024-10073 · Other software · flairNLP · reported by VulDBMedium 6.3
A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- flair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.