Skip to content
OpenAdvisories

Archive

9 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /9 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.3
    CVE-2024-47832

    XML Signature Bypass via differential XML parsing in ssoready

    ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits dif…

    ssoready ssoready github.com/ssoready/ssoready Go
  • Critical 9.2
    CVE-2024-9465 Exploited Public exploit Scanner template EPSS 100%

    Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

    An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and…

    Palo Alto Networks Expedition Network devices
    KEV Nov 14, 2024
  • Critical 9.3
    CVE-2024-9464 Public exploit EPSS 83%

    Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

    An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys o…

    Palo Alto Networks Expedition Network devices
  • Critical 9.9
    CVE-2024-9463 Exploited Public exploit Scanner template EPSS 99%

    Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

    An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys…

    Palo Alto Networks Expedition Network devices
    KEV Nov 14, 2024
  • Critical 9.1
    CVE-2024-8015

    Telerik Report Server Insecure Type Resolution

    In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.

    Progress Software Telerik Reporting
  • Critical 9.1
    CVE-2024-47659

    smack: tcp: ipv4, fix incorrect labeling

    In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'fo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-9680 Exploited · Ransomware Public exploit EPSS 23%

    An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi
    KEV Oct 15, 2024
  • Critical 9.1
    CVE-2023-46586

    cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because str…

    weborf weborf Debian Ubuntu
  • Critical 9.8
    CVE-2024-32608

    HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer …

    hdf5 hdf5 Debian Ubuntu
  • Critical 9.1
    CVE-2024-48941

    The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to by…

  • Critical 9.1
    CVE-2024-48942

    The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to ea…

  • Critical 9.8
    CVE-2024-45746

    An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a …

  • Critical 9.1
    CVE-2024-45160

    Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 clie…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Critical 9.8
    CVE-2024-25825

    FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be…