Skip to content
OpenAdvisories

Archive

October 2024

Vulnerabilities first published in this month (UTC), newest first.

← September 2024 2024 / October November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

55 results · Clear filters · Feed

  • High 7.7
    CVE-2024-47823 Public exploit

    Livewire Remote Code Execution (RCE) on File Uploads

    Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.12.7` and `v3.5.2`, the file extension of an uploaded file is guessed based on the MIME type. As a result, the actual fi…

    livewire livewire livewire/livewire Packagist
  • High 7.8
    CVE-2024-43583 Public exploit

    Winlogon Elevation of Privilege Vulnerability

    Winlogon Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.0
    CVE-2024-43535 Public exploit

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.3
    CVE-2024-21532 Public exploit

    ggit is vulnerable to Command Injection via the fetchTags(branch) API

    All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec(…

    ggit npm
  • High 7.2
    CVE-2024-43363 Public exploit EPSS 36%

    Remote code execution via Log Poisoning in Cacti

    Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to c…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • High 7.0
    CVE-2024-31449 Public exploit

    Lua library commands may lead to stack overflow and RCE in Redis

    Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in a…

    Redis Redis redis redis Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2024-9570 Public exploit

    D-Link DIR-619L B1 formEasySetTimezone buffer overflow

    A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack …

    D-Link DIR-619L B1 Network devices
  • High 8.4
    CVE-2024-38399 Public exploit

    Use After Free in Graphics

    Memory corruption while processing user packets to generate page faults.

    Qualcomm Snapdragon
  • High 8.4
    CVE-2024-46278 Public exploit

    Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.

  • High 8.5
    CVE-2024-9054 Public exploit EPSS 16%

    Remote code Execution inTimeProvider® 4100

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue aff…

    Microchip TimeProvider 4100
  • High 7.7
    CVE-2024-43687 Public exploit

    XSS vulnerability in bannerconfig endpoint in TimeProvider 4100

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

    Microchip TimeProvider 4100
  • High 8.0
    CVE-2024-46658 Public exploit EPSS 24%

    Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.

  • High 8.4
    CVE-2024-44193 Public exploit

    A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local atta…

    Apple iTunes for Windows Windows
  • High 8.8
    CVE-2024-46626 Public exploit

    OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.

  • High 8.1
    CVE-2024-41290 Public exploit

    FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.