Vulnerabilities (CVE)

Total 295971 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-50470 1 Themes4wp 1 Youtube External Subtitles 2024-10-31 N/A 5.4 MEDIUM
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themes4WP Themes4WP YouTube External Subtitles allows Stored XSS.This issue affects Themes4WP YouTube External Subtitles: from n/a through 1.0.
CVE-2024-50465 1 Squirrly 1 Premium Seo Pack 2024-10-31 N/A 6.5 MEDIUM
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP SEO – Calin Vingan Premium SEO Pack allows SQL Injection.This issue affects Premium SEO Pack: from n/a through 1.6.001.
CVE-2024-10447 1 Projectworlds 1 Online Time Table Generator 2024-10-31 6.5 MEDIUM 8.8 HIGH
A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely.
CVE-2024-50498 1 Lubus 1 Wp Query Console 2024-10-31 N/A 9.8 CRITICAL
Improper Control of Generation of Code ('Code Injection') vulnerability in LUBUS WP Query Console allows Code Injection.This issue affects WP Query Console: from n/a through 1.0.
CVE-2024-50492 1 Scottpaterson 1 Scottcart 2024-10-31 N/A 9.8 CRITICAL
Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart allows Code Injection.This issue affects ScottCart: from n/a through 1.1.
CVE-2024-20526 1 Cisco 1 Adaptive Security Appliance Software 2024-10-31 N/A 5.3 MEDIUM
A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for the SSH server of an affected device. This vulnerability is due to a logic error when an SSH session is established. An attacker could exploit this vulnerability by sending crafted SSH messages to an affected device. A successful exploit could allow the attacker to exhaust available SSH resources on the affected device so that new SSH connections to the device are denied, resulting in a DoS condition. Existing SSH connections to the device would continue to function normally. The device must be rebooted manually to recover. However, user traffic would not be impacted and could be managed using a remote application such as Cisco Adaptive Security Device Manager (ASDM).
CVE-2024-50613 1 Libsndfile Project 1 Libsndfile 2024-10-31 N/A 6.5 MEDIUM
libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.
CVE-2024-10438 1 Sun.net 1 Ehdr Ctms 2024-10-31 N/A 7.5 HIGH
The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific conditions in order to access certain functionalities.
CVE-2024-10439 1 Sun.net 1 Ehdr Ctms 2024-10-31 N/A 7.5 HIGH
The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user.
CVE-2024-10440 1 Sun.net 1 Ehdr Ctms 2024-10-31 N/A 9.8 CRITICAL
The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to read, modify, and delete database contents.
CVE-2024-50477 1 Stacksmarket 1 Stacks Mobile App Builder 2024-10-31 N/A 9.8 CRITICAL
Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through 5.2.3.
CVE-2024-50487 1 Maantheme 1 Maanstore Api 2024-10-31 N/A 9.8 CRITICAL
Authentication Bypass Using an Alternate Path or Channel vulnerability in MaanTheme MaanStore API allows Authentication Bypass.This issue affects MaanStore API: from n/a through 1.0.1.
CVE-2024-50489 1 Realtyworkstation 1 Realty Workstation 2024-10-31 N/A 9.8 CRITICAL
Authentication Bypass Using an Alternate Path or Channel vulnerability in Realty Workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through 1.0.45.
CVE-2024-48427 1 Oretnom23 1 Packers And Movers Management System 2024-10-31 N/A 8.8 HIGH
A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in /mpms/admin/?page=services/manage_service&id
CVE-2024-47035 1 Google 1 Android 2024-10-31 N/A 7.8 HIGH
In vring_init of external/headers/include/virtio/virtio_ring.h, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-47481 1 Dell 1 Data Lakehouse 2024-10-31 N/A 6.5 MEDIUM
Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Denial of service.
CVE-2024-47483 1 Dell 1 Data Lakehouse 2024-10-31 N/A 5.5 MEDIUM
Dell Data Lakehouse, version(s) 1.0.0.0 and 1.1.0.0, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2024-10374 1 Butlerblog 1 Wp-members 2024-10-31 N/A 5.4 MEDIUM
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpmem_loginout shortcode in all versions up to, and including, 3.4.9.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-10378 1 Esafenet 1 Cdg 2024-10-30 6.5 MEDIUM 9.8 CRITICAL
A vulnerability classified as critical has been found in ESAFENET CDG 5. Affected is the function actionViewCDGRenewFile of the file /com/esafenet/servlet/client/CDGRenewApplicationService.java. The manipulation of the argument CDGRenewFileId leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-8421 2024-10-30 N/A N/A
Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.