CVE-2024-47793

CVE-2024-47793

Título es
CVE-2024-47793

Vie, 18/10/2024 – 06:15

Tipo
CWE-79

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2024-47793

Descripción en
Stored cross-site scripting vulnerability exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. When accessing the edit screen containing custom columns (column type: images or files), an arbitrary script may be executed on the web browser of the user.

18/10/2024
18/10/2024
Vector CVSS:3.1
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Gravedad 3.1 (CVSS 3.1 Base Score)
5.40

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
MEDIUM

Referencias

  • https://exment.net/docs/#/weakness/20241010

  • https://exment.net/vulnerability-correspondence-version-6-1-5-and-5-0-12-released/

  • https://jvn.jp/en/jp/JVN74538317/

    • Enviar en el boletín
    Off

    CVE-2024-9703

    CVE-2024-9703

    Título es
    CVE-2024-9703

    Vie, 18/10/2024 – 07:15

    Tipo
    CWE-79

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-9703

    Descripción en
    The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button' shortcode in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    18/10/2024
    18/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.40

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170741%40arconix-shortcodes&new=3170741%40arconix-shortcodes

  • https://www.wordfence.com/threat-intel/vulnerabilities/id/ef395956-477c-4970-becd-4f437e4807a3?source=cve

    • Enviar en el boletín
    Off

    CVE-2024-9206

    CVE-2024-9206

    Título es
    CVE-2024-9206

    Vie, 18/10/2024 – 07:15

    Tipo
    CWE-79

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-9206

    Descripción en
    The MAS Companies For WP Job Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

    18/10/2024
    18/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.10

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://plugins.trac.wordpress.org/browser/mas-wp-job-manager-company/tags/1.0.13/templates/company-dashboard.php#L99

  • https://plugins.trac.wordpress.org/changeset/3170459/

  • https://www.wordfence.com/threat-intel/vulnerabilities/id/dc277e7c-86ec-448f-a91e-e4d12a4b4177?source=cve

    • Enviar en el boletín
    Off

    CVE-2024-10118

    CVE-2024-10118

    Título es
    CVE-2024-10118

    Vie, 18/10/2024 – 04:15

    Tipo
    CWE-78

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-10118

    Descripción en
    SECOM WRTR-304GN-304TW-UPSC does not properly filter user input in the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.

    18/10/2024
    18/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    9.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    CRITICAL

    Referencias

  • https://www.twcert.org.tw/en/cp-139-8155-c1ea6-2.html

  • https://www.twcert.org.tw/tw/cp-132-8154-69fa5-1.html

    • Enviar en el boletín
    Off

    CVE-2024-9264

    CVE-2024-9264

    Título es
    CVE-2024-9264

    Vie, 18/10/2024 – 04:15

    Tipo
    CWE-94

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-9264

    Descripción en
    The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

    18/10/2024
    18/10/2024
    Vector CVSS:4.0
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

    Gravedad 4.0
    9.40

    Gravedad 4.0 txt
    CRITICAL

    Gravedad 3.1 (CVSS 3.1 Base Score)
    9.90

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    CRITICAL

    Referencias

  • https://grafana.com/security/security-advisories/cve-2024-9264/

    • Enviar en el boletín
    Off

    CVE-2024-10093

    CVE-2024-10093

    Título es
    CVE-2024-10093

    Jue, 17/10/2024 – 23:15

    Tipo
    CWE-427

    Gravedad v2.0
    6.80

    Gravedad 2.0 Txt
    MEDIUM

    Título en

    CVE-2024-10093

    Descripción en
    A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83. Affected is an unknown function in the library avcodec.dll of the file ConvertXtoDvd.exe. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

    18/10/2024
    18/10/2024
    Vector CVSS:4.0
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    Vector CVSS:3.1
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Vector CVSS:2.0
    AV:L/AC:L/Au:S/C:C/I:C/A:C

    Gravedad 4.0
    8.50

    Gravedad 4.0 txt
    HIGH

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://vuldb.com/?ctiid_280758=

  • https://vuldb.com/?id_280758=

  • https://vuldb.com/?submit_420798=

    • Enviar en el boletín
    Off

    CVE-2024-43566

    CVE-2024-43566

    Título es
    CVE-2024-43566

    Jue, 17/10/2024 – 23:15

    Tipo
    CWE-190

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-43566

    Descripción en
    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    18/10/2024
    18/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.50

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43566

    • Enviar en el boletín
    Off

    CVE-2024-43580

    CVE-2024-43580

    Título es
    CVE-2024-43580

    Jue, 17/10/2024 – 23:15

    Tipo
    CWE-357

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-43580

    Descripción en
    Microsoft Edge (Chromium-based) Spoofing Vulnerability

    18/10/2024
    18/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.40

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43580

    • Enviar en el boletín
    Off

    CVE-2024-43579

    CVE-2024-43579

    Título es
    CVE-2024-43579

    Jue, 17/10/2024 – 23:15

    Tipo
    CWE-122

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-43579

    Descripción en
    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    18/10/2024
    18/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.60

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43579

    • Enviar en el boletín
    Off

    CVE-2024-43578

    CVE-2024-43578

    Título es
    CVE-2024-43578

    Jue, 17/10/2024 – 23:15

    Tipo
    CWE-122

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-43578

    Descripción en
    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    18/10/2024
    18/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.60

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43578

    • Enviar en el boletín
    Off