CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48744
https://notcve.org/view.php?id=CVE-2024-48744
16 Oct 2024 — A Reflected Cross Site Scripting (XSS) vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary code via "searchinput" POST request parameter. • https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Teachers%20Record/Reflected%20XSS.pdf • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48758
https://notcve.org/view.php?id=CVE-2024-48758
16 Oct 2024 — dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the addPro parameter of the component doAdminAction.php which allows a remote attacker to execute arbitrary code Se descubrió que dingfanzu CMS V1.0 contiene Cross-Site Request Forgery (CSRF) a través del parámetro addPro del componente doAdminAction.php que permite a un atacante remoto ejecutar código arbitrario. • https://github.com/Yllxx03/CVE/blob/main/CVE-2024-48758/CVE-2024-48758.md • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-9965
https://notcve.org/view.php?id=CVE-2024-9965
15 Oct 2024 — Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. • https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-21259 – Oracle VirtualBox TPM Heap-based Buffer Overflow Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2024-21259
15 Oct 2024 — An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the implementation of the virtual TPM device. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. • https://www.oracle.com/security-alerts/cpuoct2024.html • CWE-863: Incorrect Authorization •
CVSS: 4.8EPSS: 0%CPEs: 23EXPL: 0CVE-2024-21235 – JDK: Integer conversion error leads to incorrect range check (8332644)
https://notcve.org/view.php?id=CVE-2024-21235
15 Oct 2024 — This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. ... Multiple vulnerabilities have been discovered in OpenJDK, the worst of which could lead to remote code execution. • https://www.oracle.com/security-alerts/cpuoct2024.html • CWE-195: Signed to Unsigned Conversion Error •
CVSS: 3.7EPSS: 0%CPEs: 23EXPL: 0CVE-2024-21217 – JDK: Unbounded allocation leads to out-of-memory error (8331446)
https://notcve.org/view.php?id=CVE-2024-21217
15 Oct 2024 — This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. ... Multiple vulnerabilities have been discovered in OpenJDK, the worst of which could lead to remote code execution. • https://www.oracle.com/security-alerts/cpuoct2024.html • CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 3.7EPSS: 0%CPEs: 19EXPL: 0CVE-2024-21210 – JDK: Array indexing integer overflow (8328544)
https://notcve.org/view.php?id=CVE-2024-21210
15 Oct 2024 — This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. ... Multiple vulnerabilities have been discovered in OpenJDK, the worst of which could lead to remote code execution. • https://www.oracle.com/security-alerts/cpuoct2024.html • CWE-190: Integer Overflow or Wraparound CWE-203: Observable Discrepancy •
CVSS: 3.7EPSS: 0%CPEs: 21EXPL: 0CVE-2024-21208 – JDK: HTTP client improper handling of maxHeaderSize (8328286)
https://notcve.org/view.php?id=CVE-2024-21208
15 Oct 2024 — Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). ... Multiple vulnerabilities have been discovered in OpenJDK,... • https://www.oracle.com/security-alerts/cpuoct2024.html • CWE-130: Improper Handling of Length Parameter Inconsistency CWE-203: Observable Discrepancy •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-47674 – mm: avoid leaving partial pfn mappings around in error case
https://notcve.org/view.php?id=CVE-2024-47674
15 Oct 2024 — A physically proximate remote attacker could use this to cause a denial of service or possibly execute arbitrary code. ... A physically proximate remote attacker could use this to expose sensitive information. • https://git.kernel.org/stable/c/3213fdcab961026203dd587a4533600c70b3336b •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-45274 – MB connect line/Helmholz: Remote code execution via confnet service
https://notcve.org/view.php?id=CVE-2024-45274
15 Oct 2024 — An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication. • https://cert.vde.com/en/advisories/VDE-2024-056 • CWE-306: Missing Authentication for Critical Function •