Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-24 11:44Z
2024-09-12
2024-09-12 09:15Z
CRIT

CVE-2024-8529 — Thimpress Learnpress: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-8529

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be use CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDThimpressVNDLearnpressTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-09-12
2024-09-12 09:15Z
CRIT

CVE-2024-8522 — Thimpress Learnpress: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-8522

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used CVSSv3.1 10.0 (CRITICAL)

CWECWE 89VNDThimpressVNDLearnpressTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2024-09-11
2024-09-11 17:15Z
HIGH

CVE-2024-44577 — Relyum Rely-pcie_firmware: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44577

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the time_date function. CVSSv3.1 8.8 (HIGH) · EPSS 62th percentile

CWECWE 77VNDRelyumVNDRelyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-09-11
2024-09-11 17:15Z
HIGH

CVE-2024-44574 — Relyum Rely-pcie_firmware: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44574

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_conf function. CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile

CWECWE 77VNDRelyumVNDRelyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-09-11
2024-09-11 17:15Z
HIGH

CVE-2024-44572 — Relyum Rely-pcie_firmware: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44572

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the sys_mgmt function. CVSSv3.1 8.8 (HIGH) · EPSS 61th percentile

CWECWE 77VNDRelyumVNDRelyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-09-11
2024-09-11 17:15Z
HIGH

CVE-2024-44571 — Relyum Rely-pcie_firmware: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44571

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService function at phpinf.php. CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile

CWECWE 284VNDRelyumVNDRelyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-09-11
2024-09-11 17:15Z
HIGH

CVE-2024-44570 — Relyum Rely-pcie_firmware: RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a code injection vulnerability via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44570

RELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a code injection vulnerability via the getParams function in phpinf.php. CVSSv3.1 8.8 (HIGH) · EPSS 38th percentile

CWECWE 77VNDRelyumVNDRelyTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-09-11
2024-09-11 16:15Z
CRIT

CVE-2024-45030 — Linux Linux_kernel: Address the issue by checking if 2K buffers are insufficient.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-45030

In the Linux kernel, the following vulnerability has been resolved: igb: cope with large MAX_SKB_FRAGS Sabrina reports that the igb driver does not cope well with large MAX_SKB_FRAG values: setting MAX_SKB_FRAG to 45 causes payload corruption on TX. An easy reproducer is to run ssh to connect to the machine. With MAX_SKB_FRAGS=17 it works, with MAX_SKB_FRAGS=45 it fails. This has been reported originally in https://bugzilla.redhat.com/show_bug.cgi?id=2265320 The root ca CVSSv3.1 9.8 (CRITICAL)

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-09-11
2024-09-11 16:15Z
CRIT

CVE-2024-45013 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-45013

In the Linux kernel, the following vulnerability has been resolved: nvme: move stopping keep-alive into nvme_uninit_ctrl() Commit 4733b65d82bd ("nvme: start keep-alive after admin queue setup") moves starting keep-alive from nvme_start_ctrl() into nvme_init_ctrl_finish(), but don't move stopping keep-alive into nvme_uninit_ctrl(), so keep-alive work can be started and keep pending after failing to start controller, finally use-after-free is triggered if nvme host driver is CVSSv3.1 9.8 (CRITICAL)

CWECWE 416TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-09-11
2024-09-11 16:15Z
HIGH

CVE-2024-45009 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-45009

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter helped to find a bug when running the "remove single subflow" subtest from the mptcp_join.sh selftest. Removing a 'subflow' endpoint will first trigger a RM_ADDR, then the subflow closure. Before this patch, and upon CVSSv3.1 8.2 (HIGH)

TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-09-11
2024-09-11 14:15Z
HIGH

CVE-2024-8642 — Eclipse Eclipse_dataspace_components: In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-8642

In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module "transfer-data-plane". The affected code was marked deprecated from the version 0.6.0 in favour of CVSSv3.1 8.1 (HIGH) · EPSS 30th percentile

CWECWE 287CWECWE 305CWECWE 303VNDEclipseTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-09-11
2024-09-11 05:15Z
HIGH

CVE-2024-21529 — Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-21529

Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program. CVSSv3.1 8.2 (HIGH) · EPSS 45th percentile

CWECWE 1321TYPVulnerability
8.2
CVSS v3.1
91
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-44667 — Shenzhen: Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-44667

Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to Incorrect Access Control. Unauthenticated factory mode reset and command injection leads to information exposure and root shell access. CVSSv3.1 8.0 (HIGH) · EPSS 45th percentile

CWECWE 863VNDShenzhenTYPVulnerability
8.0
CVSS v3.1
90
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-43479 — Microsoft Power_automate: Power Automate Desktop Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-43479

Microsoft Power Automate Desktop Remote Code Execution Vulnerability CVSSv3.1 8.5 (HIGH) · EPSS 56th percentile

CWECWE 284VNDMicrosoftTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-43469 — Microsoft Azure_cyclecloud: Azure CycleCloud Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-43469

Azure CycleCloud Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 73th percentile

CWECWE 94VNDMicrosoftVNDAzureTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-43461 — Microsoft Windows_10_1507: Windows MSHTML Platform Spoofing Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-43461in the wild

Windows MSHTML Platform Spoofing Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile

CWECWE 451VNDMicrosoftTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
100
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-43455 — Microsoft Windows_server_2008: Windows Remote Desktop Licensing Service Spoofing Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-43455

Windows Remote Desktop Licensing Service Spoofing Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 90th percentile

CWECWE 20VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-43454 — Microsoft Windows_server_2008: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-43454

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability CVSSv3.1 7.1 (HIGH) · EPSS 97th percentile

CWECWE 23VNDMicrosoftTYPVulnerability
7.1
CVSS v3.1
92
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-38260 — Microsoft Windows_server_2008: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38260

Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile

CWECWE 908VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-38259 — Microsoft Windows_11_21h2: Management Console Remote Code Execution Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38259

Microsoft Management Console Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 77th percentile

CWECWE 416VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-38240 — Microsoft Windows_10_1507: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38240

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 72th percentile

CWECWE 125VNDMicrosoftTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-38226 — Microsoft Office_2019: Publisher Security Feature Bypass Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38226in the wild

Microsoft Publisher Security Feature Bypass Vulnerability CVSSv3.1 7.3 (HIGH) · EPSS 84th percentile

CWECWE 693VNDMicrosoftTYPVulnerabilitySTAitw exploited
7.3
CVSS v3.1
87
Edit Score
2024-09-10
2024-09-10 17:15Z
HIGH

CVE-2024-38225 — Microsoft Dynamics_365_business_central: Dynamics 365 Business Central Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38225

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 69th percentile

CWECWE 287VNDMicrosoftTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-09-10
2024-09-10 17:15Z
CRIT

CVE-2024-38220 — Microsoft Azure_stack_hub: Azure Stack Hub Elevation of Privilege Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38220

Azure Stack Hub Elevation of Privilege Vulnerability CVSSv3.1 9.0 (CRITICAL) · EPSS 59th percentile

CWECWE 284VNDMicrosoftVNDAzureTYPVulnerability
9.0
CVSS v3.1
95
Edit Score
2024-09-10
2024-09-10 17:15Z
MED

CVE-2024-38217 — Microsoft Windows_10_1507: Windows Mark of the Web Security Feature Bypass Vulnerability

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-38217in the wild

Windows Mark of the Web Security Feature Bypass Vulnerability CVSSv3.1 5.4 (MEDIUM) · EPSS 95th percentile

CWECWE 693VNDMicrosoftTYPVulnerabilitySTAitw exploited
5.4
CVSS v3.1
80
Edit Score