Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-11-02 | CVE-2024-10540 | SQL Injection vulnerability in Reputeinfosystems Bookingpress The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'service' parameter of the bookingpress_form shortcode in all versions up to, and including, 1.1.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | 6.5 |
| 2024-11-02 | CVE-2024-8739 | Cross-site Scripting vulnerability in Wedevs Recaptcha Integration The ReCaptcha Integration for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.5. | 6.1 |
| 2024-11-02 | CVE-2024-9868 | Cross-site Scripting vulnerability in Bdthemes Element Pack The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate Widget 'url' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization and output escaping. | 5.4 |
| 2024-11-01 | CVE-2024-9191 | Incorrect Default Permissions vulnerability in Okta Verify The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. | 7.8 |
| 2024-11-01 | CVE-2024-44232 | Unspecified vulnerability in Apple products The issue was addressed with improved bounds checks. | 5.5 |
| 2024-11-01 | CVE-2024-44233 | Unspecified vulnerability in Apple products The issue was addressed with improved bounds checks. | 5.5 |
| 2024-11-01 | CVE-2024-44234 | Unspecified vulnerability in Apple products The issue was addressed with improved bounds checks. | 5.5 |
| 2024-11-01 | CVE-2024-48353 | Insecure Storage of Sensitive Information vulnerability in Yealink Meeting Server Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintext passwords based on the obtained key information. | 7.5 |
| 2024-11-01 | CVE-2024-51252 | OS Command Injection vulnerability in Draytek Vigor3900 Firmware 1.5.1.3 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function. | 9.8 |
| 2024-11-01 | CVE-2024-41738 | Unspecified vulnerability in IBM Txseries for Multiplatforms 10.1 IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques. | 5.9 |