CVEs published November 4, 2024
148 CVEs were published on November 4, 2024: 18 critical, 53 high.
- Published
- 148
- Critical
- 18
- High
- 53
- Medium
- 74
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Qualcomm Snapdragon
- 22
- PHPGurukul Online Shopping Portal
- 7
- Combodo iTop
- 6
- Brokerage Technology Solutions Wave
- 5
- MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…
- 4
- MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…
- 4
- code-projects University Event Management System
- 2
- Codezips Online Institute Management System
- 2
- MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…
- 2
- MediaTek MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT…
- 2
Critical 18
- CVE-2024-51501CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributesreactiveui refit · Refit
- CVE-2024-50523WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerabilityRainbowLink All Post Contact Form
- CVE-2024-50525WordPress Helloprint plugin <= 2.0.4 - Arbitrary File Upload vulnerabilityHelloprint
- CVE-2024-50526WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerabilityLindeni Mahlalela Multi Purpose Mail Form
- CVE-2024-50527WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Arbitrary File Upload vulnerabilityStacks Mobile App Builder
- CVE-2024-50529WordPress Training – Courses plugin <= 2.0.1 - Arbitrary File Upload vulnerabilityrudrainn Training – Courses
- CVE-2024-50530WordPress Stars SMTP Mailer plugin <= 2.2.1 - Arbitrary File Upload vulnerabilityMyriad Solutionz Stars SMTP Mailer
- CVE-2024-50531WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerabilitydavidfcarr RSVPMaker for Toastmasters
- CVE-2024-51561Authentication bypass Vulnerability in AeroBrokerage Technology Solutions Aero
- CVE-2024-51558Brute Force Attack Vulnerability in Wave 2.0Brokerage Technology Solutions Wave
- CVE-2024-10035Code Injection in BG-TEK's CoslatV3BG-TEK Informatics Security Technologies CoslatV3
- CVE-2024-51661WordPress Media Library Assistant plugin <= 3.19 - Remote Code Execution (RCE) vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2024-23590Apache Kylin: Session fixation in web interfaceApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2024-48050In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression.agentscope
- CVE-2024-48061langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on thlangflow
- CVE-2024-51127An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.org.hornetq:hornetq-core-client
- CVE-2024-51136An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbit
- CVE-2024-51327SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Inje
High 53
- CVE-2024-31998CSRF security issue on CSV import in Combodo iTopCombodo iTop
- CVE-2024-31448Cross-site Scripting vulnerability in link CSV import in Combodo iTopCombodo iTop
- CVE-2023-34445Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTopCombodo iTop
- CVE-2023-34444Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTopCombodo iTop
- CVE-2023-34443Cross-site Scripting vulnerability in the run_query.php page in Combodo iTopCombodo iTop
- CVE-2024-51734User data deletion by anoynmous users in Zopezopefoundation AccessControl · accesscontrol +1
- CVE-2024-51626WordPress Woocommerce Quote Calculator plugin <= 1.1 - SQL Injection vulnerabilitychenyenming Woocommerce Quote Calculator
- CVE-2024-51672WordPress BetterLinks plugin <= 2.1.7 - SQL Injection vulnerabilityWPDeveloper BetterLinks
- CVE-2024-50528WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Sensitive Data Exposure vulnerabilityStacks Mobile App Builder
- CVE-2024-51582WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerabilityThimPress WP Hotel Booking
- CVE-2024-51560Improper Error Handling Vulnerability in Wave 2.0Brokerage Technology Solutions Wave
- CVE-2024-51559Improper Access Control Vulnerability in Wave 2.0Brokerage Technology Solutions Wave
- CVE-2024-51557No Rate Limiting Vulnerability in Wave 2.0Brokerage Technology Solutions Wave
- CVE-2024-51556Sensitive Information Disclosure Vulnerability in Wave 2.0Brokerage Technology Solutions Wave
- CVE-2024-36485SQL InjectionManageEngine ADAudit Plus
- CVE-2024-48878SQL InjectionManageEngine ADManager Plus
- CVE-2024-38424Use After Free in GPSQualcomm Snapdragon
- CVE-2024-38423Buffer Copy Without Checking Size of Input in Graphics LinuxQualcomm Snapdragon
- CVE-2024-38422Integer Overflow to Buffer Overflow in AudioQualcomm Snapdragon
- CVE-2024-38421Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-38419Use After Free in Automotive GPUQualcomm Snapdragon
- CVE-2024-38415Use After Free in Computer VisionQualcomm Snapdragon
- CVE-2024-38410Stack-based Buffer Overflow in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-38409Buffer Copy Without Checking Size of Input in WLAN Windows HostQualcomm Snapdragon
- CVE-2024-38408Cryptographic Issues in BT ControllerQualcomm Snapdragon
- CVE-2024-38407Time-of-check Time-of-use (TOCTOU) Race Condition in CameraQualcomm Snapdragon
- CVE-2024-38406Time-of-check Time-of-use (TOCTOU) Race Condition in CameraQualcomm Snapdragon
- CVE-2024-38405Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-38403Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2024-33068Use After Free in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-23385Reachable Assertion in ModemQualcomm Snapdragon
- CVE-2024-20104In da, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…
- CVE-2024-10750Tenda i22 SysToo websReadEvent null pointer dereferenceTenda i22
- CVE-2024-30616Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile.
- CVE-2024-30619Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control.
- CVE-2024-45882DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability.
- CVE-2024-45884DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability.
- CVE-2024-45885DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability.
- CVE-2024-45887DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability.
- CVE-2024-45888DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability.
- CVE-2024-45889DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability.
- CVE-2024-45890DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` paramet
- CVE-2024-45891DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability.
- CVE-2024-45893DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability.
- CVE-2024-48336The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh
- CVE-2024-48809An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service vi
- CVE-2024-51246In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the do
- CVE-2024-51249In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the re
- CVE-2024-51251In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ba
- CVE-2024-51253In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the do
- CVE-2024-51326SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2'
- CVE-2024-51329A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a cra
- CVE-2024-51408AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadat
Medium, low and unrated 77
- CVE-2024-32870iTop hub connector Information disclosureCombodo iTop
- CVE-2024-50346WebFeed HTML injection vulnerabilitiestaoso webfeed
- CVE-2024-51498[@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instanceimputnet cobalt
- CVE-2024-51500Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmwaremeshtastic firmware
- CVE-2024-51502Panic Vulnerability in loona-hpackbearcove loona · loona-hpack
- CVE-2024-10805code-projects University Event Management System doedit.php sql injectioncode-projects University Event Management System
- CVE-2024-51744Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwtgolang-jwt jwt · github.com/golang-jwt/jwt/v4
- CVE-2024-10791Codezips Hospital Appointment System doctorAction.php sql injectionCodezips Hospital Appointment System
- CVE-2024-45086IBM WebSphere Application Server XML external entity injectionIBM WebSphere Application Server
- CVE-2024-10768PHPGurukul Online Shopping Portal two_tables.php cross site scriptingPHPGurukul Online Shopping Portal
- CVE-2024-10766Codezips Free Exam Hall Seating Management System save_user.php unrestricted uploadCodezips Free Exam Hall Seating Management System
- CVE-2024-10765Codezips Online Institute Management System profile.php unrestricted uploadCodezips Online Institute Management System
- CVE-2024-10764Codezips Online Institute Management System save_user.php unrestricted uploadCodezips Online Institute Management System
- CVE-2024-51677WordPress Knowledge Base plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityAjay Knowledge Base
- CVE-2024-51678WordPress Elo Rating Shortcode plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityMarcel Pol Elo Rating Shortcode
- CVE-2024-51680WordPress Cresta Addons for Elementor plugin <= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerabilityCrestaProject Cresta Addons for Elementor
- CVE-2024-51681WordPress WP Pocket URLs plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityCodeRevolution WP Pocket URLs
- CVE-2024-51682WordPress HT Builder – WordPress Theme Builder for Elementor plugin <= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerabilityHasThemes HT Builder – WordPress Theme Builder for Elementor
- CVE-2024-51683WordPress Custom post type templates for Elementor plugin <= 1.10.1 - Stored Cross Site Scripting (XSS) vulnerabilityMichael Custom post type templates for Elementor
- CVE-2024-51685WordPress Accordion title for Elementor plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityMichael Gangolf Accordion title for Elementor
- CVE-2024-51665WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerabilityNoor Alam Magical Addons For Elementor
- CVE-2024-9147HTML Injection in Bna Informatics' PosPratikBna Informatics PosPratik
- CVE-2024-10523Information Disclosure Vulnerability in TP-Link IoT Smart HubTP-Link Tapo H100 IoT Smart Hub
- CVE-2024-10389Path Traversal in SafearchiveGoogle Safearchive · github.com/google/safearchive
- CVE-2024-33033Use After Free in ComputerVisionQualcomm Snapdragon
- CVE-2024-33032Improper Validation of Array Index in Camera_LinuxQualcomm Snapdragon
- CVE-2024-33031Improper Input Validation in RILQualcomm Snapdragon
- CVE-2024-33030Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in PerformanceQualcomm Snapdragon
- CVE-2024-33029Use After Free in DSP ServicesQualcomm Snapdragon
- CVE-2024-23386Improper Input Validation in VideoQualcomm Snapdragon
- CVE-2024-23377Use of Out-of-range Pointer Offset in ComputerVisionQualcomm Snapdragon
- CVE-2024-10761Umbraco CMS Dashboard frame cross site scriptingUmbraco CMS · Umbraco.Cms +1
- CVE-2024-10760code-projects University Event Management System dodelete.php sql injectioncode-projects University Event Management System
- CVE-2024-10759itsourcecode Farm Management System edit-pig.php sql injectionitsourcecode Farm Management System
- CVE-2024-10758code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injectioncode-projects Content Management System · code-projects… +2
- CVE-2024-10757PHPGurukul Online Shopping Portal js_data.php cross site scriptingPHPGurukul Online Shopping Portal
- CVE-2024-10756PHPGurukul Online Shopping Portal html_table.php cross site scriptingPHPGurukul Online Shopping Portal
- CVE-2024-10755PHPGurukul Online Shopping Portal empty_table.php cross site scriptingPHPGurukul Online Shopping Portal
- CVE-2024-10754PHPGurukul Online Shopping Portal dymanic_table.php cross site scriptingPHPGurukul Online Shopping Portal
- CVE-2024-10753PHPGurukul Online Shopping Portal dom_data_two_headers.php cross site scriptingPHPGurukul Online Shopping Portal
- CVE-2024-20124In vdec, there is a possible out of bounds read due to improper structure design.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…
- CVE-2024-20123In vdec, there is a possible out of bounds read due to improper structure design.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…
- CVE-2024-20122In vdec, there is a possible out of bounds read due to improper structure design.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…
- CVE-2024-20121In KeyInstall, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT…
- CVE-2024-20120In KeyInstall, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT…
- CVE-2024-20119In mms, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…
- CVE-2024-20118In mms, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…
- CVE-2024-20117In vdec, there is a possible out of bounds read due to improper structure design.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…
- CVE-2024-20115In ccu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT…
- CVE-2024-20114In ccu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…
- CVE-2024-20113In ccu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT8188, MT8195
- CVE-2024-20112In isp, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6878, MT6886, MT6897, MT6985, MT8676
- CVE-2024-20111In ccu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…
- CVE-2024-20110In ccu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…
- CVE-2024-20109In ccu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…
- CVE-2024-20108In atci, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-20107In da, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…
- CVE-2024-20106In m4u, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6785, MT…
- CVE-2024-10752Codezips Pet Shop Management System productsadd.php sql injectionCodezips Pet Shop Management System
- CVE-2024-10751Codezips ISP Management System pay.php sql injectionCodezips ISP Management System
- CVE-2024-10749ThinkAdmin Plugs.php script deserializationThinkAdmin
- CVE-2024-10748Cosmote Greece What's Up App Realm Database RealmDB.java default keyCosmote Greece What's Up App
- CVE-2024-10747PHPGurukul Online Shopping Portal dom_data_th.php cross site scriptingPHPGurukul Online Shopping Portal
- CVE-2024-30617A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request tha
- CVE-2024-30618A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web b
- CVE-2024-34882Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP acco
- CVE-2024-34883Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-serve
- CVE-2024-34885Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP acco
- CVE-2024-34887Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDA
- CVE-2024-34891Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange a
- CVE-2024-45164Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch an
- CVE-2024-45185An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200,
- CVE-2024-48052In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability.gradio
- CVE-2024-48057localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS).github.com/mudler/LocalAI
- CVE-2024-48059gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission.
- CVE-2024-48463Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs view
- CVE-2024-51328Cross Site Scripting vulnerability in addcategory.php in projectworld's Travel Management System v1.0 allows remote attacker to inject arbit