CVEs published November 6, 2024
93 CVEs were published on November 6, 2024: 8 critical, 11 high.
- Published
- 93
- Critical
- 8
- High
- 11
- Medium
- 63
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Samsung Mobile Devices
- 14
- Cisco Identity Services Engine Software
- 12
- D-Link DNS-320 · D-Link DNS-320LW +2
- 3
- Cisco IP Phones with Multiplatform Firmware · Cisco Session…
- 2
- Ericsson CodeChecker · codechecker
- 2
- eyecix JobSearch WP Job Board
- 2
- Google Chrome
- 2
- MonoCMS
- 2
- twigphp Twig · twig/twig
- 2
- ansible-core · Red Hat Ansible Automation Platform Execu… +4
- 1
Critical 8
- CVE-2024-51757Fixes security vulnerability that allowed for server side code to be executed by a <script> tagcapricorn86 happy-dom · happy-dom
- CVE-2024-20418Cisco Ultra-Reliable Wireless Backhaul Software Command Injection VulnerabilityCisco Aironet Access Point Software
- CVE-2024-10081CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.Ericsson CodeChecker · codechecker
- CVE-2024-10915D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionD-Link DNS-320 · D-Link DNS-320LW +2
- CVE-2024-10914D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injectionD-Link DNS-320 · D-Link DNS-320LW +2
- CVE-2024-8615WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Uploadeyecix JobSearch WP Job Board
- CVE-2024-8614WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Uploadeyecix JobSearch WP Job Board
- CVE-2024-9307mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Filesthemelooks mFolio Lite
High 11
- CVE-2024-50340Ability to change environment from query in symfony/runtimesymfony · symfony/runtime +1
- CVE-2024-20536Cisco Nexus Dashboard Fabric Controller SQL Injection VulnerabilityCisco Data Center Network Manager
- CVE-2024-20484Cisco Enterprise Chat and Email Denial of Service VulnerabilityCisco Enterprise Chat and Email
- CVE-2024-10827Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2024-10826Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heGoogle Chrome
- CVE-2024-6861Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql apiforeman · Red Hat Satellite 6.12 for RHEL +1
- CVE-2024-10082CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.Ericsson CodeChecker · codechecker
- CVE-2020-11859Potential Cross Site Scripting vulnerability in OpenText iManagerOpenText iManager
- CVE-2024-9946Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth providerthe_champ Social Share, Social Login and Social Comments Pl…
- CVE-2024-10020Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth providerHeateor Social Login WordPress
- CVE-2024-48325Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class.
Medium, low and unrated 74
- CVE-2024-10928MonoCMS Posts Page opensaved.php cross site scriptingMonoCMS
- CVE-2024-10927MonoCMS Account Information Page account.php cross site scriptingMonoCMS
- CVE-2024-50341Security::login does not take into account custom user_checker in symfony/security-bundlesymfony · symfony/security-bundle +1
- CVE-2024-50342Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-clientsymfony · symfony/http-client +1
- CVE-2024-50343Incorrect response from Validator when input ends with `\n` in symfony/validatorsymfony · symfony/symfony +1
- CVE-2024-10926IBPhoenix ibWebAdmin Tabelas Section toggle_fold_panel.php cross site scriptingIBPhoenix ibWebAdmin
- CVE-2024-50345Open redirect via browser-sanitized URLs in symfony/http-foundationsymfony · symfony/http-foundation
- CVE-2024-51736Command execution hijack on Windows with Process class in symfony/processsymfony · symfony/process +1
- CVE-2024-10941A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash.Mozilla Firefox
- CVE-2024-51754Unguarded calls to __toString() when nesting an object into an array in Twigtwigphp Twig · twig/twig
- CVE-2024-51755Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twigtwigphp Twig · twig/twig
- CVE-2024-51988HTTP API's queue deletion endpoint does not verify that the user has a required permissionrabbitmq-server
- CVE-2024-51751Arbitrary file read with File and UploadButton components in Gradiogradio-app gradio · gradio
- CVE-2024-10318NGINX OpenID Connect VulnerabilityF5 NGINX OpenID Connect · F5 NGINX Instance Manager +2
- CVE-2024-20540Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting VulnerabilityCisco Unified Contact Center Management Portal
- CVE-2024-20539Cisco Identity Services Engine Stored Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20538Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20537Cisco Identity Services Engine Authorization Bypass VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20534Cisco IP Phone 6800, 7800, 8800, and 9800 Series with Multiplatform Firmware Stored Cross-Site Scripting VulnerabilityCisco IP Phones with Multiplatform Firmware · Cisco Session…
- CVE-2024-20533Cisco IP Phone 6800, 7800, 8800, and 9800 Series with Multiplatform Firmware Stored Cross-Site Scripting VulnerabilitiesCisco IP Phones with Multiplatform Firmware · Cisco Session…
- CVE-2024-20532Cisco Identity Services Engine Arbitrary File Read and Delete VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20531Cisco Identity Services Engine XML External Entity Injection VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20530Cisco Identity Services Engine Reflected Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20529Cisco Identity Services Engine Arbitrary File Read and Delete VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20528Cisco Identity Services Engine Path Traversal VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20527Cisco Identity Services Engine Arbitrary File Read and Delete VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20525Cisco Identity Services Engine Reflected Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20514Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2024-20511Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2024-20507Cisco Meeting Management Information Disclosure VulnerabilityCisco Meeting Management
- CVE-2024-20504Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting VulnerabilitiesCisco Secure Email · Cisco Secure Web Appliance
- CVE-2024-20487Cisco Identity Services Engine Stored Cross-Site Scripting VulnerabiliyCisco Identity Services Engine Software
- CVE-2024-20457Cisco Unified Communications Manager IM & Presence Service Information Disclosure VulnerabilityCisco Unified Communications Manager IM and Presence Service
- CVE-2024-20445Cisco IP Phone 7800, 8800, and 9800 Series Information Disclosure VulnerabilityCisco Session Initiation Protocol (SIP) Software
- CVE-2024-20476Cisco Identity Services Engine Authorization Bypass VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20371Cisco Nexus 3550-F Switches Access Control List Programming VulnerabilityCisco Nexus 3550 System Software
- CVE-2024-10920mariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded keymariazevedo88 travels-java-api
- CVE-2024-10919didi Super-Jacoco triggerUnitCover os command injectiondidi Super-Jacoco
- CVE-2024-10916D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosureD-Link DNS-320 · D-Link DNS-320LW +2
- CVE-2024-35146IBM Maximo Application Suite cross-site scriptingIBM Maximo Application Suite
- CVE-2024-10186Event Post <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcodebastho Event post
- CVE-2024-8323Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attributefatcatapps Pricing Table WordPress Plugin – Easy Pricing Ta…
- CVE-2024-10168Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcoderealmag777 Active Products Tables for WooCommerce. Use cons…
- CVE-2024-10715MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Blockchrisvrichardson MapPress Maps for WordPress
- CVE-2024-9902Ansible-core: ansible-core user may read/write unauthorized contentansible-core · Red Hat Ansible Automation Platform Execu… +4
- CVE-2024-52043User enumeration in HubHubHumHub GmbH & Co. KG HumHub
- CVE-2024-9681HSTS subdomain overwrites parent cache entrycurl
- CVE-2024-6626EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorizationcscode EleForms – All In One Form Integration including DB…
- CVE-2024-10543Tumult Hype Animations <= 1.9.14 - Missing Authorizationtumultinc Tumult Hype Animations
- CVE-2024-10535Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletionnitramix Video Gallery for WooCommerce
- CVE-2024-9934Wp-ImageZoom <= 1.1.0 - Reflected XSSWp-ImageZoom
- CVE-2024-7879WP ULike < 4.7.5 - Admin+ Stored XSS via WidgetsWP ULike
- CVE-2024-49409Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write ouSamsung Mobile Devices
- CVE-2024-49408Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memoSamsung Mobile Devices
- CVE-2024-49407Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles.Samsung Mobile Samsung Flow
- CVE-2024-49406Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction.Samsung Mobile Blockchain Keystore
- CVE-2024-49405Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive informatiSamsung Mobile Samsung Pass
- CVE-2024-49404Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android Samsung Mobile Samsung Video Player
- CVE-2024-49403Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the locSamsung Mobile Samsung Voice Recorder
- CVE-2024-49402Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profilesSamsung Mobile Devices
- CVE-2024-49401Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities.Samsung Mobile Devices
- CVE-2024-34682Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance MSamsung Mobile Devices
- CVE-2024-34681Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local permanent denial of servSamsung Mobile Devices
- CVE-2024-34680Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive inforSamsung Mobile Devices
- CVE-2024-34679Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege.Samsung Mobile Devices
- CVE-2024-34678Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption.Samsung Mobile Devices
- CVE-2024-34677Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitiSamsung Mobile Devices
- CVE-2024-34676Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory coSamsung Mobile Devices
- CVE-2024-34675Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen.Samsung Mobile Devices
- CVE-2024-34674Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles.Samsung Mobile Devices
- CVE-2024-34673Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service.Samsung Mobile Devices
- CVE-2024-10647WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URLwestguard WS Form LITE – Drag & Drop Contact Form Builder
- CVE-2024-50637UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.unopim/unopim
- CVE-2024-51409Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network packet in a fixed fo