CVEs published November 7, 2024
114 CVEs were published on November 7, 2024: 9 critical, 52 high.
- Published
- 114
- Critical
- 9
- High
- 52
- Medium
- 48
- Low
- 3
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Linux
- 34
- moodle · moodle/moodle
- 8
- Combodo iTop
- 3
- GitHub Enterprise Server
- 3
- HCL Software BigFix Compliance
- 3
- 1000 Projects Bookstore Management System
- 2
- Adobe Experience Manager
- 2
- emqx neuron
- 2
- Guangzhou Tuchuang Computer Software Development Interlib L…
- 2
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 1
Critical 9
- CVE-2024-47073Dataease arbitrary interface access vulnerabilitydataease
- CVE-2024-51504Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerApache Software Foundation Apache ZooKeeper · org.apache.zo…
- CVE-2024-50162bpf: devmap: provide rxq after redirectLinux
- CVE-2024-50154tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().Linux
- CVE-2024-50152smb: client: fix possible double free in smb2_set_ea()Linux
- CVE-2024-51990Path traversal via crafted Git repositories in jjmartinvonz jj · jj-lib
- CVE-2019-20457An issue was discovered on Brother MFC-J491DW C1806180757 devices.
- CVE-2019-20461An issue was discovered on Alecto IVM-100 2019-11-12 devices.
- CVE-2024-50766SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter.
High 52
- CVE-2024-47072XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input streamx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2024-51998Path traversal using file URI scheme without supplying hostname in changedetection.iodgtlmoon changedetection.io · changedetection-io
- CVE-2024-8424WatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEMWatchGuard Endpoint Security · WatchGuard Panda Dome
- CVE-2024-8810Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write accessGitHub Enterprise Server
- CVE-2024-10975Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write PermissionHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2024-10007Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationGitHub Enterprise Server
- CVE-2024-51994Cross-site Scripting in portal picture upload in Combodo iTopCombodo iTop
- CVE-2024-51995Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTopCombodo iTop
- CVE-2024-51989Cross-site Scripting (XSS) Vulnerability in PasswordPusherpglombardo PasswordPusher
- CVE-2024-45794SQL Injection in CreateUser API in devtrondevtron-labs devtron · github.com/devtron-labs/devtron
- CVE-2024-40715A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypasVeeam Enterprise Manager
- CVE-2024-10963Pam: improper hostname interpretation in pam_access leads to access control bypasspam · Red Hat Enterprise Linux +2
- CVE-2024-43440Moodle: lfi vulnerability when restoring malformed block backupsmoodle · moodle/moodle
- CVE-2024-43438Moodle: idor in feedback non-respondents report allows messaging arbitrary site usersmoodle · moodle/moodle
- CVE-2024-43436Moodle: site administration sql injection via xmldb editormoodle · moodle/moodle
- CVE-2024-43434Moodle: csrf risk in feedback non-respondents reportmoodle · moodle/moodle
- CVE-2024-43431Moodle: idor in badges allows deletion of arbitrary badgesmoodle · moodle/moodle
- CVE-2024-43428Moodle: cache poisoning via injection into storagemoodle · moodle/moodle
- CVE-2024-43426Moodle: arbitrary file read risk through pdftexmoodle · moodle/moodle
- CVE-2024-43425Moodle: remote code execution via calculated question typesmoodle · moodle/moodle
- CVE-2024-24914Authenticated Gaia users can inject code or commands by global variables through special HTTP requests.checkpoint ClusterXL, Multi-Domain Security Management, Qua…
- CVE-2024-10526Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor ServiceRapid7 Velociraptor
- CVE-2023-1973Undertow: unrestricted request storage leads to memory exhaustionRed Hat JBoss Enterprise Application Platform · io.undertow…
- CVE-2024-50170net: bcmasp: fix potential memory leak in bcmasp_xmit()Linux
- CVE-2024-50165bpf: Preserve param->string when parsing mount optionsLinux
- CVE-2024-50164bpf: Fix overloading of MEM_UNINIT's meaningLinux
- CVE-2024-50161bpf: Check the remaining info_cnt before repeating btf fieldsLinux
- CVE-2024-50159firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()Linux
- CVE-2024-50158RDMA/bnxt_re: Fix out of bound checkLinux
- CVE-2024-50155netdevsim: use cond_resched() in nsim_dev_trap_report_work()Linux
- CVE-2024-50151smb: client: fix OOBs when building SMB2_IOCTL requestLinux
- CVE-2024-50150usb: typec: altmode should keep reference to parentLinux
- CVE-2024-50149drm/xe: Don't free job in TDRLinux
- CVE-2024-50145octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()Linux
- CVE-2024-50143udf: fix uninit-value use in udf_get_fileshortadLinux
- CVE-2024-50141ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and contextLinux
- CVE-2024-50139KVM: arm64: Fix shift-out-of-bounds bugLinux
- CVE-2024-10203Agent Arbitrary File DeletionManageEngine EndPoint Central
- CVE-2024-38286Apache Tomcat: Denial of ServiceApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2019-20458An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices.
- CVE-2019-20459An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices.
- CVE-2019-20460An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices.
- CVE-2020-11919An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14.
- CVE-2020-11921An issue was discovered in Lush 2 through 2020-02-25.
- CVE-2020-11926An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25.
- CVE-2024-36063The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place
- CVE-2024-46960The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execut
- CVE-2024-46961The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to ex
- CVE-2024-48950An issue was discovered in Logpoint before 7.5.0.
- CVE-2024-48951An issue was discovered in Logpoint before 7.5.0.
- CVE-2024-48953An issue was discovered in Logpoint before 7.5.0.
- CVE-2024-51428An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.
Medium, low and unrated 53
- CVE-2024-51987HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnectDuendeSoftware Duende.AccessTokenManagement · Duende.Access…
- CVE-2024-49523Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-49524Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-10824Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert DataGitHub Enterprise Server
- CVE-2024-109691000 Projects Bookstore Management System Login login_process.php sql injection1000 Projects Bookstore Management System
- CVE-2024-109681000 Projects Bookstore Management System contact_process.php sql injection1000 Projects Bookstore Management System
- CVE-2024-10967code-projects E-Health Care System delete_user_appointment_request.php sql injectioncode-projects E-Health Care System
- CVE-2024-10966TOTOLINK X18 cstecgi.cgi os command injectionTOTOLINK X18
- CVE-2024-51993Password is stored in clear in the database in Combodo iTopCombodo iTop
- CVE-2024-51758Exported files stored in default (`public`) filesystem if not reconfigured in filamentfilamentphp filament · filament/actions
- CVE-2024-10965emqx neuron JSON File schema information disclosureemqx neuron
- CVE-2024-10964emqx neuron plugin_handle.c handle_add_plugin buffer overflowemqx neuron
- CVE-2024-10668Auth Bypass in QuickshareGoogle Nearby
- CVE-2024-8378Safe SVG < 2.2.6 - Author+ SVG Sanitisation BypassSafe SVG
- CVE-2024-9926Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback AccessJetpack
- CVE-2024-8442Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widgetbdthemes Prime Slider – Addons for Elementor
- CVE-2023-1932Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xssRed Hat A-MQ Clients · Red Hat Cryostat +22
- CVE-2024-50172RDMA/bnxt_re: Fix a possible memory leakLinux
- CVE-2024-50171net: systemport: fix potential memory leak in bcm_sysport_xmit()Linux
- CVE-2024-50169vsock: Update rx_bytes on read_skb()Linux
- CVE-2024-50168net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()Linux
- CVE-2024-50167be2net: fix potential memory leak in be_xmit()Linux
- CVE-2024-50166fsl/fman: Fix refcount handling of fman-related devicesLinux
- CVE-2024-50163bpf: Make sure internal and UAPI bpf_redirect flags don't overlapLinux
- CVE-2024-50160ALSA: hda/cs8409: Fix possible NULL dereferenceLinux
- CVE-2024-50157RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loopLinux
- CVE-2024-50156drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()Linux
- CVE-2024-50153scsi: target: core: Fix null-ptr-deref in target_alloc_device()Linux
- CVE-2024-50148Bluetooth: bnep: fix wild-memory-access in proto_unregisterLinux
- CVE-2024-50147net/mlx5: Fix command bitmask initializationLinux
- CVE-2024-50146net/mlx5e: Don't call cleanup on profile rollback failureLinux
- CVE-2024-50144drm/xe: fix unbalanced rpm put() with fence_fini()Linux
- CVE-2024-50142xfrm: validate new SA's prefixlen using SA family when sel.family is unsetLinux
- CVE-2024-50140sched/core: Disable page allocation in task_tick_mm_cid()Linux
- CVE-2024-30142HCL BigFix Compliance is affected by a missing secure flag on a cookieHCL Software BigFix Compliance
- CVE-2024-30141HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive informationHCL Software BigFix Compliance
- CVE-2024-30140HCL BigFix Compliance is affected by unvalidated redirects and forwardsHCL Software BigFix Compliance
- CVE-2024-10027WP Booking Calendar < 10.6.3 - Admin+ Stored XSSWP Booking Calendar
- CVE-2024-10947Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System BatchOrder sql injectionGuangzhou Tuchuang Computer Software Development Interlib L…
- CVE-2024-10946Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System SysLib sql injectionGuangzhou Tuchuang Computer Software Development Interlib L…
- CVE-2019-20462An issue was discovered on Alecto IVM-100 2019-11-12 devices.
- CVE-2019-20469An issue was discovered on One2Track 2019-12-08 devices.
- CVE-2019-20472An issue was discovered on One2Track 2019-12-08 devices.
- CVE-2020-11916An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14.
- CVE-2020-11917An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14.
- CVE-2020-11918An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14.
- CVE-2024-36062The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no pe
- CVE-2024-36064The NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (wi
- CVE-2024-48290An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) v
- CVE-2024-48952An issue was discovered in Logpoint before 7.5.0.
- CVE-2024-48954An issue was discovered in Logpoint before 7.5.0.
- CVE-2024-50599A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the we
- CVE-2024-51434Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.froala-editor · froala/wysiwyg-editor