CVEs published November 8, 2024
121 CVEs were published on November 8, 2024: 13 critical, 45 high.
- Published
- 121
- Critical
- 13
- High
- 45
- Medium
- 60
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Linux
- 38
- HASOMED Elefant
- 4
- 1000 Projects Bookstore Management System
- 3
- code-projects E-Health Care System
- 3
- Combodo iTop
- 3
- Dell Enterprise SONiC OS
- 3
- Dell PowerProtect DD
- 3
- pywasm3
- 3
- CodeAstro Real Estate Management System
- 2
- Codezips Hospital Appointment System
- 2
Critical 13
- CVE-2024-45763Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS CommDell Enterprise SONiC OS
- CVE-2024-45764Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability.Dell Enterprise SONiC OS
- CVE-2024-45765Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS CommDell Enterprise SONiC OS
- CVE-2024-50588Unprotected Exposed Firebird Database with default credentialsHASOMED Elefant
- CVE-2024-50206net: ethernet: mtk_eth_soc: fix memory corruption during fq dma initLinux
- CVE-2024-7982Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSSRegistrations for the Events Calendar
- CVE-2020-8007The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via th
- CVE-2023-27195Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func=UserfromUUID&uuid= to retrieve the last registration
- CVE-2024-35426vmir e8117 was discovered to contain a stack overflow via the init_local_vars function at /src/vmir_wasm_parser.c.
- CVE-2024-48073sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions.
- CVE-2024-50811hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd
- CVE-2024-50966dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin.
- CVE-2024-51211SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file.
High 45
- CVE-2024-52007XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +5
- CVE-2024-52009Git credentials are exposed in atlantis logsrunatlantis atlantis · github.com/runatlantis/atlantis
- CVE-2024-52000Reflected Cross-site Scripting exploit in Combodo iTopCombodo iTop
- CVE-2024-52002Cross-Site Request Forgery (CSRF) in several iTop pagesCombodo iTop
- CVE-2024-52004Remote code execution vulnerabilities in MediaCMSmediacms-io mediacms
- CVE-2024-51997The Attestation Results Token can be arbitrarily modified without being detected in Trusteeconfidential-containers trustee
- CVE-2024-9841OpenText ArcSight Management Center and ArcSight Platform Stored XSSOpenText ArcSight Management Center · OpenText ArcSight Pla…
- CVE-2024-50592Local Privilege Escalation via Race ConditionHASOMED Elefant Software Updater
- CVE-2024-50593Hardcoded Service PasswordHASOMED Elefant
- CVE-2024-50591Local Privilege Escalation via Command InjectionHASOMED Elefant Software Updater
- CVE-2024-50590Local Privilege Escalation via Weak Service Binary PermissionsHASOMED Elefant
- CVE-2024-50589Unprotected FHIR APIHASOMED Elefant
- CVE-2024-10839XML External EntityManageEngine SharePoint Manager Plus
- CVE-2024-24409Privilege EscalationManageEngine ADManager Plus
- CVE-2024-50211udf: refactor inode_bmap() to handle errorLinux
- CVE-2024-50209RDMA/bnxt_re: Add a check for memory allocationLinux
- CVE-2024-50208RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pagesLinux
- CVE-2024-50207ring-buffer: Fix reader locking when changing the sub buffer orderLinux
- CVE-2024-50203bpf, arm64: Fix address emission with tag-based KASAN enabledLinux
- CVE-2024-50200maple_tree: correct tree corruption on spanning storeLinux
- CVE-2024-50195posix-clock: Fix missing timespec64 check in pc_clock_settime()Linux
- CVE-2024-50193x86/entry_32: Clear CPU buffers after register restore in NMI returnLinux
- CVE-2024-50189HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()Linux
- CVE-2024-50188net: phy: dp83869: fix memory corruption when enabling fiberLinux
- CVE-2024-50187drm/vc4: Stop the active perfmon before being destroyedLinux
- CVE-2024-50186net: explicitly clear the sk pointer, when pf->create failsLinux
- CVE-2024-50185mptcp: handle consistently DSS corruptionLinux
- CVE-2024-50182secretmem: disable memfd_secret() if arch cannot set direct mapLinux
- CVE-2024-50180fbdev: sisfb: Fix strbuf array overflowLinux
- CVE-2024-50175media: qcom: camss: Remove use_count guard in stop_streamingLinux
- CVE-2024-50174drm/panthor: Fix race when converting group handle to group objectLinux
- CVE-2024-50173drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup()Linux
- CVE-2024-21538Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS)cross-spawn · org.webjars.npm:cross-spawn
- CVE-2024-25431An issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f allows a remote attacker to escalate privileges
- CVE-2024-27527wasm3 139076a is vulnerable to Denial of Service (DoS).pywasm3
- CVE-2024-27528wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution.pywasm3
- CVE-2024-27529wasm3 139076a contains memory leaks in Read_utf8.github.com/shareup/wasm-interpreter-apple · pywasm3 +1
- CVE-2024-27530wasm3 139076a contains a Use-After-Free in ForEachModule.pywasm3
- CVE-2024-27532wasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer Dereference in function `block_type_get_res
- CVE-2024-35422vmir e8117 was discovered to contain a heap buffer overflow via the wasm_call function at /src/vmir_wasm_parser.c.
- CVE-2024-35423vmir e8117 was discovered to contain a heap buffer overflow via the wasm_parse_section_functions function at /src/vmir_wasm_parser.c.
- CVE-2024-50634A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token
- CVE-2024-50808SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module,
- CVE-2024-50809The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands
- CVE-2024-51152File Upload vulnerability in Laravel CMS v.1.4.7 and before allows a remote attacker to execute arbitrary code via the shell.php a component
Medium, low and unrated 63
- CVE-2024-52001Portal user is able to access forbidden services information in Combodo iTopCombodo iTop
- CVE-2024-11026Intelligent Apps Freenow App Keystore SSL.java hard-coded passwordIntelligent Apps Freenow App
- CVE-2024-21994CVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)NetApp StorageGRID
- CVE-2024-50378Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cliApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-10325Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadbrainstormforce Ultimate Addons for Elementor
- CVE-2024-10187myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcodesaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2024-11000CodeAstro Real Estate Management System About Us Page aboutedit.php unrestricted uploadCodeAstro Real Estate Management System
- CVE-2024-10999CodeAstro Real Estate Management System About Us Page aboutadd.php unrestricted uploadCodeAstro Real Estate Management System
- CVE-2024-109981000 Projects Bookstore Management System process_category_add.php sql injection1000 Projects Bookstore Management System
- CVE-2024-109971000 Projects Bookstore Management System book_list.php sql injection1000 Projects Bookstore Management System
- CVE-2024-10269Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadbenjamin_zekavica Easy SVG Support
- CVE-2024-109961000 Projects Bookstore Management System process_category_edit.php sql injection1000 Projects Bookstore Management System
- CVE-2024-10995Codezips Hospital Appointment System removeDoctorResult.php sql injectionCodezips Hospital Appointment System
- CVE-2024-50210posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()Linux
- CVE-2024-50205ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()Linux
- CVE-2024-50204fs: don't try and remove empty rbtree nodeLinux
- CVE-2024-10994Codezips Online Institute Management System edit_user.php unrestricted uploadCodezips Online Institute Management System
- CVE-2024-50202nilfs2: propagate directory read errors from nilfs_find_entry()Linux
- CVE-2024-50201drm/radeon: Fix encoder->possible_clonesLinux
- CVE-2024-50199mm/swapfile: skip HugeTLB pages for unuse_vmaLinux
- CVE-2024-50198iio: light: veml6030: fix IIO device retrieval from embedded deviceLinux
- CVE-2024-50197pinctrl: intel: platform: fix error path in device_for_each_child_node()Linux
- CVE-2024-50196pinctrl: ocelot: fix system hang on level based interruptsLinux
- CVE-2024-50194arm64: probes: Fix uprobes for big-endian kernelsLinux
- CVE-2024-50192irqchip/gic-v4: Don't allow a VMOVP on a dying VPELinux
- CVE-2024-50191ext4: don't set SB_RDONLY after filesystem errorsLinux
- CVE-2024-50190ice: fix memleak in ice_init_tx_topology()Linux
- CVE-2024-50184virtio_pmem: Check device status before requesting flushLinux
- CVE-2024-50183scsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instanceLinux
- CVE-2024-10621Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodefullworks Simple Shortcode for Google Maps
- CVE-2024-10993Codezips Online Institute Management System manage_website.php unrestricted uploadCodezips Online Institute Management System
- CVE-2024-50179ceph: remove the incorrect Fw reference check when dirtying pagesLinux
- CVE-2024-50178cpufreq: loongson3: Use raw_smp_processor_id() in do_service_request()Linux
- CVE-2024-50177drm/amd/display: fix a UBSAN warning in DML2.1Linux
- CVE-2024-50176remoteproc: k3-r5: Fix error handling when power-up failedLinux
- CVE-2024-10991Codezips Hospital Appointment System editBranchResult.php sql injectionCodezips Hospital Appointment System
- CVE-2024-10990SourceCodester Online Veterinary Appointment System view_service.php sql injectionSourceCodester Online Veterinary Appointment System
- CVE-2024-10989code-projects E-Health Care System detail.php sql injectioncode-projects E-Health Care System
- CVE-2024-10988code-projects E-Health Care System doctor_login.php sql injectioncode-projects E-Health Care System
- CVE-2024-10987code-projects E-Health Care System user_appointment.php sql injectioncode-projects E-Health Care System
- CVE-2024-48010Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerability.Dell PowerProtect DD
- CVE-2024-45759Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of privilege vulnerabilDell PowerProtect DD
- CVE-2024-48011Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Dell PowerProtect DD
- CVE-2024-35410wac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac-asan/wa.c.
- CVE-2024-35418wac commit 385e1 was discovered to contain a heap overflow via the setup_call function at /wac-asan/wa.c.
- CVE-2024-35419wac commit 385e1 was discovered to contain a heap overflow via the load_module function at /wac-asan/wa.c.
- CVE-2024-35420wac commit 385e1 was discovered to contain a heap overflow.
- CVE-2024-35421vmir e8117 was discovered to contain a segmentation violation via the wasm_parse_block function at /src/vmir_wasm_parser.c.
- CVE-2024-35424vmir e8117 was discovered to contain a segmentation violation via the import_function function at /src/vmir_wasm_parser.c.
- CVE-2024-35425vmir e8117 was discovered to contain a segmentation violation via the function_prepare_parse function at /src/vmir_function.c.
- CVE-2024-35427vmir e8117 was discovered to contain a segmentation violation via the export_function function at /src/vmir_wasm_parser.c.
- CVE-2024-40239An incorrect access control issue in Life: Personal Diary, Journal android app 17.5.0 allows a physically proximate attacker to escalate pri
- CVE-2024-40240An incorrect access control issue in HomeServe Home Repair' android app - 3.3.4 allows a physically proximate attacker to escalate privilege
- CVE-2024-44765An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privil
- CVE-2024-46947Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.
- CVE-2024-46948Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control.
- CVE-2024-47190Northern.tech Hosted Mender before 2024.07.11 allows SSRF.
- CVE-2024-50810hopetree izone lts c011b48 contains a Cross Site Scripting (XSS) vulnerability in the article comment function.
- CVE-2024-51030A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to e
- CVE-2024-51031A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated use
- CVE-2024-51032A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authentica
- CVE-2024-51055An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component.
- CVE-2024-5115707FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component http://erp.07fly.net:80/oa/OaSchedule/add.ht