CVEs published November 11, 2024
114 CVEs were published on November 11, 2024: 22 critical, 30 high.
- Published
- 114
- Critical
- 22
- High
- 30
- Medium
- 58
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- moodle · moodle/moodle
- 8
- ampache
- 7
- D-Link DSL6740C
- 7
- Grand Vice info Webopac
- 4
- code-projects Job Recruitment
- 3
- Delta Electronics DIAScreen
- 3
- Helix Core
- 3
- Grand Vice info Webopac7
- 2
- kanboard
- 2
- Acronis Backup plugin for cPanel & WHM
- 1
Critical 22
- CVE-2024-51747Arbitrary File Read and Delete in kanboardkanboard
- CVE-2024-51748Remote code execution through language setting in kanboardkanboard
- CVE-2024-11068D-Link DSL6740C - Incorrect Use of Privileged APIsD-Link DSL6740C
- CVE-2024-11020Grand Vice info Webopac7 - SQL InjectionGrand Vice info Webopac7
- CVE-2024-11018Grand Vice info Webopac - Arbitrary File UploadGrand Vice info Webopac
- CVE-2024-11016Grand Vice info Webopac - SQL InjectionGrand Vice info Webopac
- CVE-2024-51788WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerabilityJoshua Wolfe The Novel Design Store Directory
- CVE-2024-51789WordPress Image Classify plugin <= 1.0.0 - Arbitrary File Upload vulnerabilityUjW0L Image Classify
- CVE-2024-51790WordPress HB AUDIO GALLERY plugin <= 3.0 - Arbitrary File Upload vulnerabilityHB WEBSOL HB AUDIO GALLERY
- CVE-2024-51791WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerabilityMade I.T. Forms
- CVE-2024-51792WordPress Audio Record plugin <= 1.0 - Arbitrary File Upload vulnerabilityDang Ngoc Binh Audio Record
- CVE-2024-51793WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerabilityAteeq Rafeeq RepairBuddy
- CVE-2024-25254SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter.
- CVE-2024-25255Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module.
- CVE-2024-36061EnGenius EWS356-FIT devices through 1.1.30 allow blind OS command injection.
- CVE-2024-44546Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter.
- CVE-2024-46962The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary
- CVE-2024-50636PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM
- CVE-2024-50667The boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/form
- CVE-2024-50989A SQL injection vulnerability in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System v1.0 allows an attacker to execute
- CVE-2024-51135An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensorg.powertac:server-interface
- CVE-2024-52533gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not suf
High 30
- CVE-2024-39354Delta Electronics DIAScreen Stack-based Buffer OverflowDelta Electronics DIAScreen
- CVE-2024-39605Delta Electronics DIAScreen Stack-based Buffer OverflowDelta Electronics DIAScreen
- CVE-2024-47131Delta Electronics DIAScreen Stack-based Buffer OverflowDelta Electronics DIAScreen
- CVE-2024-10314Unauthenticated Denial of Service via Auto Generation FunctionHelix Core
- CVE-2024-10344Unauthenticated Denial of Service via Refuse FunctionHelix Core
- CVE-2024-50263fork: only invoke khugepaged, ksm hooks if no errorLinux
- CVE-2024-10345Unauthenticated Denial of Service via Shutdown FunctionHelix Core
- CVE-2024-11067D-Link DSL6740C - Arbitrary File Reading through Path TraversalD-Link DSL6740C
- CVE-2024-11066D-Link DSL6740C - OS Command InjectionD-Link DSL6740C
- CVE-2024-11065D-Link DSL6740C - OS Command InjectionD-Link DSL6740C
- CVE-2024-11064D-Link DSL6740C - OS Command InjectionD-Link DSL6740C
- CVE-2024-11063D-Link DSL6740C - OS Command InjectionD-Link DSL6740C
- CVE-2024-11062D-Link DSL6740C - OS Command InjectionD-Link DSL6740C
- CVE-2024-11017Grand Vice info Webopac - Arbitrary File UploadGrand Vice info Webopac
- CVE-2024-51820WordPress L Squared Hub WP plugin <= 1.0 - SQL Injection vulnerabilitywplsquared L Squared Hub WP
- CVE-2024-51837WordPress WP Contest plugin <= 1.0.0 - SQL Injection vulnerabilitySophia M Williams WP Contest
- CVE-2024-51843WordPress Horsemanager plugin <= 1.3 - SQL Injection vulnerabilityfruitcakestudios Horsemanager
- CVE-2024-51845WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerabilityrichteam Share Buttons – Social Media
- CVE-2024-51882WordPress Gboy Custom Google Map plugin <= 1.2 - SQL Injection vulnerabilitygopalkumar315 Gboy Custom Google Map
- CVE-2024-11061Tenda AC10 fast_setting_wifi_set FUN_0044db3c stack-based overflowTenda AC10
- CVE-2024-25253Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module.
- CVE-2024-41992Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library funct
- CVE-2024-46963The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attac
- CVE-2024-46964The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaSc
- CVE-2024-46966The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbit
- CVE-2024-48322UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.
- CVE-2024-48939Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with
- CVE-2024-51186D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and
- CVE-2024-52530GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignor
- CVE-2024-52532GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption.
Medium, low and unrated 62
- CVE-2024-11079Ansible-core: unsafe tagging bypass via hostvars object in ansible-coreansible-core · Red Hat Ansible Automation Platform Execu… +2
- CVE-2024-23983Access rules for PingAccess may be circumvented with URL-encoded charactersPing Identity PingAccess
- CVE-2024-51484Insufficient Validation in Controllers (Activation/Deactivation) in Ampacheampache
- CVE-2024-51485Insufficient Validation in Plugins (Activation/Deactivation) in Ampacheampache
- CVE-2024-51486Stored Cross-Site Scripting in Ampacheampache
- CVE-2024-51487Insufficient Validation in Catalog (Activation/Deactivation) in Ampacheampache
- CVE-2024-51488Insufficient Validation in Delete Message in Ampacheampache
- CVE-2024-51489Insufficient Message Token Validation in Ampacheampache
- CVE-2024-51490Stored Cross-Site Scripting in Ampacheampache
- CVE-2024-11078code-projects Job Recruitment register.php cross site scriptingcode-projects Job Recruitment
- CVE-2024-51992Method Exposure Vulnerability in Modals in orchid/platformorchidsoftware platform · orchid/platform
- CVE-2024-52286Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDFStirling-Tools Stirling-PDF
- CVE-2024-10315Insecure Configuration in Gliffy OnlineGliffy Online
- CVE-2024-52288RMAC revert to the beginning of the session in libosdpgoToMain libosdp · libosdp
- CVE-2024-11077code-projects Job Recruitment index.php sql injectioncode-projects Job Recruitment
- CVE-2024-11076code-projects Job Recruitment activation.php sql injectioncode-projects Job Recruitment
- CVE-2024-11074itsourcecode Tailoring Management System incadd.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-45087IBM WebSphere Application Server cross-site scriptingIBM WebSphere Application Server
- CVE-2024-11073SourceCodester Hospital Management System delete-account.php improper authorizationSourceCodester Hospital Management System
- CVE-2024-10917Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLengthEclipse Foundation Open J9
- CVE-2024-45088IBM Maximo Asset Management cross-site scriptingIBM Maximo Asset Management
- CVE-2024-43439Moodle: reflected xss via h5p error messagemoodle · moodle/moodle
- CVE-2024-11070Sanluan PublicCMS Tag Type save cross site scriptingSanluan PublicCMS
- CVE-2024-34015Sensitive information disclosure during file browsing due to improper symbolic link handling.Acronis Backup plugin for cPanel & WHM
- CVE-2024-34014Arbitrary file overwrite during recovery due to improper symbolic link handling.Acronis Backup plugin for cPanel & WHM · Acronis Backup… +1
- CVE-2024-43437Moodle: xss risk when restoring malicious course backup filemoodle · moodle/moodle
- CVE-2024-43435Moodle: can create global glossary without being adminmoodle · moodle/moodle
- CVE-2024-43433Moodle: matrix user/power level management not always working as expected with suspended usersmoodle · moodle/moodle
- CVE-2024-43432Moodle: authorization headers preserved between "emulated redirects"moodle · moodle/moodle
- CVE-2024-43430Moodle: lack of access control when using external methods for quiz overridesmoodle · moodle/moodle
- CVE-2024-43429Moodle: user information visibility control issues in gradebook reportsmoodle · moodle/moodle
- CVE-2024-43427Moodle: admin presets export tool includes some secrets that should not be exportedmoodle · moodle/moodle
- CVE-2024-11021Grand Vice info Webopac - Stored XSSGrand Vice info Webopac
- CVE-2024-11019Grand Vice info Webopac7 - Reflected XSSGrand Vice info Webopac7
- CVE-2024-52350WordPress CRM 2go plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitynrmendez CRM 2go
- CVE-2024-52351WordPress BU Slideshow plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerabilityBU Web Team BU Slideshow
- CVE-2024-52352WordPress Postcasa Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitymiloandrew Postcasa Shortcode
- CVE-2024-52353WordPress Christian Science Bible Lesson Subjects plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityGabriel Serafini Christian Science Bible Lesson Subjects
- CVE-2024-52354WordPress Web Stories Widgets For Elementor plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityCool Plugins Web Stories Widgets For Elementor
- CVE-2024-52355WordPress OSM – OpenStreetMap plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerabilityMiKa OSM
- CVE-2024-52356WordPress The Pack Elementor addons plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilitywebangon The Pack Elementor addons
- CVE-2024-52357WordPress LIQUID BLOCKS plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilitylqd LIQUID BLOCKS
- CVE-2024-52358WordPress Responsive Addons for Elementor plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityCyberChimps Responsive Addons for Elementor
- CVE-2024-51571WordPress MasterBip para Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerabilityMasterBip para Elementor
- CVE-2024-51572WordPress LH QR Codes plugin <= 1.06 - Stored Cross Site Scripting (XSS) vulnerabilityshawfactor LH QR Codes
- CVE-2024-51573WordPress ML Responsive Audio plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerabilityersatzpole ML Responsive Audio player with playlist Shortco…
- CVE-2024-51574WordPress Simple Goods plugin <= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerabilitySimple Goods
- CVE-2024-51575WordPress Extender All In One For Elementor plugin <= 1.0.3 - Stored Cross Site Scripting (XSS) vulnerabilityMd. Abdullah Al Masum Extender All In One For Elementor
- CVE-2024-38826CVE-2024-38826 Cloud Controller Denial of Service AttackCloud Foundry
- CVE-2024-11060Jinher Network Collaborative Management Platform 金和数字化智能办公平台 AcceptShow.aspx sql injectionJinher Network Collaborative Management Platform 金和数字化智能办公平台
- CVE-2024-46965The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execut
- CVE-2024-50601Persistent and reflected XSS vulnerabilities in the themeMode cookie and _h URL parameter of Axigen Mail Server up to version 10.5.28 allow
- CVE-2024-50990A Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.
- CVE-2024-50991A Cross Site Scripting (XSS) vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which
- CVE-2024-51026The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is po
- CVE-2024-51054A Cross Site Scriptng (XSS) vulnerability was found in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System 1.0, which a
- CVE-2024-51187TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t
- CVE-2024-51188TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t
- CVE-2024-51189TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t
- CVE-2024-51190TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t
- CVE-2024-51213Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component
- CVE-2024-52531GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict.GNOME libsoup