CVEs published November 13, 2024
230 CVEs were published on November 13, 2024: 16 critical, 91 high. 1 is now in CISA KEV.
- Published
- 230
- Critical
- 16
- High
- 91
- Medium
- 115
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 57
Most affected products
- Google Android
- 23
- Ivanti EPM
- 10
- Ivanti Connect Secure · Ivanti Policy Secure
- 6
- Kognetiks Chatbot for WordPress
- 5
- Intel(R) Neural Compressor software
- 4
- Intel(R) VPL software
- 4
- Schneider Electric Modicon M340 CPU · Schneider Electric… +1
- 4
- craftcms cms · craftcms/cms
- 3
- Intel(R) Graphics Drivers
- 3
- Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) W…
- 3
Critical 16
- CVE-2024-43091In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2024-52295DataEase has a forged JWT token vulnerabilitydataease
- CVE-2024-52300macro-pdfviewer has a XSS through the width parameterxwikisas macro-pdfviewer
- CVE-2022-45157Exposure of vSphere's CPI and CSI credentials in RancherSUSE rancher · github.com/rancher/rancher
- CVE-2024-11028MultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonationicdsoft MultiManager WP – Manage All Your WordPress Sites E…
- CVE-2024-10575CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impactiSchneider Electric EcoStruxure IT Gateway
- CVE-2024-11150WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletionvanquish WordPress User Extra Fields
- CVE-2024-8938CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrarySchneider Electric Modicon M340 CPU · Schneider Electric… +1
- CVE-2024-10820WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File UploadWooCommerce Upload Files
- CVE-2024-38655Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-39712Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-39711Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-38656Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-39710Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a rIvanti Connect Secure · Ivanti Policy Secure
- CVE-2024-40404Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Socke
- CVE-2024-48510Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.SharedDotNetZip · ProDotNetZip
High 91
- CVE-2024-39766Improper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow anIntel(R) Neural Compressor software
- CVE-2024-28028Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially eIntel(R) Neural Compressor software
- CVE-2024-39368Improper neutralization of special elements used in an SQL command ('SQL Injection') in some Intel(R) Neural Compressor software before versIntel(R) Neural Compressor software
- CVE-2024-32483Improper access control for some Intel(R) EMA software before version 1.13.1.0 may allow an authenticated user to potentially enable escalatIntel(R) EMA software
- CVE-2024-36242Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of priIntel(R) Processors
- CVE-2024-36282Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged Intel(R) Server Board S2600ST Family BIOS and Firmware Upda…
- CVE-2024-36482Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalatioIntel(R) CIP software
- CVE-2024-31074Observable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via neIntel(R) QAT Engine for OpenSSL software
- CVE-2024-28885Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network aIntel(R) QAT Engine for OpenSSL software
- CVE-2024-33617Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosureIntel(R) QAT Engine for OpenSSL software
- CVE-2024-39609Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation Intel(R) Server Board M70KLP
- CVE-2024-40885Use after free in the UEFI firmware of some Intel(R) Server M20NTP BIOS may allow a privileged user to potentially enable escalation of privIntel(R) Server M20NTP BIOS
- CVE-2024-41167Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable Intel(R) Server Board M10JNP2SB Family
- CVE-2024-31154Improper input validation in UEFI firmware for some Intel(R) Server S2600BPBR may allow a privileged user to potentially enable escalation oIntel(R) Server S2600BPBR
- CVE-2024-31158Improper input validation in UEFI firmware in some Intel(R) Server Board S2600BP Family may allow a privileged user to potentially enable esIntel(R) Server Board S2600BP Family
- CVE-2024-24985Exposure of resource to wrong sphere in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalaIntel(R) processors with Intel(R) ACTM
- CVE-2024-22185Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable esIntel(R) processors with Intel(R) ACTM
- CVE-2024-52554Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that theJenkins Project Jenkins Shared Library · io.jenkins.plugins…
- CVE-2024-52553Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.Jenkins Project Jenkins OpenId Connect Authentication Plugi…
- CVE-2024-52552Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resJenkins Project Jenkins Authorize Project Plugin · org.jenk…
- CVE-2024-52551Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restJenkins Project Jenkins Pipeline: Declarative Plugin · org.…
- CVE-2024-52550Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (JenkinsfileJenkins Project Jenkins Pipeline: Groovy Plugin · org.jenki…
- CVE-2024-21820Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privilIntel(R) Xeon(R) processor memory controller configurations…
- CVE-2024-23918Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privilegedIntel(R) Xeon(R) processor memory controller configurations…
- CVE-2024-21850Sensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow aIntel(R) TDX Seamldr module software
- CVE-2024-43093In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitGoogle Android
- CVE-2024-43089In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check.Google Android
- CVE-2024-43088In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the deGoogle Android
- CVE-2024-43087In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in tGoogle Android
- CVE-2024-43085In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due toGoogle Android
- CVE-2024-43081In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the codGoogle Android
- CVE-2024-43080In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization.Google Android
- CVE-2024-40671In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission cheGoogle Android
- CVE-2024-40661In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permisGoogle Android
- CVE-2024-40660In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the codGoogle Android
- CVE-2024-34747In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic error in the code.Google Android
- CVE-2024-34729In multiple locations, there is a possible arbitrary code execution due to a logic error in the code.Google Android
- CVE-2024-34719In multiple locations, there is a possible permissions bypass due to a missing null check.Google Android
- CVE-2024-31337In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation.Google Android
- CVE-2024-23715In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code.Google Android
- CVE-2023-35686In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation.Google Android
- CVE-2023-35659In DevmemIntChangeSparse of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code.Google Android
- CVE-2024-45594Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embedsdecidim · decidim-meetings
- CVE-2024-51996Symphony has an Authentication Bypass via RememberMesymfony · symfony/security-http
- CVE-2024-52291Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Executioncraftcms cms · craftcms/cms
- CVE-2024-9413The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing Arm SCP-Firmware
- CVE-2024-52292Craft Allows Attackers to Read Arbitrary System Filescraftcms cms · craftcms/cms
- CVE-2024-52293Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTIcraftcms cms · craftcms/cms
- CVE-2024-52298macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last authorxwikisas macro-pdfviewer
- CVE-2024-52299The PDF viewer macro allows accessing any attachment without access right checksxwikisas macro-pdfviewer
- CVE-2024-7295Hard-coded credentials used for temporary and cache data encryptionProgress Software Telerik Report Server
- CVE-2024-10012Progress UI for WPF format provider unsafe deserialization vulnerabilityProgress Software Telerik UI for WPF
- CVE-2024-10013Progress UI for WinForms format provider unsafe deserialization vulnerabilityProgress Software Telerik UI for WinForms
- CVE-2024-52306FileManager Deserialization of Untrusted DataLaravel-Backpack FileManager · backpack/filemanager
- CVE-2024-49504grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted ImagesopenSUSE Tumbleweed
- CVE-2024-49506Fixed temporary file path in aeon-checks allows fixing of disk encryption keyopenSUSE Tumbleweed
- CVE-2024-48989A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial Bosch Rexroth AG IndraDrive FWA-INDRV*-MP*
- CVE-2024-47574A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versiFortinet FortiClientWindows
- CVE-2024-4741Use After Free with SSL_free_buffersOpenSSL
- CVE-2024-10800WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationvanquish WordPress User Extra Fields
- CVE-2024-9409CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communicaSchneider Electric PowerLogic PM5320 · Schneider Electri… +1
- CVE-2024-8936CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful MaSchneider Electric Modicon M340 CPU
- CVE-2024-8937CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrarySchneider Electric Modicon M340 CPU · Schneider Electric… +1
- CVE-2024-8935CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integriSchneider Electric Modicon M340 CPU · Schneider Electric… +1
- CVE-2024-8933CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrSchneider Electric Modicon M340 CPU · Schneider Electric… +1
- CVE-2024-10816LUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Readsodah LUNA RADIO PLAYER
- CVE-2024-10174WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypasswedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2024-10828Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Detailsalgolplus Advanced Order Export For WooCommerce
- CVE-2024-10629GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creationaxelkeller GPX Viewer
- CVE-2024-34784SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-34780SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-29211A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuratioIvanti Secure Access Client
- CVE-2024-34781SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-37400An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop,Ivanti Connect Secure
- CVE-2024-32839SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-38649An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated atIvanti Connect Secure
- CVE-2024-39709Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-32844SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-34787Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthentIvanti EPM
- CVE-2024-32847SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-37398Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.Ivanti Secure Access Client
- CVE-2024-32841SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-34782SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-37376SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticIvanti EPM
- CVE-2024-40405Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via
- CVE-2024-40407A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application
- CVE-2024-40408Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section.
- CVE-2024-50852Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function.
- CVE-2024-50853Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function.
- CVE-2024-50854Tenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping function.
- CVE-2024-50955An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a
Medium, low and unrated 123
- CVE-2024-36284Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enaIntel(R) Neural Compressor software
- CVE-2024-34165Uncontrolled search path in some Intel(R) oneAPI DPC++/C++ Compiler before version 2024.2 may allow an authenticated user to potentially enaIntel(R) oneAPI DPC++/C++ Compiler
- CVE-2024-34022Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enableThunderbolt(TM) Share software
- CVE-2024-36294Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enableIntel(R) DSA software
- CVE-2024-36488Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of prIntel(R) DSA
- CVE-2024-37025Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 mIntel(R) Advanced Link Analyzer Standard Edition software i…
- CVE-2024-38660Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially eIntel(R) Xeon(R) processor family
- CVE-2024-38383Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated Intel(R) Quartus(R) Prime Pro Edition software for Windows
- CVE-2024-38668Uncontrolled search path for some Intel(R) Quartus(R) Prime Standard Edition software for Windows before version 23.1.1 may allow an authentIntel(R) Quartus(R) Prime Standard Edition software for Win…
- CVE-2024-38387Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authenticated user to potentiaIntel(R) Graphics Driver installers
- CVE-2024-21799Path traversal for some Intel(R) Extension for Transformers software before version 1.5 may allow an authenticated user to potentially enablIntel(R) Extension for Transformers software
- CVE-2024-36275NULL pointer dereference in some Intel(R) Optane(TM) PMem Management software versions before CR_MGMT_02.00.00.4040, CR_MGMT_03.00.00.0499 mIntel(R) Optane(TM) PMem Management software versions
- CVE-2024-34776Out-of-bounds write in some Intel(R) SGX SDK software may allow an authenticated user to potentially enable escalation of privilege via locaIntel(R) SGX SDK software
- CVE-2024-37027Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentiallIntel(R) VTune(TM) Profiler software
- CVE-2024-36245Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potIntel(R) VTune(TM) Profiler software
- CVE-2024-34167Uncontrolled search path for the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow an authenticaIntel(R) Server Board S2600ST Family BIOS and Firmware Upda…
- CVE-2024-36276Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enableIntel(R) CIP software
- CVE-2024-36253Uncontrolled search path in the Intel(R) SDP Tool for Windows software all version may allow an authenticated user to potentially enable escIntel(R) SDP Tool for Windows software
- CVE-2024-35201Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalatioIntel(R) SDP Tool for Windows software
- CVE-2024-37024Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to ACAT software maintained by Intel(R) for Windows
- CVE-2024-39285Improper access control in UEFI firmware in some Intel(R) Server M20NTP Family may allow a privileged user to potentially enable informationIntel(R) Server M20NTP Family
- CVE-2024-39811Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potentially enable escalatiIntel(R) Server M20NTP Family UEFI
- CVE-2024-28881Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potenIntel(R) Fortran Compiler Classic software
- CVE-2024-35245Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated Intel(R) PROSet/Wireless WiFi software for Windows
- CVE-2024-33611Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a privileged user to poIntel(R) PROSet/Wireless WiFi software for Windows
- CVE-2024-33624Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated userIntel(R) PROSet/Wireless WiFi software for Windows
- CVE-2024-29083Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potIntel(R) Distribution for Python software
- CVE-2024-32667Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service via local access.OpenCL(TM) software
- CVE-2024-34028Uncontrolled search path in some Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows before version 2024.1.0.142, grIntel(R) Graphics Offline Compiler for OpenCL(TM) Code soft…
- CVE-2024-32044Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated uIntel(R) Arc(TM) Pro Graphics for Windows drivers
- CVE-2024-34164Uncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to potentially enable escaIntel(R) MAS software
- CVE-2024-32048Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthenticaIntel(R) Distribution of OpenVINO(TM) Model Server software
- CVE-2024-28950Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may allow an authenticated Intel(R) oneAPI Math Kernel Library software for Windows
- CVE-2024-32485Improper Input Validation in some Intel(R) VROC software before version 8.6.0.2003 may allow an authenticated user to potentially enable denIntel(R) VROC software
- CVE-2024-29079Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentiallyIntel(R) VROC software
- CVE-2024-29077Improper access control in some JAM STAPL Player software before version 2.6.1 may allow an authenticated user to potentially enable escalatJAM STAPL Player software
- CVE-2024-31407Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before vIntel(R) High Level Synthesis Compiler software for Intel(R…
- CVE-2024-28169Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticatBigDL software maintained by Intel
- CVE-2024-29085Improper access control for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially eBigDL software maintained by Intel
- CVE-2024-27200Improper access control in some Intel(R) Granulate(TM) software before version 4.30.1 may allow a authenticated user to potentially enable eIntel(R) Granulate(TM) software
- CVE-2024-26017Uncontrolled search path in some Intel(R) Rendering Toolkit software before version 2024.1.0 may allow an authenticated user to potentially Intel(R) Rendering Toolkit software
- CVE-2024-28952Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated user to potentially Intel(R) IPP software for Windows
- CVE-2024-23312Uncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated usIntel(R) Binary Configuration Tool software for Windows
- CVE-2024-25647Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticatIntel(R) Binary Configuration Tool software for Windows
- CVE-2024-34170Improper buffer restrictions in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via lIntel(R) Graphics Drivers
- CVE-2024-34023Untrusted pointer dereference in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilegIntel(R) Graphics Drivers
- CVE-2024-23919Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilegIntel(R) Graphics software
- CVE-2024-38665Out-of-bounds write in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilege via locaIntel(R) Graphics Drivers
- CVE-2024-28030NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable denial ofIntel(R) VPL software
- CVE-2024-11193An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application YugabyteDB Anywhere
- CVE-2024-28051Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information disIntel(R) VPL software
- CVE-2024-21808Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalIntel(R) VPL software
- CVE-2024-21783Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of prIntel(R) VPL software
- CVE-2024-25563Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) W…
- CVE-2024-21853Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authoriz4th and 5th Generation Intel(R) Xeon(R) Processors
- CVE-2024-52549Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perJenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2024-28049Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before versIntel(R) PROSet/Wireless Software and Intel(R) Killer(TM) W…
- CVE-2024-24984Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow an unauthenticated useIntel(R) Wireless Bluetooth(R) products for Windows
- CVE-2024-23198Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) W…
- CVE-2024-25565Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated user to enable denial Intel(R) Xeon(R) Processors
- CVE-2024-29076Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of sIntel(R) CST software
- CVE-2024-43090In multiple locations, there is a possible cross-user image read due to a missing permission check.Google Android
- CVE-2024-43086In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to aGoogle Android
- CVE-2024-43084In visitUris of multiple files, there is a possible information disclosure due to a confused deputy.Google Android
- CVE-2024-43083In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion.Google Android
- CVE-2024-43082In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy.Google Android
- CVE-2024-49379Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrelgetumbrel umbrel
- CVE-2024-9476Privilege escalation vulnerability for Organizations in GrafanaGrafana Labs Grafana OSS and Enterprise
- CVE-2024-11175Public CMS Voting Management save cross site scriptingPublic CMS
- CVE-2024-8049Telerik Document Processing Improper Handling of Memory ResourcesProgress Software Telerik Document Processing Libraries
- CVE-2024-52305UnoPim Stored XSS : Cookie hijacking through Create User functionunopim · unopim/unopim
- CVE-2024-9477XSS in AirTies' Air4443 FirmwareAirTies Air4443 Firmware
- CVE-2024-48900Moodle: idor when accessing list of badge recipientsmoodle · moodle/moodle
- CVE-2024-49505XSS vulnerability found in OpenSuse MirrorCacheopenSUSE Tumbleweed
- CVE-2024-11165An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration reYugabyteDB Anywhere
- CVE-2024-11159Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext.Mozilla Thunderbird
- CVE-2024-8001VIWIS LMS Print authorizationVIWIS LMS
- CVE-2024-9682Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widgetwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-9668Royal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-9059Royal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widgetwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-10877AFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site Scriptingnasirahmed AFI – The Easiest Integration Plugin
- CVE-2024-52268Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0.Vektor VK All in One Expansion Unit
- CVE-2024-21541Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without dom-iterator · org.webjars.npm:dom-iterator
- CVE-2024-10794Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosureduongancol Boostify Header Footer Builder for Elementor
- CVE-2024-10802Hash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposurehashthemes Hash Elements
- CVE-2024-10529Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant DeletionKognetiks Chatbot for WordPress
- CVE-2024-11143Kognetiks Chatbot for WordPress <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant ModificationKognetiks Chatbot for WordPress
- CVE-2024-10684Kognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site ScriptingKognetiks Chatbot for WordPress
- CVE-2024-10531Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant UpdateKognetiks Chatbot for WordPress
- CVE-2024-10530Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant AdditionKognetiks Chatbot for WordPress
- CVE-2024-10593WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletionsmub WPForms – Easy Form Builder for WordPress – Contact Fo…
- CVE-2024-10882Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scriptingtychesoftwares Product Delivery Date for WooCommerce – Lite
- CVE-2024-9426Aqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadthinkaquamarine Aqua SVG Sprite
- CVE-2024-8874AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scriptingkaminskym AJAX Login and Registration modal popup + inline…
- CVE-2024-10854Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Importnorthmule Buy one click WooCommerce
- CVE-2024-10853Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletionnorthmule Buy one click WooCommerce
- CVE-2024-10717Styler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_licensewpmonks Styler for Ninja Forms
- CVE-2024-10038WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingcmanon WP-Strava
- CVE-2024-10850Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site ScriptingRazorpay Payment Button Elementor Plugin
- CVE-2024-9614Constant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site ScriptingConstant Contact Forms by MailMunch
- CVE-2024-10577Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scriptingfbtopcn 胖鼠采集
- CVE-2024-10887NiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingNiceJob
- CVE-2024-10851Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site ScriptingRazorpay Payment Button Plugin
- CVE-2024-8985Social Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcodekimberlynorris Social Proof (Testimonial) Slider
- CVE-2024-9578Hide Links <= 1.4.2 - Unauthenticated Shortcode Executionegolacrima Hide Links
- CVE-2024-10852Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Exportnorthmule Buy one click WooCommerce
- CVE-2024-10778BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosurestaxwp BuddyPress Builder for Elementor – BuddyBuilder
- CVE-2024-38654Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges toIvanti Secure Access Client
- CVE-2023-38920Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted scr
- CVE-2024-40410Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption.
- CVE-2024-40443SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of s
- CVE-2024-42834A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows a
- CVE-2024-45875The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewU
- CVE-2024-45876The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injecti
- CVE-2024-45877baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManag
- CVE-2024-45878The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable
- CVE-2024-45879The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QW
- CVE-2024-50956A buffer overflow in the RecvSocketData function of Inovance HCPLC_AM401-CPU1608TPTN 21.38.0.0, HCPLC_AM402-CPU1608TPTN 41.38.0.0, and HCPLC
- CVE-2024-50969A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbi
- CVE-2024-50970A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arb
- CVE-2024-50971A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary S
- CVE-2024-50972A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitra
- CVE-2024-51027Ruijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi/networksafe.php via the province parameter.