CVEs published November 14, 2024
147 CVEs were published on November 14, 2024: 29 critical, 44 high.
- Published
- 147
- Critical
- 29
- High
- 44
- Medium
- 56
- Low
- 18
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 52
Most affected products
- Baxter Life2000 Ventilation System
- 8
- Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- 7
- GitLab
- 5
- Harbor · github.com/goharbor/harbor
- 5
- lunary-ai/lunary
- 4
- PostgreSQL
- 4
- Apache Software Foundation Apache Traffic Server
- 3
- Apereo CAS
- 3
- SourceCodester Best Employee Management System
- 3
- The OpenAFS Foundation OpenAFS
- 3
Critical 29
- CVE-2024-48967Life2000 ventilator and Service PC lack sufficient audit logging capabilitiesBaxter Life2000 Ventilation System
- CVE-2024-48966Life2000 service tools for test and calibration do not support user authenticationBaxter Life2000 Ventilation System
- CVE-2024-48970Life2000 Ventilator microcontroller lacks memory protectionBaxter Life2000 Ventilation System
- CVE-2024-48974Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updatesBaxter Life2000 Ventilation System
- CVE-2024-48973Debug port on Life2000 Ventilator serial interface is enabled by defaultBaxter Life2000 Ventilation System
- CVE-2024-48971Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 VentilatorBaxter Life2000 Ventilation System
- CVE-2024-9832No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 VentilatorBaxter Life2000 Ventilation System
- CVE-2024-9834Improper data protection on Life2000 ventilator serial interfaceBaxter Life2000 Ventilation System
- CVE-2024-52369WordPress KBucket plugin <= 4.2.2 - Arbitrary File Upload vulnerabilityOptimal Access KBucket
- CVE-2024-52370WordPress Hive Support – WordPress Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin <= 1.1.1 - Arbitrary File Upload vulnerabilityHive Support
- CVE-2024-52372WordPress Easy CSV Importer plugin <= 7.0.0 - Arbitrary File Upload vulnerabilityWebTechGlobal Easy CSV Importer BETA
- CVE-2024-52373WordPress Devexhub Gallery plugin <= 2.0.1 - Arbitrary File Upload vulnerabilityTeam Devexhub Devexhub Gallery
- CVE-2024-52374WordPress Do That Task plugin <= 1.5.5 - Arbitrary File Upload vulnerabilityDoThatTask Do That Task
- CVE-2024-52375WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerabilityDatasets Manager by Arttia Creative
- CVE-2024-52376WordPress Boat Rental Plugin for WordPress plugin <= 1.0.1 - Arbitrary File Upload vulnerabilitycmsMinds Boat Rental Plugin for WordPress
- CVE-2024-52377WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin <= 1.5.2 - Arbitrary File Upload vulnerabilitybdthemes Instant Image Generator
- CVE-2024-52379WordPress kineticPay for WooCommerce plugin <= 2.0.8 - Arbitrary File Upload vulnerabilityfaizalbahasan kineticPay for WooCommerce
- CVE-2024-52380WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerabilitysoftpulseinfotech Picsmize
- CVE-2024-52382WordPress Matix Popup Builder plugin <= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerabilitymedmatech Matix Popup Builder
- CVE-2024-52384WordPress Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation plugin <= 2.4.9 - Arbitrary File Upload vulnerabilitywpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dall…
- CVE-2024-3502Exposure of Sensitive Information in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-3501Exposure of Sensitive Information in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-3379Incorrect Authorization in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-4343Python Command Injection in imartinez/privategptimartinez/privategpt
- CVE-2024-52393WordPress Podlove Podcast Publisher plugin <= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerabilityEric Teubert Podlove Podcast Publisher
- CVE-2024-37285Kibana arbitrary code execution via YAML deserializationElastic Kibana
- CVE-2024-10571Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via sourceays-pro Chartify – WordPress Chart Plugin
- CVE-2024-50306Apache Traffic Server: Server process can fail to drop privilegeApache Software Foundation Apache Traffic Server
- CVE-2024-31695A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authenti
High 44
- CVE-2024-52308Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computercli · github.com/cli/cli +1
- CVE-2024-51658WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerabilityHenrik Hoff WP Course Manager
- CVE-2024-51659WordPress Twitter @Anywhere Plus plugin <= 2.0 - CSRF to Stored XSS vulnerabilityGeekRMX Twitter @Anywhere Plus
- CVE-2024-51679WordPress Appointmind plugin <= 4.0.0 - CSRF to Stored XSS vulnerabilitygentlesource Appointmind
- CVE-2024-51684WordPress W3P SEO plugin < 1.8.6 - CSRF to Stored XSS vulnerabilityCiprian Popescu W3P SEO
- CVE-2024-51687WordPress Platform.ly Official plugin <= 1.1.3 - CSRF to Stored XSS vulnerabilityPlatform.ly Official
- CVE-2024-51688WordPress FraudLabs Pro SMS Verification plugin <= 1.10.1 - CSRF to Stored XSS vulnerabilityfraudlabspro FraudLabs Pro SMS Verification
- CVE-2024-10397Preallocated buffer overflows in XDR responsesThe OpenAFS Foundation OpenAFS
- CVE-2024-10394Theft of credentials in Unix client PAGsThe OpenAFS Foundation OpenAFS
- CVE-2024-3760Email Bombing Vulnerability in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-52378WordPress DigiPass plugin <= 0.3.0 - Arbitrary File Download vulnerabilitylabs64 DigiPass
- CVE-2024-49362Remote Code Execution on click of <a> Link in markdown previewlaurent22 joplin · joplin
- CVE-2024-52383WordPress Ai Auto Tool Content Writing Assistant plugin <= 2.1.2 - Broken Access Control vulnerabilityaitool Ai Auto Tool Content Writing Assistant (Gemini Write…
- CVE-2024-5125XSS and Open Redirect via SVG File Upload in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-52381WordPress ZIJ KART plugin <= 1.1 - Local File Inclusion vulnerabilityShoaib Rehmat ZIJ KART
- CVE-2024-52371WordPress Global Gateway e4 plugin <= 2.0 - Arbitrary File Deletion vulnerabilityDonnellC Global Gateway e4 | Payeezy Gateway |
- CVE-2024-6068Input Validation Vulnerability exists in Arena® Input AnalyzerRockwell Automation Arena Input Analyzer
- CVE-2024-52302common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)OsamaTaher Java-springboot-codebase
- CVE-2024-11136Arbitrary file removal via path traversal in TCL CameraTCL Camera
- CVE-2022-2232Keycloak: ldap injection on username inputRed Hat Single Sign-On · org.keycloak:keycloak-ldap-fede… +1
- CVE-2024-10962Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injectionwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2024-10979PostgreSQL PL/Perl environment variable changes execute arbitrary codePostgreSQL
- CVE-2024-7730Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb()qemu · Red Hat Enterprise Linux
- CVE-2022-31668User permission validation failure and disclosure of P2P preheat execution logsHarbor · github.com/goharbor/harbor +1
- CVE-2022-31670Harbor fails to validate the user permissions when updating tag retention policiesHarbor · github.com/goharbor/harbor
- CVE-2022-31671Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logsHarbor · github.com/goharbor/harbor
- CVE-2022-31666Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policiesHarbor · github.com/goharbor/harbor
- CVE-2024-9693Incorrect Authorization in GitLabGitLab
- CVE-2024-47916Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Boa web server 0.94.14rc21
- CVE-2024-47915VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized ActorVaeMendis Ubooquity
- CVE-2024-50305Apache Traffic Server: Valid Host field value can cause crashesApache Software Foundation Apache Traffic Server
- CVE-2024-38479Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackApache Software Foundation Apache Traffic Server
- CVE-2024-45254VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')VaeMendis Ubooquity
- CVE-2024-45253Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Avigilon VideoIQ iCVR HD camera
- CVE-2024-2550PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted PacketPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-2551PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted PacketPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-9472PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted TrafficPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-11206Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information.TECNO com.transsion.phoenix
- CVE-2024-9186Automation By Autonami < 3.3.0 - Unauthenticated SQLiRecover WooCommerce Cart Abandonment, Newsletter, Email Mar…
- CVE-2024-5082Nexus Repository 2 - Remote Code ExecutionSonatype Nexus Repository
- CVE-2024-41209A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execu
- CVE-2024-49777A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS), Information D
- CVE-2024-49778A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) and Code Execu
- CVE-2024-50968A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remo
Medium, low and unrated 74
- CVE-2017-13227In the autofill service, the package name that is provided by the app process is trusted inappropriately.Google Android
- CVE-2024-49025Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2024-10396Fileserver crash and possible information leak on StoreACL/FetchACLThe OpenAFS Foundation OpenAFS
- CVE-2024-4311Lack of login attempt rate-limiting in zenml-io/zenmlzenml-io/zenml · zenml
- CVE-2024-1682Unclaimed S3 Bucket Reference in psf/requests Documentationpsf/requests
- CVE-2024-52396WordPress WOLF plugin <= 1.0.8.3 - CSV Limited Path Traversal vulnerabilityRealMag777 WOLF
- CVE-2024-52524ReDoS in Giskard Scan text perturbationGiskard-AI giskard · giskard
- CVE-2024-10921Improper neutralization of null bytes may lead to buffer over-reads in MongoDB ServerMongoDB Server
- CVE-2024-11214SourceCodester Best Employee Management System profile.php unrestricted uploadSourceCodester Best Employee Management System
- CVE-2024-11213SourceCodester Best Employee Management System edit_role.php sql injectionSourceCodester Best Employee Management System
- CVE-2024-42188HCL Connections is vulnerable to a broken access control vulnerabilityHCL Software Connections
- CVE-2024-52505matrix-appservice-irc allows IRC Command injection in provisioning APImatrix-org matrix-appservice-irc
- CVE-2024-7124Reflected XSS in DInGO dLibraPoznan Supercomputing and Networking Center DInGO dLIbra
- CVE-2024-11212SourceCodester Best Employee Management System fetch_product_details.php sql injectionSourceCodester Best Employee Management System
- CVE-2024-11211EyouCMS Website Logo unrestricted uploadEyouCMS
- CVE-2024-11210EyouCMS FilemanagerLogic.php editFile path traversalEyouCMS
- CVE-2024-11215Path traversal vulnerability in EasyPHPEasyPHP web server
- CVE-2024-11209Apereo CAS 2FA login improper authenticationApereo CAS
- CVE-2024-11208Apereo CAS login session expirationApereo CAS
- CVE-2024-9633Incorrect Ownership Assignment in GitLabGitLab
- CVE-2024-7404Improper Restriction of Rendered UI Layers or Frames in GitLabGitLab
- CVE-2024-8648Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-10978PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user IDPostgreSQL
- CVE-2024-10977PostgreSQL libpq retains an error message from man-in-the-middlePostgreSQL
- CVE-2024-10976PostgreSQL row security below e.g. subqueries disregards user ID changesPostgreSQL
- CVE-2024-11207Apereo CAS login redirectApereo CAS
- CVE-2024-3447Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()qemu · Red Hat Enterprise Linux
- CVE-2023-4458Kernel: ksmbd: smb2_open out-of-bounds read information disclosure vulnerabilitykernel · Red Hat Enterprise Linux
- CVE-2024-45642IBM Security ReaQta information disclosureIBM Security ReaQta
- CVE-2024-45099IBM Security ReaQta cross-site scriptingIBM Security ReaQta
- CVE-2022-31667Harbor fails to validate the user permissions when updating a robot accountHarbor · github.com/goharbor/harbor
- CVE-2024-45670IBM Security SOAR weak password recovery mechanismIBM Security SOAR
- CVE-2022-31669Harbor fails to validate the user permissions when updating tag immutability policiesHarbor · github.com/goharbor/harbor
- CVE-2024-8180Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2023-4134Kernel: cyttsp4_core: use-after-free in cyttsp4_watchdog_work()kernel · Red Hat Enterprise Linux
- CVE-2024-47914VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF)VaeMendis Ubooquity
- CVE-2024-5920PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate AdministratorPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-5917PAN-OS: Server-Side Request Forgery in WildFirePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS
- CVE-2024-2552PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-5918PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect UserPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-5919PAN-OS: Authenticated XML External Entities (XXE) Injection VulnerabilityPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-7787Reflected XSS in ITG Computer Technology's vSRM Supplier Relationship Management SystemITG Computer Technology vSRM Supplier Relationship Manageme…
- CVE-2024-10146Simple File List < 6.1.13 - Reflected Cross-Site ScriptingSimple File List
- CVE-2023-34049Salt security advisory release - 2023-OCT-27SALT
- CVE-2024-5083Nexus Repository 2 - Stored XSSSonatype Nexus Repository
- CVE-2024-39707Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could le
- CVE-2024-40579Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive inf
- CVE-2024-41206A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted
- CVE-2024-41217A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted
- CVE-2024-48284A Reflected Cross-Site Scripting (XSS) vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login an
- CVE-2024-49776A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS vide
- CVE-2024-50823A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and passw
- CVE-2024-50824A SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class_name paramet
- CVE-2024-50825A SQL Injection vulnerability was found in /admin/school_year.php in kashipara E-learning Management System Project 1.0 via the school_year
- CVE-2024-50826A SQL Injection vulnerability was found in /admin/add_content.php in kashipara E-learning Management System Project 1.0 via the title and co
- CVE-2024-50827A SQL Injection vulnerability was found in /admin/add_subject.php in kashipara E-learning Management System Project 1.0 via the subject_code
- CVE-2024-50828A SQL Injection vulnerability was found in /admin/edit_department.php in kashipara E-learning Management System Project 1.0 via the d parame
- CVE-2024-50829A SQL Injection vulnerability was found in /admin/edit_subject.php in kashipara E-learning Management System Project 1.0 via the unit parame
- CVE-2024-50830A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_
- CVE-2024-50831A SQL Injection was found in /admin/admin_user.php in kashipara E-learning Management System Project 1.0 via the username and password param
- CVE-2024-50832A SQL Injection vulnerability was found in /admin/edit_class.php in kashipara E-learning Management System Project 1.0 via the class_name pa
- CVE-2024-50833A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password pa
- CVE-2024-50834A SQL Injection was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0 via the firstname and lastname parame
- CVE-2024-50835A SQL Injection vulnerability was found in /admin/edit_student.php in KASHIPARA E-learning Management System Project 1.0 via the cys, un, ln
- CVE-2024-50836A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0.
- CVE-2024-50837A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/admin_user.php in KASHIPARA E-learning Management System Project 1.0.
- CVE-2024-50838A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/department.php in KASHIPARA E-learning Management System Project 1.0.
- CVE-2024-50839A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/add_subject.php in KASHIPARA E-learning Management System Project 1.0.
- CVE-2024-50840A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/class.php in KASHIPARA E-learning Management System Project 1.0.
- CVE-2024-50841A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System Proje
- CVE-2024-50842A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school_year.php in KASHIPARA E-learning Management System Project 1.0.
- CVE-2024-50843A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers at
- CVE-2024-5115607FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.ht
- CVE-2024-52613A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) via a crafte