CVEs published November 15, 2024
222 CVEs were published on November 15, 2024: 19 critical, 46 high. 2 are now in CISA KEV.
- Published
- 222
- Critical
- 19
- High
- 46
- Medium
- 147
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 73
Most affected products
- nextcloud security-advisories
- 17
- librenms · librenms/librenms
- 13
- glpi-project glpi
- 11
- Cisco Catalyst SD-WAN Manager
- 8
- Hewlett Packard Enterprise (HPE) HPE Athonet Core
- 7
- Cisco RoomOS Software · Cisco TelePresence Endpoint Software
- 6
- Google Android
- 6
- Cisco Enterprise Chat and Email
- 4
- code-projects Farmacia
- 4
- chatwoot/chatwoot
- 3
Critical 19
- CVE-2024-11263arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=yzephyrproject-rtos Zephyr
- CVE-2024-10934OpenBSD NFS double-free vulnerabilityOpenBSD
- CVE-2024-52528Auth Token can be passed dummy or wrong the middleware response is 200 OKBudgetControl Gateway
- CVE-2023-20036Cisco Industrial Network Director Command Injection VulnerabilityCisco Industrial Network Director
- CVE-2023-20154Cisco Modeling Labs External Authentication Bypass VulnerabilityCisco Modeling Labs
- CVE-2023-0109Stored XSS in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2022-1884Remote Command Execution in gogs/gogsgogs/gogs · gogs.io/gogs
- CVE-2021-3902Improper Restriction of XML External Entity Reference in dompdf/dompdfdompdf/dompdf
- CVE-2021-3838PHAR Deserialization in dompdf/dompdfdompdf/dompdf
- CVE-2024-10443Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in SynoloSynology BeePhotos · Synology Photos
- CVE-2024-10924Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication BypassReally Simple Plugins Really Simple Security Pro multisi… +1
- CVE-2024-11120GeoVision EOL devices - OS Command InjectionGeoVision GV-VS12 · GeoVision GV-VS11 +2
- CVE-2024-44758An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to
- CVE-2024-45970Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a mali
- CVE-2024-45971Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a mali
- CVE-2024-50648yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to p
- CVE-2024-50649The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.
- CVE-2024-50724KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp.
- CVE-2024-51164Multiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog/insertBtnLog, which could allow a remote user to s
High 46
- CVE-2017-13313In ElementaryStreamQueue::dequeueAccessUnitMPEG4Video of ESQueue.cpp, there is a possible infinite loop leading to resource exhaustion due tGoogle Android
- CVE-2017-13314In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check.Google Android
- CVE-2017-13312In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation.Google Android
- CVE-2017-13311In the read() function of ProcessStats.java, there is a possible read/write serialization issue leading to a permissions bypass.Google Android
- CVE-2017-13310In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypass.Google Android
- CVE-2024-9500Autodesk ADP Desktop SDK Privilege Escalation VulnerabilityAutodesk Installer
- CVE-2024-49060Azure Stack HCI Elevation of Privilege VulnerabilityMicrosoft Azure Stack HCI OS
- CVE-2024-40638GLPI allows account takeover via SQL Injection in AJAX scriptsglpi-project glpi
- CVE-2024-52508Nextcloud Mail auto configurator can be tricked into sending account information to wrong serversnextcloud security-advisories
- CVE-2024-11248Tenda AC10 SetSysAutoRebbotCfg formSetRebootTimer stack-based overflowTenda AC10
- CVE-2024-39726IBM Engineering Insights XML external entity injectionIBM Engineering Insights
- CVE-2022-20649Cisco Redundancy Configuration Manager Debug Remote Code Execution VulnerabilityCisco Redundancy Configuration Manager
- CVE-2022-20655A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform aCisco IOS XR Software · Cisco Virtual Topology System +7
- CVE-2024-41784IBM Sterling Secure Proxy directory traversalIBM Sterling Secure Proxy
- CVE-2022-20685Multiple Cisco Products Snort Modbus Denial of Service VulnerabilityCisco Cyber Vision · Cisco Firepower Threat Defense Soft… +1
- CVE-2022-20814Cisco Expressway Series and Cisco TelePresence VCS Improper Certificate Validation VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2022-20853Cisco Expressway Series and Cisco TelePresence VCS Cross-Site Request Forgery VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2024-49754LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.phplibrenms · librenms/librenms
- CVE-2023-20125Cisco BroadWorks Network Server TCP Denial of Service VulnerabilityCisco BroadWorks
- CVE-2024-11237TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflowTP-Link VN020 F3v
- CVE-2024-10534Improper Access Control in Dataprom Informatics' PACS-ACSSDataprom Informatics Personnel Attendance Control Systems (…
- CVE-2024-0875Stored XSS in openemr/openemropenemr/openemr
- CVE-2024-1097Stored XSS in craigk5n/webcalendarcraigk5n/webcalendar
- CVE-2021-3742Server-Side Request Forgery (SSRF) in chatwoot/chatwootchatwoot/chatwoot
- CVE-2021-3741Stored Cross-site Scripting (XSS) in chatwoot/chatwootchatwoot/chatwoot
- CVE-2024-10311External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypasscmorillas1 External Database Based Actions
- CVE-2024-8979Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalationwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-45784Apache Airflow: Sensitive configuration values are not masked in the logs by defaultApache Software Foundation Apache Airflow · apache-airfl… +1
- CVE-2024-10793WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parametermelapress WP Activity Log
- CVE-2024-10260Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File UploadWordPress form builder plugin for contact forms, surveys an…
- CVE-2024-24426Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackegithub.com/magma/magma
- CVE-2024-24431A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2024-44625Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.gogs.io/gogs
- CVE-2024-44759An arbitrary file download vulnerability in the component /Doc/DownloadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to dow
- CVE-2024-45969NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malic
- CVE-2024-46462By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them per
- CVE-2024-46463By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perf
- CVE-2024-46465By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perf
- CVE-2024-46466By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by
- CVE-2024-46467By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them p
- CVE-2024-50647The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information.
- CVE-2024-50650python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different I
- CVE-2024-50653CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.
- CVE-2024-50654lilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain coupons beyond the quantity limit by capturi
- CVE-2024-50986An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.
- CVE-2024-51141An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe a
Medium, low and unrated 157
- CVE-2024-11262SourceCodester Student Record Management System View All Student Marks main stack-based overflowSourceCodester Student Record Management System
- CVE-2024-11261SourceCodester Student Record Management System Number of Students Menu StudentRecordManagementSystem.cpp memory corruptionSourceCodester Student Record Management System
- CVE-2024-51765A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS).Hewlett Packard Enterprise (HPE) Cray System Management Sof…
- CVE-2024-51764A security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS).Hewlett Packard Enterprise (HPE) SGI CXFS
- CVE-2024-38370GLPI allows API document download without rightsglpi-project glpi
- CVE-2017-13309In readEncryptedData of ConscryptEngine.java, there is a possible plaintext leak due to improperly used crypto.Google Android
- CVE-2024-11217Oauth-server-container: oauth-server-container logs client secret in debug leveloauth-server-container · Red Hat OpenShift Container Platfo…
- CVE-2024-45611GLPI has a stored XSS at src/RSSFeed.phpglpi-project glpi
- CVE-2024-45610GLPI has a reflected XSS in ajax/cable.phpglpi-project glpi
- CVE-2024-45609GLPI has a Reflected XSS in /front/stat.graph.phpglpi-project glpi
- CVE-2024-11259code-projects Farmacia fornecedores.php cross site scriptingcode-projects Farmacia
- CVE-2024-112581000 Projects Beauty Parlour Management System index.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-3334USB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0Fortra Digital Guardian Agent
- CVE-2024-49536Audition | Out-of-bounds Read (CWE-125)Adobe Audition
- CVE-2024-112571000 Projects Beauty Parlour Management System forgot-password.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-112561000 Projects Portfolio Management System MCA login.php sql injection1000 Projects Portfolio Management System MCA
- CVE-2024-45608GLPI has an Authenticated SQL Injectionglpi-project glpi
- CVE-2024-43418GLPI has multiple reflected XSSglpi-project glpi
- CVE-2024-43417Reflected XSS in Software formglpi-project glpi
- CVE-2024-41679Authenticated SQL injection in ticket formglpi-project glpi
- CVE-2024-41678GLPI has multiple reflected XSSglpi-project glpi
- CVE-2024-11251erzhongxmu Jeewms AuthInterceptor cgReportController.do sql injectionerzhongxmu Jeewms
- CVE-2024-47759GLPI has a stored XSS via document uploadglpi-project glpi
- CVE-2024-52509Nextcloud Mail app does not respect download permissions in sharesnextcloud security-advisories
- CVE-2024-11250code-projects Inventory Management editProduct.php sql injectioncode-projects Inventory Management
- CVE-2024-52510Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is emptynextcloud security-advisories
- CVE-2024-52507Share information of the Nextcloud Tables app is not limited to affected usersnextcloud security-advisories
- CVE-2024-52511Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tablesnextcloud security-advisories
- CVE-2024-52512Nextcloud User OIDC has an open redirection when logging in with User OIDCnextcloud security-advisories
- CVE-2024-52522Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadatarclone · github.com/rclone/rclone
- CVE-2024-52513Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" sharesnextcloud security-advisories
- CVE-2024-52514Nextcloud Server allows users to copy folder that contain files that are blocked by the files access controlnextcloud security-advisories
- CVE-2021-1466Cisco SD-WAN vDaemon Buffer Overflow VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2024-52515Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previewsnextcloud security-advisories
- CVE-2024-52516Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of themnextcloud security-advisories
- CVE-2024-52517Nextcloud Server's global credentials of external storages are sent back to the frontendnextcloud security-advisories
- CVE-2024-52518Nextcloud Server is missing password confirmation when changing external storage optionsnextcloud security-advisories
- CVE-2024-52519Nextcloud Server's OAuth2 client secrets were stored in a recoverable waynextcloud security-advisories
- CVE-2024-52520Nextcloud Server's link reference provider can be tricked into downloading bigger files than intendednextcloud security-advisories
- CVE-2021-1470Cisco SD-WAN SQL Injection VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2024-52521Nextcloud Server has a potential hash collision for background jobs could skip queuing themnextcloud security-advisories
- CVE-2021-1481Cisco SD-WAN vManage Cypher Query Language Injection VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2021-1482Cisco SD-WAN vManage Authorization Bypass VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2024-52523Nextcloud Server Custom defined credentials of external storages are sent back to the frontendnextcloud security-advisories
- CVE-2021-1464Cisco SD-WAN vManage Authorization Bypass VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2024-11247SourceCodester Online Eyewear Shop Inventory Page Master.php cross site scriptingSourceCodester Online Eyewear Shop
- CVE-2024-52525Nextcloud Server User password is available in memory of the PHP processnextcloud security-advisories
- CVE-2021-1483Cisco SD-WAN vManage Software XML External Entity VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2021-1484Cisco SD-WAN vManage Command Injection VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2021-1491Cisco SD-WAN vManage Software Information Disclosure VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2021-1494Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker tCisco Firepower Threat Defense Software · Cisco UTD SNORT I…
- CVE-2022-20633Cisco Enterprise Chat and Email Username Enumeration VulnerabilityCisco Enterprise Chat and Email
- CVE-2022-20632Cisco Enterprise Chat and Email Cross-Site Scripting VulnerabilityCisco Enterprise Chat and Email
- CVE-2021-34753Cisco Firepower Threat Defense Ethernet Industrial Protocol Policy Bypass VulnerabilitiesCisco Firepower Threat Defense Software
- CVE-2021-34752Cisco Firepower Threat Defense Command Injection VulnerabilitiesCisco Firepower Threat Defense Software
- CVE-2021-34751Cisco Firepower Management Center Software Configuration Information Disclosure VulnerabilityCisco Firepower Management Center
- CVE-2021-34750Cisco Firepower Management Center Software Configuration Information Disclosure VulnerabilityCisco Firepower Management Center
- CVE-2022-20626Cisco Prime Access Registrar Appliance Cross-Site Scripting VulnerabilityCisco Prime Access Registrar
- CVE-2022-20631Cisco Enterprise Chat and Email Cross-Site Scripting VulnerabilityCisco Enterprise Chat and Email
- CVE-2022-20654Cisco Webex Meetings Cross-Site Scripting VulnerabilityCisco Webex Meetings
- CVE-2022-20634Cisco Enterprise Chat and Email Open Redirect VulnerabilityCisco Enterprise Chat and Email
- CVE-2024-11246code-projects Farmacia adicionar-cliente.php cross site scriptingcode-projects Farmacia
- CVE-2022-20648Cisco Redundancy Configuration Manager Debug Information Disclosure VulnerabilityCisco Redundancy Configuration Manager
- CVE-2022-20652Cisco Tetration Command Injection VulnerabilityCisco Secure Workload
- CVE-2024-52526LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.phplibrenms · librenms/librenms
- CVE-2024-51497LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.phplibrenms · librenms/librenms
- CVE-2024-51496LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.phplibrenms · librenms/librenms
- CVE-2024-51495LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.phplibrenms · librenms/librenms
- CVE-2024-51494LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.phplibrenms · librenms/librenms
- CVE-2024-50355LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpointslibrenms · librenms/librenms
- CVE-2024-50352LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.phplibrenms · librenms/librenms
- CVE-2022-20657Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Cross-Site Scripting VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2022-20663Secure Network Analytics Cross-Site Scripting VulnerabilityCisco Secure Network Analytics
- CVE-2022-20656Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Path Traversal VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2022-20766Cisco ATA 190 Series Analog Telephone Adapter firmware Cisco Discovery Protocol Denial of Service VulnerabilityCisco Analog Telephone Adaptor (ATA) Software
- CVE-2024-50351LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.phplibrenms · librenms/librenms
- CVE-2022-20793Cisco Touch 10 Device Insufficient Identity Verification VulnerabilityCisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2022-20846Cisco IOS XR Software Cisco Discovery Protocol Buffer Overflow VulnerabilityCisco IOS XR Software
- CVE-2022-20845Cisco Network Convergence System 4000 Series TL1 Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2022-20849Cisco IOS XR Software Broadband Network Gateway PPPoE Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2024-11245code-projects Farmacia editar-produto.php sql injectioncode-projects Farmacia
- CVE-2024-11244code-projects Farmacia editar-cliente.php sql injectioncode-projects Farmacia
- CVE-2022-20948Cisco BroadWorks Hosted Thin Receptionist Cross-Site Scripting VulnerabilityCisco BroadWorks
- CVE-2022-20931Cisco Touch 10 Device Downgrade Attack VulnerabilityCisco TelePresence Endpoint Software
- CVE-2024-50350LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.phplibrenms · librenms/librenms
- CVE-2024-49764LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.phplibrenms · librenms/librenms
- CVE-2022-20871Cisco Secure Web Appliance Privilege Escalation VulnerabilityCisco Secure Web Appliance
- CVE-2024-49759LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.phplibrenms · librenms/librenms
- CVE-2022-20939Cisco Smart Software Manager On-Prem Privilege Escalation VulnerabilityCisco Smart Software Manager On-Prem
- CVE-2023-20004Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Write VulnerabilityCisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2023-20039Cisco Industrial Network Director File PermissionsCisco Industrial Network Director
- CVE-2023-20060Cisco Prime Collaboration Deployment Cross-Site Scripting VulnerabilityCisco Prime Collaboration Deployment
- CVE-2023-20090Cisco TelePresence Collaboration Endpoint and RoomOS Software Privilege Escalation VulnerabilityCisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2024-49758LibreNMS has a stored XSS in ExamplePlugin with Device's Noteslibrenms · librenms/librenms
- CVE-2023-20091Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityCisco TelePresence Endpoint Software
- CVE-2023-20092Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityCisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2023-20093Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityCisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2023-20094Cisco TelePresence Collaboration Endpoint and RoomOS Software Information Disclosure VulnerabilityCisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2024-52555In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer scriptJetBrains WebStorm
- CVE-2024-11243code-projects Online Shop Store signup.php cross site scriptingcode-projects Online Shop Store
- CVE-2024-20373Cisco IOS and Cisco IOS XE SNMP Extended ACL Bypass VulnerabilityCisco IOS XE Catalyst SD-WAN
- CVE-2024-43189IBM Concert Software information disclosureIBM Concert Software
- CVE-2024-41785IBM Concert cross-site scriptingIBM Concert Software
- CVE-2024-11242ZZCMS Keyword Filtering ad_list.php sql injectionZZCMS
- CVE-2024-11241code-projects Job Recruitment reset.php sql injectioncode-projects Job Recruitment
- CVE-2024-11240IBPhoenix ibWebAdmin Banco de Dados Tab database.php cross site scriptingIBPhoenix ibWebAdmin
- CVE-2024-11239Landray EKP API Interface import.do deleteFile path traversalLandray EKP
- CVE-2024-11238Landray EKP sysUiComponent.do delPreviewFile path traversalLandray EKP
- CVE-2022-1226Cross-site Scripting (XSS) in phpipam/phpipamphpipam/phpipam
- CVE-2023-2332Stored Cross-site Scripting (XSS) in pimcore/pimcorepimcore/pimcore
- CVE-2021-3740Session Fixation in chatwoot/chatwootchatwoot/chatwoot
- CVE-2024-1240Open Redirection in pyload/pyloadpyload/pyload · pyload-ng
- CVE-2024-0787Improper Restriction of Excessive Authentication Attempts in phpipam/phpipamphpipam/phpipam
- CVE-2023-4679Use After Free in gpac/gpacgpac/gpac
- CVE-2023-0737CSRF in wallabag/wallabagwallabag/wallabag
- CVE-2021-3991Improper Authorization in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2021-3988Cross-site Scripting (XSS) in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2021-3987Improper Access Control in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2021-3986Information Disclosure in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2021-3841Stored Cross-site Scripting (XSS) in sylius/syliussylius/sylius
- CVE-2024-11182Stored XSS vulnerability in MDaemon Email ServerMDaemon Email Server
- CVE-2024-8978Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposurewpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-10825Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URLjohndarrel WP Ghost (Hide My WP Ghost) – Security & Firewall
- CVE-2024-8961Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-9529Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code ExecutionSecure Custom Fields · Advanced Custom Fields Pro
- CVE-2024-10104Jobs for WordPress < 2.7.8 - Contributor+ Stored XSSJobs for WordPress
- CVE-2024-9356Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site ScriptingYotpo: Product & Photo Reviews for WooCommerce
- CVE-2024-10582Music Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Importsmartwpress Music Player for Elementor – Audio Player & Pod…
- CVE-2024-10113WP AdCenter – Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcodewpeka-club WP AdCenter – Ad Manager & Adsense Ads
- CVE-2024-39610Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026.unclebob FitNesse · org.fitnesse:fitnesse
- CVE-2024-42499Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026.unclebob FitNesse · org.fitnesse:fitnesse
- CVE-2024-9609LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scriptingthimpress LearnPress – Backup & Migration Tool
- CVE-2024-10897Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installationthemeum Tutor LMS Elementor Addons
- CVE-2024-23169The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule c
- CVE-2024-24425Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amgithub.com/magma/magma
- CVE-2024-24446An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a cra
- CVE-2024-24447A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause
- CVE-2024-24449An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a D
- CVE-2024-24450Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allo
- CVE-2024-24452An invalid memory access when handling the ProtocolIE_ID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attacHewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2024-24453An invalid memory access when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME Hewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2024-24454An invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackersHewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2024-24455An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows aHewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2024-24457An invalid memory access when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allowsHewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2024-24458An invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.Hewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2024-24459An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cHewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2024-46383Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext
- CVE-2024-48068A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbi
- CVE-2024-49592Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation because of an Uncont
- CVE-2024-50651java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs
- CVE-2024-50652A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function.
- CVE-2024-50655emlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write malicious JavaScript code in published artic
- CVE-2024-50800Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error
- CVE-2024-50983FlightPath 7.5 contains a Cross Site Scripting (XSS) vulnerability, which allows authenticated remote attackers with administrative rights t
- CVE-2024-51037An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature in the password res
- CVE-2024-51142Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the stor
- CVE-2024-51330An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IP