CVEs published November 20, 2024
122 CVEs were published on November 20, 2024: 19 critical, 46 high.
- Published
- 122
- Critical
- 19
- High
- 46
- Medium
- 52
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Google Android
- 19
- 115cms
- 6
- Code4Berry Decoration Management System
- 4
- moodle · moodle/moodle
- 4
- Rakuten Mobile Rakuten Turbo
- 3
- Bubka 2FAuth
- 2
- upKeeper Solutions upKeeper Instant Privilege Access
- 2
- aaron13100 404 Solution
- 1
- aaronrobbins Post Ideas
- 1
- brainvireinfo Dynamic URL SEO
- 1
Critical 19
- CVE-2018-9479In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds chGoogle Android
- CVE-2018-9478In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds chGoogle Android
- CVE-2018-9471In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion.Google Android
- CVE-2024-10094Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of CodePegasystems Pega Infinity
- CVE-2024-9479Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue aupKeeper Solutions upKeeper Instant Privilege Access
- CVE-2024-9478Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue aupKeeper Solutions upKeeper Instant Privilege Access
- CVE-2024-52442WordPress UserPlus plugin <= 2.0 - Privilege Escalation vulnerabilityUserPlus
- CVE-2024-52439WordPress Team Rosters plugin <= 4.8.2 - PHP Object Injection vulnerabilityMark O'Donnell Team Rosters
- CVE-2024-52440WordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerabilityXpresslane Fast Checkout
- CVE-2024-52441WordPress Quick Learn plugin <= 1.0.1 - PHP Object Injection vulnerabilityRajesh Thanoch Quick Learn
- CVE-2024-52443WordPress Geolocator plugin <= 1.1 - PHP Object Injection vulnerabilitymasikonis Geolocator
- CVE-2024-10127Support for authentication bypass condition in M-Files LDAP authenticationM-Files Server
- CVE-2024-29292Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to exe
- CVE-2024-33439An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi p
- CVE-2024-48984An issue was discovered in MBed OS 6.16.0.
- CVE-2024-52677HkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php.
- CVE-2024-52765H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.
- CVE-2024-52770An arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary c
- CVE-2024-52771DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.
High 46
- CVE-2024-9875Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo commOkta Privileged Access Server Agent
- CVE-2024-52581Litestar allows unbounded resource consumption (DoS vulnerability)litestar-org litestar · litestar +1
- CVE-2018-9484In l2cu_send_peer_config_rej of l2c_utils.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9477In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check.Google Android
- CVE-2018-9475In HeadsetInterface::ClccResponse of btif_hf.cc, there is a possible out of bounds stack write due to a missing bounds check.Google Android
- CVE-2018-9474In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation.Google Android
- CVE-2018-9472In xmlMemStrdupLoc of xmlmemory.c, there is a possible out-of-bounds write due to an integer overflow.Google Android
- CVE-2018-9470In bff_Scanner_addOutPos of Scanner.c, there is a possible out-of-bounds write due to an incorrect bounds check.Google Android
- CVE-2018-9469In multiple functions of ShortcutService.java, there is a possible creation of a spoofed shortcut due to a missing permission check.Google Android
- CVE-2018-9468In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass.Google Android
- CVE-2024-52470WordPress Dynamic URL SEO plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitybrainvireinfo Dynamic URL SEO
- CVE-2024-52471WordPress Extensions for Elementor plugin <= 2.0.37 - Reflected Cross Site Scripting (XSS) vulnerabilitypetesheppard84 Extensions for Elementor
- CVE-2024-52472WordPress Weather Atlas Widget plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityWeather Atlas Widget
- CVE-2024-52473WordPress HTML5 Lyrics Karaoke Player plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerabilitySandeep Verma HTML5 Lyrics Karaoke Player
- CVE-2024-525982FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/previewBubka 2FAuth
- CVE-2024-10913Clone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'migrate Clone
- CVE-2024-11495Buffer overflow in OllyDbgOllyDbg.exe
- CVE-2024-52437WordPress Banner System plugin <= 1.0.0 - Privilege Escalation vulnerabilitySaul Morales Pacheco Banner System
- CVE-2024-52438WordPress de:branding plugin <= 1.0.2 - Privilege Escalation vulnerabilitydeco.agency de:branding
- CVE-2024-52451WordPress Post Ideas plugin <= 2 - CSRF to SQL Injection vulnerabilityaaronrobbins Post Ideas
- CVE-2024-52448WordPress Ultimate Classified Listings plugin <= 1.7 - Local File Inclusion vulnerabilitywebcodingplace Ultimate Classified Listings
- CVE-2024-52449WordPress WordPress Bootscraper plugin <= 2.1.0 - Local File Inclusion vulnerabilityNavneil Naicer Bootscraper
- CVE-2024-52450WordPress nBlocks plugin <= 1.0.2 - Local File Inclusion vulnerabilityofficialprocoders nBlocks
- CVE-2024-52445WordPress QRMenu Restaurant QR Menu Lite plugin <= 1.0.4 - PHP Object Injection vulnerabilityModelTheme QRMenu Restaurant QR Menu Lite
- CVE-2024-52446WordPress Buying Buddy IDX CRM plugin <= 1.2.8 - CSRF to PHP Object Injection vulnerabilityBuying Buddy IDX CRM
- CVE-2024-52444WordPress Opal Woo Custom Product Variation plugin <= 1.1.3 - Arbitrary File Deletion vulnerabilitywpopal Opal Woo Custom Product Variation
- CVE-2024-52447WordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerabilitycorporatezen222 Contact Page With Google Map
- CVE-2024-45690Moodle: idor when deleting oauth2 linked accountsmoodle · moodle/moodle
- CVE-2024-10382Arbitrary Code execution in Car App Android Jetpack LibraryGoogle Android
- CVE-2024-11494**UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_201403Zyxel P-6101C firmware
- CVE-2024-48895Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware versionRakuten Mobile Rakuten Turbo
- CVE-2024-10855Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option DeletionImage Optimizer, Resizer and CDN – Sirv
- CVE-2024-10899WooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scriptingwcproducttable Product Table and List Builder for WooCommer…
- CVE-2024-48530An issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (Do
- CVE-2024-48536Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a c
- CVE-2024-48981An issue was discovered in MBed OS 6.16.0.
- CVE-2024-48982An issue was discovered in MBed OS 6.16.0.
- CVE-2024-48983An issue was discovered in MBed OS 6.16.0.
- CVE-2024-48985An issue was discovered in MBed OS 6.16.0.
- CVE-2024-48986An issue was discovered in MBed OS 6.16.0.
- CVE-2024-51151D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.
- CVE-2024-51162An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges.
- CVE-2024-51163A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive
- CVE-2024-51208File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious P
- CVE-2024-52739D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function vi
- CVE-2024-52769An arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code
Medium, low and unrated 57
- CVE-2018-9487In setVpnForcedLocked of Vpn.java, there is a possible blocking of internet traffic through vpn due to a bad uid check.Google Android
- CVE-2018-9486In hidh_l2cif_data_ind of hidh_conn.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9485In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2018-9483In bta_dm_remove_sec_dev_entry of bta_dm_act.cc, there is a possible out of bounds read due to a use after free.Google Android
- CVE-2018-9482In intr_data_copy_cb of btif_hd.cc, there is a possible out of bounds read due to an integer overflow.Google Android
- CVE-2018-9481In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow.Google Android
- CVE-2018-9480In bta_hd_get_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to improper input validation.Google Android
- CVE-2024-11493115cms pageAE.html cross site scripting115cms
- CVE-2024-11492115cms appurladd.html cross site scripting115cms
- CVE-2024-11491115cms useradmin.html cross site scripting115cms
- CVE-2024-11490115cms set.html cross site scripting115cms
- CVE-2024-11489115cms file.html cross site scripting115cms
- CVE-2024-11488115cms web_user.html cross site scripting115cms
- CVE-2024-52796Password Pusher's rate limiter can be bypassed by forging proxy headerspglombardo PasswordPusher · pwpush
- CVE-2024-11487Code4Berry Decoration Management System Between Dates Reports btndates_report.php sql injectionCode4Berry Decoration Management System
- CVE-2024-11486Code4Berry Decoration Management System User Permission user_permission.phpCode4Berry Decoration Management System
- CVE-2024-11485Code4Berry Decoration Management System User userregister.php permissionCode4Berry Decoration Management System
- CVE-2024-11484Code4Berry Decoration Management System User Image update_image.php access controlCode4Berry Decoration Management System
- CVE-2024-525972FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderBubka 2FAuth
- CVE-2024-11154PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information ExposurePublishPress Revisions: Duplicate Posts, Submit, Approve an…
- CVE-2024-11406Stored XSS in django CMS Attributes Fieldsdjango CMS Association django CMS Attributes Fields · djang…
- CVE-2024-11404File Upload Bypass in django Filerdjango CMS Association django Filer · django-filer
- CVE-2024-10520WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletionwedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2024-10872Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scriptingjetmonsters Getwid – Gutenberg Blocks
- CVE-2024-48899Moodle: idor when accessing list of course badgesmoodle · moodle/moodle
- CVE-2024-45691Moodle: lesson activity password bypass through php loose comparisonmoodle · moodle/moodle
- CVE-2024-45689Moodle: unprotected access to sensitive information via dynamic tablesmoodle · moodle/moodle
- CVE-2024-11179MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injectioninspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2024-10891Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingSave as PDF Plugin by PDFCrowd
- CVE-2024-10665Yaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletionyaadsarig Yaad Sarig Payment Gateway For WC
- CVE-2024-10126Local file inclusion vulnerability in M-Files ServerM-Files Corporation" M-Files Server
- CVE-2024-11176Incorrect evaluation of effective permissions in M-Files AinoM-Files Aino
- CVE-2024-47865Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier.Rakuten Mobile Rakuten Turbo
- CVE-2024-52033Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earRakuten Mobile Rakuten Turbo
- CVE-2024-10365The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-9239Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scriptingpluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2024-8726MailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site ScriptingMailChimp Forms by MailMunch
- CVE-2024-10900ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletionmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-11277404 Solution <= 2.35.19 - Reflected Cross-Site Scriptingaaron13100 404 Solution
- CVE-2024-10515SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSSSEO Plugin by Squirrly SEO
- CVE-2024-9653Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scriptinggloriafood Restaurant Menu – Food Ordering System – Table R…
- CVE-2024-52614Use of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK" for Android versions prior to 3.8.5.Kura Sushi Official App Produced by EPARK
- CVE-2024-11278GD bbPress Attachments <= 4.7.2 - Reflected Cross-Site Scriptinggdragon GD bbPress Attachments
- CVE-2024-45510An issue was discovered in Zimbra Collaboration (ZCS) through 10.0.
- CVE-2024-45511An issue was discovered in Zimbra Collaboration (ZCS) through 10.1.
- CVE-2024-48531A reflected cross-site scripting (XSS) vulnerability on the Rental Availability module of eSoft Planner 3.24.08271-USA allows attackers to e
- CVE-2024-48533A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allow
- CVE-2024-48534A reflected cross-site scripting (XSS) vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute
- CVE-2024-48535A stored cross-site scripting (XSS) vulnerability in eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary web scripts or HTML
- CVE-2024-49203Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery.io.github.openfeign.querydsl:querydsl-jpa · io.github.op… +2
- CVE-2024-51209Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary we
- CVE-2024-52701A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scri
- CVE-2024-52702A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary w
- CVE-2024-52725SemCms v4.8 was discovered to contain a SQL injection vulnerability.
- CVE-2024-52754D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile_htm function.
- CVE-2024-52755D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host_ip parameter in the ipsec_road_asp function.
- CVE-2024-52757D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter in the arp_sys_asp function.