CVEs published November 21, 2024
130 CVEs were published on November 21, 2024: 10 critical, 28 high.
- Published
- 130
- Critical
- 10
- High
- 28
- Medium
- 91
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Linux
- 7
- Brocade SANnav
- 5
- Wowza Streaming Engine
- 5
- MC Technologies MC LR Router
- 4
- goauthentik authentik
- 3
- 1000 Projects Beauty Parlour Management System
- 2
- Automated Logic, a Carrier company WebCTRL · Carrier i-Vu
- 2
- avahi · Red Hat Enterprise Linux +1
- 2
- Brocade Fabric OS
- 2
- GoCast
- 2
Critical 10
- CVE-2024-52052Stream Target Remote Code Execution in Wowza Streaming EngineWowza Streaming Engine
- CVE-2024-53095smb: client: Fix use-after-free of network namespace.Linux
- CVE-2024-53094RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGESLinux
- CVE-2024-8525Automated Logic WebCTRL and Carrier i-Vu Unrestricted File UploadAutomated Logic, a Carrier company WebCTRL · Carrier i-Vu
- CVE-2024-28892An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3.GoCast · github.com/mayuresh82/gocast
- CVE-2024-29224An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3.GoCast
- CVE-2024-21855A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3.GoCast
- CVE-2024-30896InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with r
- CVE-2024-51366An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploa
- CVE-2024-51367An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitr
High 28
- CVE-2024-52055Application Copy Path Traversal in Wowza Streaming EngineWowza Streaming Engine
- CVE-2024-52053Stored Cross-Site Scripting in Wowza Streaming EngineWowza Streaming Engine
- CVE-2024-53093nvme-multipath: defer partition scanningLinux
- CVE-2024-53092virtio_pci: Fix admin vq cleanup by using correct info pointerLinux
- CVE-2024-53091bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rxLinux
- CVE-2024-53090afs: Fix lock recursionLinux
- CVE-2024-52289authentik has an insecure default configuration for OAuth2 Redirect URIsgoauthentik authentik
- CVE-2024-52799Argo Workflows Chart: Excessive Privileges in Workflow Roleargoproj argo-helm
- CVE-2024-52803LLama Factory Remote OS Command Injection Vulnerabilityhiyouga LLaMA-Factory · llamafactory
- CVE-2024-28027Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5MC Technologies MC LR Router
- CVE-2024-28026Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5MC Technologies MC LR Router
- CVE-2024-28025Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5MC Technologies MC LR Router
- CVE-2024-21786An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5.MC Technologies MC LR Router
- CVE-2024-7026SQLi in Teknogis Informatics' Closed Circuit Vehicle Tracking SoftwareTeknogis Informatics Closed Circuit Vehicle Tracking Softwa…
- CVE-2024-11596Buffer Over-read in WiresharkWireshark Foundation Wireshark
- CVE-2024-11595Loop with Unreachable Exit Condition ('Infinite Loop') in WiresharkWireshark Foundation Wireshark
- CVE-2024-10400Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterthemeum Tutor LMS – eLearning and online course solution
- CVE-2024-7517Privileged escalation via crafted use of portcfg commandBrocade Fabric OS
- CVE-2024-10788Activity Log – Monitor & Record User Changes <= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Contextelemntor Activity Log – Monitor & Record User Changes
- CVE-2024-10898Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusionkrishaweb Email addon for CF7
- CVE-2024-11409Grid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injectionpriyajain2802 Grid View Gallery
- CVE-2024-48286Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.
- CVE-2024-48288TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the fronten
- CVE-2024-51364An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file.
- CVE-2024-53334TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.
- CVE-2024-53335TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.
- CVE-2024-53429Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.
- CVE-2024-53432While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at.
Medium, low and unrated 92
- CVE-2024-52056Application Delete Path Traversal in Wowza Streaming EngineWowza Streaming Engine
- CVE-2024-52054Application Creation Path Traversal in Wowza Streaming EngineWowza Streaming Engine
- CVE-2024-52616Avahi: avahi wide-area dns predictable transaction idsavahi · Red Hat Enterprise Linux +1
- CVE-2024-52615Avahi: avahi wide-area dns uses constant source portavahi · Red Hat Enterprise Linux +1
- CVE-2024-49588Multiple authenticated SQL injections in oracle-sidecarcom.palantir.srx.prometheus.sls-oracle-sidecar:sls-oracle-s…
- CVE-2024-53089LoongArch: KVM: Mark hrtimer to expire in hard interrupt contextLinux
- CVE-2024-52287authentik performs insufficient validation of OAuth scopesgoauthentik authentik
- CVE-2024-52307authentik allows a timing attack due to missing constant time comparison for metrics viewgoauthentik authentik
- CVE-2024-52309SFTPGo allows administrators to restrict command execution from the EventManagerdrakkan sftpgo · github.com/drakkan/sftpgo/v2 +2
- CVE-2024-49529InDesign Desktop | Out-of-bounds Read (CWE-125)Adobe InDesign Desktop
- CVE-2024-8526Automated Logic WebCTRL and Carrier i-Vu Open RedirectAutomated Logic, a Carrier company WebCTRL · Carrier i-Vu
- CVE-2024-115921000 Projects Beauty Parlour Management System about-us.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-115911000 Projects Beauty Parlour Management System add-services.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-11088Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actorwpinsider-1 Simple Membership
- CVE-2024-11089Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurecayenne Anonymous Restricted Content
- CVE-2024-7130Reflected XSS in Kion Computer's KION Exchange Programs SoftwareKion Computer KION Exchange Programs Software
- CVE-2024-115901000 Projects Bookstore Management System forget_password_process.php sql injection1000 Projects Bookstore Management System
- CVE-2024-11589itsourcecode Tailoring Management System expcatedit.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-11588AVL-DiTEST-DiagDev libdoip DoIPConnection.cpp reactOnReceivedTcpMessage null pointer dereferenceAVL-DiTEST-DiagDev libdoip
- CVE-2024-11587idcCMS classProvCity.php GetCityOptionJs cross site scriptingidcCMS
- CVE-2024-7016Stored XSS in Smarttek Informatics' Smart DoctorSmarttek Informatics Smart Doctor
- CVE-2024-9542Sky Addons for Elementor <= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Templatewowdevs Sky Addons – Elementor Addons with Widgets & Templa…
- CVE-2024-10316Stratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesjetmonsters Stratum Widgets for Elementor
- CVE-2024-11320Command Injection leading to RCE via LDAP MisconfigurationPandora FMS
- CVE-2024-10792Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scriptinggetwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- CVE-2024-52067Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug LogApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2024-10675affiliate-toolkit <= 3.6.7 - Reflected Cross-Site Scriptingcservit affiliate-toolkit – Multi-Network Affiliate & Amazo…
- CVE-2024-11371Theater for WordPress <= 0.18.6.2 - Reflected Cross-Site Scriptingslimndap Theater for WordPress
- CVE-2024-11456Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scriptingmdedev Run Contests, Raffles, and Giveaways with ContestsWP
- CVE-2024-10890WPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scriptinggwin WPAdverts – Classifieds Plugin
- CVE-2024-10393Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registrationthemeum Tutor LMS – eLearning and online course solution
- CVE-2024-9828Taskbuilder < 3.0.5 - Admin+ SQL InjectionTaskbuilder
- CVE-2024-9768Formidable Forms < 6.14.1 - Admin+ Stored XSSFormidable Forms
- CVE-2024-9600Ditty < 3.1.47 - Author+ Stored XSSDitty
- CVE-2024-8157Alphabetical List <= 1.0.3 - Settings Update via CSRFAlphabetical List
- CVE-2024-5029CM Table Of Contents – WordPress TOC Plugin < 1.2.4 - Stored XSS via CSRFCM Table Of Contents
- CVE-2024-10482Media Library Tools < 1.5.0 - Author+ Stored XSS via SVGMedia File Rename, Find Unused File, Add Alt text, Caption,…
- CVE-2024-10403SFTP/FTP password could be captured in plain text in Supportsave generated from SANnavBrocade Fabric OS
- CVE-2024-10671Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosurebplugins Button Block – Design Stylish, Interactive, and Mu…
- CVE-2024-11334My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Exportluydjmi My Contador lesr
- CVE-2024-10782Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosuretheblockswp Theme Builder For Elementor
- CVE-2024-11438StreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingjburleigh1 StreamWeasels Online Status Bar
- CVE-2024-10528Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Updateultimatemember Ultimate Member – User Profile, Registration…
- CVE-2024-9371Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scriptingwpmudev Branda – White Label & Branding, Free Login Page Cu…
- CVE-2024-10623ForumEngine <= 1.8 - Reflected Cross-Site ScriptingEngineThemes ForumEngine
- CVE-2024-10796If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosureifso If-So Dynamic Content Personalization
- CVE-2024-10785Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2022-43937Brocade SANnav Information Disclosure VulnerabilityBrocade SANnav
- CVE-2022-43936Brocade Fabric OS switch passwords when debugging is enabledBrocade SANnav
- CVE-2024-11440Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinggreyowl0015 Grey Owl Lightbox
- CVE-2024-10177Beds24 Online Booking <= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcodemarkkinchin Beds24 Online Booking
- CVE-2024-11365Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scriptingsecurityforce Crypto and DeFi Widgets – Web3 Cryptocurrency…
- CVE-2024-11416WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingalexvtn WIP Incoming Lite
- CVE-2024-10172WPBakery Visual Composer WHMCS Elements <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcodevoidcoders Innovs WPBakery Visual Composer WHMCS Elements
- CVE-2024-11385Pure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingsafi-mohammad Pure CSS Circle Progress bar
- CVE-2024-9442F4 Improvements <= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadfaktorvier F4 Improvements
- CVE-2024-11388Dino Game – Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingtahmidulkarim Dino Game – Embed Google Chrome Dinosaur Game…
- CVE-2024-11424Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingpengbos Slick Sitemap
- CVE-2024-11360Page Parts <= 1.4.3 - Reflected Cross-Site Scriptinghusobj Page Parts
- CVE-2024-10696UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcodecodersaiful UltraAddons for Elementor
- CVE-2024-10522Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameterseb-emendo Co-marquage service-public.fr
- CVE-2024-11197Lock User Account <= 1.0.5 - User Lock Bypassbabatechs Lock User Account
- CVE-2024-11412Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingsabbirislam397 Shine PDF Embeder
- CVE-2024-11435salavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scriptinggoback2 salavat counter Plugin
- CVE-2024-11432SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingalexvtn SuevaFree Essential Kit
- CVE-2024-11428Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingaishan Lazy load videos and sticky control
- CVE-2024-11354Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletioncodelizarplugs Ultimate YouTube Video & Shorts Player With…
- CVE-2024-10726Friendly Functions for Welcart <= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingmainichiweb Friendly Functions for Welcart
- CVE-2024-11370Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scriptingmediaticus Subaccounts for WooCommerce
- CVE-2024-9111Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadPickPlugins Product Designer for WooCommerce
- CVE-2024-11455Include Mastodon Feed <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingwolfgang101 Include Mastodon Feed
- CVE-2024-10532Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Importwproyal Bard Extra
- CVE-2024-11414RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingdasmaeh RecipePress Reloaded
- CVE-2024-10164Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcodecodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2024-9851LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadfeedmymedia Tour Operator
- CVE-2024-10682Bulletin Announcements <= 3.11.7 - Reflected Cross-Site Scriptingmikewire_rocksolid Announcement & Notification Banner – Bul…
- CVE-2024-11447Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App <=7.0.3.0 - Reflected Cross-Site ScriptingCommunity by PeepSo – Download from PeepSo.com
- CVE-2022-43935Switch passwords and authorization IDs are printed in the embedded MLS DB fileBrocade SANnav
- CVE-2022-43934Weak Key-exchange algorithmsBrocade SANnav
- CVE-2022-43933configuration secrets are logged in support-saveBrocade SANnav
- CVE-2024-52797Searching Opencast may cause a denial of serviceopencast · org.opencastproject:opencast-elasticsearch-impl
- CVE-2024-45663IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2024-45194In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) p
- CVE-2024-45512An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1.
- CVE-2024-45513An issue was discovered in Zimbra Collaboration (ZCS) through 10.1.
- CVE-2024-45514An issue was discovered in Zimbra Collaboration (ZCS) through v10.1.
- CVE-2024-45517An issue was discovered in Zimbra Collaboration (ZCS) through 10.1.
- CVE-2024-48747An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file.
- CVE-2024-51337Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive informatio
- CVE-2024-53333TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function.
- CVE-2024-53425A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3.pyassimp
- CVE-2024-53426A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.