CVEs published November 25, 2024
71 CVEs were published on November 25, 2024: 2 critical, 16 high.
- Published
- 71
- Critical
- 2
- High
- 16
- Medium
- 47
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- EnGenius ENH1350EXT · EnGenius ENS500-AC +1
- 9
- Linux
- 6
- 1000 Projects Beauty Parlour Management System
- 3
- Devolutions Remote Desktop Manager
- 3
- Eaton Intelligent Power Protector
- 2
- IBM Jazz Foundation
- 2
- keycloak · Red Hat build of Keycloak +3
- 2
- libjxl
- 2
- sveltejs kit · @sveltejs/kit
- 2
- vivo Framework
- 2
Critical 2
- CVE-2024-50672A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administ
- CVE-2024-52787An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename ilibre-chat
High 16
- CVE-2024-53843Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-serverDapperDuckling keycloak-connector · @dapperduckling/keycloa…
- CVE-2024-53100nvme: tcp: avoid race between queue_lock lock and destroyLinux
- CVE-2024-53099bpf: Check validity of link->type in bpf_link_show_fdinfo()Linux
- CVE-2024-53098drm/xe/ufence: Prefetch ufence addr to catch bogus addressLinux
- CVE-2024-53096mm: resolve faulty mmap_region() error path behaviourLinux
- CVE-2024-53268Lack of validation on openExternal allows 1 click remote code execution in joplinlaurent22 joplin
- CVE-2024-53258download_all_submissions allows student to download another student's submissions in AutolabAutolab
- CVE-2024-52811Acks not validated before logged to qlog leads to buffer overflow in ngtcp2ngtcp2
- CVE-2024-8272macOS Universal Audio (UAConnect) <= 2.7.0 - Local Privilege EscalationUniversal Audio UAConnect
- CVE-2024-7915macOS Sensei Mac Cleaner Local Privilege Escalation via PID Reuse - Race Condition AttackSensei Mac Cleaner
- CVE-2024-27134Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udfmlflow
- CVE-2024-11664eNMS TGZ File controller.py multiselect_filtering path traversaleNMS
- CVE-2024-11650Tenda i9 GetIPTV websReadEvent null pointer dereferenceTenda i9
- CVE-2024-45755An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x befo
- CVE-2024-45756An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before 24.04.2, 23.10.x before 23.10.1, 23.04.x be
- CVE-2024-53554A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execut
Medium, low and unrated 53
- CVE-2024-11674CodeAstro Hospital Management System his_doc_update-account.php unrestricted uploadCodeAstro Hospital Management System
- CVE-2024-116731000 Projects Bookstore Management System cross-site request forgery1000 Projects Bookstore Management System
- CVE-2024-53101fs: Fix uninitialized value issue in from_kuid and from_kgidLinux
- CVE-2024-53097mm: krealloc: Fix MTE false alarm in __do_kreallocLinux
- CVE-2024-53261Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKitsveltejs kit · @sveltejs/kit
- CVE-2024-53262Unescaped error message included on error page in SvelteKitsveltejs kit · @sveltejs/kit
- CVE-2024-53255Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMSBoidCMS
- CVE-2024-52529Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Ciliumcilium · github.com/cilium/cilium
- CVE-2024-32468Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generatordenoland deno · deno_doc
- CVE-2024-51723Vulnerability in Management Console Impacts BlackBerry AtHocBlackBerry AtHoc
- CVE-2023-26280IBM Jazz Foundation improper access controlIBM Jazz Foundation
- CVE-2023-45181IBM Jazz Foundation cross-site scriptingIBM Jazz Foundation
- CVE-2024-11670Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allowsDevolutions Remote Desktop Manager
- CVE-2024-11671Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on Windows allows an aDevolutions Remote Desktop Manager
- CVE-2024-11672Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an autDevolutions Remote Desktop Manager
- CVE-2024-11403Out of Bounds Memory Read/Write in libjxllibjxl
- CVE-2024-11498Resource exhaustion via Stack overflow in libjxllibjxl
- CVE-2020-12492Wifi information acquisition vulnerability in Framework Servicesvivo Framework
- CVE-2020-12491Framework Information Disclosure Vulnerabilityvivo Framework
- CVE-2022-33862Improper access control mechanism in IPPEaton Intelligent Power Protector
- CVE-2022-33861Insufficient verification of authenticity in IPPEaton Intelligent Power Protector
- CVE-2021-23282Stored Cross-site Scripting reported in Intelligent Power Manager v1Eaton Intelligent Power Manager
- CVE-2024-11663Codezips E-Commerce Site search.php sql injectionCodezips E-Commerce Site
- CVE-2024-11662welliamcao OpsManage API Endpoint deploy_api.py deploy_host_vars deserializationwelliamcao OpsManage
- CVE-2024-10492Keycloak-quarkus-server: keycloak path trasversalkeycloak · Red Hat build of Keycloak +3
- CVE-2024-10451Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build processRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2
- CVE-2024-10270Org.keycloak:keycloak-services: keycloak denial of servicekeycloak · Red Hat build of Keycloak +3
- CVE-2024-11661Codezips Free Exam Hall Seating Management System Profile Image profile.php unrestricted uploadCodezips Free Exam Hall Seating Management System
- CVE-2024-9666Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilitykeycloak · Red Hat build of Keycloak +2
- CVE-2024-11660code-projects Farmacia usuario.php cross site scriptingcode-projects Farmacia
- CVE-2024-11659EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-6538Openshift-console: openshift console: server-side request forgeryopenshift-console · Red Hat OpenShift Container Platform +1
- CVE-2024-11658EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-7056WPForms < 1.9.1.6 - Admin+ Stored XSSWPForms
- CVE-2024-6393NextGEN Gallery < 3.59.5 - Admin+ Stored XSSPhoto Gallery, Sliders, Proofing and Themes
- CVE-2024-10710YaDisk Files <= 1.2.5 - Admin+ Stored XSSYaDisk Files
- CVE-2024-10709YaDisk Files <= 1.2.5 - Contributor+ Stored XSS via ShortcodeYaDisk Files
- CVE-2024-11657EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-11656EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_ping6 command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-11655EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-11654EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-11483Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5django-ansible-base · Red Hat Ansible Automation Platform 2…
- CVE-2024-11653EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-11652EnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-11651EnGenius ENH1350EXT/ENS500-AC/ENS620EXT wifi_schedule command injectionEnGenius ENH1350EXT · EnGenius ENS500-AC +1
- CVE-2024-116491000 Projects Beauty Parlour Management System search-appointment.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-116481000 Projects Beauty Parlour Management System add-customer.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-116471000 Projects Beauty Parlour Management System view-appointment.php sql injection1000 Projects Beauty Parlour Management System
- CVE-2024-50671Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email add
- CVE-2024-53556An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /log
- CVE-2024-53597masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit.
- CVE-2024-53599A cross-site scripting (XSS) vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web sc
- CVE-2024-53930WikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser.