CVEs published November 26, 2024
162 CVEs were published on November 26, 2024: 22 critical, 61 high. 2 are now in CISA KEV.
- Published
- 162
- Critical
- 22
- High
- 61
- Medium
- 76
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 60
Most affected products
- Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- 20
- Mozilla Firefox · Mozilla Thunderbird
- 16
- Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- 14
- Qualcomm Snapdragon
- 12
- GitLab
- 7
- VMware Aria Operations
- 5
- Apache Software Foundation Apache NimBLE
- 4
- CodeAstro Hospital Management System
- 4
- Axis Communications AB AXIS Camera Station Pro · Axis Commu…
- 3
- Dell Wyse Management Suite
- 3
Critical 22
- CVE-2024-49038Microsoft Copilot Studio Elevation Of Privilege VulnerabilityMicrosoft Copilot Studio
- CVE-2019-17082Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass.OpenText™ AccuRev
- CVE-2024-11145Easy Folder Listing Pro deserialization vulnerabilityValor Apps Easy Folder Listing Pro
- CVE-2024-11705`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11698A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialMozilla Firefox · Mozilla Thunderbird
- CVE-2024-11704A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11693The executable file warning was not presented when downloading .library-ms files.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11024AppPresser – Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Resetscottopolis AppPresser – Mobile App Framework
- CVE-2024-50375A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50374A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50373A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50372A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50371A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50370A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-11680ProjectSend Unauthenticated Configuration ModificationProjectSend
- CVE-2016-10394Improper Authentication in CoreQualcomm Snapdragon
- CVE-2024-36248API keys for some cloud services are hardcoded in the "main" binary.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-35244There are several hidden accounts.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-33610"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-28038The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-10542Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin InstallationSpam protection, Honeypot, Anti-Spam by CleanTalk
- CVE-2024-50942qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml.
High 61
- CVE-2024-53675An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainHewlett Packard Enterprise (HPE) HPE Insight Remote Support
- CVE-2024-53674An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainHewlett Packard Enterprise (HPE) HPE Insight Remote Support
- CVE-2024-53673A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code.Hewlett Packard Enterprise (HPE) Insight Remote Support
- CVE-2024-11622An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainHewlett Packard Enterprise (HPE) HPE Insight Remote Support
- CVE-2024-11745Tenda AC8 SetStaticRouteCfg route_static_check stack-based overflowTenda AC8
- CVE-2024-49053Microsoft Dynamics 365 Sales Spoofing VulnerabilityMicrosoft Dynamics 365 Sales for Android · Microsoft Dynami…
- CVE-2024-49052Microsoft Azure PolicyWatch Elevation of Privilege VulnerabilityMicrosoft Azure Functions
- CVE-2024-49035Partner.Microsoft.Com Elevation of Privilege VulnerabilityMicrosoft Partner Center
- CVE-2024-8676Cri-o: checkpoint restore can be triggered from different namespacescri-o · Red Hat OpenShift Container Platform +2
- CVE-2024-8114Missing Authorization in GitLabGitLab
- CVE-2024-32965ssrf vulnerability in lobe-chatlobehub lobe-chat · @lobehub/chat
- CVE-2024-52336Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by roottuned · Fast Datapath for Red Hat Enterprise Linux +2
- CVE-2024-9461Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup SettingsTotal Upkeep – WordPress Backup Plugin plus Restore & Migra…
- CVE-2018-5852Buffer Over-read in IPAQualcomm Snapdragon
- CVE-2018-11816Use After Free in VideoQualcomm Snapdragon
- CVE-2017-18307Information Exposure in KernelQualcomm Snapdragon
- CVE-2017-18306Information Exposure in Camera DriverQualcomm Snapdragon
- CVE-2016-10408Improper Access Control in Core.Qualcomm Snapdragon
- CVE-2024-11699Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11697When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialogMozilla Firefox · Mozilla Thunderbird
- CVE-2024-11702Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-baseMozilla Firefox · Mozilla Thunderbird
- CVE-2024-11700Malicious websites may have been able to perform user intent confirmation through tapjacking.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11691Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-38832Stored cross-site scripting vulnerability (CVE-2024-38832)VMware Aria Operations
- CVE-2024-38831Local privilege escalation vulnerability (CVE-2024-38831)VMware Aria Operations
- CVE-2024-38830Local privilege escalation vulnerabilityVMware Aria Operations
- CVE-2023-0163Prototype Pollution in convictMozilla Convict · convict
- CVE-2024-51569Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handlerApache Software Foundation Apache NimBLE
- CVE-2023-1521Local Privilege Escalation in sccacheMozilla sccache · sccache
- CVE-2024-50376A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affecting the following devicAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50369A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50368A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50367A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50366A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50365A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50364A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50363A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50362A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50361A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50360A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50359A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the followingAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-50358A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKIAdvantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2018-11952Improper Authentication in TrustZoneQualcomm Snapdragon
- CVE-2018-11922Configurations in Android BuildQualcomm Snapdragon
- CVE-2017-17772Multiple buffer overread vulnerabilities in WLANQualcomm Snapdragon
- CVE-2017-15832Buffer overwrite due to improper input validation in WLAN hostQualcomm Snapdragon
- CVE-2017-11076Use of Out-of-range Pointer Offset in VideoQualcomm Snapdragon
- CVE-2024-36254Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lSharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-36251The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-36249Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers).Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-33605Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-9504Booking calendar, Appointment Booking System <= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Uploadwpdevart Booking calendar, Appointment Booking System
- CVE-2024-47257Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device Axis Communications AB AXIS Q6128-E PTZ Network Camera · Ax…
- CVE-2024-10781Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin InstallationSpam protection, Honeypot, Anti-Spam by CleanTalk
- CVE-2024-10570Security & Malware scan by CleanTalk <= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL InjectionLogin Security, FireWall, Malware removal by CleanTalk
- CVE-2024-49353IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data denial of serviceWatson Speech Services Cartridge for IBM Cloud Pak for Data
- CVE-2024-49597Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability.Dell Wyse Management Suite
- CVE-2024-49595Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability.Dell Wyse Management Suite
- CVE-2024-10729Booking & Appointment Plugin for WooCommerce <= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option UpdateTyche Softwares Booking & Appointment Plugin for WooCommerce
- CVE-2024-52899IBM Data Virtualization Manager code executionIBM Data Virtualization Manager for z/OS
- CVE-2024-53555A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file.
Medium, low and unrated 79
- CVE-2024-53849Several stack buffer overflows and pointer overflows in editorconfig-core-ceditorconfig-core-c
- CVE-2024-118191000 Projects Portfolio Management System MCA forgot_password_process.php sql injection1000 Projects Portfolio Management System MCA
- CVE-2024-11818PHPGurukul User Registration & Login and User Management System signup.php sql injectionPHPGurukul User Registration & Login and User Management Sy…
- CVE-2024-11817PHPGurukul User Registration & Login and User Management System index.php sql injectionPHPGurukul User Registration & Login and User Management Sy…
- CVE-2024-117441000 Projects Portfolio Management System MCA register.php sql injection1000 Projects Portfolio Management System MCA
- CVE-2024-43784Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletiontreeverse lakeFS · github.com/treeverse/lakefs
- CVE-2024-11743SourceCodester Best House Rental Management System POST Request ajax.php cross-site request forgerySourceCodester Best House Rental Management System
- CVE-2024-11742SourceCodester Best House Rental Management System ajax.php cross site scriptingSourceCodester Best House Rental Management System
- CVE-2024-10240Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLabGitLab
- CVE-2024-52008Password Policy Bypass Vulnerability in Fides Webserverethyca fides · ethyca-fides
- CVE-2024-53267Vulnerability with bundle verification in sigstore-javasigstore-java · dev.sigstore:sigstore-java
- CVE-2024-11828Inefficient Algorithmic Complexity in GitLabGitLab
- CVE-2024-11669Incorrect Authorization in GitLabGitLab
- CVE-2024-53844Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in labsai/eddilabsai EDDI
- CVE-2024-8177Inefficient Algorithmic Complexity in GitLabGitLab
- CVE-2024-8237Inefficient Algorithmic Complexity in GitLabGitLab
- CVE-2024-11668Insufficient Session Expiration in GitLabGitLab
- CVE-2024-10878Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scriptingsmub Sugar Calendar – Events Calendar, Event Tickets, and E…
- CVE-2024-11407Denial of Service through Data corruption in gRPC-C++gRPC-C++
- CVE-2024-52337Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` methodtuned · Fast Datapath for Red Hat Enterprise Linux +2
- CVE-2024-36463The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objecZabbix
- CVE-2024-22117Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is addedZabbix
- CVE-2024-8236Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingelemntor Elementor Website Builder – more than just a page…
- CVE-2024-53976Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what tMozilla Firefox for iOS
- CVE-2024-53975Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appeMozilla Firefox for iOS
- CVE-2024-11708Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11706A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when hMozilla Firefox · Mozilla Thunderbird
- CVE-2024-11696The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11703On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication.Mozilla Firefox
- CVE-2024-11695A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoMozilla Firefox · Mozilla Thunderbird
- CVE-2024-11694Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeMozilla Firefox · Mozilla Thunderbird
- CVE-2024-11701The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-11692An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-9929A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps.Hitachi Energy NSD570 Teleprotection Equipment
- CVE-2024-9928A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts.Hitachi Energy NSD570 Teleprotection Equipment
- CVE-2024-38834Stored cross-site scripting vulnerability (CVE-2024-38834)VMware Aria Operations
- CVE-2024-38833Stored cross-site scripting vulnerability (CVE-2024-38833)VMware Aria Operations
- CVE-2023-2142Nunjucks autoescape bypass leads to cross site scriptingMozilla Nunjucks · nunjucks
- CVE-2024-47250Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound accessApache Software Foundation Apache NimBLE
- CVE-2024-47249Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerApache Software Foundation Apache NimBLE
- CVE-2024-47248Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackApache Software Foundation Apache NimBLE
- CVE-2024-10579Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposurewpmudev Hustle – Email Marketing, Lead Generation, Optins,…
- CVE-2024-10308Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widgetjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2024-8899Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_templatejegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2024-50377A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3)Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1
- CVE-2024-11032Parsi Date <= 5.1.1 - Reflected Cross-Site Scripting via add_query_arg Parameterman4toman پارسی دیت – Parsi Date
- CVE-2017-18153Use After Free in WLANQualcomm Snapdragon
- CVE-2024-11091Support SVG – Upload svg files in wordpress without hassle <= 1.1.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG File Uploadsayedulsayem Support SVG – Upload svg files in wordpress wi…
- CVE-2024-11192Spotify Play Button for WordPress <= 2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcodejonkastonka Sp*tify Play Button for WordPress
- CVE-2024-11119BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcodebluenotes BNE Gallery Extended
- CVE-2024-9170Booster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcodepluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2024-34162The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-33616Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-32151User passwords are decrypted and stored on memory before any user logged in.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-29978User passwords are decrypted and stored on memory before any user logged in.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-29146User passwords are decrypted and stored on memory before any user logged in.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-28955Affected devices create coredump files when crashed, storing them with world-readable permission.Sharp Multiple MFPs · Toshiba Tec Multiple MFPs
- CVE-2024-11202Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcodecreativemindssolutions CM Header and Footer – Add custo… +5
- CVE-2024-8160Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation Axis Communications AB AXIS OS
- CVE-2024-877251l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition Axis Communications AB AXIS OS
- CVE-2024-6831Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necesAxis Communications AB AXIS Camera Station Pro · Axis Commu…
- CVE-2024-6749Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive credenAxis Communications AB AXIS Camera Station Pro · Axis Commu…
- CVE-2024-6476Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system priviAxis Communications AB AXIS Camera Station Pro · Axis Commu…
- CVE-2024-10857Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Readtychesoftwares Product Input Fields for WooCommerce
- CVE-2024-11002InPost Gallery <= 2.1.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_templaterealmag777 InPost Gallery
- CVE-2024-10471Everest Forms < 3.0.4.2 - Admin+ Stored XSSEverest Forms
- CVE-2024-53278Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14.gqevu6bsiz WP Admin UI Customize
- CVE-2024-11418Additional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site Scriptingantonbond Additional Order Filters for WooCommerce
- CVE-2024-11342Skt NURCaptcha <= 3.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingsanskritforum Skt NURCaptcha
- CVE-2024-49351IBM Workload Scheduler information disclosureIBM Workload Scheduler
- CVE-2024-49596Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability.Dell Wyse Management Suite
- CVE-2024-11678CodeAstro Hospital Management System his_doc_register_patient.php cross site scriptingCodeAstro Hospital Management System
- CVE-2024-11677CodeAstro Hospital Management System Add Vendor Details Page his_admin_add_vendor.php cross site scriptingCodeAstro Hospital Management System
- CVE-2024-11676CodeAstro Hospital Management System Add Laboratory Equipment Page his_admin_add_lab_equipment.php cross site scriptingCodeAstro Hospital Management System
- CVE-2024-11675CodeAstro Hospital Management System Add Patient Details Page his_admin_register_patient.php cross site scriptingCodeAstro Hospital Management System
- CVE-2024-51058Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5.tecnickcom/tcpdf
- CVE-2024-53365A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php
- CVE-2024-53619An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via u
- CVE-2024-53620A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scri