CVEs published November 27, 2024
82 CVEs were published on November 27, 2024: 7 critical, 36 high. 1 is now in CISA KEV.
- Published
- 82
- Critical
- 7
- High
- 36
- Medium
- 31
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- Fuji Electric Monitouch V-SFT
- 12
- Google Android
- 12
- Zabbix
- 11
- Fuji Electric Tellus Lite
- 5
- contiki-ng
- 4
- Galaxy Software Services iota C.ai Conversational Platform
- 2
- Google Chrome
- 2
- Atlassian Confluence Data Center · Atlassian Confluence Ser…
- 1
- Autolab
- 1
- Automatic Internal Links for SEO by Pagup
- 1
Critical 7
- CVE-2024-42330JS - Internal strings in HTTP headersZabbix
- CVE-2024-42327SQL injection in user.get APIZabbix
- CVE-2024-52959iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')Galaxy Software Services iota C.ai Conversational Platform
- CVE-2024-52958iota C.ai Conversational Platform - Improper Verification of Cryptographic SignatureGalaxy Software Services iota C.ai Conversational Platform
- CVE-2024-53676A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.Hewlett Packard Enterprise (HPE) HPE Insight Remote Support
- CVE-2024-46054OpenVidReview 1.0 is vulnerable to Incorrect Access Control.
- CVE-2024-53604A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which al
High 36
- CVE-2018-9374In installPackageLI of PackageManagerService.java, there is a possible permissions bypass.Google Android
- CVE-2024-11933Fuji Electric Monitouch V-SFT X1 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11803Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFuji Electric Tellus Lite
- CVE-2024-11802Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Tellus Lite
- CVE-2024-11801Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFuji Electric Tellus Lite
- CVE-2024-11800Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Tellus Lite
- CVE-2024-11799Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Tellus Lite
- CVE-2024-11798Fuji Electric Monitouch V-SFT X1 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11797Fuji Electric Monitouch V-SFT V8 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11796Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11795Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11794Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11793Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11792Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11791Fuji Electric Monitouch V-SFT V8C File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11790Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11789Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2024-11787Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFuji Electric Monitouch V-SFT
- CVE-2017-13323In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2024-53860Potential Abuse for Sending Arbitrary Emails in sp-php-email-handlerSpencer14420 SPEmailHandler-PHP · spencer14420/sp-php-email…
- CVE-2017-13319In pvmp3_get_main_data_size of pvmp3_get_main_data_size.cpp, there is a possible buffer overread due to a missing bounds check.Google Android
- CVE-2017-13316In checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check.Google Android
- CVE-2023-29001Uncontrolled recursion due to insufficient validation of the IPv6 source routing header in Contiki-NGcontiki-ng
- CVE-2024-41125Out-of-bounds read in SNMP when decoding a string in Contiki-NGcontiki-ng
- CVE-2024-41126Out-of-bounds read when decoding SNMP messages in Contiki-NGcontiki-ng
- CVE-2024-47181Unaligned memory access in RPL option processing in Contiki-NGcontiki-ng
- CVE-2024-9369Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2024-7025Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2024-54003Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability Jenkins Project Jenkins Simple Queue Plugin · io.jenkins.pl…
- CVE-2024-52323Sensitive Data ExposureManageEngine Analytics Plus
- CVE-2024-11667A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX seriZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2024-36467Authentication privilege escalation via user groups due to missing authorization checksZabbix
- CVE-2024-31976EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity para
- CVE-2024-52951Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to e
- CVE-2024-53603A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which all
- CVE-2024-53920In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs L
Medium, low and unrated 39
- CVE-2018-9354In VideoFrameScheduler.cpp of VideoFrameScheduler::PLL::fit, there is a possible remote denial of service due to divide by 0.Google Android
- CVE-2018-9353In ihevcd_parse_slice_data of ihevcd_parse_slice.c there is a possible heap buffer out of bound read due to a missing bounds check.Google Android
- CVE-2018-9352In ihevcd_allocate_dynamic_bufs of ihevcd_api.c there is a possible resource exhaustion due to integer overflow.Google Android
- CVE-2018-9351In ih264e_fmt_conv_420p_to_420sp of ih264e_fmt_conv.c there is a possible out of bound read due to missing bounds check.Google Android
- CVE-2018-9350In ih264d_assign_pic_num of ih264d_utils.c there is a possible out of bound read due to missing bounds check.Google Android
- CVE-2018-9349In mv_err_cost of mcomp.c there is a possible out of bounds read due to missing bounds check.Google Android
- CVE-2017-13321In SensorService::isDataInjectionEnabled of frameworks/native/services/sensorservice/SensorService.cpp, there is a possible out of bounds reGoogle Android
- CVE-2024-53260Course Roster vulnerable to CSV Injection in AutolabAutolab
- CVE-2024-53858Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh clicli · github.com/cli/cli +1
- CVE-2024-53859go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespacecli go-gh · github.com/cli/go-gh/v2 +1
- CVE-2017-13320In impeg2d_bit_stream_flush() of libmpeg2dec there is a possible OOB read due to a missing bounds check.Google Android
- CVE-2024-53264Open Redirect Vulnerability in Loading Page in bunkerwebbunkerity bunkerweb · github.com/bunkerity/bunkerweb
- CVE-2024-53855User can view tickets from organizations they're not apart of in centurion_erpnofusscomputing centurion_erp
- CVE-2024-54004Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, alloJenkins Project Jenkins Filesystem List Parameter Plugin ·…
- CVE-2024-21703This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for WindowAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2024-11860SourceCodester Best House Rental Management System POST Request ajax.php improper authorizationSourceCodester Best House Rental Management System
- CVE-2024-11862Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption Devolutions XTS.NET · Devolutions.XTS.NET
- CVE-2024-36464Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exportedZabbix
- CVE-2024-42333Heap buffer over-readZabbix
- CVE-2024-42332New line injection in Zabbix SNMP trapsZabbix
- CVE-2024-42331Use after free in browser_push_errorZabbix
- CVE-2024-42329JS - Crash on unexpected HTTP server responseZabbix
- CVE-2024-42328JS - Crash on empty HTTP server responseZabbix
- CVE-2024-42326Use after free vulnerability in browser.cZabbix
- CVE-2024-36468Stack buffer overflow in zbx_snmp_cache_handle_engineidZabbix
- CVE-2024-11009Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id ParameterAutomatic Internal Links for SEO by Pagup
- CVE-2024-10521WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action FunctionContact Forms by Cimatti
- CVE-2024-11025SMA: SQL injection in Sunny Central UPSMA Sunny Central SC 1760-US · SMA Sunny Central SC 185… +54
- CVE-2024-10175Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcodelabibahmed42 Pricing Tables For WPBakery Page Builder
- CVE-2024-10580Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submissionwpmudev Hustle – Email Marketing, Lead Generation, Optins,…
- CVE-2024-10895Counter Up – Animated Number Counter & Milestone Showcase <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinglogichunt Counter Up – Animated Number Counter & Milestone…
- CVE-2024-11219Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image Viewthemeisle Otter Blocks – Gutenberg Blocks, Page Builder for…
- CVE-2024-11083ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposureproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-5921GlobalProtect App: Insufficient Certificate Validation Leads to Privilege EscalationPalo Alto Networks GlobalProtect App
- CVE-2024-11820code-projects Crud Operation System add.php cross site scriptingcode-projects Crud Operation System
- CVE-2024-37816Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow.
- CVE-2024-46055OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names.
- CVE-2024-51228An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1
- CVE-2024-53635A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Manage