CVEs published November 28, 2024
75 CVEs were published on November 28, 2024: 8 critical, 29 high.
- Published
- 75
- Critical
- 8
- High
- 29
- Medium
- 37
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- PHPGurukul Complaint Management system
- 4
- Container suse/manager/5.0/x86_64/server:5.0.2.7.8.1 · SUSE…
- 2
- D-Link DIR-605L
- 2
- iseardmedia Kudos Donations: Easy Donations with Mollie | O…
- 2
- Logo Slider
- 2
- Mitsubishi Electric GENESIS64 · Mitsubishi Electric ICON… +7
- 2
- ninjateam File Manager Pro – Filester
- 2
- AbsolutePlugins Absolute Addons For Elementor
- 1
- adBuddy+ (AdBlocker Detection) by NetfunkDesign
- 1
- Apache Software Foundation Apache Arrow R package · pyarrow
- 1
Critical 8
- CVE-2024-52338Apache Arrow R package: Arbitrary code execution when loading a malicious data fileApache Software Foundation Apache Arrow R package · pyarrow
- CVE-2024-52474WordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerabilityСервис “Экспресс Платежи” Express Payments Module
- CVE-2024-52490WordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerabilityPathomation
- CVE-2024-52475WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerabilityInformation Technology Wawp
- CVE-2024-11082Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Functiontumultinc Tumult Hype Animations
- CVE-2024-8672Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Executionmarketingfire Widget Options – Advanced Conditional Visibil…
- CVE-2024-11103Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeovercontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2024-11925WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalationeyecix JobSearch WP Job Board
High 29
- CVE-2024-9852Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32Mitsubishi Electric GENESIS64 · Mitsubishi Electric ICON… +7
- CVE-2024-8300Malicious Code Execution Vulnerability in GENESIS64 and ICONICS SuiteMitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +2
- CVE-2024-8299Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32Mitsubishi Electric GENESIS64 · Mitsubishi Electric ICON… +7
- CVE-2024-11969Incorrect default permissions in Cradlepoint NetCloud ExchangeCradlepoint NetCloud Exchange Client
- CVE-2023-52922can: bcm: Fix UAF in bcm_proc_show()Linux
- CVE-2024-11960D-Link DIR-605L formSetPortTr buffer overflowD-Link DIR-605L
- CVE-2024-11959D-Link DIR-605L formResetStatistic buffer overflowD-Link DIR-605L
- CVE-2024-53732WordPress Footer Flyout Widget plugin <= 1.1 - CSRF to Stored XSS vulnerabilitywpwox Footer Flyout Widget
- CVE-2024-53733WordPress Fence URL plugin <= 2.0.0 - CSRF to Stored XSS vulnerabilityharshtohit111 Fence URL
- CVE-2024-53734WordPress Idealien Category Enhancements plugin <= 1.2 - CSRF to Stored XSS vulnerabilityJamie O Idealien Category Enhancements
- CVE-2024-53736WordPress Custom Shortcode Sidebars plugin <= 1.2 - CSRF to Stored XSS vulnerabilityJason Grim Custom Shortcode Sidebars
- CVE-2024-11402WordPress Block Editor Bootstrap Blocks plugin <= 6.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilitykubiq Block Editor Bootstrap Blocks
- CVE-2024-52495WordPress Distance Based Shipping Calculator plugin <= 2.0.23 - SQL Injection vulnerabilityenituretechnology Distance Based Shipping Calculator
- CVE-2024-52496WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Local File Inclusion vulnerabilityAbsolutePlugins Absolute Addons For Elementor
- CVE-2024-52497WordPress Shopready plugin <= 3.6 - Local File Inclusion vulnerabilityquomodosoft Shopready
- CVE-2024-52498WordPress SP Blog Designer plugin <= 1.0.0 - Local File Inclusion vulnerabilitysoftpulseinfotech SP Blog Designer
- CVE-2024-52499WordPress Pricing table addon for elementor plugin <= 1.0.0 - Local File Inclusion vulnerabilityIbrahim Pricing table addon for elementor
- CVE-2024-52501WordPress Office Locator plugin <= 1.3.0 - Local File Inclusion vulnerabilityWebbyTemplate Office Locator
- CVE-2024-52481WordPress Jobify theme < 4.3.0 - Unauthenticated Arbitrary File Read vulnerabilityAstoundify Jobify
- CVE-2024-11620WordPress Rank Math SEO plugin <= 1.0.231 - Arbitrary .htaccess Overwrite to Remote Code Execution (RCE) vulnerabilityRank Math SEO
- CVE-2024-11599Domain Restriction Bypass on RegistrationMattermost
- CVE-2024-22038DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridgeopenSUSE Factory
- CVE-2024-9669File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusionninjateam File Manager Pro – Filester
- CVE-2024-8066File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Uploadninjateam File Manager Pro – Filester
- CVE-2024-36466Unauthenticated Zabbix frontend takeover when SSO is being usedZabbix
- CVE-2024-38658There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier).FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- CVE-2024-38389There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier).FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS
- CVE-2024-38309There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS LFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT · F…
- CVE-2018-9377In getIntentForIntentSender of ActivityManagerService.java, there is a possible way to access user metadata due to a pending intent.Google Android
Medium, low and unrated 38
- CVE-2024-11971Guizhou Xiaoma Technology jpress Avatar upload cross site scriptingGuizhou Xiaoma Technology jpress
- CVE-2024-11970code-projects Concert Ticket Ordering System tour(cor).php sql injectioncode-projects Concert Ticket Ordering System
- CVE-2024-11968code-projects Farmacia pagamento.php sql injectioncode-projects Farmacia
- CVE-2024-11967PHPGurukul Complaint Management system reset-password.php sql injectionPHPGurukul Complaint Management system
- CVE-2024-11966PHPGurukul Complaint Management system index.php sql injectionPHPGurukul Complaint Management system
- CVE-2024-11965PHPGurukul Complaint Management system reset-password.php sql injectionPHPGurukul Complaint Management system
- CVE-2024-11964PHPGurukul Complaint Management system index.php sql injectionPHPGurukul Complaint Management system
- CVE-2024-11963code-projects Responsive Hotel Site room.php sql injectioncode-projects Responsive Hotel Site
- CVE-2024-11962code-projects Simple Car Rental System login.php sql injectioncode-projects Simple Car Rental System
- CVE-2024-11961Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosureGuangzhou Huayi Intelligent Technology Jeewms
- CVE-2024-7747Wallet for WooCommerce <= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Typessubratamal Wallet for WooCommerce
- CVE-2024-53731WordPress Fintelligence Calculator plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityFintelligence Calculator
- CVE-2024-53737WordPress WP Mailster plugin <= 1.8.16.0 - Cross Site Scripting (XSS) vulnerabilitybrandtoss WP Mailster
- CVE-2024-8308Siempelkamp: SQL injection due to improper handling of HTTP request input dataSiempelkamp UmweltOffice
- CVE-2024-10780Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosurenicheaddons Restaurant & Cafe Addon for Elementor
- CVE-2024-10670Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosurenicheaddons Primary Addon for Elementor
- CVE-2024-10798Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosurewproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-22037Database password leaked by systemd uyuni-server-attestation serviceSUSE Manager Server
- CVE-2024-49502Reflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-webContainer suse/manager/5.0/x86_64/server:5.0.2.7.8.1 · SUSE…
- CVE-2024-49503Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-webContainer suse/manager/5.0/x86_64/server:5.0.2.7.8.1 · SUSE…
- CVE-2024-52283Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain projectSUSE hackweek
- CVE-2024-11684Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scriptingiseardmedia Kudos Donations: Easy Donations with Mollie | O…
- CVE-2024-11786Login with Vipps and MobilePay <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwphostingdev Login with Vipps and MobilePay
- CVE-2024-11458FAQ Builder AYS <= 1.7.1 - Reflected Cross-Site Scriptingays-pro FAQ Builder AYS
- CVE-2024-11685Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg'iseardmedia Kudos Donations: Easy Donations with Mollie | O…
- CVE-2024-11366SEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site Scriptingintellasoftsolutions SEO Landing Page Generator
- CVE-2024-11333HLS Player <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scriptingr00tsector HLS Player
- CVE-2024-11431Ragic Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingragicsupport Ragic Shortcode
- CVE-2024-11203EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-11788StreamWeasels YouTube Integration <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingStreamWeasels YouTube Integration
- CVE-2024-11761LegalWeb Cloud <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingLegalWeb Cloud
- CVE-2024-10896Logo Slider < 4.5.0 - Contributor+ Stored XSSLogo Slider
- CVE-2024-10510adBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Admin+ Stored XSSadBuddy+ (AdBlocker Detection) by NetfunkDesign
- CVE-2024-10493Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSSElement Pack Elementor Addons
- CVE-2024-10473Logo Slider < 4.5.0 - Author+ Stored XSSLogo Slider
- CVE-2024-11918Image Alt Text <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Updaterswebstudios Image Alt Text
- CVE-2024-46939Game Extension Engine Path Traversal Vulnerabilityvivo Game Extension Engine
- CVE-2024-53008Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy.HAProxy Project HAProxy