CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- eyecix jobsearch wp job boardWP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload9.9 Critical
- humhubUser enumeration in HubHub6.9 Medium
- cscode eleforms – all in one form integration including db for elementor, theinnovs eleforms +1 moreEleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization5.3 Medium
- heateor super socializer, the champ social share, social login and social comments plugin – super socializer +1 moreSocial Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider8.1 High
- tumult hype animations, tumultinc tumult hype animations +1 moreTumult Hype Animations <= 1.9.14 - Missing Authorization4.3 Medium
- martinvalchev video gallery for woocommerceVideo Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion5.3 Medium
- heateor social login wordpress, social login +1 moreHeateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider8.1 High
- themelooks mfolio, mfolio lite +1 moremFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files9.9 Critical
- aueda wp-imagezoom, silkypress wp image zoom +1 moreWp-ImageZoom <= 1.1.0 - Reflected XSS6.1 Medium
- alimir wp ulikeWP ULike < 4.7.5 - Admin+ Stored XSS via Widgets4.8 Medium
- samsung galaxy s24 firmware, samsung mobile devices +1 moreOut-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on...6.4 Medium
- samsung galaxy s24 firmware, samsung mobile devices +1 moreOut-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows...6.4 Medium
- samsung flowImproper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to...4.6 Medium
- samsung blockchain keystoreImproper validation of integrity check value in Blockchain Keystore prior to version 1.3.16...6.7 Medium
- samsung passImproper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows...5.3 Medium
- samsung video playerImproper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36...5.5 Medium
- samsung voice recorderImproper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical...4.6 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers...4.6 Medium
- samsung android, samsung mobile devices +1 moreImproper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local...5.1 Medium
- samsung android, samsung mobile devices +1 moreImproper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to...2.4 Low
- samsung mobile devicesImproper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local...6.6 Medium
- samsung android, samsung mobile devices +1 moreUse of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1...4.0 Medium
- samsung android, samsung mobile devices +1 moreIncorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to...4.0 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers...5.9 Medium
- samsung android, samsung mobile devices +1 moreExposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local...4.0 Medium
- samsung android, samsung mobile devices +1 moreOut-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release...4.4 Medium
- samsung android, samsung mobile devices +1 moreImproper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to...2.4 Low
- samsung android, samsung mobile devices +1 moreImproper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to...4.6 Medium
- samsung android, samsung mobile devices +1 moreImproper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local...4.1 Medium
- westguard ws form lite – drag & drop contact form builder, westguardsolutions ws form +1 moreWS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL6.1 Medium
- curlHSTS subdomain overwrites parent cache entry6.5 Medium
- tenda o3 firmwareBuffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of...6.5 Medium
- unopimUnoPim Cross-site Scripting vulnerability5.4 Medium
- suse opensuse tumbleweedgrub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images7.0 High
- portabilis i-educarPortabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the ...8.1 High
- everestthemes everest backup – wordpress cloud backup, migration, restore & cloning plugin, everest backup +1 moreEverest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log7.5 High
- hewlett packard enterprise (hpe) hpe aruba networking access points, instant aos-8, and aos-10Authenticated Path Traversal Vulnerability Leads to a Remote Unauthorized Access to Files6.8 Medium
- arubanetworks instant, arubaos, hewlett packard enterprise (hpe) hpe aruba networking access points, instant aos-8, and aos-10 +2 moreArbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)7.2 High
- arubanetworks instant, arubaos, hewlett packard enterprise (hpe) hpe aruba networking access points, instant aos-8, and aos-10 +2 moreArbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE)7.2 High
- arubanetworks instant, arubaos, hewlett packard enterprise (hpe) hpe aruba networking access points, instant aos-8, and aos-10 +2 moreAuthenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-107.2 High
- arubanetworks arubaos, instant, hewlett packard enterprise (hpe) hpe aruba networking access points, instant aos-8, and aos-10 +2 moreUnauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol9.0 Critical
- arubanetworks arubaos, instant, hewlett packard enterprise (hpe) hpe aruba networking access points, instant aos-8, and aos-10 +2 moreUnauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol9.8 Critical
- sevenspark contact form 7 – dynamic text extension, contact form 7 - dynamic text extension +1 moreContact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode4.3 Medium
- autodesk vred, vred design +1 moreAutodesk VRED Design Privilege Escalation Vulnerability7.8 High
- salesagility suitecrmAuthenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM4.9 Medium
- salesagility suitecrmRCE in ModuleBuilder in SuiteCRM6.6 Medium
- salesagility suitecrmAuthenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM8.8 High
- nvidia container toolkit, gpu operator +1 moreNVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a...4.1 Medium
- salesagility suitecrmModuleScanner flaws in SuiteCRM7.2 High
- salesagility suitecrmImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM5.3 Medium
- Show moreLoading…