CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Authorization Bypass Vulnerability6.5 Medium
- cisco nexus dashboard fabric controller, data center network manager +1 moreCisco Nexus Dashboard Fabric Controller SQL Injection Vulnerability8.8 High
- cisco ip phones with multiplatform firmware, session initiation protocol (sip) software, desk phone 9841 with multiplatform firmware +22 more +24 moreCisco IP Phone 6800, 7800, 8800, and 9800 Series with Multiplatform Firmware Stored Cross-Site Scripting Vulnerability4.8 Medium
- cisco ip phones with multiplatform firmware, session initiation protocol (sip) software, desk phone 9841 with multiplatform firmware +22 more +24 moreCisco IP Phone 6800, 7800, 8800, and 9800 Series with Multiplatform Firmware Stored Cross-Site Scripting Vulnerabilities4.8 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Arbitrary File Read and Delete Vulnerability5.5 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine XML External Entity Injection Vulnerability5.5 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability6.1 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Arbitrary File Read and Delete Vulnerability5.5 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Path Traversal Vulnerability3.8 Low
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Arbitrary File Read and Delete Vulnerability5.5 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability6.1 Medium
- cisco evolved programmable network manager (epnm), prime infrastructure, evolved programmable network manager +2 moreCisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability5.4 Medium
- gradio-app gradioArbitrary file read with File and UploadButton components in Gradio6.5 Medium
- cisco unified communications managerCisco Unified Communications Manager Cross-Site Scripting Vulnerability6.1 Medium
- cisco meeting managementCisco Meeting Management Information Disclosure Vulnerability4.3 Medium
- cisco asyncos, secure email, secure email and web manager +1 more +3 moreCisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities5.4 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy4.3 Medium
- cisco enterprise chat and emailCisco Enterprise Chat and Email Denial of Service Vulnerability7.5 High
- cisco unified communications manager im and presence serviceCisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability6.5 Medium
- cisco session initiation protocol (sip) software, desk phone 9841 firmware, desk phone 9851 firmware +17 more +19 moreCisco IP Phone 7800, 8800, and 9800 Series Information Disclosure Vulnerability5.3 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Authorization Bypass Vulnerability4.3 Medium
- drupal tooltipTooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-0584.8 Medium
- cisco nexus 3550 system software, nexus 3550 firmware +1 moreCisco Nexus 3550-F Switches Access Control List Programming Vulnerability5.3 Medium
nssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +2 more +4 moreUpdate of nssNo scoreca-certificatesTuxCareUpdate of ca-certificatesNo score- google chromeUse after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to...8.8 High
- google chromeUse after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed...8.8 High
- mariazevedo88 travels-java-apimariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded key2.3 Low
- didi super-jacoco, super jacoco +1 moredidi Super-Jacoco triggerUnitCover os command injection5.3 Medium
github.com/cometbft/cometbftGoCometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data8.3 High- capricorn86 happy-domFixes security vulnerability that allowed for server side code to be executed by a <script> tag9.3 Critical
- sensiolabs symfonyCommand execution hijack on Windows with Process class in symfony/process0.0 None
- sensiolabs symfonyOpen redirect via browser-sanitized URLs in symfony/http-foundation3.1 Low
- symfonyIncorrect response from Validator when input ends with `\n` in symfony/validator3.1 Low
- sensiolabs httpclient, symfony +1 moreInternal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client3.1 Low
- symfonySecurity::login does not take into account custom user_checker in symfony/security-bundle3.1 Low
- sensiolabs symfonyAbility to change environment from query in symfony/runtime7.3 High
- d-link dns-320, dns-320lw, dns-325 +5 more +7 moreD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure6.9 Medium
- ericsson codecheckercodechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service8.7 High
- ericsson codecheckercodechecker vulnerable to authentication bypass when using specifically crafted URLs10.0 Critical
- ibm maximo application suiteIBM Maximo Application Suite cross-site scripting5.4 Medium
- microfocus imanagerPotential Cross Site Scripting vulnerability in OpenText iManager7.6 High
- d-link dns-320, dns-320lw, dns-325 +5 more +7 moreD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection9.2 Critical
- d-link dns-320, dns-320lw, dns-325 +5 more +7 moreD-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection9.2 Critical
- avecnous event postEvent Post <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode6.4 Medium
- fatcatapps easy pricing tables, pricing table wordpress plugin – easy pricing tables +1 morePricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute6.4 Medium
- pluginus woot, realmag777 active products tables for woocommerce. use constructor to create tables +1 moreActive Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode6.4 Medium
- chrisvrichardson mappress maps for wordpress, mappresspro mappress +1 moreMapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block6.4 Medium
- red hat ansible automation platform execution environments, ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +4 more +6 moreAnsible-core: ansible-core user may read/write unauthorized content6.3 Medium
- eyecix jobsearch wp job boardWP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload10.0 Critical
- Show moreLoading…