CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- kanaka wacwac commit 385e1 was discovered to contain a heap overflow via the setup_call function at /wac...6.2 Medium
- kanaka wacwac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac...6.2 Medium
- bytecodealliance webassembly micro runtimewasm-micro-runtime (aka WebAssembly Micro Runtime or WAMR) 06df58f is vulnerable to NULL Pointer...7.5 High
- wasm3 project wasm3pywasm3 contains a Use-After-Free in ForEachModule8.4 High
- wasm3 project wasm3wasm3 uncontrolled memory allocation vulnerability8.4 High
- wasm3 project wasm3pywasm3 has an Invalid Memory Read, Leading to DoS and Potential Code Execution8.4 High
- wasm3 project wasm3wasm3 139076a is vulnerable to Denial of Service (DoS).7.5 High
- bytecodealliance webassembly micro runtimeAn issue in bytecodealliance wasm-micro-runtime before v.b3f728c and fixed in commit 06df58f...7.8 High
- trimble tm4webTrimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tm_ajax.msw?func...9.8 Critical
- pwrstudio ev chargerThe pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2)...9.8 Critical
- watchguard panda dome, elastic endpoint security, watchgua panda dome firmware +2 more +4 moreWatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEM8.5 High
- dgtlmoon changedetection.ioPath traversal using file URI scheme without supplying hostname in changedetection.io8.6 High
- duendesoftware duende.accesstokenmanagementHTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect5.4 Medium
- x-stream xstream, x-stream +1 moreXStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream7.5 High
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4 Medium
- adobe experience managerAdobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4 Medium
- github enterprise serverPrivilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access8.7 High
- github enterprise serverAuthorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data6.0 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission7.7 High
- github enterprise serverPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation8.7 High
- 1000 projects bookstore management system, bookstore management system project management system +1 more1000 Projects Bookstore Management System Login login_process.php sql injection6.9 Medium
- 1000 projects bookstore management system1000 Projects Bookstore Management System contact_process.php sql injection6.9 Medium
- anisha e-health care systemcode-projects E-Health Care System delete_user_appointment_request.php sql injection6.9 Medium
- totolink x18, x18 firmware +1 moreTOTOLINK X18 cstecgi.cgi os command injection5.3 Medium
- combodo itopPassword is stored in clear in the database in Combodo iTop3.4 Low
- combodo itopCross-site Scripting in portal picture upload in Combodo iTop7.1 High
- combodo itopLogic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop7.1 High
- apnotic llc passwordpusherCross-site Scripting (XSS) Vulnerability in PasswordPusher7.1 High
nssTuxCare,nsprTuxCare,nspr-develTuxCare +10 more +12 moreUpdate of nssNo score- dataeaseDataease arbitrary interface access vulnerability9.3 Critical
phpoffice/phpexcelPackagistPHPExcel XXE Vulnerability8.7 High- devtronSQL Injection in CreateUser API in devtron8.3 High
- emqx neuronemqx neuron JSON File schema information disclosure5.3 Medium
- emqx neuronemqx neuron plugin_handle.c handle_add_plugin buffer overflow5.3 Medium
- veeam enterprise manager, backup \& replication +1 moreA vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which...7.7 High
- filamentphp filament, filament excel export +1 moreExported files stored in default (`public`) filesystem if not reconfigured in filament2.3 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +8 more +10 morePam: improper hostname interpretation in pam_access leads to access control bypass7.4 High
- google quick share, nearby +1 moreAuth Bypass in Quickshare5.9 Medium
- 10up safe svgSafe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass4.8 Medium
- automattic jetpackJetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access4.3 Medium
- moodleMoodle: lfi vulnerability when restoring malformed block backups7.5 High
- moodleMoodle: idor in feedback non-respondents report allows messaging arbitrary site users7.5 High
- moodleMoodle: site administration sql injection via xmldb editor7.2 High
- moodleMoodle: csrf risk in feedback non-respondents report8.1 High
- moodleMoodle: idor in badges allows deletion of arbitrary badges7.5 High
- moodleMoodle: cache poisoning via injection into storage7.7 High
- moodleMoodle: arbitrary file read risk through pdftex7.5 High
- moodleMoodle: remote code execution via calculated question types8.1 High
- bdthemes prime slider – addons for elementor, prime slider +1 morePrime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget6.4 Medium
- checkpoint clusterxl, clusterxl, multi-domain security management, quantum appliances, quantum maestro, quantum scalable chassis, quantum security gateways, quantum security management, gaia os +6 more +8 moreAuthenticated Gaia users can inject code or commands by global variables through special HTTP...8.0 High
- Show moreLoading…