CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- vanquish wordpress user extra fieldsWordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- e-plugins wp membershipWP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- trustyplugins category ajax filter, category ajax filter – advanced filter for posts & custom post types +1 moreCategory Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion9.8 Critical
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting6.1 Medium
- crestaproject attesa extraAttesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- ays-pro poll maker – versus polls, anonymous polls, image polls, poll maker +1 moreWordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection4.9 Medium
- scott paterson contact form 7 – paypal & stripe add-on, wpplugin paypal \& stripe add-on +1 moreContact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting6.1 Medium
- themecatcher quform, quform - wordpress form builder +1 moreQuform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information Exposure5.3 Medium
- vibethemes wplms learning management system for wordpress, wordpress lms, wordpress learning management system, wordpress learning management system +2 moreWPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion9.8 Critical
- bplugins content slider block – slide through text or media contentContent Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- dartiss code embedCode Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery6.4 Medium
- bplugins countdown timer block – animated countdown for events or launchesCountdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- envothemes envo extraEnvo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- sktthemes skt addons for elementorSKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- support ticket system project ticket system, vanquish woocommerce support ticket system +1 moreWooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload9.8 Critical
- support ticket system project ticket system, vanquish woocommerce support ticket system +1 moreWooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion8.8 High
- themehunk th shop maniaTh Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation8.8 High
- support ticket system project ticket system, vanquish woocommerce support ticket system +1 moreWooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion9.8 Critical
- fatcatapps landing page cat – coming soon & maintenance pagesLanding Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site Scripting6.1 Medium
- themehunk top storeTop Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation8.8 High
- codeless cowidgets – elementor addons, cowidgets elementor addons +1 moreCowidgets – Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- codeless cowidgets – elementor addons, cowidgets elementor addons +1 moreCowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure5.3 Medium
- ce21 suite, ce21com ce21 suite, ce21 ce21-suite +2 moreCE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change6.5 Medium
- shtheme anih, anih - creative agency wordpress theme +1 moreAnih - Creative Agency WordPress Theme <= 2024 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- eugen bobrowski debug toolDebug Tool <= 2.2 - Unauthenticated Arbitrary File Creation9.8 Critical
- ce21 suite, ce21com ce21 suite, ce21 ce21-suite +2 moreCE21 Suite <= 2.2.0 - JWT Token Disclosure9.8 Critical
- ce21 suite, ce21com ce21 suite, ce21 ce21-suite +2 moreCE21 Suite <= 2.2.0 - Authentication Bypass9.8 Critical
- eugen bobrowski debug toolDebug Tool <= 2.2 - Missing Authorization to Information Exposure4.3 Medium
- khaledsaikat user meta – user profile builder and user management pluginUser Meta – User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Information Exposure6.5 Medium
- ogunlab lenxel ai lms – course lesson generatorLenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- amazon data.alldata.all admin user may access potentially sensitive data stored by producers via logs6.9 Medium
- amazon data.alldata.all authenticated users can perform restricted operations against DataSets and Environments5.3 Medium
- amazon data.alldata.all authenticated users can obtain incorrect object level authorizations5.3 Medium
- amazon data.alldata.all authenticated users can perform mutating update operations on persisted notification records5.3 Medium
- amazon data.alldata.all does not invalidate authentication token upon user logout5.3 Medium
qpdfOSS-FuzzHeap-buffer-overflow in rijndaelSetupEncryptNo score- combodo itopReflected Cross-site Scripting exploit in Combodo iTop8.1 High
- combodo itopPortal user is able to access forbidden services information in Combodo iTop4.3 Medium
- combodo itopCross-Site Request Forgery (CSRF) in several iTop pages7.6 High
- mediacmsRemote code execution vulnerabilities in MediaCMS8.7 High
- free-now freenow, intelligent apps freenow app +1 moreIntelligent Apps Freenow App Keystore SSL.java hard-coded password6.3 Medium
- netapp storagegridCVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)4.3 Medium
- runatlantis atlantisGit credentials are exposed in atlantis logs8.5 High
- hapifhir org.hl7.fhir.core, hl7 fhir core +1 moreXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`8.6 High
- confidential-containers trusteeThe Attestation Results Token can be arbitrarily modified without being detected in Trustee8.1 High
- microfocus arcsight management center, arcsight platform +1 moreOpenText ArcSight Management Center and ArcSight Platform Stored XSS7.0 High
sp1-recursion-circuitcrates.iosp1 has insufficient observation of cumulative sum1.7 Low- dell enterprise sonic os, enterprise sonic distribution +1 moreDell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of...9.1 Critical
- dell enterprise sonic os, enterprise sonic distribution +1 moreDell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in...9.0 Critical
- dell enterprise sonic os, enterprise sonic distribution +1 moreDell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of...9.1 Critical
- Show moreLoading…