CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- kognetiks chatbot for wordpress, chatbot +1 moreKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition4.3 Medium
- smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more, wpforms +1 moreWPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion4.3 Medium
- tychesoftwares product delivery date for woocommerce – liteProduct Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting6.1 Medium
- thinkaquamarine aqua svg spriteAqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- axelkeller gpx viewer, devfarm wp gpx maps +1 moreGPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation8.8 High
- kaminskym ajax login and registration modal popup + inline formAJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting6.1 Medium
- northmule buy one click woocommerceBuy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import4.3 Medium
- northmule buy one click woocommerceBuy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion4.3 Medium
- wpmonks styler for ninja formsStyler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license6.5 Medium
- razorpay payment button elementor plugin, payment button +1 moreRazorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting6.1 Medium
- cmanon wp-stravaWP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting6.1 Medium
- mailmunch constant contact forms by mailmunch, constant contact forms +1 moreConstant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site Scripting6.1 Medium
- nicejobNiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- fbtopcn 胖鼠采集(fat rat collect)Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scripting6.1 Medium
- kimberlynorris social proof (testimonial) sliderSocial Proof (Testimonials) Slider <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode6.4 Medium
- razorpay payment button plugin, payment button +1 moreRazorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting6.1 Medium
- avovkdesign hide linksHide Links <= 1.4.2 - Unauthenticated Shortcode Execution5.3 Medium
- northmule buy one click woocommerceBuy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export4.3 Medium
- staxwp buddybuilder, buddypress builder for elementor – buddybuilder +1 moreBuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti...9.1 Critical
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti...9.1 Critical
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2 and 9.1R18.7 and Ivanti Policy...9.1 Critical
- ivanti connect secure, policy secure +1 moreIncorrect file permissions in Ivanti Connect Secure before version 22.6R2 and Ivanti Policy...7.8 High
- ivanti connect secure, policy secure, automation +2 moreArgument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti...9.1 Critical
- ivanti connect secure, policy secure +1 moreArgument injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure...9.1 Critical
- ivanti secure access clientImproper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local...4.4 Medium
- ivanti connect secureAn out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote...7.5 High
- ivanti connect secureAn out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote...7.5 High
- ivanti secure access clientInsufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated...7.8 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 morePath traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.8 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti endpoint manager, epm +1 moreSQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6...7.2 High
- ivanti secure access clientA race condition in Ivanti Secure Access Client before version 22.7R4 allows a local...7.1 High
- ruijienetworks rg-nbr rgos firmwareRuijie NBR800G gateway NBR_RGOS_11.1(6)B4P9 is vulnerable to command execution in /itbox_pi...6.5 Medium
- angeljudesuarez construction management systemA SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0...7.2 High
- angeljudesuarez construction management systemA SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0...7.2 High
- itsourcecode online furniture shopping projectA SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project...8.8 High
- anisha jonnys liquorA Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor...6.1 Medium
- No product listedA buffer overflow in the RecvSocketData function of Inovance HCPLC_AM401-CPU1608TPTN 21.38.0.0,...6.5 Medium
- xinje xd5e-24r-e firmwareAn issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows...7.5 High
- tenda g3, tendacn g3 firmware +1 moreTenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping...8.8 High
- tenda g3, tendacn g3 firmware +1 moreTenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the...8.8 High
- tenda g3, tendacn g3 firmware +1 moreTenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the...8.8 High
- Show moreLoading…