CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- dataeaseDataEase has a forged JWT token vulnerability9.3 Critical
- xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 moremacro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author7.5 High
- public cms, publiccms +1 morePublic CMS Voting Management save cross site scripting5.3 Medium
- xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 moreThe PDF viewer macro allows accessing any attachment without access right checks7.5 High
- xwiki pdf viewer macro, xwikisas macro-pdfviewer, macro pdfviewer +2 moremacro-pdfviewer has a XSS through the width parameter9.1 Critical
- progress telerik report serverHard-coded credentials used for temporary and cache data encryption7.1 High
- progress telerik document processing librariesTelerik Document Processing Improper Handling of Memory Resources6.5 Medium
- unopimUnoPim Stored XSS : Cookie hijacking through Create User function6.5 Medium
- progress software telerik ui for wpf, telerik ui for wpf versions, telerik ui for wpf +2 moreProgress UI for WPF format provider unsafe deserialization vulnerability7.8 High
- progress telerik ui for winforms, progress software telerik ui for wpf versions +1 moreProgress UI for WinForms format provider unsafe deserialization vulnerability7.8 High
- backpackforlaravel filemanager, laravel-backpack file manager +1 moreFileManager Deserialization of Untrusted Data7.7 High
- airties air4443 firmwareXSS in AirTies' Air4443 Firmware4.6 Medium
- moodleMoodle: idor when accessing list of badge recipients4.3 Medium
- opensuse mirrorcache, tumbleweed, suse opensuse tumbleweed +2 moreXSS vulnerability found in OpenSuse MirrorCache5.3 Medium
- yugabytedb anywhereAn information disclosure vulnerability exists in the backup configuration process where the SAS...5.7 Medium
- craftcms cms, craft cms +1 moreCraft has a Potential Remote Code Execution via missing path normalization & Twig SSTI7.2 High
- craftcms cms, craft cms +1 moreCraft Allows Attackers to Read Arbitrary System Files7.7 High
- opensuse tumbleweedFixed temporary file path in aeon-checks allows fixing of disk encryption key7.3 High
- craftcms cms, craft cms +1 moreCraft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution8.5 High
- mozilla thunderbirdUsing remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This...4.3 Medium
- bosch rexroth ag indradrive fwa-indrv*-mp*, boschrexrothag indradrive fwa indrv mp +1 moreA vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch...7.5 High
- fortinet forticlient, forticlientwindows +1 moreA authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version...7.4 High
- frappe lms, viwis learning management system +1 moreVIWIS LMS Print authorization6.9 Medium
- icdsoft multimanager wp – manage all your wordpress sites easily, multimanager wp, multimanager wp manage all your word press sites easily +2 moreMultiManager WP – Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation9.8 Critical
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget6.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget6.4 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Template <= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget6.4 Medium
- nasirahmed afi – the easiest integration plugin, advancedformintegration advanced form integration +1 moreAFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site Scripting6.1 Medium
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +2 more +4 moreKernel: ksmbd: smb2_open out-of-bounds read information disclosure vulnerability4.0 Medium
- hidekazu ishikawa vk all in one expansion unitCross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100...4.8 Medium
- dom-iteratordom-iterator code execution vulnerability6.9 Medium
- schneider electric ecostruxure it gatewayCWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when...10.0 Critical
- vanquish user extra fields, wordpress user extra fields +1 moreWordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion9.8 Critical
- vanquish user extra fields, wordpress user extra fields +1 moreWordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- schneider electric powerlogic pm5320, powerlogic pm5340, powerlogic pm5341 +3 more +5 moreCWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to...8.7 High
- schneider electric modicon m340 cpu (part numbers bmxp34*)CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality...8.3 High
- schneider electric modicon m340 cpu (part numbers bmxp34*), modicon mc80 (part numbers bmkc80), modicon momentum unity m1e processor (171cbu*) +3 more +5 moreCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability...9.2 Critical
- schneider electric modicon m340 cpu (part numbers bmxp34*), modicon mc80 (part numbers bmkc80), modicon momentum unity m1e processor (171cbu*) +2 moreCWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability...8.3 High
- schneider electric modicon m340 cpu (part numbers bmxp34*), modicon mc80 (part numbers bmkc80), modicon momentum unity m1e processor (171cbu*) +3 more +5 moreCWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of...7.7 High
- schneider electric modicon m340 cpu (part numbers bmxp34*), modicon mc80 (part numbers bmkc80), modicon momentum unity m1e processor (171cbu*) +3 more +5 moreCWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel...7.5 High
- sodah luna radio playerLUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Read7.5 High
- wedevs wp project manager, project manager – ai powered project management, task management, kanban board & time tracker +1 moreWP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass7.3 High
- unknown woocommerce upload files, woocommerce upload files +1 moreWooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload9.8 Critical
- algolplus advanced order export for woocommerce, advanced order export +1 moreAdvanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details8.1 High
- duongancol boostify header footer builder for elementorBoostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- hashthemes hash elementsHash Elements <= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure5.3 Medium
- kognetiks chatbot, chatbot for wordpress +1 moreKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion5.3 Medium
- kognetiks chatbot for wordpress, chatbot +1 moreKognetiks Chatbot for WordPress <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification4.3 Medium
- kognetiks chatbot for wordpress, chatbot +1 moreKognetiks Chatbot for WordPress <= 2.1.7 - Reflected Cross-Site Scripting6.1 Medium
- kognetiks chatbot, chatbot for wordpress +1 moreKognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update5.3 Medium
- Show moreLoading…