CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure5.7 Medium
- apache airflowApache Airflow: Sensitive configuration values are not masked in the logs by default7.5 High
- wpplugins hide my wp ghost, johndarrel wp ghost (hide my wp ghost) – security & firewall +1 moreHide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL6.1 Medium
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- advancedcustomfields advanced custom fields, unknown advanced custom fields pro, secure custom fields +1 more +3 moreSecure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution6.6 Medium
- blueglass jobs for wordpressJobs for WordPress < 2.7.8 - Contributor+ Stored XSS5.9 Medium
- melapress wp activity logWP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter7.2 High
- tripetto, tripetto wordpress form builder plugin for contact forms, surveys and quizzes – tripetto +1 moreTripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload7.2 High
- yotpo, yotpo yotpo: product & photo reviews for woocommerce +1 moreYotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site Scripting6.1 Medium
- smartwpress music player for elementor – audio player & podcast player, music player for elementor +1 moreMusic Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import4.3 Medium
- wpeka wp adcenter, wpeka-club wp adcenter – ad manager & adsense ads +1 moreWP AdCenter – Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode6.4 Medium
- cleancoder fitnesseFitNesse Cross-site scripting6.1 Medium
- fitnesseFitNesse Path Traversal5.3 Medium
- thimpress learnpress export import, learnpress – backup & migration tool +1 moreLearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting6.1 Medium
- themeum tutor lms elementor addonsTutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation4.3 Medium
- really-simple-plugins really simple security, really simple plugins simple security pro, simple security pro multisite +1 more +3 moreReally Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass9.8 Critical
- geovision gv-dsp lpr firmware, gv-dsp lpr v3, gv-dsp lpr v3 firmware +10 more +12 moreGeoVision EOL devices - OS Command Injection9.8 Critical
jqOSS-FuzzHeap-buffer-overflow in jv_string_vfmtNo scorelibjpeg-turboOSS-FuzzUse-of-uninitialized-value in decompress_yuv.ccNo score- ultimaker curaAn issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute...5.1 Medium
- jepaasMultiple parameters have SQL injection vulnerability in JEPaaS 7.2.8 via /je/login/btnLog...9.1 Critical
- chamilo lmsCross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute...6.1 Medium
- totolink a6000ub firmware, wifi usb driver +1 moreAn issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute...7.8 High
- kalcaddle kodboxAn issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information...5.3 Medium
- clementine-player clementineAn issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted...7.3 High
- getflightpath flightpathFlightPath 7.5 contains a Cross Site Scripting (XSS) vulnerability, which allows authenticated...6.1 Medium
- No product listedCross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote...6.1 Medium
- kasoKASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at ...9.8 Critical
- emlogemlog pro <=2.3.18 is vulnerable to Cross Site Scripting (XSS), which allows attackers to write...5.4 Medium
- pickmall lilishoplilishop <=4.2.4 is vulnerable to Incorrect Access Control, which can allow attackers to obtain...7.5 High
- crmebCRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end...7.5 High
- geeeeeeeek java shopA file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by...4.3 Medium
- geeeeeeeek java shopjava_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain...6.5 Medium
- python book book, timgreen python book +1 morepython_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain...7.5 High
- python book book, timgreen python book +1 moreThe user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.9.8 Critical
- guchengwuyue yshopmallyshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over...9.8 Critical
- python food ordering system food ordering systemThe python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage...7.5 High
- mcafee total protectionMcAfee Trial Installer 16.0.53 has Incorrect Access Control that leads to Local Escalation of...6.7 Medium
- No product listedA cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16...6.1 Medium
- No product listedBy default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other...7.8 High
- No product listedBy default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI...7.8 High
- primx cryhodBy default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users...7.8 High
- No product listedBy default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users...7.8 High
- No product listedBy default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users...7.8 High
- No product listedHathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about...2.4 Low
- mz-automation libiec61850, lib60870 +1 moreMultiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit...9.8 Critical
- mz-automation libiec61850, lib60870 +1 moreMultiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit...9.8 Critical
- mz-automation libiec61850NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit...7.5 High
- erp management software, nuserp nus-m9 erp +1 moreAn arbitrary file download vulnerability in the component /Doc/DownloadFile of NUS-M9 ERP...7.5 High
- erp management software, nuserp nus-m9 erp +1 moreAn arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP...9.8 Critical
- Show moreLoading…