CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- linux, linux kernel +1 moreaf_netlink: Fix shift out of bounds in group mask calculation5.5 Medium
- linux, linux kernel +1 morex86/mce: Work around an erratum on fast string copy instructions5.5 Medium
- linux, linux kernel +1 morelz4: fix LZ4_decompress_safe_partial read out of bound7.8 High
- hewlett packard enterprise (hpe) sgi cxfsA security vulnerability has been identified in HPE Data Management Framework (DMF) Suite (CXFS)....5.5 Medium
- autodesk installerAutodesk ADP Desktop SDK Privilege Escalation Vulnerability7.8 High
- glpi-project glpiGLPI allows API document download without rights5.3 Medium
- google androidIn readEncryptedData of ConscryptEngine.java, there is a possible plaintext leak due to...5.5 Medium
- red hat openshift container platform 4Oauth-server-container: oauth-server-container logs client secret in debug level4.9 Medium
- eslint rewriteRegular Expression Denial of Service (ReDoS) in @eslint/plugin-kit8.7 High
- microsoft azure stack hci, azure stack hci os +1 moreAzure Stack HCI Elevation of Privilege Vulnerability8.8 High
- glpi-project glpiGLPI has a stored XSS at src/RSSFeed.php5.7 Medium
- glpi-project glpiGLPI has a reflected XSS in ajax/cable.php6.5 Medium
- glpi-project glpiGLPI has a Reflected XSS in /front/stat.graph.php6.5 Medium
- code-projects farmaciacode-projects Farmacia fornecedores.php cross site scripting5.3 Medium
- 1000 projects beauty parlour management system1000 Projects Beauty Parlour Management System index.php sql injection6.9 Medium
- fortra digital guardian agentUSB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.04.3 Medium
- adobe auditionAudition | Out-of-bounds Read (CWE-125)5.5 Medium
- 1000 projects beauty parlour management system1000 Projects Beauty Parlour Management System forgot-password.php sql injection6.9 Medium
- 1000 projects portfolio management system mca1000 Projects Portfolio Management System MCA login.php sql injection6.9 Medium
- openbsdOpenBSD NFS double-free vulnerability9.2 Critical
- glpi-project glpiGLPI has an Authenticated SQL Injection6.5 Medium
- glpi-project glpiGLPI has multiple reflected XSS6.5 Medium
- glpi-project glpiReflected XSS in Software form6.5 Medium
- glpi-project glpiAuthenticated SQL injection in ticket form6.5 Medium
- glpi-project glpiGLPI has multiple reflected XSS6.5 Medium
- glpi-project glpiGLPI allows account takeover via SQL Injection in AJAX scripts8.1 High
- erzhongxmu jeewmserzhongxmu Jeewms AuthInterceptor cgReportController.do sql injection5.3 Medium
- glpi-project glpiGLPI has a stored XSS via document upload6.7 Medium
- nextcloud mail, kiteworks security-advisories +1 moreNextcloud Mail app does not respect download permissions in shares3.5 Low
- nextcloud mail, kiteworks security-advisories +1 moreNextcloud Mail auto configurator can be tricked into sending account information to wrong servers8.2 High
- code-projects inventory managementcode-projects Inventory Management editProduct.php sql injection5.3 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty4.2 Medium
- nextcloud tables, kiteworks security-advisories +1 moreShare information of the Nextcloud Tables app is not limited to affected users3.5 Low
- nextcloud tables, kiteworks security-advisories +1 moreNextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables6.3 Medium
- nextcloud user oidc, kiteworks security-advisories +1 moreNextcloud User OIDC has an open redirection when logging in with User OIDC3.3 Low
- rcloneRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata5.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares2.6 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server allows users to copy folder that contain files that are blocked by the files access control4.1 Medium
- cisco catalyst sd-wan managerCisco SD-WAN vDaemon Buffer Overflow Vulnerability5.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews5.7 Medium
- tenda ac10, ac10 firmware +1 moreTenda AC10 SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow8.7 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them3.0 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's global credentials of external storages are sent back to the frontend4.6 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server is missing password confirmation when changing external storage options4.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's OAuth2 client secrets were stored in a recoverable way2.7 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's link reference provider can be tricked into downloading bigger files than intended5.7 Medium
- cisco catalyst sd-wan managerCisco SD-WAN SQL Injection Vulnerability4.9 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has a potential hash collision for background jobs could skip queuing them2.6 Low
- cisco catalyst sd-wan managerCisco SD-WAN vManage Cypher Query Language Injection Vulnerability4.3 Medium
- cisco catalyst sd-wan managerCisco SD-WAN vManage Authorization Bypass Vulnerability6.4 Medium
- Show moreLoading…