CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- cobblerCobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes9.8 Critical
- egeabilgi software website templateSQLi in Egebilgi Software's Website Template8.8 High
- apache tomcatApache Tomcat: Incorrect JSP tag recycling leads to XSS6.1 Medium
- django cms association django-cms, django-cms django cms +1 moreStored XSS in Open Source Project "django-cms"4.8 Medium
- apache tomcatApache Tomcat: Request/response mix-up with HTTP/26.5 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Authentication bypass when using Jakarta Authentication API9.8 Critical
- moodleMoodle: idor when fetching report schedules4.3 Medium
- moodleMoodle: some users can delete audiences of other reports4.3 Medium
- moodleMoodle: idor in edit/delete rss feed4.3 Medium
- moodleMoodle: users' names returned in messaging error message4.3 Medium
- firebase javascript sdk, google firebase javascript sdk +1 moreSession Hijacking in Firebase JavaScript SDK5.2 Medium
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +2 more +4 moreKernel: ksmbd: read request out-of-bounds read information disclosure vulnerability7.5 High
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +2 more +4 moreKernel: ksmbd: transform header out-of-bounds read information disclosure vulnerability5.8 Medium
- cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 moreImproper Neutralization of Delimiters in Mongoose Web Server library4.0 Medium
- cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 moreUse of Out-of-range Pointer Offset in Mongoose Web Server library4.3 Medium
- cesanta mongoose, mongoose web server +1 moreUse of Out-of-range Pointer Offset in Mongoose Web Server library4.3 Medium
- cesanta mongoose, mongoose web server +1 moreUse of Out-of-range Pointer Offset in Mongoose Web Server library5.3 Medium
- cesanta mongoose, mongoose web server +1 moreUse of Out-of-range Pointer Offset in Mongoose Web Server library5.3 Medium
- cesanta mongoose, mongoose web server +1 moreUse of Out-of-range Pointer Offset in Mongoose Web Server library5.3 Medium
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +9 more +11 moreWAGO: BACNet Service Property Modification Due to Permission Misconfiguration in Multiple Devices7.1 High
- cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 moreUse of Out-of-range Pointer Offset in Mongoose Web Server library8.2 High
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +9 more +11 moreWAGO: Remote Arbitrary File Write with Root Privileges in multiple Devices8.1 High
- cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 moreImproper Neutralization of Delimiters in Mongoose Web Server library4.0 Medium
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +9 more +11 moreWAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices6.5 Medium
- cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 moreInteger Overflow or Wraparound in Mongoose Web Server library7.5 High
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +9 more +11 moreWAGO: Arbitrary File Overwrite in Multiple Devices8.1 High
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +9 more +11 moreWAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices5.7 Medium
- cesanta mongoose, mongoose web server +1 moreUse of Out-of-range Pointer Offset in Mongoose Web Server library4.2 Medium
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +12 more +14 moreWAGO: CODESYS V3 Configuration Authentication Bypass in Multiple Devices8.8 High
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +12 more +14 moreWAGO: Boot Mode Manipulation in Multiple Devices8.1 High
- wago cc100 0751-9x01, cc100 0751/9x01, edge controller 0752-8303/8000-0002 +12 more +14 moreWAGO: Docker Settings Manipulation in Multiple Devices5.4 Medium
- apache hertzbeatApache HertzBeat: RCE by notice template injection vulnerability8.8 High
- apache hertzbeatApache HertzBeat: Exposure sensitive token via http GET method with query string7.5 High
- apache hertzbeatApache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities8.8 High
- apache ofbizApache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE9.8 Critical
- apache ofbizApache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)8.9 High
- manageengine adaudit plus, zohocorp manageengine adaudit plus +1 moreSQL Injection8.3 High
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- zte nh8091, nh8091 firmware +1 moreZTE NH8091 product has an improper permission control vulnerability6.8 Medium
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Upload through Path Traversal9.8 Critical
- trcore dvcTRCore DVC - Arbitrary File Read through Path Traversal7.5 High
- trcore dvcTRCore DVC - Arbitrary File Read through Path Traversal7.5 High
- cminds cm table of contents, creativemindssolutions cm-table-of-content +1 moreCM Table Of Contents – WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF3.8 Low
- trcore dvcTRCore DVC - Use of Hard-coded Cryptographic Key6.2 Medium
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused8.4 High
- springCVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter5.3 Medium
- altenergy power control softwareAltenergy Power Control Software database improper authorization6.9 Medium
- Show moreLoading…