CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- corporate zen contact page with google mapWordPress Contact Page With Google Map plugin <= 1.6.1 - Arbitrary File Deletion vulnerability8.6 High
- jetmonsters getwid – gutenberg blocks, motopress getwid +1 moreGetwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- moodleMoodle: idor when accessing list of course badges4.3 Medium
- moodleMoodle: lesson activity password bypass through php loose comparison5.4 Medium
- moodleMoodle: idor when deleting oauth2 linked accounts7.5 High
- moodleMoodle: unprotected access to sensitive information via dynamic tables6.5 Medium
- google android, androidx.car.app +1 moreArbitrary Code execution in Car App Android Jetpack Library7.3 High
- zyxel p-6101c firmware, p6101c firmware, p610c firmware +2 more**UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL...7.5 High
- inspireui mstore api – create native android & ios apps on the cloud, mstore api +1 moreMStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- pdfcrowd save as pdf plugin by pdfcrowd, save as pdf +1 moreSave as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- yaadsarig yaad sarig payment gateway for wcYaad Sarig Payment Gateway For WC <= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion5.4 Medium
- m-files serverLocal file inclusion vulnerability in M-Files Server5.3 Medium
- m-files, m-files server +1 moreSupport for authentication bypass condition in M-Files LDAP authentication9.2 Critical
- m-files corporation ainoIncorrect evaluation of effective permissions in M-Files Aino5.3 Medium
- rakuten turbo 5g firmware, rakuten mobile, inc. turbo 5g +1 moreMissing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware...5.3 Medium
- rakuten turbo 5g firmware, rakuten mobile, inc. turbo 5g +1 moreImproper neutralization of special elements used in an OS command ('OS Command Injection') issue...8.8 High
- rakuten turbo 5g firmware, rakuten mobile, inc. turbo 5g +1 moreExposure of sensitive system information to an unauthorized control sphere issue exists in...5.3 Medium
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates4.3 Medium
- wcproducttable woocommerce product table, woocommerce product table lite, product table and list builder for woocommerce lite +2 moreWooCommerce Product Table Lite <= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting7.3 High
- sirv image optimizer, resizer and cdn – sirv, sirv +1 moreImage Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion8.1 High
- booster for woocommerce, pluggabl booster for woocommerce – pdf invoices, abandoned cart, variation swatches & 100+ tools +1 moreBooster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting6.1 Medium
- mailmunch mailchimp forms by mailmunch, mailchimp forms +1 moreMailChimp Forms by MailMunch <= 3.2.3 - Reflected Cross-Site Scripting6.1 Medium
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion6.5 Medium
- aaron13100 404 solution404 Solution <= 2.35.19 - Reflected Cross-Site Scripting6.1 Medium
- seo squirrly plugin by squirrly seo, squirrly seo plugin by squirrly seo +1 moreSEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS3.5 Low
- gloriafood restaurant menu – food ordering system – table reservation, oracle restaurant menu - food ordering system - table reservation +1 moreRestaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting6.1 Medium
- epark, inc. kura sushi official app produced by eparkUse of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK"...4.0 Medium
- gdragon gd bbpress attachmentsGD bbPress Attachments <= 4.7.2 - Reflected Cross-Site Scripting6.1 Medium
ndpiOSS-FuzzHeap-buffer-overflow in zoom_search_againNo score- dedebizDedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the...9.1 Critical
- dedebizAn arbitrary file upload vulnerability in the component /admin/file_manage_control of DedeBIZ v6...9.8 Critical
- dedebizAn arbitrary file upload vulnerability in the component /admin/friendlink_edit of DedeBIZ v6.3.0...7.2 High
- h3c gr-1800ax, gr-1800ax firmware +1 moreH3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm...9.8 Critical
- dlink di-8003 firmwareD-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter...4.9 Medium
- dlink di-8003 firmwareD-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host_ip parameter...4.9 Medium
- dlink di-8003 firmwareD-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in...4.9 Medium
- d-link di-8400 firmwareD-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE)...8.0 High
- sem-cms semcmsSemCms v4.8 was discovered to contain a SQL injection vulnerability. This allows an attacker to...4.9 Medium
- mybbA stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8...6.1 Medium
- piwigoA stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0...5.4 Medium
- hkcmsHkCms <= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common...9.8 Critical
- phpgurukul client management systemCross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2...6.1 Medium
- phpgurukul boat booking systemFile Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0...7.2 High
- vegam solutions 4iLocal File Inclusion vulnerability in Vegam Solutions Vegam 4i v.6.3.47.0 and earlier allows a...7.5 High
- audimex audimexeeAn issue in Audimex EE v.15.1.20 and before allows a remote attacker to escalate privileges.8.8 High
- dlink di-8200 firmwareD-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function...9.8 Critical
- openfeign querydsl querydslQuerydsl vulnerable to HQL injection through orderBy8.8 High
- arm mbedAn issue was discovered in MBed OS 6.16.0. Its hci parsing software dynamically determines the...7.5 High
- arm mbedAn issue was discovered in MBed OS 6.16.0. During processing of HCI packets, the software...7.5 High
- arm mbed os, mbed +1 moreAn issue was discovered in MBed OS 6.16.0. When parsing hci reports, the hci parsing software...9.8 Critical
- Show moreLoading…