CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- google androidIn ih264d_assign_pic_num of ih264d_utils.c there is a possible out of bound read due to missing...6.5 Medium
- google androidIn mv_err_cost of mcomp.c there is a possible out of bounds read due to missing bounds check....6.5 Medium
- google android, pixel +1 moreIn String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow....7.8 High
- spencer14420 spemailhandler-phpPotential Abuse for Sending Arbitrary Emails in sp-php-email-handler8.6 High
- google androidIn SensorService::isDataInjectionEnabled of frameworks/native/services/sensorservice...5.5 Medium
- autolabCourse Roster vulnerable to CSV Injection in Autolab6.8 Medium
- cliRecursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli6.5 Medium
- cli go-ghgo-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace6.5 Medium
- google androidIn impeg2d_bit_stream_flush() of libmpeg2dec there is a possible OOB read due to a missing bounds...6.5 Medium
- google android, pixel +1 moreIn pvmp3_get_main_data_size of pvmp3_get_main_data_size.cpp, there is a possible buffer overread...7.5 High
- google android, pixel +1 moreIn checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a...7.8 High
- bunkerity bunkerwebOpen Redirect Vulnerability in Loading Page in bunkerweb5.1 Medium
- nofusscomputing centurion erpUser can view tickets from organizations they're not apart of in centurion_erp1.9 Low
- contiki-ngUncontrolled recursion due to insufficient validation of the IPv6 source routing header in Contiki-NG8.7 High
- contiki-ngOut-of-bounds read in SNMP when decoding a string in Contiki-NG8.4 High
- contiki-ngOut-of-bounds read when decoding SNMP messages in Contiki-NG8.4 High
- contiki-ngUnaligned memory access in RPL option processing in Contiki-NG7.5 High
- jenkins filesystem list parameter, jenkins project filesystem list parameter plugin +1 moreJenkins Filesystem List Parameter Plugin has Path Traversal vulnerability4.3 Medium
- jenkins simple queue, jenkins project simple queue plugin +1 moreJenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability8.0 High
- atlassian confluence data center, confluence server +1 moreThis Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of...6.4 Medium
- drupal tarte au citronTarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-0644.8 Medium
- mayurik best house rental management systemSourceCodester Best House Rental Management System POST Request ajax.php improper authorization6.9 Medium
- devolutions xts.netDevolutions.XTS.NET Vulnerable to Timing Attack on GF Multiplications5.1 Medium
- zabbixMedia Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported2.7 Low
hplipopenSUSESecurity update for hplipNo score- zabbixHeap buffer over-read2.7 Low
- zabbixNew line injection in Zabbix SNMP traps3.7 Low
- zabbixUse after free in browser_push_error3.3 Low
- zabbix frontend, zabbix +1 moreJS - Internal strings in HTTP headers9.1 Critical
- zabbixJS - Crash on unexpected HTTP server response3.3 Low
- zabbixJS - Crash on empty HTTP server response3.3 Low
- zabbixSQL injection in user.get API9.9 Critical
- zabbixUse after free vulnerability in browser.c4.4 Medium
- zabbixStack buffer overflow in zbx_snmp_cache_handle_engineid3.0 Low
- pagup automatic internal links for seo by pagupInternal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter4.9 Medium
- cimatti contact forms by cimatti, wordpress contact forms +1 moreWordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function4.3 Medium
- sma sunny central sc 1760-us, sunny central sc 1850-us, sunny central sc 2000 ev-us +53 more +55 moreSMA: SQL injection in Sunny Central UP5.4 Medium
- manageengine analytics plus, zohocorp manageengine analytics plus +1 moreSensitive Data Exposure8.1 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +7 more +9 moreA directory traversal vulnerability in the web management interface of Zyxel ATP series firmware...7.5 High
- wpmudev hustle, hustle – email marketing, lead generation, optins, popups +1 moreHustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission5.3 Medium
- labibahmed42 pricing tables for wpbakery page builder (formerly visual composer)Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode6.4 Medium
- logichunt counter up – animated number counter & milestone showcaseCounter Up – Animated Number Counter & Milestone Showcase <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themeisle otter blocks – gutenberg blocks, page builder for gutenberg editor & fse, otter blocks +1 moreOtter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View5.3 Medium
- properfraction profilepress, profilepress loginwp, properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress +2 moreProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- galaxy software services corporation iota c.ai conversational platform, gss iota c.ai +1 moreiota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')9.3 Critical
- galaxy software services corporation iota c.ai conversational platform, gss iota c.ai +1 moreiota C.ai Conversational Platform - Improper Verification of Cryptographic Signature9.3 Critical
- palo alto networks globalprotect app, paloaltonetworks globalprotect, palo alto networks globalprotect ios app +1 more +3 moreGlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation6.0 Medium
- hpe insight remote support, hewlett packard enterprise (hpe) hpe insight remote support +1 moreA directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may...9.8 Critical
shadercOSS-FuzzContainer-overflow in glslang::HlslParseContext::decomposeIntrinsicNo score- code-projects crud operation systemcode-projects Crud Operation System add.php cross site scripting5.3 Medium
- Show moreLoading…