CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- century systems co., ltd. futurenet nxr-g050 series, futurenet nxr-g060 series, futurenet nxr-g110 series +3 more +5 moreFutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are...9.8 Critical
- nec corporation univerge ixCross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to...4.3 Medium
- nec univerge ix, nec corporation univerge ix-r/ix-v +1 moreCommand Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for...7.2 High
- msg suisse ag easytaxXML External Entity (XXE) Vulnerability in EasyTax4.6 Medium
- hp enterprise security manager, trellix enterprise security manager (esm) +1 moreA vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and...9.8 Critical
- trellix enterprise security manager, enterprise security manager (esm) +1 moreA vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API....8.2 High
- billion electric m100, m120n, m150 +1 more +3 moreBillion Electric router - OS Command Injection7.2 High
- billion electric m100, m120n, m150 +1 more +3 moreBillion Electric router - Plaintext Storage of a Password7.2 High
- billion electric m100, m120n, m150 +1 more +3 moreBillion Electric router - Authentication Bypass7.5 High
- billion electric m100, m120n, m150 +1 more +3 moreBillion Electric router - Missing Authentication8.6 High
- bdthemes element pack elementor addons (header footer, template library, dynamic grid, carousel and remote arrows), element pack, element pack elementor addons wordpress pack elementor addons wordpress +2 moreElement Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS5.4 Medium
- 10web photo gallery by 10web, photo gallery, photo gallery by 10web wordpress gallery by 10web wordpress +2 morePhoto Gallery by 10Web < 1.8.31 - Admin+ Stored XSS4.8 Medium
- fcnt llc arrows n f-51c, arrows we, arrows we f-51b +1 more +3 moreMultiple FCNT Android devices provide the original security features such as "privacy mode" where...3.1 Low
- interinfo dreammakerInterinfo DreamMaker - Unrestricted File Upload through Path Traversal9.8 Critical
- interinfo dreammakerInterinfo DreamMaker - Arbitrary File Reading through Path Traversal7.5 High
stalldopenSUSEstalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp...4.1 Medium- clickstudios passwordstateIn Click Studios Passwordstate before build 9920, there is a potential permission escalation on...8.8 High
- backdropcms backdrop cmsBackdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG...6.1 Medium
- tp-link archer c7 firmwareIncorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to...7.5 High
- b3log siyuanA SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.9.8 Critical
- b3log siyuanA SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in...9.8 Critical
- b3log siyuanA SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at ...9.8 Critical
- b3log siyuanA SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in ...9.8 Critical
- dcnetworks dcme-320-l firmware, dcme-320 firmware, dcme-520 firmware +1 more +3 moreDCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are...9.8 Critical
- dcnetworks dcme-320-l firmware, dcme-320 firmware, dcme-520 firmware +1 more +3 moreDCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are...9.8 Critical
- dcnetworks dcme-320-l firmware, dcme-320 firmware, dcme-520 firmware +1 more +3 moreDCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are...9.8 Critical
- dcnetworks dcme-320-l firmware, dcme-320 firmware, dcme-520 firmware +1 more +3 moreDCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are...9.8 Critical
- dcnetworks dcme-320-l firmware, dcme-320 firmware, dcme-520 firmware +1 more +3 moreDCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are...9.8 Critical
- dcnetworks dcme-320-l firmware, dcme-320 firmware, dcme-520 firmware +1 more +3 moreDCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L, <=9.3.5.26, and DCME-720 <=9.1.5.11 are...9.8 Critical
- proftpdIn ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access...7.5 High
- umicatBuffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an...9.8 Critical
- No product listedWithSecure Elements Agent for Mac before 24.3, MDR before 24.3, and Elements Client Security for...5.5 Medium
- No product listedMSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.4.3 Medium
pyspiderPyPIpyspider Cross-site Scripting vulnerability6.1 Medium- nodemcunodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the...9.8 Critical
- prestashopIn prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within...5.3 Medium
- zulipZulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in...6.1 Medium
- zulipZulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in...6.1 Medium
- mobyproject mobyMoby Race Condition vulnerability8.1 High
- raspap raspap-webguiIn RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the...9.8 Critical
- mobyproject mobyMoby Race Condition vulnerability6.5 Medium
- mobyproject mobyNULL Pointer Dereference on moby image history6.5 Medium
- ffmpegFFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows...5.3 Medium
- ffmpegFFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for...6.2 Medium
- ffmpegFFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race...5.9 Medium
- zulip, zulip server +1 moreZulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.7.5 High
- symfonyWithdrawn Advisory: Symfony http-security has authentication bypass7.5 High
- linkstackLinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF.4.8 Medium
- ant-media ant-media-serverAnt-Media-Server vulnerable to Improper Output Neutralization for Logs7.5 High
- ffmpegIn FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security...5.5 Medium
- Show moreLoading…