Skip to content
OpenAdvisories

Archive

6 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /6 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.3
    CVE-2024-50340 Public exploit Scanner template EPSS 62%

    Ability to change environment from query in symfony/runtime

    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to c…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist
  • High 8.8
    CVE-2024-20536

    Cisco Nexus Dashboard Fabric Controller SQL Injection Vulnerability

    A vulnerability in a REST API endpoint and web-based management interface of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, remote attacker with read-only privileges to execute arbitrary SQL commands on an affected device. This v…

    Cisco Cisco Data Center Network Manager Network devices
  • High 7.5
    CVE-2024-20484

    Cisco Enterprise Chat and Email Denial of Service Vulnerability

    A vulnerability in the External Agent Assignment Service (EAAS) feature of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to i…

    Cisco Cisco Enterprise Chat and Email Network devices
  • High 8.8
    CVE-2024-10827

    Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap…

    Google Chrome chromium chromium Browsers Debian Alpine Wolfi
  • High 8.8
    CVE-2024-10826

    Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to p…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • High —
    GHSA-p7mv-53f2-4cwj

    CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data

    Name: ASA-2024-011: Vote Extensions: Panic when receiving a Pre-commit with an invalid data Component: CometBFT Criticality: High (Considerable Impact, and Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFI…

    github.com/cometbft/cometbft Go
  • High 7.5
    CVE-2024-6861

    Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

    A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product…

    Red Hat Red Hat Satellite 6 Red Hat Satellite 6.12 for RHEL 8
  • High 8.7
    CVE-2024-10082

    codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service

    CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1…

    Ericsson CodeChecker codechecker PyPI
  • High 7.6
    CVE-2020-11859

    Potential Cross Site Scripting vulnerability in OpenText iManager

    Improper Input Validation vulnerability in OpenText iManager allows Cross-Site Scripting (XSS). This issue affects iManager before 3.2.3

    OpenText iManager
  • High 8.1
    CVE-2024-10915 Public exploit Scanner template EPSS 83%

    D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

    A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argu…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • High 8.1
    CVE-2024-10914 Public exploit Scanner template EPSS 98%

    D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

    A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation …

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • High 8.1
    CVE-2024-9946

    Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider

    The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the …

    the_champ Social Share, Social Login and Social Comments Plugin – Super Socializer Web / CMS
  • High 8.1
    CVE-2024-10020

    Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider

    The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.1.35. This is due to insufficient verification on the user being returned by the social login token. This makes it possible …

    heateor Heateor Social Login WordPress Web / CMS
  • High 8.1
    CVE-2024-48325 Public exploit

    Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacao…