Skip to content
OpenAdvisories

Archive

13 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /13 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.0
    CVE-2024-52550 Public exploit

    Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin

    Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build who…

    Jenkins Project Jenkins Pipeline: Groovy Plugin org.jenkins-ci.plugins.workflow:workflow-cps Web / CMS Maven
  • High 7.3
    CVE-2024-43093 Exploited Public exploit

    In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to pre…

    Google Android Android
    KEV Nov 7, 2024
  • Medium 5.3
    CVE-2024-49379 Public exploit

    Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel

    Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vuln…

    getumbrel umbrel
  • High 7.5
    CVE-2024-51996 Public exploit

    Symphony has an Authentication Bypass via RememberMe

    Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie…

    symfony symfony symfony symfony Debian Ubuntu Packagist
  • High 8.8
    CVE-2024-10629 Public exploit

    GPX Viewer <= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation

    The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.9. This makes it possible for authenticated at…

    axelkeller GPX Viewer Web / CMS
  • Medium 6.1
    CVE-2024-50969 Public exploit

    A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote att…

  • Medium 6.5
    CVE-2024-50970 Public exploit

    A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote att…

  • Medium 6.5
    CVE-2024-50971 Public exploit

    A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers t…

  • Medium 6.5
    CVE-2024-50972 Public exploit

    A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attacke…

  • Critical 9.1
    CVE-2024-48510 Public exploit

    DotNetZip Directory Traversal vulnerability

    Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maint…

    DotNetZip ProDotNetZip NuGet
  • Medium 4.3
    CVE-2024-40443 Public exploit

    SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker t…

  • Medium 6.1
    CVE-2024-42834 Public exploit

    A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SA…