Skip to content
OpenAdvisories

Archive

18 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /18 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-47533 Public exploit Scanner template

    Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes

    Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1…

    cobbler cobbler cobbler PyPI
  • High 7.5
    CVE-2024-43416 Public exploit

    GLPI vulnerable to enumeration of users' email addresses by unauthenticated user

    GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the is…

    GLPI glpi glpi Ubuntu
  • Medium 5.9
    CVE-2024-9474 Exploited · Ransomware Public exploit Scanner template EPSS 94%

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

    A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
    KEV Nov 18, 2024
  • Medium 5.9
    CVE-2024-0012 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
    KEV Nov 18, 2024
  • Critical 9.8
    CVE-2024-52430 Public exploit

    WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through <= 0.2.1.

    bublick Lis Video Gallery
  • Critical 9.8
    CVE-2024-52433 Public exploit Scanner template

    WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.

    Mindstien Technologies My Geo Posts Free
  • Critical 9.9
    CVE-2024-52429 Public exploit

    WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through <= 2.0.

    AntonHoelstad WP Quick Setup
  • High 7.5
    CVE-2024-11318 Public exploit

    IDOR vulnerability in AbsysNet

    An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifie…

    Baratz Innovación AbsysNet
  • Medium 6.1
    CVE-2024-52318 Public exploit

    Apache Tomcat: Incorrect JSP tag recycling leads to XSS

    Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat10 Debian Maven
  • Medium 6.5
    CVE-2024-52317 Public exploit

    Apache Tomcat: Request/response mix-up with HTTP/2

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 throug…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat10 Debian Ubuntu Maven
  • Critical 9.8
    CVE-2024-52316 Public exploit

    Apache Tomcat: Authentication bypass when using Jakarta Authentication API

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2024-38828 Public exploit

    CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter

    Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.

    Spring Spring libspring-java libspring-java Debian Ubuntu Maven
  • High 7.8
    CVE-2024-50804 Public exploit

    Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execu…

  • Medium 6.5
    CVE-2024-50848 Public exploit

    An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldS…

  • Medium 4.8
    CVE-2024-50849 Public exploit

    A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote a…

  • Medium 6.1
    CVE-2024-33231 Public exploit

    Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a …

  • High 7.5
    CVE-2024-52940 Public exploit

    AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address w…