Skip to content
OpenAdvisories

Archive

21 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /21 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.4
    CVE-2024-52052

    Stream Target Remote Code Execution in Wowza Streaming Engine

    Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.

    Wowza Streaming Engine
  • Critical 9.8
    CVE-2024-53095

    smb: client: Fix use-after-free of network namespace.

    In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report that CIFS triggers oops while reconnecting to a server. [0] The workload runs on Kubernetes, and some …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-53094

    RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Add sendpage_ok() check to disable MSG_SPLICE_PAGES While running ISER over SIW, the initiator machine encounters a warning from skb_splice_from_iter() indicating that a slab page i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 10.0
    CVE-2024-8525

    Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload

    An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file.

    Carrier Automated Logic, a Carrier company i-Vu WebCTRL
  • Critical 9.8
    CVE-2024-28892

    GoCast OS Command Injection vulnerability

    An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

    GoCast GoCast github.com/mayuresh82/gocast Go
  • Critical 9.8
    CVE-2024-29224

    An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can…

    GoCast GoCast
  • Critical 9.8
    CVE-2024-21855

    A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP r…

    GoCast GoCast
  • Critical 9.1
    CVE-2024-30896 Public exploit

    InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows au…

    influxdb influxdb Ubuntu Azure Linux
  • Critical 9.8
    CVE-2024-51367

    An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attack…

  • Critical 9.8
    CVE-2024-51366

    An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arb…