Skip to content
OpenAdvisories

Archive

29 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /29 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

76 results · Feed

  • Critical 9.1
    CVE-2024-35367

    FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer

    ffmpeg ffmpeg libav ffmpeg Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2024-35369

    In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists …

    ffmpeg libav Debian Ubuntu
  • Medium 6.1
    CVE-2024-39162

    pyspider Cross-site Scripting vulnerability

    pyspider through 0.3.10 allows /update XSS. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

    pyspider PyPI
  • High 7.5
    CVE-2024-53623

    Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive inform…

  • Critical 9.8
    CVE-2024-53507

    A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems.

  • Critical 9.8
    CVE-2024-53505

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent.

  • Critical 9.8
    CVE-2024-53506

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs.

  • Critical 9.8
    CVE-2024-53504

    A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory.

  • Medium 5.3
    CVE-2024-36626

    In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php.

  • Medium 6.2
    CVE-2024-36618

    FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, p…

    ffmpeg ffmpeg libav Debian Ubuntu
  • Medium 6.5
    CVE-2024-36621

    Moby Race Condition vulnerability

    moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

    kubevela-vela-core kubevela-vela-cli pulumi-language-nodejs pulumi Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.3
    CVE-2024-36619

    FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow …

    ffmpeg ffmpeg libav Debian Ubuntu
  • High 7.5
    CVE-2024-36611

    In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to a…

    symfony Debian
  • Medium 6.1
    CVE-2024-36624

    Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.

  • Critical 9.8
    CVE-2024-36622

    In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vul…

  • Medium 6.2
    CVE-2024-36617

    FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.

    ffmpeg ffmpeg libav ffmpeg Debian Ubuntu Alpine
  • High 7.5
    CVE-2024-36612

    Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.

  • Critical 9.8
    CVE-2024-36671

    nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /module…

  • Medium 6.5
    CVE-2024-36616

    An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of…

    ffmpeg ffmpeg libav Debian Ubuntu
  • Medium 6.1
    CVE-2024-36625

    Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.

  • High 8.1
    CVE-2024-36623

    Moby Race Condition vulnerability

    moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

    kubevela-vela-core kubevela-vela-cli pulumi-language-nodejs pulumi Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.9
    CVE-2024-36615

    FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding par…

    ffmpeg libav Debian Ubuntu
  • Medium 6.5
    CVE-2024-36620

    NULL Pointer Dereference on moby image history

    moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

    pulumi-language-nodejs pulumi promxy moby-engine Azure Linux Wolfi Go
  • High 7.5
    CVE-2024-48651 Scanner template

    In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of t…

    proftpd-dfsg proftpd-dfsg proftpd Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2024-48406

    Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arb…

  • Medium 4.3
    CVE-2024-45495

    MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking.

  • Critical 9.8
    CVE-2024-52780

    DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Cod…

  • Critical 9.8
    CVE-2024-52778

    DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Cod…

  • Critical 9.8
    CVE-2024-52779

    DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Cod…

  • Critical 9.8
    CVE-2024-52782

    DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Cod…

  • Critical 9.8
    CVE-2024-52781

    DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Cod…

  • Critical 9.8
    CVE-2024-52777

    DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L, <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Co…

  • Medium 6.1
    CVE-2024-54123

    Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a tex…

  • High 8.8
    CVE-2024-54124

    In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen.

  • Medium 4.1
    CVE-2024-54159

    stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink at…

  • Medium 5.5
    CVE-2024-47193

    WithSecure Elements Agent for Mac before 24.3, MDR before 24.3, and Elements Client Security for Mac before 16.10 allow…