Skip to content
OpenAdvisories

Archive

November 2024

Vulnerabilities first published in this month (UTC), newest first.

← October 2024 2024 / November December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

137 results · Clear filters · Feed

  • High 8.1
    CVE-2024-10914 Public exploit Scanner template EPSS 98%

    D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

    A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation …

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-9902 Public exploit

    Ansible-core: ansible-core user may read/write unauthorized content

    A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivi…

    Red Hat Red Hat Enterprise Linux 10 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Linux Debian Ubuntu Azure Linux PyPI
  • High 8.1
    CVE-2024-48325 Public exploit

    Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacao…

  • Medium 4.9
    CVE-2024-50335 Public exploit

    Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious J…

    salesagility SuiteCRM
  • Critical 9.8
    CVE-2024-51132 Public exploit

    HAPI FHIR XML External Entity (XXE) vulnerability

    An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.

    ca.uhn.hapi.fhir:org.hl7.fhir.r5 ca.uhn.hapi.fhir:org.hl7.fhir.validation ca.uhn.hapi.fhir:org.hl7.fhir.utilities ca.uhn.hapi.fhir:org.hl7.fhir.r4b Maven
  • Critical 9.8
    CVE-2024-51358 Public exploit

    An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to th…

  • Critical 10.0
    CVE-2024-50526 Public exploit

    WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Lindeni Mahlalela Multi Purpose Mail Form multi-purpose-mail-form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through <= 1.0.2.

    Lindeni Mahlalela Multi Purpose Mail Form
  • Medium 4.9
    CVE-2024-51665 Public exploit

    WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Server Side Request Forgery.This issue affects Magical Addons For Elementor: from n/a through <= 1.2.1.

    Noor Alam Magical Addons For Elementor
  • High 7.3
    CVE-2024-10758 Public exploit

    code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection

    A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument user_name leads to sql injection. It…

    code-projects anirbandutta9 Content Management System News-Buzz
  • High 8.4
    CVE-2024-48336 Public exploit

    The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app …

  • Critical 9.8
    CVE-2024-48061 Public exploit

    Langflow vulnerable to remote code execution

    langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

    langflow PyPI
  • High 8.1
    CVE-2024-51774 Public exploit

    qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.

    qbittorrent qbittorrent qbittorrent Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2024-43919 Public exploit Scanner template EPSS 45%

    WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability

    Access Control vulnerability in YARPP YARPP allows . This issue affects YARPP: from n/a through 5.30.10.

    YARPP YARPP
  • Medium 6.5
    CVE-2024-43998 Public exploit

    WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.

    WebsiteinWP Blogpoet
  • Critical 9.8
    CVE-2024-7456 Public exploit

    SQL Injection in lunary-ai/lunary

    A SQL injection vulnerability exists in the `/api/v1/external-users` route of lunary-ai/lunary version v1.4.2. The `order by` clause of the SQL query uses `sql.unsafe` without prior sanitization, allowing for SQL injection. The `orderByClause` variable is con…

    lunary-ai lunary-ai/lunary
  • Medium 5.3
    CVE-2024-10654 Public exploit

    TOTOLINK LR350 formLoginAuth.htm authorization

    A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to autho…

    Toto Link LR350
  • High 8.8
    CVE-2024-48217 Public exploit

    An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-…