Skip to content
OpenAdvisories

Archive

November 2024

Vulnerabilities first published in this month (UTC), newest first.

← October 2024 2024 / November December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 7.5
    CVE-2024-11667 Exploited · Ransomware

    A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through…

    Zyxel USG FLEX series firmware ATP series firmware USG FLEX 50(W) series firmware Network devices
    KEV Dec 3, 2024
  • High 8.7
    CVE-2024-49035 Exploited

    Partner.Microsoft.Com Elevation of Privilege Vulnerability

    An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.

    Microsoft Microsoft Partner Center
    KEV Feb 25, 2025
  • Critical 9.8
    CVE-2024-11680 Exploited Public exploit Scanner template EPSS 92%

    ProjectSend Unauthenticated Configuration Modification

    ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's conf…

    ProjectSend ProjectSend
    KEV Dec 3, 2024
  • Medium 6.3
    CVE-2024-44309 Exploited EPSS 22%

    A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.…

    Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu
    KEV Nov 21, 2024
  • High 8.8
    CVE-2024-44308 Exploited Public exploit

    The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 1…

    Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu
    KEV Nov 21, 2024
  • Medium 5.5
    CVE-2024-50302 Exploited

    HID: core: zero-initialize the report buffer

    In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
    KEV Mar 4, 2025
  • High 7.5
    CVE-2024-21287 Exploited

    Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Pr…

    Oracle Oracle Agile PLM Framework
    KEV Nov 21, 2024
  • Medium 5.9
    CVE-2024-9474 Exploited · Ransomware Public exploit Scanner template EPSS 94%

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

    A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
    KEV Nov 18, 2024
  • Medium 5.9
    CVE-2024-0012 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

    An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
    KEV Nov 18, 2024
  • Medium 5.3
    CVE-2024-11182 Exploited EPSS 33%

    Stored XSS vulnerability in MDaemon Email Server

    An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's brow…

    MDaemon Email Server
    KEV May 19, 2025
  • Critical 9.8
    CVE-2024-11120 Exploited EPSS 28%

    GeoVision EOL devices - OS Command Injection

    Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by…

    GeoVision GVLX 4 V2 GVLX 4 V3 GV-VS11
    KEV May 7, 2025
  • High 7.3
    CVE-2024-43093 Exploited Public exploit

    In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to pre…

    Google Android Android
    KEV Nov 7, 2024
  • Medium 5.1
    CVE-2024-8069 Exploited Public exploit EPSS 18%

    Limited remote code execution with privilege of a NetworkService Account access

    Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server

    Citrix Session Recording Citrix Session Recording Network devices
    KEV Aug 25, 2025
  • High 8.8
    CVE-2024-49039 Exploited · Ransomware Public exploit EPSS 14%

    Windows Task Scheduler Elevation of Privilege Vulnerability

    Windows Task Scheduler Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 12, 2024
  • Medium 6.5
    CVE-2024-43451 Exploited Public exploit EPSS 84%

    NTLM Hash Disclosure Spoofing Vulnerability

    NTLM Hash Disclosure Spoofing Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 12, 2024
  • Medium 5.1
    CVE-2024-8068 Exploited Public exploit

    Privilege escalation to NetworkService Account access

    Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

    Citrix Citrix Session Recording Network devices
    KEV Aug 25, 2025