Skip to content
OpenAdvisories

Archive

November 2024

Vulnerabilities first published in this month (UTC), newest first.

← October 2024 2024 / November December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

56 results · Clear filters · Feed

  • High 8.8
    CVE-2024-41992 Public exploit

    Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the s…

  • High 7.3
    CVE-2024-10958 Public exploit

    WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay

    The The WP Photo Album Plus plugin for WordPress is vulnerable to arbitrary shortcode execution via getshortcodedrenderedfenodelay AJAX action in all versions up to, and including, 8.8.08.007 . This is due to the software allowing users to execute an action t…

    opajaap WP Photo Album Plus Web / CMS
  • High 8.8
    CVE-2024-10674 Public exploit

    Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_install_and_activate_callback() function in all versions up to, and including, 1.4.9. This makes it possib…

    ThemeHunk Th Shop Mania Web / CMS
  • High 8.8
    CVE-2024-10673 Public exploit

    Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

    The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for a…

    ThemeHunk Top Store Web / CMS
  • High 7.6
    CVE-2024-52002 Public exploit

    Cross-Site Request Forgery (CSRF) in several iTop pages

    Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and a…

    Combodo iTop
  • High 8.8
    CVE-2024-24409 Public exploit

    Privilege Escalation

    Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option.

    ManageEngine ADManager Plus
  • High 8.1
    CVE-2024-43425 Public exploit Scanner template EPSS 88%

    Moodle: remote code execution via calculated question types

    A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 7.5
    CVE-2024-51428 Public exploit

    An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel pac…

  • High 7.3
    CVE-2024-50340 Public exploit Scanner template EPSS 62%

    Ability to change environment from query in symfony/runtime

    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to c…

    symfony symfony symfony/symfony symfony Debian Ubuntu Packagist
  • High 8.1
    CVE-2024-10915 Public exploit Scanner template EPSS 83%

    D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

    A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been rated as critical. Affected by this issue is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation of the argu…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • High 8.1
    CVE-2024-10914 Public exploit Scanner template EPSS 98%

    D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection

    A vulnerability was found in D-Link DNS-320, DNS-320LW, DNS-325 and DNS-340L up to 20241028. It has been declared as critical. Affected by this vulnerability is the function cgi_user_add of the file /cgi-bin/account_mgr.cgi?cmd=cgi_user_add. The manipulation …

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • High 8.1
    CVE-2024-48325 Public exploit

    Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacao…

  • High 7.3
    CVE-2024-10758 Public exploit

    code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection

    A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument user_name leads to sql injection. It…

    code-projects anirbandutta9 Content Management System News-Buzz
  • High 8.4
    CVE-2024-48336 Public exploit

    The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app …

  • High 8.1
    CVE-2024-51774 Public exploit

    qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors.

    qbittorrent qbittorrent qbittorrent Debian Ubuntu Alpine
  • High 8.8
    CVE-2024-48217 Public exploit

    An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-…