Archive
November 2024
Vulnerabilities first published in this month (UTC), newest first.
41 results · Clear filters · Feed
-
Medium 6.1CVE-2024-11252 Public exploit
Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escapin…
-
Medium 5.3CVE-2024-53255 Public exploit
Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS
BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the …
-
Medium 6.9CVE-2024-50395 Public exploit
Media Streaming add-on
An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege. We have already fixed the vulnerability in the followi…
-
Medium 6.8CVE-2024-50657 Public exploit
An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCode…
-
Medium 6.9
Command Injection leading to RCE via LDAP Misconfiguration
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4
-
Medium 6.1CVE-2024-50803 Public exploit
Redaxo Core CMS Cross Site Scripting (XSS)
The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges
-
Medium 5.7CVE-2024-52711 Public exploit
DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.
-
Medium 5.9
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this…
KEV Nov 18, 2024 -
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or…
KEV Nov 18, 2024 -
Medium 6.1CVE-2024-52318 Public exploit
Apache Tomcat: Incorrect JSP tag recycling leads to XSS
Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97, which fixes the issue.
-
Medium 6.5CVE-2024-52317 Public exploit
Apache Tomcat: Request/response mix-up with HTTP/2
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 throug…
-
Medium 5.3CVE-2024-38828 Public exploit
CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter
Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.
-
Medium 6.5CVE-2024-50848 Public exploit
An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldS…
-
Medium 4.8CVE-2024-50849 Public exploit
A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote a…
-
Medium 6.1CVE-2024-33231 Public exploit
Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a …
-
Medium 4.2CVE-2024-52510 Public exploit
Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. The Desktop client did not stop with an error but allowed by-passing the signature validation, if a manipulated server sends an empty initial signature. It i…
-
Medium 5.3CVE-2024-24450 Public exploit
Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface C…
-
Medium 5.3CVE-2024-7124 Public exploit
Reflected XSS in DInGO dLibra
Improper Neutralization of Input During Web Page Generation vulnerability in DInGO dLibra software in the parameter 'filter' in the endpoint 'indexsearch' allows a Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL…
-
Medium 5.1CVE-2024-5083 Public exploit
Nexus Repository 2 - Stored XSS
A stored Cross-site Scripting vulnerability has been discovered in Sonatype Nexus Repository 2 This issue affects Nexus Repository 2 OSS/Pro versions up to and including 2.15.1.
-
Medium 5.3CVE-2024-49379 Public exploit
Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel
Umbrel is a home server OS for self-hosting. The login functionality of Umbrel before version 1.2.2 contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vuln…
-
Medium 6.1CVE-2024-50969 Public exploit
A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote att…
-
Medium 6.5CVE-2024-50970 Public exploit
A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote att…
-
Medium 6.5CVE-2024-50971 Public exploit
A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers t…
-
Medium 6.5CVE-2024-50972 Public exploit
A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attacke…
-
Medium 4.3CVE-2024-40443 Public exploit
SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker t…
-
Medium 6.1CVE-2024-42834 Public exploit
A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SA…
-
Medium 5.1
Limited remote code execution with privilege of a NetworkService Account access
Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server
KEV Aug 25, 2025 -
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
KEV Nov 12, 2024 -
Medium 5.1
Privilege escalation to NetworkService Account access
Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain
KEV Aug 25, 2025 -
Medium 5.4CVE-2024-51026 Public exploit
The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx end…
-
Medium 6.5CVE-2024-44765 Public exploit
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.…
-
Medium 5.4CVE-2024-51032 Public exploit
A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 all…
-
Medium 6.5CVE-2024-51030 Public exploit
A SQL injection vulnerability in manage_client.php and view_cab.php of Sourcecodester Cab Management System 1.0 allows …
-
Medium 5.4CVE-2024-51031 Public exploit
A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows rem…
-
Medium 4.3CVE-2024-9926 Public exploit
Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
-
Medium 6.3CVE-2024-9902 Public exploit
Ansible-core: ansible-core user may read/write unauthorized content
A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivi…
-
Medium 4.9CVE-2024-50335 Public exploit
Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious J…
-
Medium 4.9CVE-2024-51665 Public exploit
WordPress Magical Addons For Elementor plugin <= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in Noor Alam Magical Addons For Elementor magical-addons-for-elementor allows Server Side Request Forgery.This issue affects Magical Addons For Elementor: from n/a through <= 1.2.1.
-
Medium 5.3
WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability
Access Control vulnerability in YARPP YARPP allows . This issue affects YARPP: from n/a through 5.30.10.
-
Medium 6.5CVE-2024-43998 Public exploit
WordPress Blogpoet theme <= 1.0.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3.