Archive
November 2024
Vulnerabilities first published in this month (UTC), newest first.
4,074 results · Feed
-
High 7.5CVE-2024-11667 Exploited · Ransomware
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through…
KEV Dec 3, 2024 -
Medium 5.3
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission
The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized form submissions due to a missing capability check on the submit_form() function in all versions up to, and including, 7.8.5. This makes it possib…
-
Medium 6.4
Pricing Tables For WPBakery Page Builder (formerly Visual Composer) <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wdo_pricing_tables shortcode in all versions up to, and including, 1.4 due to insufficient input sanitiz…
-
Medium 6.4
Counter Up – Animated Number Counter & Milestone Showcase <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lgx-counter' shortcode in all versions up to, and including, 2.4.0 due to insufficient input sanitization and out…
-
High 7.5
Authentication privilege escalation via user groups due to missing authorization checks
An authenticated user with API access (e.g.: user with default User role), more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group (e.g.: Zabbix Administrators), except to groups that are disabl…
-
Medium 5.3
ProfilePress <= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from post…
-
Medium 5.3
Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.0.6 via the get_image function. This makes it possible for unauthenticated attackers to v…
-
Critical 9.3
iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')
A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.
-
Critical 9.3
iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature
A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.
-
High 7.1
GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation
An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same sub…
-
Critical 9.8CVE-2024-53676 EPSS 56%
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code executio…
-
Low 3.5
code-projects Crud Operation System add.php cross site scripting
A vulnerability, which was classified as problematic, has been found in code-projects Crud Operation System 1.0. This issue affects some unknown processing of the file /add.php. The manipulation of the argument saddress leads to cross site scripting. The atta…
-
Critical 9.8
A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management …
-
High 7.8
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion)…
-
High 7.3
A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management S…
-
Medium 4.8
A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul CO…
-
High 8.0
EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Control…
-
Medium 4.8
OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names.
-
Critical 9.8
OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, al…
-
High 8.0
Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authen…
-
Medium 6.8CVE-2024-51228 Scanner template
An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300…
-
Medium 4.2
Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow.
-
Medium 4.8
Several stack buffer overflows and pointer overflows in editorconfig-core-c
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backs…
-
High 7.3
1000 Projects Portfolio Management System MCA forgot_password_process.php sql injection
A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgot_password_process.php. The manipulation of the argument username leads to sql injection. The atta…
-
High 7.3
PHPGurukul User Registration & Login and User Management System signup.php sql injection
A vulnerability classified as critical has been found in PHPGurukul User Registration & Login and User Management System 1.0. This affects an unknown part of the file /signup.php. The manipulation of the argument email leads to sql injection. It is possible t…
-
High 7.3
PHPGurukul User Registration & Login and User Management System index.php sql injection
A vulnerability was found in PHPGurukul User Registration & Login and User Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument username leads…
-
High 7.3CVE-2024-53675 EPSS 81%
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose i…
-
High 7.3CVE-2024-53674 EPSS 47%
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose i…
-
High 8.1
A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute cod…
-
High 7.3
An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose i…
-
High 8.8
Tenda AC8 SetStaticRouteCfg route_static_check stack-based overflow
A vulnerability was found in Tenda AC8 16.03.34.09 and classified as critical. Affected by this issue is the function route_static_check of the file /goform/SetStaticRouteCfg. The manipulation of the argument list leads to stack-based buffer overflow. The att…
-
High 7.3
1000 Projects Portfolio Management System MCA register.php sql injection
A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection.…
-
Medium 5.7
Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion
lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a …
-
Medium 4.3
SourceCodester Best House Rental Management System POST Request ajax.php cross-site request forgery
A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.0. Affected is an unknown function of the file /rental/ajax.php?action=delete_user of the component POST Request Handler. The manipulation …
-
Low 3.5
SourceCodester Best House Rental Management System ajax.php cross site scripting
A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown processing of the file /rental/ajax.php?action=save_tenant. The manipulation of the argument lastna…
-
High 7.6
Microsoft Dynamics 365 Sales Spoofing Vulnerability
Microsoft Dynamics 365 Sales Spoofing Vulnerability
-
High 8.2
Microsoft Azure PolicyWatch Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.3
Microsoft Copilot Studio Elevation Of Privilege Vulnerability
Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
-
High 8.7CVE-2024-49035 Exploited
Partner.Microsoft.Com Elevation of Privilege Vulnerability
An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.
KEV Feb 25, 2025 -
Critical 9.0
Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on…