Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2024

203 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

  • CVE-2024-10793
    24Monitor

    WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter

    MediumCVSS 6.1Proof of conceptEPSS 1%

    melapress · wp activity logNov 15, 2024

  • CVE-2024-10443
    48Plan

    Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolo

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    synology · photosNov 15, 2024

  • CVE-2024-11182
    61This week

    Stored XSS vulnerability in MDaemon Email Server

    MediumCVSS 5.3KEVWeaponizedEPSS 33%

    mdaemon · mdaemonNov 15, 2024

  • CVE-2024-11237
    36Monitor

    TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow

    HighCVSS 8.7Proof of conceptEPSS 5%

    tp-link · vn020-f3v\(t\) firmwareNov 15, 2024

  • CVE-2024-11238
    29Monitor

    Landray EKP sysUiComponent.do delPreviewFile path traversal

    MediumCVSS 6.9Proof of conceptEPSS 5%

    landray · landray ekpNov 15, 2024

  • CVE-2024-50986
    29Monitor

    An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.

    HighCVSS 7.3Proof of conceptEPSS 0%

    clementine-player · clementineNov 15, 2024

  • CVE-2022-20649
    36Monitor

    Cisco Redundancy Configuration Manager Debug Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 11%

    cisco · cisco redundancy configuration managerNov 15, 2024

  • CVE-2023-20036
    43Plan

    Cisco Industrial Network Director Command Injection Vulnerability

    CriticalCVSS 9.9No exploitEPSS 13%

    cisco · industrial network directorNov 15, 2024

  • CVE-2024-49754
    43Plan

    LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php

    MediumCVSS 5.4No exploitEPSS 73%

    librenms · librenmsNov 15, 2024

  • CVE-2024-50352
    33Monitor

    LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php

    MediumCVSS 5.4No exploitEPSS 41%

    librenms · librenmsNov 15, 2024

  • CVE-2024-44625
    40Plan

    Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

    HighCVSS 8.8Proof of conceptEPSS 16%

    gogs · gogsNov 15, 2024

  • CVE-2024-24450
    21Monitor

    Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allo

    MediumCVSS 5.3Proof of conceptEPSS 1%

    Nov 15, 2024

  • CVE-2024-40638
    46Plan

    GLPI allows account takeover via SQL Injection in AJAX scripts

    HighCVSS 8.8No exploitEPSS 38%

    glpi-project · glpiNov 15, 2024

  • CVE-2024-46383
    9Monitor

    Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected devices in plaintext

    LowCVSS 2.4Proof of conceptEPSS 0%

    Nov 15, 2024

  • CVE-2024-52510
    30Monitor

    Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty

    HighCVSS 7.5Proof of conceptEPSS 0%

    nextcloud · desktopNov 15, 2024

  • CVE-2024-9935
    32Monitor

    PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download

    HighCVSS 7.5Proof of conceptEPSS 7%

    redefiningtheweb · pdf generator for wordpress elementorNov 16, 2024

  • CVE-2024-10728
    47Plan

    PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation

    HighCVSS 8.8Proof of conceptEPSS 39%

    wpxpo · postxNov 16, 2024

  • CVE-2024-8856
    67This week

    Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8WeaponizedEPSS 94%

    revmakx · backup and staging by wp time capsuleNov 16, 2024

  • CVE-2024-11305
    22Monitor

    Altenergy Power Control Software status_zigbee get_status_zigbee sql injection

    MediumCVSS 5.3Proof of conceptEPSS 3%

    altenergy · power control softwareNov 17, 2024

  • CVE-2024-38828
    21Monitor

    CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter

    MediumCVSS 5.3Proof of conceptEPSS 0%

    spring · springNov 18, 2024

  • CVE-2024-52940
    30Monitor

    AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic

    HighCVSS 7.5Proof of conceptEPSS 1%

    Nov 18, 2024

  • CVE-2024-52316
    41Plan

    Apache Tomcat: Authentication bypass when using Jakarta Authentication API

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    apache · tomcatNov 18, 2024

  • CVE-2024-52317
    27Monitor

    Apache Tomcat: Request/response mix-up with HTTP/2

    MediumCVSS 6.5Proof of conceptEPSS 2%

    apache · tomcatNov 18, 2024

  • CVE-2024-52318
    25Monitor

    Apache Tomcat: Incorrect JSP tag recycling leads to XSS

    MediumCVSS 6.1Proof of conceptEPSS 1%

    apache · tomcatNov 18, 2024

  • CVE-2024-11303
    35Monitor

    The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.

    HighCVSS 8.7Proof of conceptEPSS 1%

    korenix · jetport 5601Nov 18, 2024

  • CVE-2024-11318
    30Monitor

    IDOR vulnerability in AbsysNet

    HighCVSS 7.5Proof of conceptEPSS 0%

    baratz innovación · absysnetNov 18, 2024

  • CVE-2024-52429
    35Monitor

    WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    antonhoelstad · wp quick setupNov 18, 2024

  • CVE-2024-52430
    39Monitor

    WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    lis · video galleryNov 18, 2024

  • CVE-2024-52433
    40Plan

    WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    mindstien · my geo posts freeNov 18, 2024

  • CVE-2020-26073
    34Monitor

    Cisco SD-WAN vManage Directory Traversal Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 12%

    cisco · catalyst sd-wan managerNov 18, 2024

  • CVE-2024-0012
    97Now

    PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

    CriticalCVSS 9.3KEVWeaponizedEPSS 99%

    paloaltonetworks · pan-osNov 18, 2024

  • CVE-2024-9474
    85Now

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

    MediumCVSS 6.9KEVWeaponizedEPSS 93%

    paloaltonetworks · pan-osNov 18, 2024

  • CVE-2024-43416
    21Monitor

    GLPI vulnerable to enumeration of users' email addresses by unauthenticated user

    MediumCVSS 5.3Proof of conceptEPSS 1%

    glpi-project · glpiNov 18, 2024

  • CVE-2024-47533
    40Plan

    Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    cobbler · cobblerNov 18, 2024

  • CVE-2024-50804
    31Monitor

    Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via

    HighCVSS 7.8Proof of conceptEPSS 0%

    Nov 18, 2024

  • CVE-2024-50848
    26Monitor

    An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to acce

    MediumCVSS 6.5Proof of conceptEPSS 1%

    rws · worldserverNov 18, 2024

  • CVE-2024-50849
    19Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker

    MediumCVSS 4.8Proof of conceptEPSS 0%

    rws · worldserverNov 18, 2024

  • CVE-2024-10486
    21Monitor

    Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File

    MediumCVSS 5.3Proof of conceptEPSS 0%

    woocommerce · google for woocommerceNov 18, 2024

  • CVE-2024-21287
    61This week

    Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension).

    HighCVSS 7.5KEVWeaponizedEPSS 1%

    oracle · agile product lifecycle managementNov 18, 2024

  • CVE-2024-33231
    21Monitor

    Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to th

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Nov 18, 2024

  • CVE-2024-50302
    52Plan

    HID: core: zero-initialize the report buffer

    MediumCVSS 5.5KEVWeaponizedEPSS 0%

    linux · linux kernelNov 19, 2024

  • CVE-2024-52711
    22Monitor

    DI-8100 v16.07.26A1 is vulnerable to Buffer Overflow In the ip_position_asp function via the ip parameter.

    MediumCVSS 5.7Proof of conceptEPSS 0%

    dlink · di-8100 firmwareNov 19, 2024

  • CVE-2024-50803
    21Monitor

    The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker

    MediumCVSS 5.4Proof of conceptEPSS 0%

    redaxo · redaxoNov 19, 2024

  • CVE-2024-52402
    38Monitor

    WordPress Exclusive Content Password Protect plugin <= 1.1.0 - CSRF to Arbitrary File Upload vulnerability

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    gunghoinc · exclusive content password protectNov 19, 2024

  • CVE-2018-9338
    31Monitor

    In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check.

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidNov 19, 2024

  • CVE-2024-11003
    35Monitor

    Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library (Modules::ScanDeps) which expects safe input.

    HighCVSS 7.8Proof of conceptEPSS 12%

    needrestart project · needrestartNov 19, 2024

  • CVE-2024-48990
    40Plan

    Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart int

    HighCVSS 7.8WeaponizedEPSS 21%

    needrestart project · needrestartNov 19, 2024

  • CVE-2024-52762
    21Monitor

    A cross-site scripting (XSS) vulnerability in the component /master/header.php of Ganglia-web v3.73 to v3.76 allows attackers to execute arb

    MediumCVSS 5.4Proof of conceptEPSS 0%

    ganglia · ganglia-webNov 19, 2024

  • CVE-2024-52763
    21Monitor

    A cross-site scripting (XSS) vulnerability in the component /graph_all_periods.php of Ganglia-web v3.73 to v3.75 allows attackers to execute

    MediumCVSS 5.4Proof of conceptEPSS 0%

    ganglia · ganglia-webNov 19, 2024

  • CVE-2018-9411
    35Monitor

    In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check.

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · androidNov 19, 2024

  • CVE-2024-44308
    68This week

    The issue was addressed with improved checks.

    HighCVSS 8.8KEVWeaponizedEPSS 10%

    debian · debian linuxNov 19, 2024

  • CVE-2024-44309
    62This week

    A cookie management issue was addressed with improved state management.

    MediumCVSS 6.3KEVWeaponizedEPSS 22%

    debian · debian linuxNov 19, 2024

  • CVE-2018-9468
    28Monitor

    In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass.

    HighCVSS 7.1Proof of conceptEPSS 0%

    google · androidNov 20, 2024

  • CVE-2024-52765
    42Plan

    H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.

    CriticalCVSS 9.8No exploitEPSS 11%

    h3c · gr-1800ax firmwareNov 20, 2024

  • CVE-2024-51151
    48Plan

    D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp_info_htm function via the flag parameter and cmd parameter.

    CriticalCVSS 9.8No exploitEPSS 31%

    dlink · di-8200 firmwareNov 21, 2024

  • CVE-2024-10400
    55Plan

    Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter

    HighCVSS 7.5Proof of conceptEPSS 83%

    themeum · tutor lmsNov 21, 2024

  • CVE-2024-11320
    54Plan

    Command Injection leading to RCE via LDAP Misconfiguration

    MediumCVSS 6.9WeaponizedEPSS 91%

    pandorafms · pandora fmsNov 21, 2024

  • CVE-2024-30896
    38Monitor

    InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with r

    CriticalCVSS 9.1Proof of conceptEPSS 5%

    Nov 21, 2024

  • CVE-2024-11587
    21Monitor

    idcCMS classProvCity.php GetCityOptionJs cross site scripting

    MediumCVSS 5.3Proof of conceptEPSS 0%

    idccms · idccmsNov 21, 2024

  • CVE-2024-21786
    31Monitor

    An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5.

    HighCVSS 7.2No exploitEPSS 10%

    mc-technologies · mc lr router firmwareNov 21, 2024

  • CVE-2024-48286
    36Monitor

    Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.

    HighCVSS 8.0No exploitEPSS 13%

    linksys · e3000 firmwareNov 21, 2024

  • CVE-2024-48288
    35Monitor

    TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the fronten

    HighCVSS 8.0No exploitEPSS 10%

    tp-link · tl-ipc42c firmwareNov 21, 2024

  • CVE-2024-53333
    31Monitor

    TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function.

    MediumCVSS 6.3No exploitEPSS 19%

    totolink · ex200 firmwareNov 21, 2024

  • CVE-2024-50395
    27Monitor

    Media Streaming add-on

    MediumCVSS 6.9Proof of conceptEPSS 1%

    qnap · media streaming add-onNov 22, 2024

  • CVE-2024-10220
    33Monitor

    Arbitrary command execution through gitRepo volume

    HighCVSS 8.1Proof of conceptEPSS 3%

    kubernetes · kubeletNov 22, 2024

  • CVE-2024-50657
    27Monitor

    An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, spec

    MediumCVSS 6.8Proof of conceptEPSS 0%

    Nov 22, 2024

  • CVE-2023-51646
    19Monitor

    Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability

    MediumCVSS 4.7No exploitEPSS 1%

    alltena · allegraNov 22, 2024

  • CVE-2024-5721
    60This week

    Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability

    HighCVSS 8.1WeaponizedEPSS 5%

    logsign · unified secops platformNov 22, 2024

  • CVE-2024-11477
    38Monitor

    7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 22%

    7-zip · 7-zipNov 22, 2024

  • CVE-2024-11392
    37Monitor

    Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 7%

    huggingface · transformersNov 22, 2024

  • CVE-2024-11393
    36Monitor

    Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 3%

    huggingface · transformersNov 22, 2024

  • CVE-2024-11394
    36Monitor

    Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 2%

    huggingface · transformersNov 22, 2024

  • CVE-2024-47407
    60This week

    mySCADA myPRO OS Command Injection

    CriticalCVSS 10.0WeaponizedEPSS 63%

    myscada · mypro managerNov 22, 2024

  • CVE-2024-11651
    28Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT wifi_schedule command injection

    MediumCVSS 5.1No exploitEPSS 27%

    engeniustech · enh1350ext firmwareNov 24, 2024

  • CVE-2024-11652
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injection

    MediumCVSS 5.1No exploitEPSS 30%

    engeniustech · enh1350ext firmwareNov 24, 2024

  • CVE-2024-11653
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute command injection

    MediumCVSS 5.1No exploitEPSS 29%

    engeniustech · enh1350ext firmwareNov 25, 2024

  • CVE-2024-11654
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injection

    MediumCVSS 5.1No exploitEPSS 29%

    engeniustech · enh1350ext firmwareNov 25, 2024

  • CVE-2024-11655
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injection

    MediumCVSS 5.1No exploitEPSS 28%

    engeniustech · enh1350ext firmwareNov 25, 2024

  • CVE-2024-11656
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_ping6 command injection

    MediumCVSS 5.1No exploitEPSS 28%

    engeniustech · enh1350ext firmwareNov 25, 2024

  • CVE-2024-11657
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injection

    MediumCVSS 5.1No exploitEPSS 29%

    engeniustech · enh1350ext firmwareNov 25, 2024

  • CVE-2024-11658
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injection

    MediumCVSS 5.1No exploitEPSS 29%

    engeniustech · enh1350ext firmwareNov 25, 2024

  • CVE-2024-11659
    29Monitor

    EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injection

    MediumCVSS 5.1No exploitEPSS 29%

    engeniustech · enh1350ext firmwareNov 25, 2024

  • CVE-2024-53255
    21Monitor

    Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS

    MediumCVSS 5.3Proof of conceptEPSS 0%

    boidcms · boidcmsNov 25, 2024

  • CVE-2024-50672
    39Monitor

    A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administ

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Nov 25, 2024

  • CVE-2024-10542
    35Monitor

    Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation

    HighCVSS 7.5Proof of conceptEPSS 15%

    cleantalk · anti-spamNov 26, 2024

  • CVE-2024-33605
    32Monitor

    Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 6%

    sharp corporation · multiple mfps (multifunction printers)Nov 26, 2024

  • CVE-2024-33610
    51Plan

    "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.

    CriticalCVSS 9.1Proof of conceptEPSS 50%

    sharp corporation · multiple mfps (multifunction printers)Nov 26, 2024

  • CVE-2024-11680
    97Now

    ProjectSend Unauthenticated Configuration Modification

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    projectsend · projectsendNov 26, 2024

  • CVE-2023-1521
    31Monitor

    Local Privilege Escalation in sccache

    HighCVSS 7.8Proof of conceptEPSS 0%

    mozilla · sccacheNov 26, 2024

  • CVE-2024-32965
    42Plan

    ssrf vulnerability in lobe-chat

    HighCVSS 8.6No exploitEPSS 26%

    lobehub · lobe chatNov 26, 2024

  • CVE-2024-49035
    69This week

    Partner.Microsoft.Com Elevation of Privilege Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 1%

    microsoft · partner centerNov 26, 2024

  • CVE-2024-53674
    44Plan

    An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain

    HighCVSS 7.5No exploitEPSS 46%

    hpe · insight remote supportNov 26, 2024

  • CVE-2024-53675
    54Plan

    An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain

    HighCVSS 7.5No exploitEPSS 81%

    hpe · insight remote supportNov 26, 2024

  • CVE-2024-53676
    56Plan

    A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.

    CriticalCVSS 9.8No exploitEPSS 56%

    hpe · insight remote supportNov 26, 2024

  • CVE-2024-11667
    70This week

    A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX seri

    CriticalCVSS 9.8KEVWeaponizedEPSS 2%

    zyxel · zldNov 27, 2024

  • CVE-2024-42327
    63This week

    SQL injection in user.get API

    CriticalCVSS 9.9Proof of conceptEPSS 79%

    zabbix · zabbixNov 27, 2024

  • CVE-2024-51228
    28Monitor

    An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1

    MediumCVSS 6.8Proof of conceptEPSS 3%

    Nov 27, 2024

  • CVE-2024-54003
    56Plan

    Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability

    HighCVSS 8.0No exploitEPSS 80%

    jenkins · simple queueNov 27, 2024

  • CVE-2024-8672
    53Plan

    Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

    CriticalCVSS 9.9Proof of conceptEPSS 45%

    marketingfire · widget options – advanced conditional visibility for gutenberg blocks & classic widgetsNov 28, 2024

  • CVE-2024-52475
    40Plan

    WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    information technology · wawpNov 28, 2024