Week 45, 2024
4 November to 10 November 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 917CVEs publishedin the whole week
- 74CriticalCVSS 9.0 and above
- 329HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-51567
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary…
Product not named
ExploitedCritical10.0 - CVE-2019-16278
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
Product not named
ExploitedCritical9.8 - CVE-2024-5910
Expedition: Missing Authentication Leads to Admin Account Takeover
Palo Alto Networks · Expedition
ExploitedCritical9.3 - CVE-2024-43093
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due…
Google · Android
ExploitedHigh7.3 - CVE-2024-8956
PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
PTZOptics · PT30X-SDI
ExploitedCritical9.1 - CVE-2024-8957
PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
PTZOptics · PT30X-SDI
ExploitedHigh7.2
Most severe new CVEsBy CVSS score
- CVE-2024-10081
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the…
Ericsson · CodeChecker
Critical10.0 - CVE-2024-20418
Cisco Ultra-Reliable Wireless Backhaul Software Command Injection Vulnerability
Cisco · Cisco Aironet Access Point Software (IOS XE Controller)
Critical10.0 - CVE-2024-8615
WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload
eyecix · JobSearch WP Job Board
Critical10.0 - CVE-2024-50526
WordPress Multi Purpose Mail Form plugin <= 1.0.2 - Arbitrary File Upload vulnerability
Lindeni Mahlalela · Multi Purpose Mail Form
Critical10.0 - CVE-2024-51501
CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
reactiveui · refit
Critical10.0 - CVE-2024-50523
WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability
RainbowLink Inc. · All Post Contact Form
Critical10.0 - CVE-2024-50525
WordPress Helloprint plugin <= 2.0.4 - Arbitrary File Upload vulnerability
helloprint · Helloprint
Critical10.0 - CVE-2024-50527
WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Arbitrary File Upload vulnerability
Stacks · Stacks Mobile App Builder
Critical10.0 - CVE-2024-50531
WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerability
davidfcarr · RSVPMaker for Toastmasters
Critical10.0 - CVE-2024-9307
mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files
themelooks · mFolio Lite
Critical9.9