Explore CVE records

HighPublished 01 Dec 2024, 04:15 WIB

CVE-2024-53778

WordPress Essential Breadcrumbs plugin <= 1.1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Stored XSS.This issue affects Essential Breadcrumbs: from n/a through <= 1.1.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 01 Dec 2024, 04:03 WIB

CVE-2024-53783

WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.

Excerpt language: en.

HighPublished 01 Dec 2024, 03:55 WIB

CVE-2024-53739

WordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cool Plugins Cryptocurrency Widgets For Elementor cryptocurrency-widgets-for-elementor allows PHP Local File Inclusion.This issue affects Cryptocurrency Widgets For Elementor: from n/a through <= 1.6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 30 Nov 2024, 01:50 WIB

CVE-2024-53979

Ansible collection "ibm.ibm_zhmc" has passwords in clear text in log file and in output of some modules when specified as input

ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file and into the output returned by some of its Ansible module in the following cases: 1. The 'boot_ftp_password' and 'ssc_master_pw' properties are passed as input …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated05 Dec 2024, 00:19 WIB

Official record

HighPublished 30 Nov 2024, 01:48 WIB

CVE-2024-53865

Python package "zhmcclient" has passwords in clear text in its HMC and API logs

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated03 Dec 2024, 03:54 WIB

Official record

HighPublished 30 Nov 2024, 01:39 WIB

CVE-2024-53848

check-jsonschema default caching for remote schemas allows for cache confusion

check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This naming allows for conflicts. If an attacker can get a user t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated03 Dec 2024, 05:20 WIB

Official record

HighPublished 29 Nov 2024, 23:55 WIB

CVE-2024-49804

IBM Security Verify Access Appliance privilege escalation

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to unnecessary permissions used to perform certain tasks.

Excerpt language: en.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

HighPublished 29 Nov 2024, 15:03 WIB

CVE-2024-11013

Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.

Excerpt language: en.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated24 Jul 2025, 21:40 WIB

Official record

HighPublished 29 Nov 2024, 14:01 WIB

CVE-2024-11481

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.

Excerpt language: en.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 20:55 WIB

Official record

HighPublished 29 Nov 2024, 13:57 WIB

CVE-2024-11983

Billion Electric router - OS Command Injection

Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.

Excerpt language: en.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:10 WIB

Official record

HighPublished 29 Nov 2024, 13:45 WIB

CVE-2024-11982

Billion Electric router - Plaintext Storage of a Password

Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.

Excerpt language: en.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:22 WIB

Official record

HighPublished 29 Nov 2024, 13:21 WIB

CVE-2024-11981

Billion Electric router - Authentication Bypass

Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:31 WIB

Official record

HighPublished 29 Nov 2024, 13:03 WIB

CVE-2024-11980

Billion Electric router - Missing Authentication

Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.

Excerpt language: en.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:40 WIB

Official record

HighPublished 29 Nov 2024, 09:03 WIB

CVE-2024-11978

Interinfo DreamMaker - Arbitrary File Reading through Path Traversal

DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated03 Dec 2024, 13:06 WIB

Official record

HighPublished 29 Nov 2024, 05:20 WIB

CVE-2024-9852

Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32

Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric GENESIS32 all versions, Mitsubishi Electric MC Works64 all version…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 20:38 WIB

Official record

HighPublished 29 Nov 2024, 05:18 WIB

CVE-2024-8300

Malicious Code Execution Vulnerability in GENESIS64 and ICONICS Suite

Dead Code vulnerability in Mitsubishi Electric GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric Iconics Digital Solutions GENESIS64 Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, Mitsubishi Electric ICONICS Suite Version 10.97.2, 10.97.2 CFR1, 10.97.2 CRF2 and 10.97.3, an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7v3.1KEVNot listedEPSSPresentUpdated09 Jan 2026, 14:52 WIB

Official record

HighPublished 29 Nov 2024, 05:16 WIB

CVE-2024-8299

Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 20:35 WIB

Official record

HighPublished 28 Nov 2024, 22:41 WIB

CVE-2024-11969

Incorrect default permissions in Cradlepoint NetCloud Exchange

The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal (non-admin) user could exploit the weakness in file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:12 WIB

Official record

HighPublished 28 Nov 2024, 22:09 WIB

CVE-2023-52922

can: bcm: Fix UAF in bcm_proc_show()

In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 16:12 WIB

Official record

HighPublished 28 Nov 2024, 21:31 WIB

CVE-2024-11960

D-Link DIR-605L formSetPortTr buffer overflow

A vulnerability was found in D-Link DIR-605L 2.13B01. It has been declared as critical. This vulnerability affects the function formSetPortTr of the file /goform/formSetPortTr. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Nov 2024, 22:22 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage