Security Vulnerabilities - CVEs Published In November 2024
A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the file plugins/restful/plugin_handle.c. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue.
CVSS Score
5.3
EPSS Score
0.007
Published
2024-11-07
A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The patch is named c9ce39747e0372aaa2157b2b56174914a12c06d8. It is recommended to apply a patch to fix this issue.
CVSS Score
5.3
EPSS Score
0.005
Published
2024-11-07
The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.
CVSS Score
4.8
EPSS Score
0.003
Published
2024-11-07
There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk in the Downloads folder. Quickshare normally deletes unkown files, however an attacker can send two Payload transfer frames of type FILE and the same payload ID. The deletion logic will only delete the first file and not the second. We recommend upgrading past commit 5d8b9156e0c339d82d3dab0849187e8819ad92c0 or Quick Share Windows v1.0.2002.2
CVSS Score
5.9
EPSS Score
0.004
Published
2024-11-07
The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form
CVSS Score
4.3
EPSS Score
0.013
Published
2024-11-07
The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.
CVSS Score
8.1
EPSS Score
0.006
Published
2024-11-07
A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.
CVSS Score
7.2
EPSS Score
0.007
Published
2024-11-07
A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.
CVSS Score
7.5
EPSS Score
0.005
Published
2024-11-07
A flaw was found in moodle. A local file may include risks when restoring block backups.
CVSS Score
7.5
EPSS Score
0.006
Published
2024-11-07
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
CVSS Score
8.1
EPSS Score
0.831
Published
2024-11-07