# CVEs published 2024-11-01

235 CVEs were published on November 1, 2024: 2 critical, 39 high. Days are UTC.

- [CVE-2024-9191](https://cve.now/CVE-2024-9191.md): The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables a (CVSS 7.1, Okta Verify for Windows)
- [CVE-2024-44233](https://cve.now/CVE-2024-44233.md): The issue was addressed with improved bounds checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44232](https://cve.now/CVE-2024-44232.md): The issue was addressed with improved bounds checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44234](https://cve.now/CVE-2024-44234.md): The issue was addressed with improved bounds checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-41744](https://cve.now/CVE-2024-41744.md): IBM CICS TX Standard cross-site request forgery (CVSS 6.5, IBM CICS TX Standard)
- [CVE-2024-41745](https://cve.now/CVE-2024-41745.md): IBM CICS TX Standard cross-site scripting (CVSS 6.1, IBM CICS TX Standard)
- [CVE-2024-41741](https://cve.now/CVE-2024-41741.md): IBM TXSeries for Multiplatforms information disclosure (CVSS 5.3, IBM TXSeries for Multiplatforms)
- [CVE-2024-41738](https://cve.now/CVE-2024-41738.md): IBM TXSeries for Multiplatforms information disclosure (CVSS 5.9, IBM TXSeries for Multiplatforms)
- [CVE-2024-51492](https://cve.now/CVE-2024-51492.md): Zusam vulnerable to stored XSS, allowing token theft via crafted SVG (CVSS 8.8, zusam)
- [CVE-2024-51483](https://cve.now/CVE-2024-51483.md): changedetection.io Path Traversal vulnerability (CVSS 6.9, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2024-49770](https://cve.now/CVE-2024-49770.md): oak's path traversal allows transfer of hidden files within the served root directory (CVSS 7.7, oakserver oak · @oakserver/oak)
- [CVE-2024-10662](https://cve.now/CVE-2024-10662.md): Tenda AC15 SetOnlineDevName formSetDeviceName stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2024-10661](https://cve.now/CVE-2024-10661.md): Tenda AC15 SetDlnaCfg stack-based overflow (CVSS 8.7, Tenda AC15)
- [CVE-2024-10660](https://cve.now/CVE-2024-10660.md): ESAFENET CDG HookService.java deleteHook sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10659](https://cve.now/CVE-2024-10659.md): ESAFENET CDG CDGAuthoriseTempletService.java delSystemEncryptPolicy sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10658](https://cve.now/CVE-2024-10658.md): Tongda OA check\_seal.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10657](https://cve.now/CVE-2024-10657.md): Tongda OA prcs\_info.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10656](https://cve.now/CVE-2024-10656.md): Tongda OA 2017 apply.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-37209](https://cve.now/CVE-2024-37209.md): WordPress User Rights Access Manager plugin \<= 1.1.2 - Broken Access Control vulnerability (CVSS 6.5, Prism IT Systems User Rights Access Manager)
- [CVE-2024-49256](https://cve.now/CVE-2024-49256.md): WordPress Htaccess File Editor plugin \<= 1.0.18 - Broken Access Control vulnerability (CVSS 6.5, WP Chill Htaccess File Editor)
- [CVE-2024-48045](https://cve.now/CVE-2024-48045.md): WordPress Happy Elementor Addons plugin \<= 3.12.3 - Broken Access Control vulnerability (CVSS 4.3, HappyMonster Happy Addons for Elementor)
- [CVE-2024-48044](https://cve.now/CVE-2024-48044.md): WordPress ShortPixel Image Optimizer plugin \<= 5.6.3 - Broken Access Control vulnerability (CVSS 5.4, ShortPixel Image Optimizer)
- [CVE-2024-48039](https://cve.now/CVE-2024-48039.md): WordPress CubeWP Framework plugin \<= 1.1.15 - Broken Access Control vulnerability (CVSS 4.3, Imran Tauqeer CubeWP)
- [CVE-2024-47314](https://cve.now/CVE-2024-47314.md): WordPress Sunshine Photo Cart plugin \<= 3.2.8 - Broken Access Control vulnerability (CVSS 7.1, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-47311](https://cve.now/CVE-2024-47311.md): WordPress Wheel of Life plugin \<= 1.1.8 - Broken Access Control vulnerability (CVSS 5.3, Kraft Plugins Wheel of Life)
- [CVE-2024-47302](https://cve.now/CVE-2024-47302.md): WordPress Fluent Support plugin \<= 1.8.0 - Broken Access Control on Email Verification vulnerability (CVSS 5.3, Shahjahan Jewel Fluent Support)
- [CVE-2024-44038](https://cve.now/CVE-2024-44038.md): WordPress Sunshine Photo Cart plugin \<= 3.2.9 - Broken Access Control vulnerability (CVSS 5.3, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-37250](https://cve.now/CVE-2024-37250.md): WordPress Advanced Custom Fields Pro plugin \< 6.3.2 - Subscriber+ Broken Access Control vulnerability (CVSS 5.4, WPEngine Advanced Custom Fields PRO)
- [CVE-2024-37249](https://cve.now/CVE-2024-37249.md): WordPress Advanced Custom Fields Pro plugin \< 6.3.2 - Contributor+ Broken Access Control vulnerability (CVSS 4.3, WPEngine Advanced Custom Fields PRO)
- [CVE-2024-37095](https://cve.now/CVE-2024-37095.md): WordPress Envira Photo Gallery plugin \<= 1.8.7.3 - CSRF leading to notice dismissal vulnerability (CVSS 4.3, Envira Gallery Team Envira Photo Gallery)
- [CVE-2024-37096](https://cve.now/CVE-2024-37096.md): WordPress Popup box plugin \<= 4.5.1 - Broken Access Control vulnerability (CVSS 4.3, Popup Box Team Popup box)
- [CVE-2024-37106](https://cve.now/CVE-2024-37106.md): WordPress WishList Member X plugin \< 3.26.7 - Unautenticated Plugin Settings Change Leading to Stored XSS vulnerability (CVSS 8.2, WishList Products WishList Member X)
- [CVE-2024-37108](https://cve.now/CVE-2024-37108.md): WordPress WishList Member X plugin \< 3.26.7 - Authenticated Arbitrary File Deletion vulnerability (CVSS 7.7, WishList Products WishList Member X)
- [CVE-2024-37119](https://cve.now/CVE-2024-37119.md): WordPress Uncanny Automator Pro plugin \< 5.3.0.1 - Unauthenticated License Settings Reset vulnerability (CVSS 5.3, Uncanny Owl Uncanny Automator Pro)
- [CVE-2024-37123](https://cve.now/CVE-2024-37123.md): WordPress Ibtana – WordPress Website Builder plugin \<= 1.2.3.3 - Broken Access Control vulnerability (CVSS 5.3, VowelWeb Ibtana)
- [CVE-2024-37201](https://cve.now/CVE-2024-37201.md): WordPress Woocommerce Customers Order History plugin \<= 5.2.2 - Broken Access Control vulnerability (CVSS 4.3, javmah Woocommerce Customers Order History)
- [CVE-2024-37203](https://cve.now/CVE-2024-37203.md): WordPress Laybuy Payment Extension for WooCommerce plugin \<= 5.3.9 - Broken Access Control vulnerability (CVSS 4.3, Laybuy Payment Extension for WooCommerce)
- [CVE-2024-37204](https://cve.now/CVE-2024-37204.md): WordPress PropertyHive plugin \<= 2.0.9 - Broken Access Control vulnerability (CVSS 4.3, PropertyHive)
- [CVE-2024-37207](https://cve.now/CVE-2024-37207.md): WordPress Demo Awesome plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 5.4, Theme4Press Demo Awesome)
- [CVE-2024-37214](https://cve.now/CVE-2024-37214.md): WordPress AliExpress Dropshipping with AliNext Lite plugin \<= 3.3.5 - Broken Access Control to XSS vulnerability (CVSS 6.5, Dropshipping Guru Ali2Woo Lite)
- [CVE-2024-37218](https://cve.now/CVE-2024-37218.md): WordPress Page Builder Sandwich \<= 5.1.0 - Broken Access Control vulnerability (CVSS 4.3, WordPress Page Builder Sandwich Team Page Builder Sandwich…)
- [CVE-2024-37220](https://cve.now/CVE-2024-37220.md): WordPress Optinly plugin \<= 1.0.18 - Broken Access Control vulnerability (CVSS 5.3, OptinlyHQ Optinly)
- [CVE-2024-37226](https://cve.now/CVE-2024-37226.md): WordPress Kanban Boards for WordPress plugin \<= 2.5.21 - Broken Access Control vulnerability (CVSS 5.3, Kanban for WordPress Kanban Boards for WordPress)
- [CVE-2024-37232](https://cve.now/CVE-2024-37232.md): WordPress Hercules Core plugin \<= 6.5 - Subscriber+ Arbitrary Settings Change/Access vulnerability (CVSS 8.8, Hercules Design Hercules Core)
- [CVE-2024-37254](https://cve.now/CVE-2024-37254.md): WordPress WP File Manager plugin \<= 7.2.7 - Broken Access Control vulnerability (CVSS 4.3, mndpsingh287 File Manager)
- [CVE-2024-37255](https://cve.now/CVE-2024-37255.md): WordPress ElementsKit Lite plugin \<= 3.1.4 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3, Roxnor ElementsKit Elementor addons Lite)
- [CVE-2024-37269](https://cve.now/CVE-2024-37269.md): WordPress Masterstudy Elementor Widgets plugin \<= 1.2.2 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3, StylemixThemes Masterstudy Elementor Widgets)
- [CVE-2024-37276](https://cve.now/CVE-2024-37276.md): WordPress Featured Image from URL (FIFU) plugin \<= 4.8.1 - Broken Access Control vulnerability (CVSS 5.3, fifu.app Featured Image from URL)
- [CVE-2024-37277](https://cve.now/CVE-2024-37277.md): WordPress Paid Memberships Pro plugin \<= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5, Paid Memberships Pro)
- [CVE-2024-37411](https://cve.now/CVE-2024-37411.md): WordPress Progress Planner plugin \<= 0.9.1 - Broken Access Control vulnerability (CVSS 5.3, Progress Planner)
- [CVE-2024-37415](https://cve.now/CVE-2024-37415.md): WordPress E2Pdf plugin \<= 1.20.27 - Broken Access Control vulnerability (CVSS 5.4, e2pdf)
- [CVE-2024-37423](https://cve.now/CVE-2024-37423.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability (CVSS 8.5, Automattic Newspack Blocks)
- [CVE-2024-37425](https://cve.now/CVE-2024-37425.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Broken Access Control vulnerability (CVSS 5.4, Automattic Newspack Blocks)
- [CVE-2024-37427](https://cve.now/CVE-2024-37427.md): WordPress Timetics plugin \<= 1.0.21 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Timetics)
- [CVE-2024-37439](https://cve.now/CVE-2024-37439.md): WordPress Uncanny Toolkit Pro for LearnDash plugin \< 4.1.4.1 - Subscriber+ Arbitrary Post/Page Duplication vulnerability (CVSS 5.4, Uncanny Owl Uncanny Toolkit Pro for LearnDash)
- [CVE-2024-37440](https://cve.now/CVE-2024-37440.md): WordPress Church Admin plugin \<= 4.4.4 - Broken Access Control vulnerability (CVSS 4.3, andy\_moyle Church Admin)
- [CVE-2024-37443](https://cve.now/CVE-2024-37443.md): WordPress WP Job Manager plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 4.3, Automattic WP Job Manager - Resume Manager)
- [CVE-2024-37444](https://cve.now/CVE-2024-37444.md): WordPress Defender plugin \<= 4.7.1 - Broken Access Control vulnerability (CVSS 5.3, WPMU DEV - Your All-in-One WordPress Platform Defender Secu…)
- [CVE-2024-37453](https://cve.now/CVE-2024-37453.md): WordPress ProfileGrid – User Profiles, Groups and Communities plugin \<= 5.8.7 - Broken Access Control vulnerability (CVSS 4.3, ProfileGrid User Profiles ProfileGrid)
- [CVE-2024-37456](https://cve.now/CVE-2024-37456.md): WordPress Simple Newsletter Plugin – Noptin plugin \<= 3.4.2 - Broken Access Control vulnerability (CVSS 5.3, Noptin Newsletter Noptin)
- [CVE-2024-37463](https://cve.now/CVE-2024-37463.md): WordPress CRM Perks Forms plugin \<= 1.1.5 - Broken Access Control vulnerability (CVSS 5.3, CRM Perks Forms)
- [CVE-2024-37468](https://cve.now/CVE-2024-37468.md): WordPress Newsmatic theme \<= 1.3.1 - Broken Access Control vulnerability (CVSS 5.3, blazethemes Newsmatic)
- [CVE-2024-37470](https://cve.now/CVE-2024-37470.md): WordPress Woffice Core plugin \<= 5.4.8 - Unauthenticated Broken Access Control vulnerability (CVSS 8.2, WofficeIO Woffice Core)
- [CVE-2024-37475](https://cve.now/CVE-2024-37475.md): WordPress Newspack Newsletters plugin \<= 2.13.2 - Broken Access Control vulnerability (CVSS 5.3, Automattic Newspack Newsletters)
- [CVE-2024-37477](https://cve.now/CVE-2024-37477.md): WordPress Newspack Content Converter plugin \<= 0.1.5 - Broken Access Control vulnerability (CVSS 6.5, Automattic Newspack Content Converter)
- [CVE-2024-37481](https://cve.now/CVE-2024-37481.md): WordPress The Post Grid plugin \<= 7.7.4 - Broken Access Control vulnerability (CVSS 6.5, RadiusTheme The Post Grid)
- [CVE-2024-37482](https://cve.now/CVE-2024-37482.md): WordPress The Post Grid plugin \<= 7.7.4 - Broken Access Control vulnerability (CVSS 4.3, RadiusTheme The Post Grid)
- [CVE-2024-37483](https://cve.now/CVE-2024-37483.md): WordPress The Post Grid plugin \<= 7.7.4 - Broken Access Control vulnerability (CVSS 5.4, RadiusTheme The Post Grid)
- [CVE-2024-37505](https://cve.now/CVE-2024-37505.md): WordPress Business One Page theme \<= 1.2.9 - Broken Access Control on Notice Dismissal vulnerability (CVSS 4.3, Rara Themes Business One Page)
- [CVE-2024-37506](https://cve.now/CVE-2024-37506.md): WordPress Donation Forms by Charitable plugin \<= 1.8.1.7 - Broken Access Control vulnerability (CVSS 5.3, Charitable Donations & Fundraising Team Charitable)
- [CVE-2024-37510](https://cve.now/CVE-2024-37510.md): WordPress Donation Forms by Charitable plugin \<= 1.8.1.7 - Broken Access Control vulnerability (CVSS 6.5, Charitable Donations & Fundraising Team Charitable)
- [CVE-2024-37516](https://cve.now/CVE-2024-37516.md): WordPress Featured Image from URL (FIFU) plugin \<= 4.8.2 - Broken Access Control vulnerability (CVSS 6.3, fifu.app Featured Image from URL)
- [CVE-2024-37517](https://cve.now/CVE-2024-37517.md): WordPress Spectra plugin \<= 2.13.7 - Broken Access Control vulnerability (CVSS 4.3, Brainstorm Force Spectra)
- [CVE-2024-37921](https://cve.now/CVE-2024-37921.md): WordPress Chained Quiz plugin \<= 1.3.2.8 - Broken Access Control vulnerability (CVSS 5.3, Kiboko Labs Chained Quiz)
- [CVE-2024-37926](https://cve.now/CVE-2024-37926.md): WordPress WP Accessibility Helper (WAH) plugin \<= 0.6.2.9 - Broken Access Control vulnerability (CVSS 5.3, Alex Volkov WP Accessibility Helper)
- [CVE-2024-37929](https://cve.now/CVE-2024-37929.md): WordPress User Activity Log Pro plugin \<= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability (CVSS 6.3, solwin User Activity Log Pro)
- [CVE-2024-38690](https://cve.now/CVE-2024-38690.md): WordPress iPanorama 360 plugin \<= 1.8.3 - Broken Access Control vulnerability (CVSS 5.3, Avirtum iPanorama 360 WordPress Virtual Tour Builder)
- [CVE-2024-38695](https://cve.now/CVE-2024-38695.md): WordPress WP GoToWebinar plugin \<= 15.6 - Broken Access Control vulnerability (CVSS 4.3, Martin Gibson WP GoToWebinar)
- [CVE-2024-38702](https://cve.now/CVE-2024-38702.md): WordPress Product Delivery Date for WooCommerce – Lite plugin \<= 2.7.2 - Broken Access Control vulnerability (CVSS 5.3, Tyche Softwares Product Delivery Date for WooCommerce – Lite)
- [CVE-2024-38707](https://cve.now/CVE-2024-38707.md): WordPress EmbedPress plugin \<= 4.0.4 - Broken Access Control vulnerability (CVSS 6.3, WPDeveloper EmbedPress)
- [CVE-2024-38714](https://cve.now/CVE-2024-38714.md): WordPress WP Fast Total Search \<= 1.68.232 - Broken Access Control vulnerability (CVSS 4.3, Epsiloncool WP Fast Total Search)
- [CVE-2024-38719](https://cve.now/CVE-2024-38719.md): WordPress Auto Featured Image plugin \<= 4.1.2 - Broken Access Control vulnerability (CVSS 4.3, Creative Motion Auto Featured Image)
- [CVE-2024-38721](https://cve.now/CVE-2024-38721.md): WordPress EazyDocs plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 7.1, spider-themes EazyDocs)
- [CVE-2024-38726](https://cve.now/CVE-2024-38726.md): WordPress Product Designer plugin \<= 1.0.33 - Arbitrary Content Deletion vulnerability (CVSS 7.5, PickPlugins Product Designer)
- [CVE-2024-38727](https://cve.now/CVE-2024-38727.md): WordPress Seraphinite Post .DOCX Source plugin \<= 2.16.9 - Broken Access Control vulnerability (CVSS 4.3, Seraphinite Solutions Seraphinite Post .DOCX Source)
- [CVE-2024-38733](https://cve.now/CVE-2024-38733.md): WordPress Meks Video Importer plugin \<= 1.0.12 - Broken Access Control vulnerability (CVSS 5.4, Meks Video Importer)
- [CVE-2024-38737](https://cve.now/CVE-2024-38737.md): WordPress ReDi Restaurant Reservation plugin \<= 24.0422 - Broken Access Control vulnerability (CVSS 5.4, Reservation Diary ReDi Restaurant Reservation)
- [CVE-2024-38740](https://cve.now/CVE-2024-38740.md): WordPress Packlink PRO shipping module plugin \<= 3.4.6 - Broken Access Control vulnerability (CVSS 5.4, Packlink Shipping S.L. Packlink PRO shipping module)
- [CVE-2024-38743](https://cve.now/CVE-2024-38743.md): WordPress Plum: Spin Wheel & Email Pop-up plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 5.3, Upqode Plum: Spin Wheel & Email Pop-up)
- [CVE-2024-38744](https://cve.now/CVE-2024-38744.md): WordPress Plum: Spin Wheel & Email Pop-up plugin \<= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability (CVSS 8.3, Upqode Plum: Spin Wheel & Email Pop-up)
- [CVE-2024-38745](https://cve.now/CVE-2024-38745.md): WordPress Wholesale Suite plugin \<= 2.1.12 - Broken Access Control vulnerability (CVSS 5.3, Rymera Web Wholesale Suite)
- [CVE-2024-38748](https://cve.now/CVE-2024-38748.md): WordPress EleForms plugin \<= 2.9.9.9 - Broken Access Control vulnerability (CVSS 5.3, TheInnovs EleForms)
- [CVE-2024-38769](https://cve.now/CVE-2024-38769.md): WordPress Arconix Shortcodes plugin \<= 2.1.11 - Broken Access Control vulnerability (CVSS 5.3, Tyche Softwares Arconix Shortcodes)
- [CVE-2024-38771](https://cve.now/CVE-2024-38771.md): WordPress Atarim plugin \<= 4.0 - Broken Access Control vulnerability (CVSS 6.5, Vito Peleg Atarim)
- [CVE-2024-38774](https://cve.now/CVE-2024-38774.md): WordPress Security Optimizer plugin \<= 1.5.0 - Broken Access Control vulnerability (CVSS 5.4, SiteGround Security)
- [CVE-2024-38777](https://cve.now/CVE-2024-38777.md): WordPress Titan Anti-spam & Security plugin \<= 7.3.6 - Broken Access Control vulnerability (CVSS 6.5, CreativeMotion Titan Anti-spam & Security)
- [CVE-2024-38783](https://cve.now/CVE-2024-38783.md): WordPress Arconix FAQ plugin \<= 1.9.4 - Broken Access Control vulnerability (CVSS 5.3, Tyche Softwares Arconix FAQ)
- [CVE-2024-38792](https://cve.now/CVE-2024-38792.md): WordPress ConveyThis Translate plugin \<= 234 - Non-arbitrary Options Update vulnerability (CVSS 5.3, ConveyThis Translate Team Language Translate Widget for Wor…)
- [CVE-2024-38794](https://cve.now/CVE-2024-38794.md): WordPress Custom Query Blocks plugin \<= 5.2.0 - Broken Access Control vulnerability (CVSS 5.3, MediaRon Custom Query Blocks)
- [CVE-2024-39625](https://cve.now/CVE-2024-39625.md): WordPress Icegram Engage plugin \<= 3.1.24 - Unauthenticated Message Duplication Vulnerability (CVSS 5.3, Icegram)
- [CVE-2024-39635](https://cve.now/CVE-2024-39635.md): WordPress Youzify plugin \<= 1.2.6 - Broken Access Control vulnerability (CVSS 5.4, KaineLabs Youzify)
- [CVE-2024-39639](https://cve.now/CVE-2024-39639.md): WordPress File Upload plugin \<= 4.24.7 - Broken Access Control + CSRF vulnerability (CVSS 4.3, Nickolas Bossinas WordPress File Upload)
- [CVE-2024-39640](https://cve.now/CVE-2024-39640.md): WordPress Social Feed Gallery plugin \<= 4.3.9 - Broken Access Control vulnerability (CVSS 6.5, QuadLayers WP Social Feed Gallery)
- [CVE-2024-39650](https://cve.now/CVE-2024-39650.md): WordPress WooCommerce PDF Vouchers plugin \< 4.9.5 - Unauthenticated Multiple Vulnerabilities (CVSS 7.3, WPWeb Elite WooCommerce PDF Vouchers)
- [CVE-2024-39654](https://cve.now/CVE-2024-39654.md): WordPress Sign-up Sheets plugin \<= 2.2.12 - Broken Access Control vulnerability (CVSS 5.3, Fetch Designs Sign-up Sheets)
- [CVE-2024-39664](https://cve.now/CVE-2024-39664.md): WordPress Filter & Grids plugin \<= 2.8.32 - Broken Authentication vulnerability (CVSS 7.3, YMC Filter & Grids)
- [CVE-2024-43118](https://cve.now/CVE-2024-43118.md): WordPress Hummingbird plugin \<= 3.9.1 - Broken Access Control vulnerability (CVSS 4.3, WPMU DEV - Your All-in-One WordPress Platform Hummingbird)
- [CVE-2024-43119](https://cve.now/CVE-2024-43119.md): WordPress Aruba HiSpeed Cache plugin \<= 2.0.12 - Broken Access Control vulnerability (CVSS 4.3, Aruba.it Aruba HiSpeed Cache)
- [CVE-2024-43120](https://cve.now/CVE-2024-43120.md): WordPress TypeSquare Webfonts plugin \<= 2.0.7 - Broken Access Control vulnerability (CVSS 5.3, XSERVER TypeSquare Webfonts)
- [CVE-2024-43122](https://cve.now/CVE-2024-43122.md): WordPress Robin image optimizer plugin \<= 1.6.9 - Broken Access Control vulnerability (CVSS 6.5, Creative Motion Robin image optimizer)
- [CVE-2024-43134](https://cve.now/CVE-2024-43134.md): WordPress Waitlist Woocommerce plugin \<= 2.6 - Broken Access Control vulnerability (CVSS 4.3, xootix Waitlist Woocommerce)
- [CVE-2024-43136](https://cve.now/CVE-2024-43136.md): WordPress Sunshine Photo Cart plugin \<= 3.2.1 - Broken Access Control vulnerability (CVSS 4.3, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-43142](https://cve.now/CVE-2024-43142.md): WordPress Tutor LMS plugin \<= 2.7.3 - Broken Access Control vulnerability (CVSS 4.3, Themeum Tutor LMS)
- [CVE-2024-43143](https://cve.now/CVE-2024-43143.md): WordPress Registrations for the Events Calendar plugin \<= 2.12.1 - Broken Access Control vulnerability (CVSS 6.4, Roundup WP Registrations for the Events Calendar)
- [CVE-2024-43146](https://cve.now/CVE-2024-43146.md): WordPress Accelerated Mobile Pages plugin \<= 1.0.96.1 - Broken Access Control vulnerability (CVSS 6.3, Ahmed Kaludi, Mohammed Kaludi AMP for WP)
- [CVE-2024-43154](https://cve.now/CVE-2024-43154.md): WordPress Advanced Cron Manager – debug & control plugin \<= 2.5.9 - Broken Access Control vulnerability (CVSS 4.3, BracketSpace Advanced Cron Manager – debug & control)
- [CVE-2024-43157](https://cve.now/CVE-2024-43157.md): WordPress FormCraft plugin \<= 1.2.10 - Broken Access Control vulnerability (CVSS 4.3, nCrafts FormCraft)
- [CVE-2024-43158](https://cve.now/CVE-2024-43158.md): WordPress Masteriyo LMS plugin \<= 1.11.4 - Broken Access Control vulnerability (CVSS 7.5, Masteriyo - LMS)
- [CVE-2024-43159](https://cve.now/CVE-2024-43159.md): WordPress Masteriyo LMS plugin \<= 1.11.6 - Broken Access Control vulnerability (CVSS 5.3, Masteriyo - LMS)
- [CVE-2024-43162](https://cve.now/CVE-2024-43162.md): WordPress Easy Digital Downloads plugin \<= 3.2.12 - Broken Access Control vulnerability (CVSS 4.3, Easy Digital Downloads)
- [CVE-2024-43208](https://cve.now/CVE-2024-43208.md): WordPress Send Emails with Mandrill plugin \<= 1.4.1 - Broken Access Control vulnerability (CVSS 4.3, Matt Miller Send Emails with Mandrill)
- [CVE-2024-43209](https://cve.now/CVE-2024-43209.md): WordPress Bitly's WordPress Plugin plugin \<= 2.7.2 - Broken Access Control vulnerability (CVSS 6.5, Bitly)
- [CVE-2024-43211](https://cve.now/CVE-2024-43211.md): WordPress MailChimp Subscribe Form plugin \<=4.0.9.9 - Stored Cross-Site Scripting vulnerability (CVSS 5.9, PluginOps MailChimp Subscribe Forms)
- [CVE-2024-43212](https://cve.now/CVE-2024-43212.md): WordPress WpTravelly plugin \<= 1.7.7 - Broken Access Control vulnerability (CVSS 7.5, MagePeople Team WpTravelly)
- [CVE-2024-43215](https://cve.now/CVE-2024-43215.md): WordPress Social Slider Feed plugin \<= 2.2.2 - Broken Access Control vulnerability (CVSS 4.3, creativemotion Social Slider Feed)
- [CVE-2024-43219](https://cve.now/CVE-2024-43219.md): WordPress Persian WooCommerce plugin \<= 7.1.6 - Broken Access Control vulnerability (CVSS 5.3, ووکامرس فارسی Persian WooCommerce)
- [CVE-2024-43223](https://cve.now/CVE-2024-43223.md): WordPress EventPrime plugin \<= 4.0.3.2 - Broken Access Control vulnerability (CVSS 4.3, EventPrime Events EventPrime)
- [CVE-2024-43229](https://cve.now/CVE-2024-43229.md): WordPress WP Search Analytics plugin \<= 1.4.9 - Broken Access Control vulnerability (CVSS 4.3, Cornel Raiu WP Search Analytics)
- [CVE-2024-43235](https://cve.now/CVE-2024-43235.md): WordPress Meta Box plugin \<= 5.9.10 - Broken Access Control vulnerability (CVSS 7.1, MetaBox.io Meta Box – WordPress Custom Fields Framework)
- [CVE-2024-43253](https://cve.now/CVE-2024-43253.md): WordPress Smart Online Order for Clover plugin \<= 1.5.6 - Broken Access Control vulnerability (CVSS 5.3, ZAYTECH Smart Online Order for Clover)
- [CVE-2024-43254](https://cve.now/CVE-2024-43254.md): WordPress Smart Online Order for Clover plugin \<= 1.5.6 - Broken Access Control vulnerability (CVSS 4.3, ZAYTECH Smart Online Order for Clover)
- [CVE-2024-43260](https://cve.now/CVE-2024-43260.md): WordPress Clearfy Cache plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 5.4, Creative Motion Clearfy Cache)
- [CVE-2024-43268](https://cve.now/CVE-2024-43268.md): WordPress Backup and Restore WordPress plugin \<= 1.50 - Broken Access Control vulnerability (CVSS 5.4, WPBackItUp Backup and Restore WordPress)
- [CVE-2024-43270](https://cve.now/CVE-2024-43270.md): WordPress Backup and Restore WordPress plugin \<= 1.50 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3, WPBackItUp Backup and Restore WordPress)
- [CVE-2024-43273](https://cve.now/CVE-2024-43273.md): WordPress Icegram Collect plugin \<= 1.3.14 - Broken Access Control vulnerability (CVSS 5.4, Icegram Collect)
- [CVE-2024-43274](https://cve.now/CVE-2024-43274.md): WordPress JS Help Desk – The Ultimate Help Desk plugin \<= 2.8.6 - Broken Access Control vulnerability (CVSS 5.8, JS Help Desk – Best Help Desk & Support Plugin)
- [CVE-2024-43277](https://cve.now/CVE-2024-43277.md): WordPress UsersWP plugin \<= 1.2.15 - Broken Access Control vulnerability (CVSS 5.3, AyeCode UsersWP)
- [CVE-2024-43285](https://cve.now/CVE-2024-43285.md): WordPress Presto Player plugin \<= 3.0.2 - Broken Access Control vulnerability (CVSS 6.3, Presto Made Presto Player)
- [CVE-2024-43290](https://cve.now/CVE-2024-43290.md): WordPress Atarim plugin \<= 4.0.1 - Broken Access Control vulnerability (CVSS 5.3, Vito Peleg Atarim)
- [CVE-2024-43293](https://cve.now/CVE-2024-43293.md): WordPress Recipe Card Blocks for Gutenberg & Elementor plugin \<= 3.3.1 - Broken Access Control vulnerability (CVSS 4.3, WPZOOM Recipe Card Blocks for Gutenberg & Elementor)
- [CVE-2024-43296](https://cve.now/CVE-2024-43296.md): WordPress HTML5 Video Player plugin \<= 2.5.30 - Broken Access Control vulnerability (CVSS 4.3, bPlugins Flash & HTML5 Video)
- [CVE-2024-43297](https://cve.now/CVE-2024-43297.md): WordPress Clone plugin \<= 2.4.5 - Broken Access Control vulnerability (CVSS 4.3, Migrate Clone)
- [CVE-2024-43298](https://cve.now/CVE-2024-43298.md): WordPress Clone plugin \<= 2.4.5 - Broken Access Control vulnerability (CVSS 4.3, Migrate Clone)
- [CVE-2024-43302](https://cve.now/CVE-2024-43302.md): WordPress Fonts plugin \<= 3.7.7 - Broken Access Control vulnerability (CVSS 4.3, Fonts Plugin Fonts)
- [CVE-2024-43310](https://cve.now/CVE-2024-43310.md): WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin \<= 3.4.9 - Broken Access Control vulnerability (CVSS 6.5, UkrSolution Print Barcode Labels for your WooCommerce produ…)
- [CVE-2024-43312](https://cve.now/CVE-2024-43312.md): WordPress WPC Frequently Bought Together for WooCommerce plugin \<= 7.1.9 - Broken Access Control vulnerability (CVSS 5.4, WPClever WPC Frequently Bought Together for WooCommerce)
- [CVE-2024-43314](https://cve.now/CVE-2024-43314.md): WordPress Asset CleanUp: Page Speed Booster plugin \<= 1.3.9.3 - Broken Access Control vulnerability (CVSS 4.3, Gabe Livan Asset CleanUp: Page Speed Booster)
- [CVE-2024-43323](https://cve.now/CVE-2024-43323.md): WordPress ReviewX plugin \<= 1.6.28 - Broken Access Control vulnerability (CVSS 5.3, ReviewX)
- [CVE-2024-43332](https://cve.now/CVE-2024-43332.md): WordPress Photo Engine plugin \<= 6.4.0 - Broken Access Control vulnerability (CVSS 4.3, Jordy Meow Photo Engine)
- [CVE-2024-43341](https://cve.now/CVE-2024-43341.md): WordPress Hello Agency theme \<= 1.0.5 - Broken Access Control vulnerability (CVSS 6.5, CozyThemes Hello Agency)
- [CVE-2024-43343](https://cve.now/CVE-2024-43343.md): WordPress Order Tracking – WordPress Status Tracking Plugin plugin \< 3.3.13 - Broken Access Control vulnerability (CVSS 4.3, Etoile Web Design Order Tracking)
- [CVE-2024-43355](https://cve.now/CVE-2024-43355.md): WordPress JoomSport plugin \<= 5.3.0 - Broken Access Control vulnerability (CVSS 4.3, BearDev JoomSport)
- [CVE-2024-43919](https://cve.now/CVE-2024-43919.md): WordPress Yet Another Related Posts Plugin (YARPP) plugin \<= 5.30.10 - Broken Access Control vulnerability (CVSS 5.3, YARPP)
- [CVE-2024-43923](https://cve.now/CVE-2024-43923.md): WordPress Timetics plugin \<= 1.0.23 - Broken Access Control vulnerability (CVSS 5.3, Arraytics Timetics)
- [CVE-2024-43925](https://cve.now/CVE-2024-43925.md): WordPress Envira Gallery Lite plugin \<= 1.8.14 - Broken Access Control vulnerability (CVSS 4.3, Envira Gallery Team Envira Photo Gallery)
- [CVE-2024-43928](https://cve.now/CVE-2024-43928.md): WordPress JobSearch WP Job Board WordPress Plugin plugin \<= 2.5.4 - Broken Access Control vulnerability (CVSS 5.4, eyecix JobSearch)
- [CVE-2024-43929](https://cve.now/CVE-2024-43929.md): WordPress JobSearch WP Job Board WordPress Plugin plugin \<= 2.5.4 - Broken Access Control vulnerability (CVSS 6.5, eyecix JobSearch)
- [CVE-2024-43932](https://cve.now/CVE-2024-43932.md): WordPress The Plus Addons for Elementor plugin \<= 5.6.2 - Broken Access Control vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite)
- [CVE-2024-43937](https://cve.now/CVE-2024-43937.md): WordPress WP Crowdfunding plugin \<= 2.1.10 - Settings Change vulnerability (CVSS 6.4, Themeum WP Crowdfunding)
- [CVE-2024-43956](https://cve.now/CVE-2024-43956.md): WordPress MemberPress plugin \<= 1.11.34 - Broken Access Control vulnerability (CVSS 6.5, Caseproof Memberpress)
- [CVE-2024-43962](https://cve.now/CVE-2024-43962.md): WordPress LWS Affiliation plugin \<= 2.3.4 - Broken Access Control vulnerability (CVSS 5.4, LWS Affiliation)
- [CVE-2024-43968](https://cve.now/CVE-2024-43968.md): WordPress Newspack plugin \< 3.8.7 - Broken Access Control vulnerability (CVSS 4.3, Automattic Newspack)
- [CVE-2024-43973](https://cve.now/CVE-2024-43973.md): WordPress GetPaid plugin \<= 2.8.11 - Broken Access Control vulnerability (CVSS 4.3, Stiofan GetPaid)
- [CVE-2024-43974](https://cve.now/CVE-2024-43974.md): WordPress ReviveNews theme \<= 1.0.2 - Broken Access Control vulnerability (CVSS 6.5, CozyThemes ReviveNews)
- [CVE-2024-43979](https://cve.now/CVE-2024-43979.md): WordPress Blockbooster theme \<= 1.0.10 - Broken Access Control vulnerability (CVSS 6.5, CozyThemes Blockbooster)
- [CVE-2024-43980](https://cve.now/CVE-2024-43980.md): WordPress FotaWP theme \<= 1.4.1 - Broken Access Control vulnerability (CVSS 6.5, CozyThemes Fota WP)
- [CVE-2024-43981](https://cve.now/CVE-2024-43981.md): WordPress GeoDirectory plugin \<= 2.3.70 - Broken Access Control vulnerability (CVSS 4.3, AyeCode – WP Business Directory Plugins GeoDirectory)
- [CVE-2024-43982](https://cve.now/CVE-2024-43982.md): WordPress Login As Users plugin \<= 1.4.3 - Broken Access Control to Account Takeover vulnerability (CVSS 8.8, Geek Code Lab Login As Users)
- [CVE-2024-43998](https://cve.now/CVE-2024-43998.md): WordPress Blogpoet theme \<= 1.0.3 - Broken Access Control vulnerability (CVSS 6.5, WebsiteinWP Blogpoet)
- [CVE-2024-44006](https://cve.now/CVE-2024-44006.md): WordPress WooCommerce Multilingual & Multicurrency plugin \<= 5.3.7 - Broken Access Control vulnerability (CVSS 4.3, Amir Helzer WooCommerce Multilingual & Multicurrency)
- [CVE-2024-44019](https://cve.now/CVE-2024-44019.md): WordPress Contact Form 7 Campaign Monitor Extension plugin \<= 0.4.67 - Arbitrary File Deletion vulnerability (CVSS 5.3, Renzo Johnson Contact Form 7 Campaign Monitor Extension)
- [CVE-2024-44020](https://cve.now/CVE-2024-44020.md): WordPress WP Free SSL plugin \<= 1.2.6 - Broken Access Control vulnerability (CVSS 4.3, prasadkirpekar WP Free SSL – Free SSL Certificate for WordP…)
- [CVE-2024-44021](https://cve.now/CVE-2024-44021.md): WordPress Truepush plugin \<= 1.0.8 - Broken Access Control vulnerability (CVSS 5.4, truepushplugin Truepush)
- [CVE-2024-44031](https://cve.now/CVE-2024-44031.md): WordPress JoomSport plugin \<= 5.6.3 - Broken Access Control vulnerability (CVSS 4.3, beardev JoomSport)
- [CVE-2024-44052](https://cve.now/CVE-2024-44052.md): WordPress HelloAsso plugin \<= 1.1.10 - Broken Access Control vulnerability (CVSS 4.3, HelloAsso)
- [CVE-2024-47308](https://cve.now/CVE-2024-47308.md): WordPress Templately plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 6.5, WPDeveloper Templately)
- [CVE-2024-47317](https://cve.now/CVE-2024-47317.md): WordPress Ads by WPQuads plugin \<= 2.0.84 - Broken Access Control vulnerability (CVSS 4.3, Ads by WPQuads)
- [CVE-2024-47318](https://cve.now/CVE-2024-47318.md): WordPress PWA for WP & AMP plugin \<= 1.7.72 - Broken Access Control vulnerability (CVSS 4.3, Magazine3 PWA for WP & AMP)
- [CVE-2024-47321](https://cve.now/CVE-2024-47321.md): WordPress WP Datepicker plugin \<= 2.1.1 - Broken Access Control vulnerability (CVSS 6.5, Fahad Mahmood WP Datepicker)
- [CVE-2024-47358](https://cve.now/CVE-2024-47358.md): WordPress Popup Maker plugin \<= 1.19.2 - Broken Access Control vulnerability (CVSS 5.3, Daniel Iser Popup Maker)
- [CVE-2024-47359](https://cve.now/CVE-2024-47359.md): WordPress Depicter plugin \<= 3.2.2 - Broken Access Control vulnerability (CVSS 5.3, averta Depicter Slider)
- [CVE-2024-47361](https://cve.now/CVE-2024-47361.md): WordPress Elementor Addon Elements plugin \<= 1.13.6 - Broken Access Control vulnerability (CVSS 6.5, WPVibes Elementor Addon Elements)
- [CVE-2024-47362](https://cve.now/CVE-2024-47362.md): WordPress Strong Testimonials plugin \<= 3.1.16 - Broken Access Control vulnerability (CVSS 4.3, WP Chill Strong Testimonials)
- [CVE-2024-37094](https://cve.now/CVE-2024-37094.md): WordPress MasterStudy LMS plugin \<= 3.2.12 - Broken Access Control vulnerability (CVSS 8.2, StylemixThemes MasterStudy LMS)
- [CVE-2024-10655](https://cve.now/CVE-2024-10655.md): Tongda OA 2017 new.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-7456](https://cve.now/CVE-2024-7456.md): SQL Injection in lunary-ai/lunary (CVSS 9.8, lunary-ai/lunary)
- [CVE-2024-10654](https://cve.now/CVE-2024-10654.md): TOTOLINK LR350 formLoginAuth.htm authorization (CVSS 6.9, TOTOLINK LR350)
- [CVE-2024-10367](https://cve.now/CVE-2024-10367.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2024-10653](https://cve.now/CVE-2024-10653.md): CHANGING Information Technology IDExpert - OS Command Injection (CVSS 7.2, CHANGING Information Technology IDExpert)
- [CVE-2024-10652](https://cve.now/CVE-2024-10652.md): CHANGING Information Technology IDExpert - Reflected XSS (CVSS 6.1, CHANGING Information Technology IDExpert)
- [CVE-2024-10651](https://cve.now/CVE-2024-10651.md): CHANGING Information Technology IDExpert - Arbitrary File Read through Path Traversal (CVSS 4.9, CHANGING Information Technology IDExpert)
- [CVE-2024-10232](https://cve.now/CVE-2024-10232.md): AtomChat \<= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode (CVSS 6.4, Group Chat & Video Chat by AtomChat)
- [CVE-2024-9655](https://cve.now/CVE-2024-9655.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-7424](https://cve.now/CVE-2024-7424.md): Multiple Page Generator Plugin – MPG \<= 4.0.1 - Missing Authorization (CVSS 5.4, themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2024-0106](https://cve.now/CVE-2024-0106.md): NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper (CVSS 8.7, NVIDIA BlueField)
- [CVE-2024-0105](https://cve.now/CVE-2024-0105.md): NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. (CVSS 8.9, NVIDIA ConnectX4 · NVIDIA ConnectX GA +3)
- [CVE-2024-21510](https://cve.now/CVE-2024-21510.md): Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (X (CVSS 5.4, sinatra)
- [CVE-2024-10620](https://cve.now/CVE-2024-10620.md): knightliao Disconf Configuration Center list improper authentication (CVSS 6.9, knightliao Disconf)
- [CVE-2024-47939](https://cve.now/CVE-2024-47939.md): Stack-based buffer overflow vulnerability exists in multiple laser printers and MFPs which implement Ricoh Web Image Monitor. (CVSS 7.7, Ricoh Company Multiple laser printers and MFPs which implem…)
- [CVE-2024-49501](https://cve.now/CVE-2024-49501.md): Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. (CVSS 5.7, OMRON SYSMAC-SE2\[\]\[\]\[\])
- [CVE-2024-10619](https://cve.now/CVE-2024-10619.md): Tongda OA 2017 next\_detail.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10618](https://cve.now/CVE-2024-10618.md): Tongda OA 2017 record\_detail.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10617](https://cve.now/CVE-2024-10617.md): Tongda OA check\_seal.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10616](https://cve.now/CVE-2024-10616.md): Tongda OA webSignSubmit.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10615](https://cve.now/CVE-2024-10615.md): Tongda OA 2017 delete\_data\_attach.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10613](https://cve.now/CVE-2024-10613.md): ESAFENET CDG SystemEncryptPolicyService.java delSystemEncryptPolicy sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10612](https://cve.now/CVE-2024-10612.md): ESAFENET CDG HookInvalidCourseService.java removeHookInvalidCourse sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10611](https://cve.now/CVE-2024-10611.md): ESAFENET CDG PrintScreenListService.java delProtocol sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10610](https://cve.now/CVE-2024-10610.md): ESAFENET CDG ProtocolService.java delProtocol sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10609](https://cve.now/CVE-2024-10609.md): itsourcecode Tailoring Management System Project typeadd.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System Project)
- [CVE-2024-10608](https://cve.now/CVE-2024-10608.md): code-projects Courier Management System login.php sql injection (CVSS 6.9, code-projects Courier Management System)
- [CVE-2024-10607](https://cve.now/CVE-2024-10607.md): code-projects Courier Management System track-result.php sql injection (CVSS 6.9, code-projects Courier Management System)
- [CVE-2024-22733](https://cve.now/CVE-2024-22733.md): TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login (CVSS 3.5)
- [CVE-2024-27524](https://cve.now/CVE-2024-27524.md): Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the file (CVSS 7.1)
- [CVE-2024-27525](https://cve.now/CVE-2024-27525.md): Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the file (CVSS 4.6)
- [CVE-2024-28265](https://cve.now/CVE-2024-28265.md): IBOS v4.5.5 has an arbitrary file deletion vulnerability via \\system\\modules\\dashboard\\controllers\\LoginController.php. (CVSS 9.1)
- [CVE-2024-40490](https://cve.now/CVE-2024-40490.md): An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Pass (CVSS 7.5)
- [CVE-2024-48217](https://cve.now/CVE-2024-48217.md): An Insecure Direct Object Reference (IDOR) in the dashboard of SiSMART v7.4.0 allows attackers to execute a horizontal-privilege escalation. (CVSS 8.8)
- [CVE-2024-48270](https://cve.now/CVE-2024-48270.md): An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack. (CVSS 7.5)
- [CVE-2024-48289](https://cve.now/CVE-2024-48289.md): An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via s (CVSS 6.5)
- [CVE-2024-48352](https://cve.now/CVE-2024-48352.md): Yealink Meeting Server before V26.0.0.67 is vulnerable to sensitive data exposure in the server response via sending HTTP request with enter (CVSS 7.5)
- [CVE-2024-48353](https://cve.now/CVE-2024-48353.md): Yealink Meeting Server before V26.0.0.67 allows attackers to obtain static key information from a front-end JS file and decrypt the plaintex (CVSS 7.5)
- [CVE-2024-48410](https://cve.now/CVE-2024-48410.md): Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php. (CVSS 6.1)
- [CVE-2024-51244](https://cve.now/CVE-2024-51244.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the do (CVSS 8.0)
- [CVE-2024-51245](https://cve.now/CVE-2024-51245.md): In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the re (CVSS 8.0)
- [CVE-2024-51247](https://cve.now/CVE-2024-51247.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the do (CVSS 8.0)
- [CVE-2024-51248](https://cve.now/CVE-2024-51248.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the mo (CVSS 8.0)
- [CVE-2024-51252](https://cve.now/CVE-2024-51252.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the re (CVSS 8.0)
- [CVE-2024-51377](https://cve.now/CVE-2024-51377.md): An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary co (CVSS 8.8)
- [CVE-2024-51398](https://cve.now/CVE-2024-51398.md): Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthoriz (CVSS 6.5)
- [CVE-2024-51399](https://cve.now/CVE-2024-51399.md): Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtai (CVSS 5.7)
- [CVE-2024-51406](https://cve.now/CVE-2024-51406.md): Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be (CVSS 6.2)
- [CVE-2024-51407](https://cve.now/CVE-2024-51407.md): Floodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing inter-host communic (CVSS 6.2)
- [CVE-2024-51431](https://cve.now/CVE-2024-51431.md): LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable. (CVSS 8.1)
- [CVE-2024-51432](https://cve.now/CVE-2024-51432.md): Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI C (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.