# CVEs published 2024-11-04

148 CVEs were published on November 4, 2024: 18 critical, 53 high. Days are UTC.

- [CVE-2024-32870](https://cve.now/CVE-2024-32870.md): iTop hub connector Information disclosure (CVSS 5.8, Combodo iTop)
- [CVE-2024-31998](https://cve.now/CVE-2024-31998.md): CSRF security issue on CSV import in Combodo iTop (CVSS 8.8, Combodo iTop)
- [CVE-2024-31448](https://cve.now/CVE-2024-31448.md): Cross-site Scripting vulnerability in link CSV import in Combodo iTop (CVSS 8.8, Combodo iTop)
- [CVE-2023-34445](https://cve.now/CVE-2023-34445.md): Cross-site Scripting vulnerability on pages/ajax.render.php in Combodo iTop (CVSS 8.8, Combodo iTop)
- [CVE-2023-34444](https://cve.now/CVE-2023-34444.md): Cross-site Scripting vulnerability on pages/ajax.searchform.php in Combodo iTop (CVSS 8.8, Combodo iTop)
- [CVE-2023-34443](https://cve.now/CVE-2023-34443.md): Cross-site Scripting vulnerability in the run\_query.php page in Combodo iTop (CVSS 8.8, Combodo iTop)
- [CVE-2024-50346](https://cve.now/CVE-2024-50346.md): WebFeed HTML injection vulnerabilities (CVSS 5.1, taoso webfeed)
- [CVE-2024-51498](https://cve.now/CVE-2024-51498.md): \[@imput/cobalt-web\] Cross-site Scripting when downloading picker image from malicious instance (CVSS 6.0, imputnet cobalt)
- [CVE-2024-51500](https://cve.now/CVE-2024-51500.md): Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware (CVSS 5.3, meshtastic firmware)
- [CVE-2024-51501](https://cve.now/CVE-2024-51501.md): CRLF injection in Refit's \[Header\], \[HeaderCollection\] and \[Authorize\] attributes (CVSS 10.0, reactiveui refit · Refit)
- [CVE-2024-51502](https://cve.now/CVE-2024-51502.md): Panic Vulnerability in loona-hpack (CVSS 5.1, bearcove loona · loona-hpack)
- [CVE-2024-10805](https://cve.now/CVE-2024-10805.md): code-projects University Event Management System doedit.php sql injection (CVSS 5.3, code-projects University Event Management System)
- [CVE-2024-51734](https://cve.now/CVE-2024-51734.md): User data deletion by anoynmous users in Zope (CVSS 8.7, zopefoundation AccessControl · accesscontrol +1)
- [CVE-2024-51744](https://cve.now/CVE-2024-51744.md): Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (CVSS 3.1, golang-jwt jwt · github.com/golang-jwt/jwt/v4)
- [CVE-2024-10791](https://cve.now/CVE-2024-10791.md): Codezips Hospital Appointment System doctorAction.php sql injection (CVSS 6.9, Codezips Hospital Appointment System)
- [CVE-2024-45086](https://cve.now/CVE-2024-45086.md): IBM WebSphere Application Server XML external entity injection (CVSS 5.5, IBM WebSphere Application Server)
- [CVE-2024-10768](https://cve.now/CVE-2024-10768.md): PHPGurukul Online Shopping Portal two\_tables.php cross site scripting (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2024-10766](https://cve.now/CVE-2024-10766.md): Codezips Free Exam Hall Seating Management System save\_user.php unrestricted upload (CVSS 5.3, Codezips Free Exam Hall Seating Management System)
- [CVE-2024-10765](https://cve.now/CVE-2024-10765.md): Codezips Online Institute Management System profile.php unrestricted upload (CVSS 5.3, Codezips Online Institute Management System)
- [CVE-2024-10764](https://cve.now/CVE-2024-10764.md): Codezips Online Institute Management System save\_user.php unrestricted upload (CVSS 5.3, Codezips Online Institute Management System)
- [CVE-2024-51677](https://cve.now/CVE-2024-51677.md): WordPress Knowledge Base plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ajay Knowledge Base)
- [CVE-2024-51678](https://cve.now/CVE-2024-51678.md): WordPress Elo Rating Shortcode plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Marcel Pol Elo Rating Shortcode)
- [CVE-2024-51680](https://cve.now/CVE-2024-51680.md): WordPress Cresta Addons for Elementor plugin \<= 1.0.9 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CrestaProject Cresta Addons for Elementor)
- [CVE-2024-51681](https://cve.now/CVE-2024-51681.md): WordPress WP Pocket URLs plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CodeRevolution WP Pocket URLs)
- [CVE-2024-51682](https://cve.now/CVE-2024-51682.md): WordPress HT Builder – WordPress Theme Builder for Elementor plugin \<= 1.3.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HasThemes HT Builder – WordPress Theme Builder for Elementor)
- [CVE-2024-51683](https://cve.now/CVE-2024-51683.md): WordPress Custom post type templates for Elementor plugin \<= 1.10.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Michael Custom post type templates for Elementor)
- [CVE-2024-51685](https://cve.now/CVE-2024-51685.md): WordPress Accordion title for Elementor plugin \<= 1.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Michael Gangolf Accordion title for Elementor)
- [CVE-2024-51626](https://cve.now/CVE-2024-51626.md): WordPress Woocommerce Quote Calculator plugin \<= 1.1 - SQL Injection vulnerability (CVSS 8.5, chenyenming Woocommerce Quote Calculator)
- [CVE-2024-51672](https://cve.now/CVE-2024-51672.md): WordPress BetterLinks plugin \<= 2.1.7 - SQL Injection vulnerability (CVSS 7.6, WPDeveloper BetterLinks)
- [CVE-2024-50528](https://cve.now/CVE-2024-50528.md): WordPress Stacks Mobile App Builder plugin \<= 5.2.3 - Sensitive Data Exposure vulnerability (CVSS 7.5, Stacks Mobile App Builder)
- [CVE-2024-50523](https://cve.now/CVE-2024-50523.md): WordPress All Post Contact Form plugin \<= 1.8.2 - Arbitrary File Upload vulnerability (CVSS 10.0, RainbowLink All Post Contact Form)
- [CVE-2024-50525](https://cve.now/CVE-2024-50525.md): WordPress Helloprint plugin \<= 2.0.4 - Arbitrary File Upload vulnerability (CVSS 10.0, Helloprint)
- [CVE-2024-50526](https://cve.now/CVE-2024-50526.md): WordPress Multi Purpose Mail Form plugin \<= 1.0.2 - Arbitrary File Upload vulnerability (CVSS 10.0, Lindeni Mahlalela Multi Purpose Mail Form)
- [CVE-2024-50527](https://cve.now/CVE-2024-50527.md): WordPress Stacks Mobile App Builder plugin \<= 5.2.3 - Arbitrary File Upload vulnerability (CVSS 10.0, Stacks Mobile App Builder)
- [CVE-2024-50529](https://cve.now/CVE-2024-50529.md): WordPress Training – Courses plugin \<= 2.0.1 - Arbitrary File Upload vulnerability (CVSS 9.9, rudrainn Training – Courses)
- [CVE-2024-50530](https://cve.now/CVE-2024-50530.md): WordPress Stars SMTP Mailer plugin \<= 2.2.1 - Arbitrary File Upload vulnerability (CVSS 9.9, Myriad Solutionz Stars SMTP Mailer)
- [CVE-2024-50531](https://cve.now/CVE-2024-50531.md): WordPress RSVPMaker for Toastmasters plugin \<= 6.2.4 - Arbitrary File Upload vulnerability (CVSS 10.0, davidfcarr RSVPMaker for Toastmasters)
- [CVE-2024-51582](https://cve.now/CVE-2024-51582.md): WordPress WP Hotel Booking plugin \<= 2.2.9 - Local File Inclusion vulnerability (CVSS 7.5, ThimPress WP Hotel Booking)
- [CVE-2024-51665](https://cve.now/CVE-2024-51665.md): WordPress Magical Addons For Elementor plugin \<= 1.2.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Noor Alam Magical Addons For Elementor)
- [CVE-2024-9147](https://cve.now/CVE-2024-9147.md): HTML Injection in Bna Informatics' PosPratik (CVSS 6.9, Bna Informatics PosPratik)
- [CVE-2024-51561](https://cve.now/CVE-2024-51561.md): Authentication bypass Vulnerability in Aero (CVSS 9.3, Brokerage Technology Solutions Aero)
- [CVE-2024-51560](https://cve.now/CVE-2024-51560.md): Improper Error Handling Vulnerability in Wave 2.0 (CVSS 7.1, Brokerage Technology Solutions Wave)
- [CVE-2024-51559](https://cve.now/CVE-2024-51559.md): Improper Access Control Vulnerability in Wave 2.0 (CVSS 7.1, Brokerage Technology Solutions Wave)
- [CVE-2024-51558](https://cve.now/CVE-2024-51558.md): Brute Force Attack Vulnerability in Wave 2.0 (CVSS 9.3, Brokerage Technology Solutions Wave)
- [CVE-2024-51557](https://cve.now/CVE-2024-51557.md): No Rate Limiting Vulnerability in Wave 2.0 (CVSS 7.1, Brokerage Technology Solutions Wave)
- [CVE-2024-51556](https://cve.now/CVE-2024-51556.md): Sensitive Information Disclosure Vulnerability in Wave 2.0 (CVSS 7.1, Brokerage Technology Solutions Wave)
- [CVE-2024-10523](https://cve.now/CVE-2024-10523.md): Information Disclosure Vulnerability in TP-Link IoT Smart Hub (CVSS 4.4, TP-Link Tapo H100 IoT Smart Hub)
- [CVE-2024-10035](https://cve.now/CVE-2024-10035.md): Code Injection in BG-TEK's CoslatV3 (CVSS 9.2, BG-TEK Informatics Security Technologies CoslatV3)
- [CVE-2024-36485](https://cve.now/CVE-2024-36485.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-51661](https://cve.now/CVE-2024-51661.md): WordPress Media Library Assistant plugin \<= 3.19 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, David Lingren Media LIbrary Assistant)
- [CVE-2024-48878](https://cve.now/CVE-2024-48878.md): SQL Injection (CVSS 8.3, ManageEngine ADManager Plus)
- [CVE-2024-10389](https://cve.now/CVE-2024-10389.md): Path Traversal in Safearchive (CVSS 5.9, Google Safearchive · github.com/google/safearchive)
- [CVE-2024-38424](https://cve.now/CVE-2024-38424.md): Use After Free in GPS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38423](https://cve.now/CVE-2024-38423.md): Buffer Copy Without Checking Size of Input in Graphics Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38422](https://cve.now/CVE-2024-38422.md): Integer Overflow to Buffer Overflow in Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38421](https://cve.now/CVE-2024-38421.md): Use After Free in Graphics Linux (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38419](https://cve.now/CVE-2024-38419.md): Use After Free in Automotive GPU (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38415](https://cve.now/CVE-2024-38415.md): Use After Free in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38410](https://cve.now/CVE-2024-38410.md): Stack-based Buffer Overflow in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38409](https://cve.now/CVE-2024-38409.md): Buffer Copy Without Checking Size of Input in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38408](https://cve.now/CVE-2024-38408.md): Cryptographic Issues in BT Controller (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-38407](https://cve.now/CVE-2024-38407.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38406](https://cve.now/CVE-2024-38406.md): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38405](https://cve.now/CVE-2024-38405.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-38403](https://cve.now/CVE-2024-38403.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33068](https://cve.now/CVE-2024-33068.md): Use After Free in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33033](https://cve.now/CVE-2024-33033.md): Use After Free in ComputerVision (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33032](https://cve.now/CVE-2024-33032.md): Improper Validation of Array Index in Camera\_Linux (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33031](https://cve.now/CVE-2024-33031.md): Improper Input Validation in RIL (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33030](https://cve.now/CVE-2024-33030.md): Buffer Copy without Checking Size of Input (\`Classic Buffer Overflow\`) in Performance (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33029](https://cve.now/CVE-2024-33029.md): Use After Free in DSP Services (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23386](https://cve.now/CVE-2024-23386.md): Improper Input Validation in Video (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23385](https://cve.now/CVE-2024-23385.md): Reachable Assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-23377](https://cve.now/CVE-2024-23377.md): Use of Out-of-range Pointer Offset in ComputerVision (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23590](https://cve.now/CVE-2024-23590.md): Apache Kylin: Session fixation in web interface (CVSS 9.1, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2024-10761](https://cve.now/CVE-2024-10761.md): Umbraco CMS Dashboard frame cross site scripting (CVSS 6.9, Umbraco CMS · Umbraco.Cms +1)
- [CVE-2024-10760](https://cve.now/CVE-2024-10760.md): code-projects University Event Management System dodelete.php sql injection (CVSS 5.3, code-projects University Event Management System)
- [CVE-2024-10759](https://cve.now/CVE-2024-10759.md): itsourcecode Farm Management System edit-pig.php sql injection (CVSS 5.3, itsourcecode Farm Management System)
- [CVE-2024-10758](https://cve.now/CVE-2024-10758.md): code-projects/anirbandutta9 Content Management System/News-Buzz index.php sql injection (CVSS 6.9, code-projects Content Management System · code-projects… +2)
- [CVE-2024-10757](https://cve.now/CVE-2024-10757.md): PHPGurukul Online Shopping Portal js\_data.php cross site scripting (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2024-10756](https://cve.now/CVE-2024-10756.md): PHPGurukul Online Shopping Portal html\_table.php cross site scripting (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2024-10755](https://cve.now/CVE-2024-10755.md): PHPGurukul Online Shopping Portal empty\_table.php cross site scripting (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2024-10754](https://cve.now/CVE-2024-10754.md): PHPGurukul Online Shopping Portal dymanic\_table.php cross site scripting (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2024-10753](https://cve.now/CVE-2024-10753.md): PHPGurukul Online Shopping Portal dom\_data\_two\_headers.php cross site scripting (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2024-20124](https://cve.now/CVE-2024-20124.md): In vdec, there is a possible out of bounds read due to improper structure design. (CVSS 4.4, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…)
- [CVE-2024-20123](https://cve.now/CVE-2024-20123.md): In vdec, there is a possible out of bounds read due to improper structure design. (CVSS 4.4, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…)
- [CVE-2024-20122](https://cve.now/CVE-2024-20122.md): In vdec, there is a possible out of bounds read due to improper structure design. (CVSS 4.4, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…)
- [CVE-2024-20121](https://cve.now/CVE-2024-20121.md): In KeyInstall, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT…)
- [CVE-2024-20120](https://cve.now/CVE-2024-20120.md): In KeyInstall, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6765, MT6768, MT6833, MT6835, MT6853, MT6855, MT…)
- [CVE-2024-20119](https://cve.now/CVE-2024-20119.md): In mms, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2024-20118](https://cve.now/CVE-2024-20118.md): In mms, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2024-20117](https://cve.now/CVE-2024-20117.md): In vdec, there is a possible out of bounds read due to improper structure design. (CVSS 4.4, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT8766, MT…)
- [CVE-2024-20115](https://cve.now/CVE-2024-20115.md): In ccu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT…)
- [CVE-2024-20114](https://cve.now/CVE-2024-20114.md): In ccu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…)
- [CVE-2024-20113](https://cve.now/CVE-2024-20113.md): In ccu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6765, MT6768, MT8188, MT8195)
- [CVE-2024-20112](https://cve.now/CVE-2024-20112.md): In isp, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6878, MT6886, MT6897, MT6985, MT8676)
- [CVE-2024-20111](https://cve.now/CVE-2024-20111.md): In ccu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…)
- [CVE-2024-20110](https://cve.now/CVE-2024-20110.md): In ccu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…)
- [CVE-2024-20109](https://cve.now/CVE-2024-20109.md): In ccu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6765, MT6768, MT6833, MT6853, MT6873, MT6877, MT…)
- [CVE-2024-20108](https://cve.now/CVE-2024-20108.md): In atci, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20107](https://cve.now/CVE-2024-20107.md): In da, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.2, MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…)
- [CVE-2024-20106](https://cve.now/CVE-2024-20106.md): In m4u, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6785, MT…)
- [CVE-2024-20104](https://cve.now/CVE-2024-20104.md): In da, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.4, MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…)
- [CVE-2024-10752](https://cve.now/CVE-2024-10752.md): Codezips Pet Shop Management System productsadd.php sql injection (CVSS 6.9, Codezips Pet Shop Management System)
- [CVE-2024-10751](https://cve.now/CVE-2024-10751.md): Codezips ISP Management System pay.php sql injection (CVSS 5.3, Codezips ISP Management System)
- [CVE-2024-10750](https://cve.now/CVE-2024-10750.md): Tenda i22 SysToo websReadEvent null pointer dereference (CVSS 7.1, Tenda i22)
- [CVE-2024-10749](https://cve.now/CVE-2024-10749.md): ThinkAdmin Plugs.php script deserialization (CVSS 2.3, ThinkAdmin)
- [CVE-2024-10748](https://cve.now/CVE-2024-10748.md): Cosmote Greece What's Up App Realm Database RealmDB.java default key (CVSS 2.0, Cosmote Greece What's Up App)
- [CVE-2024-10747](https://cve.now/CVE-2024-10747.md): PHPGurukul Online Shopping Portal dom\_data\_th.php cross site scripting (CVSS 5.3, PHPGurukul Online Shopping Portal)
- [CVE-2024-30616](https://cve.now/CVE-2024-30616.md): Chamilo LMS 1.11.26 is vulnerable to Incorrect Access Control via main/auth/profile. (CVSS 8.8)
- [CVE-2024-30617](https://cve.now/CVE-2024-30617.md): A Cross-Site Request Forgery (CSRF) vulnerability in Chamilo LMS 1.11.26 "/main/social/home.php," allows attackers to initiate a request tha (CVSS 5.4)
- [CVE-2024-30618](https://cve.now/CVE-2024-30618.md): A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web b (CVSS 6.1)
- [CVE-2024-30619](https://cve.now/CVE-2024-30619.md): Chamilo LMS Version 1.11.26 is vulnerable to Incorrect Access Control. (CVSS 7.5)
- [CVE-2024-34882](https://cve.now/CVE-2024-34882.md): Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP acco (CVSS 6.8)
- [CVE-2024-34883](https://cve.now/CVE-2024-34883.md): Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to read proxy-serve (CVSS 6.8)
- [CVE-2024-34885](https://cve.now/CVE-2024-34885.md): Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read SMTP acco (CVSS 6.8)
- [CVE-2024-34887](https://cve.now/CVE-2024-34887.md): Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send AD/LDA (CVSS 6.8)
- [CVE-2024-34891](https://cve.now/CVE-2024-34891.md): Insufficiently protected credentials in DAV server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to read Exchange a (CVSS 6.8)
- [CVE-2024-45164](https://cve.now/CVE-2024-45164.md): Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch an (CVSS 4.3)
- [CVE-2024-45185](https://cve.now/CVE-2024-45185.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, (CVSS 5.1)
- [CVE-2024-45882](https://cve.now/CVE-2024-45882.md): DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. (CVSS 8.0)
- [CVE-2024-45884](https://cve.now/CVE-2024-45884.md): DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. (CVSS 8.0)
- [CVE-2024-45885](https://cve.now/CVE-2024-45885.md): DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. (CVSS 8.0)
- [CVE-2024-45887](https://cve.now/CVE-2024-45887.md): DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. (CVSS 8.0)
- [CVE-2024-45888](https://cve.now/CVE-2024-45888.md): DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. (CVSS 8.0)
- [CVE-2024-45889](https://cve.now/CVE-2024-45889.md): DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. (CVSS 8.0)
- [CVE-2024-45890](https://cve.now/CVE-2024-45890.md): DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the \`action\` paramet (CVSS 8.0)
- [CVE-2024-45891](https://cve.now/CVE-2024-45891.md): DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. (CVSS 8.0)
- [CVE-2024-45893](https://cve.now/CVE-2024-45893.md): DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. (CVSS 8.0)
- [CVE-2024-48050](https://cve.now/CVE-2024-48050.md): In agentscope \<=v0.0.4, the file agentscope\\web\\workstation\\workflow\_utils.py has the function is\_callable\_expression. (CVSS 9.8, agentscope)
- [CVE-2024-48052](https://cve.now/CVE-2024-48052.md): In gradio \<=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. (CVSS 6.5, gradio)
- [CVE-2024-48057](https://cve.now/CVE-2024-48057.md): localai \<=2.20.1 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1, github.com/mudler/LocalAI)
- [CVE-2024-48059](https://cve.now/CVE-2024-48059.md): gaizhenbiao/chuanhuchatgpt project, version \<=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission. (CVSS 6.1)
- [CVE-2024-48061](https://cve.now/CVE-2024-48061.md): langflow \<=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on th (CVSS 9.8, langflow)
- [CVE-2024-48336](https://cve.now/CVE-2024-48336.md): The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh (CVSS 8.4)
- [CVE-2024-48463](https://cve.now/CVE-2024-48463.md): Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs view (CVSS 6.5)
- [CVE-2024-48809](https://cve.now/CVE-2024-48809.md): An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service vi (CVSS 7.5)
- [CVE-2024-51127](https://cve.now/CVE-2024-51127.md): An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information. (CVSS 9.1, org.hornetq:hornetq-core-client)
- [CVE-2024-51136](https://cve.now/CVE-2024-51136.md): An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbit (CVSS 9.8)
- [CVE-2024-51246](https://cve.now/CVE-2024-51246.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the do (CVSS 8.0)
- [CVE-2024-51249](https://cve.now/CVE-2024-51249.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the re (CVSS 8.0)
- [CVE-2024-51251](https://cve.now/CVE-2024-51251.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ba (CVSS 8.0)
- [CVE-2024-51253](https://cve.now/CVE-2024-51253.md): In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the do (CVSS 8.0)
- [CVE-2024-51326](https://cve.now/CVE-2024-51326.md): SQL Injection vulnerability in projectworlds Travel management System v.1.0 allows a remote attacker to execute arbitrary code via the 't2' (CVSS 7.5)
- [CVE-2024-51327](https://cve.now/CVE-2024-51327.md): SQL Injection in loginform.php in ProjectWorld's Travel Management System v1.0 allows remote attackers to bypass authentication via SQL Inje (CVSS 9.8)
- [CVE-2024-51328](https://cve.now/CVE-2024-51328.md): Cross Site Scripting vulnerability in addcategory.php in projectworld's Travel Management System v1.0 allows remote attacker to inject arbit (CVSS 6.1)
- [CVE-2024-51329](https://cve.now/CVE-2024-51329.md): A Host header injection vulnerability in Agile-Board 1.0 allows attackers to obtain the password reset token via user interaction with a cra (CVSS 8.1)
- [CVE-2024-51408](https://cve.now/CVE-2024-51408.md): AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadat (CVSS 8.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.