# CVEs published 2024-11-05

211 CVEs were published on November 5, 2024: 14 critical, 70 high. Days are UTC.

- [CVE-2024-10028](https://cve.now/CVE-2024-10028.md): Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin \<= 2.2.13 - Sensitive Invormation Disclosure via procstat Log (CVSS 7.5, everestthemes Everest Backup – WordPress Cloud Backup, Migr…)
- [CVE-2024-47464](https://cve.now/CVE-2024-47464.md): Authenticated Path Traversal Vulnerability Leads to a Remote Unauthorized Access to Files (CVSS 6.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Acces…)
- [CVE-2024-47463](https://cve.now/CVE-2024-47463.md): Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE) (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Acces…)
- [CVE-2024-47462](https://cve.now/CVE-2024-47462.md): Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE) (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Acces…)
- [CVE-2024-47461](https://cve.now/CVE-2024-47461.md): Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10 (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Acces…)
- [CVE-2024-47460](https://cve.now/CVE-2024-47460.md): Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol (CVSS 9.0, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Acces…)
- [CVE-2024-42509](https://cve.now/CVE-2024-42509.md): Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Acces…)
- [CVE-2024-51756](https://cve.now/CVE-2024-51756.md): cap-std doesn't fully sandbox all the Windows device filenames (CVSS 2.3, bytecodealliance cap-std · cap-primitives +2)
- [CVE-2024-10084](https://cve.now/CVE-2024-10084.md): Contact Form 7 – Dynamic Text Extension \<= 4.5 - Information Disclosure via Shortcode (CVSS 4.3, sevenspark Contact Form 7 – Dynamic Text Extension)
- [CVE-2024-51745](https://cve.now/CVE-2024-51745.md): Wasmtime doesn't fully sandbox all the Windows device filenames (CVSS 2.3, bytecodealliance wasmtime · wasmtime)
- [CVE-2024-7995](https://cve.now/CVE-2024-7995.md): Autodesk VRED Design Privilege Escalation Vulnerability (CVSS 7.8, Autodesk VRED Design)
- [CVE-2024-51752](https://cve.now/CVE-2024-51752.md): Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs (CVSS 2.1, workos authkit-nextjs · @workos-inc/authkit-nextjs)
- [CVE-2024-51753](https://cve.now/CVE-2024-51753.md): Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix (CVSS 2.1, workos authkit-remix · @workos-inc/authkit-remix)
- [CVE-2024-51746](https://cve.now/CVE-2024-51746.md): Use of incorrect Rekor entries during verification in gitsign (CVSS 1.8, sigstore gitsign · github.com/sigstore/gitsign)
- [CVE-2024-51735](https://cve.now/CVE-2024-51735.md): Stored Cross-site Scripting to RCE on Osmedeus Web Server (CVSS 8.7, j3ssie osmedeus · github.com/j3ssie/osmedeus)
- [CVE-2024-50335](https://cve.now/CVE-2024-50335.md): Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM (CVSS 4.9, salesagility SuiteCRM)
- [CVE-2024-50333](https://cve.now/CVE-2024-50333.md): RCE in ModuleBuilder in SuiteCRM (CVSS 6.6, salesagility SuiteCRM)
- [CVE-2024-50332](https://cve.now/CVE-2024-50332.md): Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM (CVSS 8.8, salesagility SuiteCRM)
- [CVE-2024-0134](https://cve.now/CVE-2024-0134.md): NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead t (CVSS 4.1, NVIDIA Container Toolkit · NVIDIA GPU Operator)
- [CVE-2024-49774](https://cve.now/CVE-2024-49774.md): ModuleScanner flaws in SuiteCRM (CVSS 7.2, salesagility SuiteCRM)
- [CVE-2024-49773](https://cve.now/CVE-2024-49773.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM (CVSS 5.3, salesagility SuiteCRM)
- [CVE-2024-49772](https://cve.now/CVE-2024-49772.md): Authenticated SQL injection in AM\_ProjectTemplates controller in SuiteCRM (CVSS 8.8, salesagility SuiteCRM)
- [CVE-2024-49377](https://cve.now/CVE-2024-49377.md): Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint (CVSS 5.5, OctoPrint)
- [CVE-2024-51493](https://cve.now/CVE-2024-51493.md): API key access in settings without reauthentication in OctoPrint (CVSS 5.3, OctoPrint)
- [CVE-2024-51740](https://cve.now/CVE-2024-51740.md): SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop (CVSS 4.3, Combodo iTop)
- [CVE-2024-51739](https://cve.now/CVE-2024-51739.md): Users enumeration allowed through Rest API in Combodo iTop (CVSS 7.5, Combodo iTop)
- [CVE-2024-50138](https://cve.now/CVE-2024-50138.md): bpf: Use raw\_spinlock\_t in ringbuf (no CVSS, Linux)
- [CVE-2024-50137](https://cve.now/CVE-2024-50137.md): reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC (no CVSS, Linux)
- [CVE-2024-50136](https://cve.now/CVE-2024-50136.md): net/mlx5: Unregister notifier on eswitch init failure (CVSS 5.5, Linux)
- [CVE-2024-50135](https://cve.now/CVE-2024-50135.md): nvme-pci: fix race condition between reset and nvme\_dev\_disable() (CVSS 4.7, Linux)
- [CVE-2024-50134](https://cve.now/CVE-2024-50134.md): drm/vboxvideo: Replace fake VLA at end of vbva\_mouse\_pointer\_shape with real VLA (no CVSS, Linux)
- [CVE-2024-50133](https://cve.now/CVE-2024-50133.md): LoongArch: Don't crash in stack\_top() for tasks without vDSO (CVSS 5.5, Linux)
- [CVE-2024-50132](https://cve.now/CVE-2024-50132.md): tracing/probes: Fix MAX\_TRACE\_ARGS limit handling (CVSS 7.8, Linux)
- [CVE-2024-50131](https://cve.now/CVE-2024-50131.md): tracing: Consider the NULL character when validating the event length (CVSS 7.3, Linux)
- [CVE-2024-50130](https://cve.now/CVE-2024-50130.md): netfilter: bpf: must hold reference on net namespace (CVSS 7.8, Linux)
- [CVE-2024-50129](https://cve.now/CVE-2024-50129.md): net: pse-pd: Fix out of bound for loop (CVSS 7.8, Linux)
- [CVE-2024-50128](https://cve.now/CVE-2024-50128.md): net: wwan: fix global oob in wwan\_rtnl\_policy (CVSS 7.8, Linux)
- [CVE-2024-50127](https://cve.now/CVE-2024-50127.md): net: sched: fix use-after-free in taprio\_change() (CVSS 7.8, Linux)
- [CVE-2024-50126](https://cve.now/CVE-2024-50126.md): net: sched: use RCU read-side critical section in taprio\_dump() (CVSS 7.8, Linux)
- [CVE-2024-50125](https://cve.now/CVE-2024-50125.md): Bluetooth: SCO: Fix UAF on sco\_sock\_timeout (CVSS 8.0, Linux)
- [CVE-2024-50124](https://cve.now/CVE-2024-50124.md): Bluetooth: ISO: Fix UAF on iso\_sock\_timeout (CVSS 8.0, Linux)
- [CVE-2024-50123](https://cve.now/CVE-2024-50123.md): bpf: Add the missing BPF\_LINK\_TYPE invocation for sockmap (CVSS 7.1, Linux)
- [CVE-2024-50122](https://cve.now/CVE-2024-50122.md): PCI: Hold rescan lock while adding devices during host probe (CVSS 5.5, Linux)
- [CVE-2024-50121](https://cve.now/CVE-2024-50121.md): nfsd: cancel nfsd\_shrinker\_work using sync mode in nfs4\_state\_shutdown\_net (CVSS 7.8, Linux)
- [CVE-2024-50120](https://cve.now/CVE-2024-50120.md): smb: client: Handle kstrdup failures for passwords (no CVSS, Linux)
- [CVE-2024-50119](https://cve.now/CVE-2024-50119.md): cifs: fix warning when destroy 'cifs\_io\_request\_pool' (CVSS 7.0, Linux)
- [CVE-2024-50118](https://cve.now/CVE-2024-50118.md): btrfs: reject ro-\>rw reconfiguration if there are hard ro requirements (CVSS 5.5, Linux)
- [CVE-2024-50117](https://cve.now/CVE-2024-50117.md): drm/amd: Guard against bad data for ATIF ACPI method (CVSS 7.3, Linux)
- [CVE-2024-50116](https://cve.now/CVE-2024-50116.md): nilfs2: fix kernel bug due to missing clearing of buffer delay flag (CVSS 5.5, Linux)
- [CVE-2024-50115](https://cve.now/CVE-2024-50115.md): KVM: nSVM: Ignore nCR3\[4:0\] when loading PDPTEs from memory (CVSS 8.4, Linux)
- [CVE-2024-50114](https://cve.now/CVE-2024-50114.md): KVM: arm64: Unregister redistributor for failed vCPU creation (CVSS 7.8, Linux)
- [CVE-2024-50113](https://cve.now/CVE-2024-50113.md): firewire: core: fix invalid port index for parent device (CVSS 8.8, Linux)
- [CVE-2024-50112](https://cve.now/CVE-2024-50112.md): x86/lam: Disable ADDRESS\_MASKING in most cases (CVSS 7.8, Linux)
- [CVE-2024-50111](https://cve.now/CVE-2024-50111.md): LoongArch: Enable IRQ if do\_ale() triggered in irq-enabled context (CVSS 5.5, Linux)
- [CVE-2024-50110](https://cve.now/CVE-2024-50110.md): xfrm: fix one more kernel-infoleak in algo dumping (CVSS 5.5, Linux)
- [CVE-2024-50109](https://cve.now/CVE-2024-50109.md): md/raid10: fix null ptr dereference in raid10\_size() (CVSS 5.5, Linux)
- [CVE-2024-50108](https://cve.now/CVE-2024-50108.md): drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too (CVSS 5.5, Linux)
- [CVE-2024-50107](https://cve.now/CVE-2024-50107.md): platform/x86/intel/pmc: Fix pmc\_core\_iounmap to call iounmap for valid addresses (CVSS 5.5, Linux)
- [CVE-2024-50106](https://cve.now/CVE-2024-50106.md): nfsd: fix race between laundromat and free\_stateid (CVSS 9.8, Linux)
- [CVE-2024-50105](https://cve.now/CVE-2024-50105.md): ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc (CVSS 5.5, Linux)
- [CVE-2024-50104](https://cve.now/CVE-2024-50104.md): ASoC: qcom: sdm845: add missing soundwire runtime stream alloc (CVSS 5.5, Linux)
- [CVE-2024-50103](https://cve.now/CVE-2024-50103.md): ASoC: qcom: Fix NULL Dereference in asoc\_qcom\_lpass\_cpu\_platform\_probe() (no CVSS, Linux)
- [CVE-2024-50102](https://cve.now/CVE-2024-50102.md): x86: fix user address masking non-canonical speculation issue (CVSS 5.5, Linux)
- [CVE-2024-50101](https://cve.now/CVE-2024-50101.md): iommu/vt-d: Fix incorrect pci\_for\_each\_dma\_alias() for non-PCI devices (CVSS 7.8, Linux)
- [CVE-2024-50100](https://cve.now/CVE-2024-50100.md): USB: gadget: dummy-hcd: Fix "task hung" problem (CVSS 5.5, Linux)
- [CVE-2024-50099](https://cve.now/CVE-2024-50099.md): arm64: probes: Remove broken LDR (literal) uprobe support (CVSS 7.3, Linux)
- [CVE-2024-50098](https://cve.now/CVE-2024-50098.md): scsi: ufs: core: Set SDEV\_OFFLINE when UFS is shut down (CVSS 5.5, Linux)
- [CVE-2024-50097](https://cve.now/CVE-2024-50097.md): net: fec: don't save PTP state if PTP is unsupported (CVSS 5.5, Linux)
- [CVE-2024-50096](https://cve.now/CVE-2024-50096.md): nouveau/dmem: Fix vulnerability in migrate\_to\_ram upon copy error (CVSS 7.3, Linux)
- [CVE-2024-50095](https://cve.now/CVE-2024-50095.md): RDMA/mad: Improve handling of timed out WRs of mad agent (CVSS 7.5, Linux)
- [CVE-2024-50094](https://cve.now/CVE-2024-50094.md): sfc: Don't invoke xdp\_do\_flush() from netpoll. (CVSS 7.5, Linux)
- [CVE-2024-50093](https://cve.now/CVE-2024-50093.md): thermal: intel: int340x: processor: Fix warning during module unload (CVSS 5.5, Linux)
- [CVE-2024-50092](https://cve.now/CVE-2024-50092.md): net: netconsole: fix wrong warning (CVSS 3.3, Linux)
- [CVE-2024-50091](https://cve.now/CVE-2024-50091.md): dm vdo: don't refer to dedupe\_context after releasing it (CVSS 7.8, Linux)
- [CVE-2024-50090](https://cve.now/CVE-2024-50090.md): drm/xe/oa: Fix overflow in oa batch buffer (CVSS 7.8, Linux)
- [CVE-2024-49522](https://cve.now/CVE-2024-49522.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-9579](https://cve.now/CVE-2024-9579.md): Certain Poly Video Conference Devices – Potential Remote Code Execution (CVSS 7.5, HP Certain Poly Video Conference Devices)
- [CVE-2023-29126](https://cve.now/CVE-2023-29126.md): Insecure loose comparison in Enel X JuiceBox (CVSS 4.2, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29125](https://cve.now/CVE-2023-29125.md): Heap overflow in CM\_main.exe binary in Enel X JuiceBox (CVSS 9.0, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29122](https://cve.now/CVE-2023-29122.md): Incorrect file ownership of privileged service's libraries in Enel X JuiceBox (CVSS 6.7, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29121](https://cve.now/CVE-2023-29121.md): Exposed TCF agent service in Enel X Juicebox (CVSS 9.6, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29120](https://cve.now/CVE-2023-29120.md): Unauthorized Remote Command Execution in Enel X Juicebox (CVSS 9.6, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29119](https://cve.now/CVE-2023-29119.md): Unauthorized SQLite Injection (CVSS 9.6, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29118](https://cve.now/CVE-2023-29118.md): Unauthorized SQLite Injection in Enel X Juicebox (CVSS 9.6, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29117](https://cve.now/CVE-2023-29117.md): Authentication Bypass in JuiceBox Web Manager interface (CVSS 8.8, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29116](https://cve.now/CVE-2023-29116.md): PHP Information Disclosure in Enel X JuiceBox (CVSS 4.3, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29115](https://cve.now/CVE-2023-29115.md): Denial of Service via Web Management interface in Enel X JuiceBox (CVSS 6.5, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2023-29114](https://cve.now/CVE-2023-29114.md): Unauthorized System Log Disclosure in Enel X JuiceBox (CVSS 5.7, Enel X JuiceBox Pro 3.0 22kW Cellular)
- [CVE-2024-10845](https://cve.now/CVE-2024-10845.md): 1000 Projects Bookstore Management System book\_detail.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-10844](https://cve.now/CVE-2024-10844.md): 1000 Projects Bookstore Management System search.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-10842](https://cve.now/CVE-2024-10842.md): romadebrian WEB-Sekolah Backend Proses\_Edit\_Akun.php cross site scripting (CVSS 5.1, romadebrian WEB-Sekolah)
- [CVE-2024-10841](https://cve.now/CVE-2024-10841.md): romadebrian WEB-Sekolah Mail Proses\_Kirim.php sql injection (CVSS 5.3, romadebrian WEB-Sekolah)
- [CVE-2024-10329](https://cve.now/CVE-2024-10329.md): Ultimate Bootstrap Elements for Elementor \<= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3, g5theme Ultimate Bootstrap Elements for Elementor)
- [CVE-2024-7059](https://cve.now/CVE-2024-7059.md): A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Secu (CVSS 8.9, Genetec Security Center)
- [CVE-2024-10840](https://cve.now/CVE-2024-10840.md): romadebrian WEB-Sekolah Backend akun\_edit.php cross site scripting (CVSS 5.1, romadebrian WEB-Sekolah)
- [CVE-2024-10263](https://cve.now/CVE-2024-10263.md): Tickera – WordPress Event Ticketing \<= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, Tickera – Sell Tickets & Manage Events)
- [CVE-2024-9867](https://cve.now/CVE-2024-9867.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget (CVSS 5.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-9657](https://cve.now/CVE-2024-9657.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.5, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-51530](https://cve.now/CVE-2024-51530.md): LaunchAnywhere vulnerability in the account module Impact: Successful exploitation of this vulnerability may affect service confidentiality. (CVSS 6.6, Huawei HarmonyOS)
- [CVE-2024-51529](https://cve.now/CVE-2024-51529.md): Data verification vulnerability in the battery module Impact: Successful exploitation of this vulnerability may affect function stability. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-9178](https://cve.now/CVE-2024-9178.md): XT Floating Cart for WooCommerce \<= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, xplodedthemes XT Floating Cart for WooCommerce)
- [CVE-2024-10319](https://cve.now/CVE-2024-10319.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template (CVSS 4.3, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2023-52920](https://cve.now/CVE-2023-52920.md): bpf: support non-r10 register spill/fill to/from stack in precision tracking (CVSS 7.8, Linux)
- [CVE-2024-51528](https://cve.now/CVE-2024-51528.md): Vulnerability of improper log printing in the Super Home Screen module Impact: Successful exploitation of this vulnerability may affect serv (CVSS 4.0, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-10687](https://cve.now/CVE-2024-10687.md): Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons \<= 24.0.3 - Unauthenticated SQL Injection (CVSS 9.8, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2024-9878](https://cve.now/CVE-2024-9878.md): Photo Gallery by 10Web \<= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2024-7429](https://cve.now/CVE-2024-7429.md): Zotpress \<= 7.3.12 - Missing Authorization (CVSS 4.3, kseaborn Zotpress)
- [CVE-2024-51527](https://cve.now/CVE-2024-51527.md): Permission control vulnerability in the Gallery app Impact: Successful exploitation of this vulnerability may affect service confidentiality (CVSS 5.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-51526](https://cve.now/CVE-2024-51526.md): Permission control vulnerability in the hidebug module Impact: Successful exploitation of this vulnerability may affect service confidential (CVSS 8.2, Huawei HarmonyOS)
- [CVE-2024-51525](https://cve.now/CVE-2024-51525.md): Permission control vulnerability in the clipboard module Impact: Successful exploitation of this vulnerability may affect service confidenti (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-47255](https://cve.now/CVE-2024-47255.md): In 2N Access Commander versions 3.1.1.2 and prior, a local attacker can escalate their privileges in the system which could allow for arbitr (CVSS 4.7, 2N Access Commander)
- [CVE-2024-51524](https://cve.now/CVE-2024-51524.md): Permission control vulnerability in the Wi-Fi module Impact: Successful exploitation of this vulnerability may affect service confidentialit (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2024-51523](https://cve.now/CVE-2024-51523.md): Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confiden (CVSS 7.1, Huawei HarmonyOS)
- [CVE-2024-51522](https://cve.now/CVE-2024-51522.md): Vulnerability of improper device information processing in the device management module Impact: Successful exploitation of this vulnerabilit (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-47254](https://cve.now/CVE-2024-47254.md): In 2N Access Commander versions 3.1.1.2 and prior, an Insufficient Verification of Data Authenticity vulnerability could allow an attacker (CVSS 6.3, 2N Access Commander)
- [CVE-2024-51521](https://cve.now/CVE-2024-51521.md): Input parameter verification vulnerability in the background service module Impact: Successful exploitation of this vulnerability may affect (CVSS 5.7, Huawei HarmonyOS)
- [CVE-2024-51520](https://cve.now/CVE-2024-51520.md): Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect avai (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-51519](https://cve.now/CVE-2024-51519.md): Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect avai (CVSS 5.0, Huawei HarmonyOS)
- [CVE-2024-47253](https://cve.now/CVE-2024-47253.md): In 2N Access Commander versions 3.1.1.2 and prior, a Path Traversal vulnerability could allow an attacker with administrative privileges to (CVSS 7.2, 2N Access Commander)
- [CVE-2024-51518](https://cve.now/CVE-2024-51518.md): Vulnerability of message types not being verified in the advanced messaging modul Impact: Successful exploitation of this vulnerability may (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2024-51517](https://cve.now/CVE-2024-51517.md): Vulnerability of improper memory access in the phone service module Impact: Successful exploitation of this vulnerability may affect availab (CVSS 5.1, Huawei HarmonyOS)
- [CVE-2024-51516](https://cve.now/CVE-2024-51516.md): Permission control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to function (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-51515](https://cve.now/CVE-2024-51515.md): Race condition vulnerability in the kernel network module Impact:Successful exploitation of this vulnerability may affect availability. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-51514](https://cve.now/CVE-2024-51514.md): Vulnerability of pop-up windows belonging to no app in the VPN module Impact: Successful exploitation of this vulnerability may affect serv (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2024-51513](https://cve.now/CVE-2024-51513.md): Vulnerability of processes not being fully terminated in the VPN module Impact: Successful exploitation of this vulnerability will affect po (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2024-51512](https://cve.now/CVE-2024-51512.md): Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-51511](https://cve.now/CVE-2024-51511.md): Vulnerability of parameter type not being verified in the WantAgent module Impact: Successful exploitation of this vulnerability may affect (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2024-9667](https://cve.now/CVE-2024-9667.md): Seriously Simple Podcasting \<= 3.5.0 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, podcastmotor Seriously Simple Podcasting)
- [CVE-2024-10711](https://cve.now/CVE-2024-10711.md): WooCommerce Report \<= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update (CVSS 8.8, ithemelandco REPORTiT – Advanced Reporting for WooCommerce)
- [CVE-2024-10114](https://cve.now/CVE-2024-10114.md): Social Login - WordPress / WooCommerce Plugin \<= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider (CVSS 8.1, WPWeb WooCommerce - Social Login)
- [CVE-2024-9443](https://cve.now/CVE-2024-9443.md): Basticom Framework \<= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, Basticom Framework)
- [CVE-2024-51510](https://cve.now/CVE-2024-51510.md): Out-of-bounds access vulnerability in the logo module Impact: Successful exploitation of this vulnerability may affect service confidentiali (CVSS 7.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-47402](https://cve.now/CVE-2024-47402.md): Liteos\_a has an Out-of-bounds Read vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-47137](https://cve.now/CVE-2024-47137.md): Liteos\_a has an out-of-bounds Write vulnerability (CVSS 8.4, OpenHarmony)
- [CVE-2024-47404](https://cve.now/CVE-2024-47404.md): Liteos\_a has a double free vulnerability (CVSS 8.4, OpenHarmony)
- [CVE-2024-47797](https://cve.now/CVE-2024-47797.md): Liteos\_a has an out-of-bounds Write vulnerability (CVSS 8.4, OpenHarmony)
- [CVE-2024-10097](https://cve.now/CVE-2024-10097.md): Loginizer Security and Loginizer \<= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider (CVSS 8.1, Softaculous Loginizer Security · softaculous Loginizer)
- [CVE-2024-9883](https://cve.now/CVE-2024-9883.md): Pods \< 3.2.7.1 - Admin+ Stored XSS (CVSS 4.8, Pods)
- [CVE-2024-9689](https://cve.now/CVE-2024-9689.md): Post From Frontend \<= 1.0.0 - Post Deletion via CSRF (CVSS 4.1, Post From Frontend)
- [CVE-2024-7877](https://cve.now/CVE-2024-7877.md): Appointment Booking Calendar \< 1.6.7.55 - Admin+ Stored XSS (CVSS 4.8, Appointment Booking Calendar — Simply Schedule Appointments…)
- [CVE-2024-7876](https://cve.now/CVE-2024-7876.md): Appointment Booking Calendar \< 1.6.7.55 - Admin+ Stored XSS (CVSS 4.8, Appointment Booking Calendar — Simply Schedule Appointments…)
- [CVE-2024-5578](https://cve.now/CVE-2024-5578.md): Table of Contents Plus \<= 2408 - Editor+ Stored XSS (CVSS 4.8, Table of Contents Plus)
- [CVE-2024-9459](https://cve.now/CVE-2024-9459.md): SQL Injection (CVSS 8.3, ManageEngine Exchange Reporter Plus)
- [CVE-2024-10340](https://cve.now/CVE-2024-10340.md): Shortcodes Blocks Creator Ultimate \<= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, cmorillas1 Shortcodes Blocks Creator Ultimate)
- [CVE-2024-10810](https://cve.now/CVE-2024-10810.md): code-projects E-Health Care System app\_request.php sql injection (CVSS 5.3, code-projects E-Health Care System)
- [CVE-2024-10809](https://cve.now/CVE-2024-10809.md): code-projects E-Health Care System chat.php sql injection (CVSS 5.3, code-projects E-Health Care System)
- [CVE-2024-10808](https://cve.now/CVE-2024-10808.md): code-projects E-Health Care System req\_detail.php sql injection (CVSS 5.3, code-projects E-Health Care System)
- [CVE-2024-10807](https://cve.now/CVE-2024-10807.md): PHPGurukul Hospital Management System search.php cross site scripting (CVSS 5.1, PHPGurukul Hospital Management System)
- [CVE-2024-10806](https://cve.now/CVE-2024-10806.md): PHPGurukul Hospital Management System betweendates-detailsreports.php cross site scripting (CVSS 5.1, PHPGurukul Hospital Management System)
- [CVE-2024-48176](https://cve.now/CVE-2024-48176.md): Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2024-48312](https://cve.now/CVE-2024-48312.md): WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page. (CVSS 5.4)
- [CVE-2024-48746](https://cve.now/CVE-2024-48746.md): An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language proc (CVSS 9.8)
- [CVE-2024-50993](https://cve.now/CVE-2024-50993.md): Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin\_account.cgi. (CVSS 8.0)
- [CVE-2024-50994](https://cve.now/CVE-2024-50994.md): Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6\_fix.cgi via the ipv6\_wan\_ip (CVSS 5.7)
- [CVE-2024-50995](https://cve.now/CVE-2024-50995.md): Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share\_name parameter at usb\_remote\_smb\_conf.cgi. (CVSS 5.7)
- [CVE-2024-50996](https://cve.now/CVE-2024-50996.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpa (CVSS 5.7)
- [CVE-2024-50997](https://cve.now/CVE-2024-50997.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the ppt (CVSS 5.7)
- [CVE-2024-50998](https://cve.now/CVE-2024-50998.md): Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpn\_serv (CVSS 5.7)
- [CVE-2024-50999](https://cve.now/CVE-2024-50999.md): Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. (CVSS 5.7)
- [CVE-2024-51000](https://cve.now/CVE-2024-51000.md): Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component wireless.cgi via the opmode, opm (CVSS 5.7)
- [CVE-2024-51001](https://cve.now/CVE-2024-51001.md): Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sysDNSHost parameter at ddns.cgi. (CVSS 5.7)
- [CVE-2024-51002](https://cve.now/CVE-2024-51002.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the l2t (CVSS 5.7)
- [CVE-2024-51003](https://cve.now/CVE-2024-51003.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilit (CVSS 5.7)
- [CVE-2024-51004](https://cve.now/CVE-2024-51004.md): Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb\_device.cgi vi (CVSS 5.7)
- [CVE-2024-51005](https://cve.now/CVE-2024-51005.md): Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share\_name parameter at usb\_remote\_smb\_conf.cgi. (CVSS 8.0)
- [CVE-2024-51006](https://cve.now/CVE-2024-51006.md): Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6\_static\_ip parameter in the ipv6\_tunnel function. (CVSS 5.7)
- [CVE-2024-51007](https://cve.now/CVE-2024-51007.md): Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi. (CVSS 5.7)
- [CVE-2024-51008](https://cve.now/CVE-2024-51008.md): Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system\_name parameter at wiz\_dyn.cgi. (CVSS 8.0)
- [CVE-2024-51009](https://cve.now/CVE-2024-51009.md): Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan\_gateway parameter at ether.cgi. (CVSS 8.0)
- [CVE-2024-51010](https://cve.now/CVE-2024-51010.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerab (CVSS 8.0)
- [CVE-2024-51011](https://cve.now/CVE-2024-51011.md): Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe\_localip paramete (CVSS 5.7)
- [CVE-2024-51012](https://cve.now/CVE-2024-51012.md): Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6\_pri\_dns parameter at ipv6\_fix.cgi. (CVSS 5.7)
- [CVE-2024-51013](https://cve.now/CVE-2024-51013.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the RADIUSAddr%d\_wla parameter at wireless.cgi. (CVSS 5.7)
- [CVE-2024-51014](https://cve.now/CVE-2024-51014.md): Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid\_an parameter in bridge\_wireless\_main.cgi. (CVSS 5.7)
- [CVE-2024-51015](https://cve.now/CVE-2024-51015.md): Netgear R7000P v1.3.3.154 was discovered to contain a command injection vulnerability via the device\_name2 parameter at operation\_mode.cgi. (CVSS 5.7)
- [CVE-2024-51016](https://cve.now/CVE-2024-51016.md): Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the addName%d parameter in usb\_approve.cgi. (CVSS 5.7)
- [CVE-2024-51017](https://cve.now/CVE-2024-51017.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the l2tp\_user\_netmask parameter at l2tp.cgi. (CVSS 5.7)
- [CVE-2024-51018](https://cve.now/CVE-2024-51018.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp\_user\_netmask parameter at pptp.cgi. (CVSS 5.7)
- [CVE-2024-51019](https://cve.now/CVE-2024-51019.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pppoe\_localnetmask parameter at pppoe.cgi. (CVSS 5.7)
- [CVE-2024-51020](https://cve.now/CVE-2024-51020.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the apn parameter at usbISP\_detail\_edit.cgi. (CVSS 5.7)
- [CVE-2024-51021](https://cve.now/CVE-2024-51021.md): Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injection vulnerability via the wan\_g (CVSS 8.0)
- [CVE-2024-51022](https://cve.now/CVE-2024-51022.md): Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid parameter in bridge\_wireless\_main.cgi. (CVSS 5.7)
- [CVE-2024-51023](https://cve.now/CVE-2024-51023.md): D-Link DIR\_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySe (CVSS 8.8)
- [CVE-2024-51024](https://cve.now/CVE-2024-51024.md): D-Link DIR\_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings functi (CVSS 8.0)
- [CVE-2024-51115](https://cve.now/CVE-2024-51115.md): DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability. (CVSS 9.8)
- [CVE-2024-51116](https://cve.now/CVE-2024-51116.md): Tenda AC6 v2.0 V15.03.06.50 was discovered to contain a buffer overflow in the function 'formSetPPTPServer'. (CVSS 8.8)
- [CVE-2024-51132](https://cve.now/CVE-2024-51132.md): An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary (CVSS 9.8, ca.uhn.hapi.fhir:org.hl7.fhir.convertors · ca.uhn.hapi.f… +7)
- [CVE-2024-51240](https://cve.now/CVE-2024-51240.md): An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, (CVSS 8.0)
- [CVE-2024-51358](https://cve.now/CVE-2024-51358.md): An issue in Linux Server Heimdall v.2.6.1 allows a remote attacker to execute arbitrary code via a crafted script to the Add new application (CVSS 9.8)
- [CVE-2024-51362](https://cve.now/CVE-2024-51362.md): The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera footage can be accessed th (CVSS 6.5)
- [CVE-2024-51379](https://cve.now/CVE-2024-51379.md): Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. (CVSS 8.4)
- [CVE-2024-51380](https://cve.now/CVE-2024-51380.md): Stored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. (CVSS 8.4)
- [CVE-2024-51381](https://cve.now/CVE-2024-51381.md): Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, includ (CVSS 8.4)
- [CVE-2024-51382](https://cve.now/CVE-2024-51382.md): Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. (CVSS 8.4)
- [CVE-2024-52013](https://cve.now/CVE-2024-52013.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the ppt (CVSS 5.7)
- [CVE-2024-52014](https://cve.now/CVE-2024-52014.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the ppt (CVSS 5.7)
- [CVE-2024-52015](https://cve.now/CVE-2024-52015.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the ppt (CVSS 5.7)
- [CVE-2024-52016](https://cve.now/CVE-2024-52016.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilit (CVSS 5.7)
- [CVE-2024-52017](https://cve.now/CVE-2024-52017.md): Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge\_wireless\_main.cgi. (CVSS 5.7)
- [CVE-2024-52018](https://cve.now/CVE-2024-52018.md): Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system\_name parameter at genie\_dyn.cgi. (CVSS 8.0)
- [CVE-2024-52019](https://cve.now/CVE-2024-52019.md): Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan\_gateway parameter at genie\_fix2.cgi. (CVSS 8.0)
- [CVE-2024-52020](https://cve.now/CVE-2024-52020.md): Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan\_gateway parameter at wiz\_fix2.cgi. (CVSS 8.0)
- [CVE-2024-52021](https://cve.now/CVE-2024-52021.md): Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan\_gateway parameter at bsw\_fix.cgi. (CVSS 8.0)
- [CVE-2024-52022](https://cve.now/CVE-2024-52022.md): Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerab (CVSS 8.0)
- [CVE-2024-52023](https://cve.now/CVE-2024-52023.md): Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe\_localip paramete (CVSS 5.7)
- [CVE-2024-52024](https://cve.now/CVE-2024-52024.md): Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe\_localip paramete (CVSS 5.7)
- [CVE-2024-52025](https://cve.now/CVE-2024-52025.md): Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe\_localip paramete (CVSS 5.7)
- [CVE-2024-52026](https://cve.now/CVE-2024-52026.md): Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe\_localip paramete (CVSS 5.7)
- [CVE-2024-52028](https://cve.now/CVE-2024-52028.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp\_user\_netmask parameter at wiz\_pptp.cgi. (CVSS 5.7)
- [CVE-2024-52029](https://cve.now/CVE-2024-52029.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp\_user\_netmask parameter at genie\_pptp.cgi. (CVSS 5.7)
- [CVE-2024-52030](https://cve.now/CVE-2024-52030.md): Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp\_user\_netmask parameter at ru\_wan\_flow.cgi. (CVSS 5.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.