# CVEs published 2024-11-06

93 CVEs were published on November 6, 2024: 8 critical, 11 high. Days are UTC.

- [CVE-2024-10928](https://cve.now/CVE-2024-10928.md): MonoCMS Posts Page opensaved.php cross site scripting (CVSS 5.3, MonoCMS)
- [CVE-2024-10927](https://cve.now/CVE-2024-10927.md): MonoCMS Account Information Page account.php cross site scripting (CVSS 5.3, MonoCMS)
- [CVE-2024-50340](https://cve.now/CVE-2024-50340.md): Ability to change environment from query in symfony/runtime (CVSS 7.3, symfony · symfony/runtime +1)
- [CVE-2024-50341](https://cve.now/CVE-2024-50341.md): Security::login does not take into account custom user\_checker in symfony/security-bundle (CVSS 3.1, symfony · symfony/security-bundle +1)
- [CVE-2024-50342](https://cve.now/CVE-2024-50342.md): Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client (CVSS 3.1, symfony · symfony/http-client +1)
- [CVE-2024-50343](https://cve.now/CVE-2024-50343.md): Incorrect response from Validator when input ends with \`\\n\` in symfony/validator (CVSS 3.1, symfony · symfony/symfony +1)
- [CVE-2024-10926](https://cve.now/CVE-2024-10926.md): IBPhoenix ibWebAdmin Tabelas Section toggle\_fold\_panel.php cross site scripting (CVSS 5.3, IBPhoenix ibWebAdmin)
- [CVE-2024-50345](https://cve.now/CVE-2024-50345.md): Open redirect via browser-sanitized URLs in symfony/http-foundation (CVSS 3.1, symfony · symfony/http-foundation)
- [CVE-2024-51736](https://cve.now/CVE-2024-51736.md): Command execution hijack on Windows with Process class in symfony/process (CVSS 0.0, symfony · symfony/process +1)
- [CVE-2024-10941](https://cve.now/CVE-2024-10941.md): A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. (CVSS 4.3, Mozilla Firefox)
- [CVE-2024-51754](https://cve.now/CVE-2024-51754.md): Unguarded calls to \_\_toString() when nesting an object into an array in Twig (CVSS 2.2, twigphp Twig · twig/twig)
- [CVE-2024-51755](https://cve.now/CVE-2024-51755.md): Unguarded calls to \_\_isset() and to array-accesses when the sandbox is enabled in Twig (CVSS 2.2, twigphp Twig · twig/twig)
- [CVE-2024-51757](https://cve.now/CVE-2024-51757.md): Fixes security vulnerability that allowed for server side code to be executed by a \<script\> tag (CVSS 9.3, capricorn86 happy-dom · happy-dom)
- [CVE-2024-51988](https://cve.now/CVE-2024-51988.md): HTTP API's queue deletion endpoint does not verify that the user has a required permission (CVSS 6.5, rabbitmq-server)
- [CVE-2024-51751](https://cve.now/CVE-2024-51751.md): Arbitrary file read with File and UploadButton components in Gradio (CVSS 6.5, gradio-app gradio · gradio)
- [CVE-2024-20418](https://cve.now/CVE-2024-20418.md): Cisco Ultra-Reliable Wireless Backhaul Software Command Injection Vulnerability (CVSS 10.0, Cisco Aironet Access Point Software)
- [CVE-2024-10318](https://cve.now/CVE-2024-10318.md): NGINX OpenID Connect Vulnerability (CVSS 5.4, F5 NGINX OpenID Connect · F5 NGINX Instance Manager +2)
- [CVE-2024-20540](https://cve.now/CVE-2024-20540.md): Cisco Unified Contact Center Management Portal Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Unified Contact Center Management Portal)
- [CVE-2024-20539](https://cve.now/CVE-2024-20539.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2024-20538](https://cve.now/CVE-2024-20538.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2024-20537](https://cve.now/CVE-2024-20537.md): Cisco Identity Services Engine Authorization Bypass Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2024-20536](https://cve.now/CVE-2024-20536.md): Cisco Nexus Dashboard Fabric Controller SQL Injection Vulnerability (CVSS 8.8, Cisco Data Center Network Manager)
- [CVE-2024-20534](https://cve.now/CVE-2024-20534.md): Cisco IP Phone 6800, 7800, 8800, and 9800 Series with Multiplatform Firmware Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco IP Phones with Multiplatform Firmware · Cisco Session…)
- [CVE-2024-20533](https://cve.now/CVE-2024-20533.md): Cisco IP Phone 6800, 7800, 8800, and 9800 Series with Multiplatform Firmware Stored Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco IP Phones with Multiplatform Firmware · Cisco Session…)
- [CVE-2024-20532](https://cve.now/CVE-2024-20532.md): Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability (CVSS 5.5, Cisco Identity Services Engine Software)
- [CVE-2024-20531](https://cve.now/CVE-2024-20531.md): Cisco Identity Services Engine XML External Entity Injection Vulnerability (CVSS 5.5, Cisco Identity Services Engine Software)
- [CVE-2024-20530](https://cve.now/CVE-2024-20530.md): Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2024-20529](https://cve.now/CVE-2024-20529.md): Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability (CVSS 5.5, Cisco Identity Services Engine Software)
- [CVE-2024-20528](https://cve.now/CVE-2024-20528.md): Cisco Identity Services Engine Path Traversal Vulnerability (CVSS 3.8, Cisco Identity Services Engine Software)
- [CVE-2024-20527](https://cve.now/CVE-2024-20527.md): Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability (CVSS 5.5, Cisco Identity Services Engine Software)
- [CVE-2024-20525](https://cve.now/CVE-2024-20525.md): Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2024-20514](https://cve.now/CVE-2024-20514.md): Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Evolved Programmable Network Manager · Cisco Prime In…)
- [CVE-2024-20511](https://cve.now/CVE-2024-20511.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2024-20507](https://cve.now/CVE-2024-20507.md): Cisco Meeting Management Information Disclosure Vulnerability (CVSS 4.3, Cisco Meeting Management)
- [CVE-2024-20504](https://cve.now/CVE-2024-20504.md): Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Stored Cross-Site Scripting Vulnerabilities (CVSS 5.4, Cisco Secure Email · Cisco Secure Web Appliance)
- [CVE-2024-20487](https://cve.now/CVE-2024-20487.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2024-20484](https://cve.now/CVE-2024-20484.md): Cisco Enterprise Chat and Email Denial of Service Vulnerability (CVSS 7.5, Cisco Enterprise Chat and Email)
- [CVE-2024-20457](https://cve.now/CVE-2024-20457.md): Cisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability (CVSS 6.5, Cisco Unified Communications Manager IM and Presence Service)
- [CVE-2024-20445](https://cve.now/CVE-2024-20445.md): Cisco IP Phone 7800, 8800, and 9800 Series Information Disclosure Vulnerability (CVSS 5.3, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2024-20476](https://cve.now/CVE-2024-20476.md): Cisco Identity Services Engine Authorization Bypass Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2024-20371](https://cve.now/CVE-2024-20371.md): Cisco Nexus 3550-F Switches Access Control List Programming Vulnerability (CVSS 5.3, Cisco Nexus 3550 System Software)
- [CVE-2024-10827](https://cve.now/CVE-2024-10827.md): Use after free in Serial in Google Chrome prior to 130.0.6723.116 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2024-10826](https://cve.now/CVE-2024-10826.md): Use after free in Family Experiences in Google Chrome on Android prior to 130.0.6723.116 allowed a remote attacker to potentially exploit he (CVSS 8.8, Google Chrome)
- [CVE-2024-10920](https://cve.now/CVE-2024-10920.md): mariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded key (CVSS 2.3, mariazevedo88 travels-java-api)
- [CVE-2024-10919](https://cve.now/CVE-2024-10919.md): didi Super-Jacoco triggerUnitCover os command injection (CVSS 5.3, didi Super-Jacoco)
- [CVE-2024-10916](https://cve.now/CVE-2024-10916.md): D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure (CVSS 6.9, D-Link DNS-320 · D-Link DNS-320LW +2)
- [CVE-2024-6861](https://cve.now/CVE-2024-6861.md): Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api (CVSS 7.5, foreman · Red Hat Satellite 6.12 for RHEL +1)
- [CVE-2024-10082](https://cve.now/CVE-2024-10082.md): CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. (CVSS 8.7, Ericsson CodeChecker · codechecker)
- [CVE-2024-10081](https://cve.now/CVE-2024-10081.md): CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. (CVSS 10.0, Ericsson CodeChecker · codechecker)
- [CVE-2024-35146](https://cve.now/CVE-2024-35146.md): IBM Maximo Application Suite cross-site scripting (CVSS 5.4, IBM Maximo Application Suite)
- [CVE-2020-11859](https://cve.now/CVE-2020-11859.md): Potential Cross Site Scripting vulnerability in OpenText iManager (CVSS 7.6, OpenText iManager)
- [CVE-2024-10915](https://cve.now/CVE-2024-10915.md): D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account\_mgr.cgi cgi\_user\_add os command injection (CVSS 9.2, D-Link DNS-320 · D-Link DNS-320LW +2)
- [CVE-2024-10914](https://cve.now/CVE-2024-10914.md): D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account\_mgr.cgi cgi\_user\_add os command injection (CVSS 9.2, D-Link DNS-320 · D-Link DNS-320LW +2)
- [CVE-2024-10186](https://cve.now/CVE-2024-10186.md): Event Post \<= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events\_cal Shortcode (CVSS 6.4, bastho Event post)
- [CVE-2024-8323](https://cve.now/CVE-2024-8323.md): Pricing Tables WordPress Plugin – Easy Pricing Tables \<= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute (CVSS 6.4, fatcatapps Pricing Table WordPress Plugin – Easy Pricing Ta…)
- [CVE-2024-10168](https://cve.now/CVE-2024-10168.md): Active Products Tables for WooCommerce. Use constructor to create tables \<= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot\_button Shortcode (CVSS 6.4, realmag777 Active Products Tables for WooCommerce. Use cons…)
- [CVE-2024-10715](https://cve.now/CVE-2024-10715.md): MapPress Maps for WordPress \<= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block (CVSS 6.4, chrisvrichardson MapPress Maps for WordPress)
- [CVE-2024-9902](https://cve.now/CVE-2024-9902.md): Ansible-core: ansible-core user may read/write unauthorized content (CVSS 6.3, ansible-core · Red Hat Ansible Automation Platform Execu… +4)
- [CVE-2024-8615](https://cve.now/CVE-2024-8615.md): WP JobSearch \<= 2.6.7 - Unauthenticated Arbitrary File Upload (CVSS 10.0, eyecix JobSearch WP Job Board)
- [CVE-2024-8614](https://cve.now/CVE-2024-8614.md): WP JobSearch \<= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 9.9, eyecix JobSearch WP Job Board)
- [CVE-2024-52043](https://cve.now/CVE-2024-52043.md): User enumeration in HubHub (CVSS 6.9, HumHub GmbH & Co. KG HumHub)
- [CVE-2024-9681](https://cve.now/CVE-2024-9681.md): HSTS subdomain overwrites parent cache entry (CVSS 5.9, curl)
- [CVE-2024-6626](https://cve.now/CVE-2024-6626.md): EleForms – All In One Form Integration including DB for Elementor \<= 2.9.9.9 - Missing Authorization (CVSS 5.3, cscode EleForms – All In One Form Integration including DB…)
- [CVE-2024-9946](https://cve.now/CVE-2024-9946.md): Social Share, Social Login and Social Comments Plugin – Super Socializer \<= 7.13.68 - Authentication Bypass via Disqus OAuth provider (CVSS 8.1, the\_champ Social Share, Social Login and Social Comments Pl…)
- [CVE-2024-10543](https://cve.now/CVE-2024-10543.md): Tumult Hype Animations \<= 1.9.14 - Missing Authorization (CVSS 4.3, tumultinc Tumult Hype Animations)
- [CVE-2024-10020](https://cve.now/CVE-2024-10020.md): Heateor Social Login WordPress \<= 1.1.35 - Authentication Bypass via Disqus OAuth provider (CVSS 8.1, Heateor Social Login WordPress)
- [CVE-2024-10535](https://cve.now/CVE-2024-10535.md): Video Gallery for WooCommerce \<= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion (CVSS 5.3, nitramix Video Gallery for WooCommerce)
- [CVE-2024-9307](https://cve.now/CVE-2024-9307.md): mFolio Lite \<= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files (CVSS 9.9, themelooks mFolio Lite)
- [CVE-2024-9934](https://cve.now/CVE-2024-9934.md): Wp-ImageZoom \<= 1.1.0 - Reflected XSS (CVSS 6.1, Wp-ImageZoom)
- [CVE-2024-7879](https://cve.now/CVE-2024-7879.md): WP ULike \< 4.7.5 - Admin+ Stored XSS via Widgets (CVSS 4.8, WP ULike)
- [CVE-2024-49409](https://cve.now/CVE-2024-49409.md): Out-of-bounds write in Battery Full Capacity node prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write ou (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2024-49408](https://cve.now/CVE-2024-49408.md): Out-of-bounds write in usb driver prior to Firmware update Sep-2024 Release on Galaxy S24 allows local attackers to write out-of-bounds memo (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2024-49407](https://cve.now/CVE-2024-49407.md): Improper access control in Samsung Flow prior to version 4.9.15.7 allows physical attackers to access data across multiple user profiles. (CVSS 4.6, Samsung Mobile Samsung Flow)
- [CVE-2024-49406](https://cve.now/CVE-2024-49406.md): Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction. (CVSS 6.7, Samsung Mobile Blockchain Keystore)
- [CVE-2024-49405](https://cve.now/CVE-2024-49405.md): Improper authentication in Private Info in Samsung Pass in prior to version 4.4.04.7 allows physical attackers to access sensitive informati (CVSS 5.3, Samsung Mobile Samsung Pass)
- [CVE-2024-49404](https://cve.now/CVE-2024-49404.md): Improper Access Control in Samsung Video Player prior to versions 7.3.29.1 in Android 12, 7.3.36.1 in Android 13, and 7.3.41.230 in Android (CVSS 5.5, Samsung Mobile Samsung Video Player)
- [CVE-2024-49403](https://cve.now/CVE-2024-49403.md): Improper access control in Samsung Voice Recorder prior to version 21.5.40.37 allows physical attackers to access recording files on the loc (CVSS 4.6, Samsung Mobile Samsung Voice Recorder)
- [CVE-2024-49402](https://cve.now/CVE-2024-49402.md): Improper input validation in Dressroom prior to SMR Nov-2024 Release 1 allow physical attackers to access data across multiple user profiles (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2024-49401](https://cve.now/CVE-2024-49401.md): Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-34682](https://cve.now/CVE-2024-34682.md): Improper authorization in Settings prior to SMR Nov-2024 Release 1 allows physical attackers to access stored WiFi password in Maintenance M (CVSS 2.4, Samsung Mobile Devices)
- [CVE-2024-34681](https://cve.now/CVE-2024-34681.md): Improper input validation in BluetoothAdapter prior to SMR Nov-2024 Release 1 allows local attackers to cause local permanent denial of serv (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2024-34680](https://cve.now/CVE-2024-34680.md): Use of implicit intent for sensitive communication in WlanTest prior to SMR Nov-2024 Release 1 allows local attackers to get sensitive infor (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34679](https://cve.now/CVE-2024-34679.md): Incorrect default permissions in Crane prior to SMR Nov-2024 Release 1 allows local attackers to access files with phone privilege. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34678](https://cve.now/CVE-2024-34678.md): Out-of-bounds write in libsapeextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory corruption. (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2024-34677](https://cve.now/CVE-2024-34677.md): Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legiti (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34676](https://cve.now/CVE-2024-34676.md): Out-of-bounds write in parsing subtitle file in libsubextractor.so prior to SMR Nov-2024 Release 1 allows local attackers to cause memory co (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2024-34675](https://cve.now/CVE-2024-34675.md): Improper access control in Dex Mode prior to SMR Nov-2024 Release 1 allows physical attackers to temporarily access to unlocked screen. (CVSS 2.4, Samsung Mobile Devices)
- [CVE-2024-34674](https://cve.now/CVE-2024-34674.md): Improper access control in Contacts prior to SMR Nov-2024 Release 1 allows physical attackers to access data across multiple user profiles. (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2024-34673](https://cve.now/CVE-2024-34673.md): Improper Input Validation in IpcProtocol in Modem prior to SMR Nov-2024 Release 1 allows local attackers to cause Denial-of-Service. (CVSS 4.1, Samsung Mobile Devices)
- [CVE-2024-10647](https://cve.now/CVE-2024-10647.md): WS Form LITE – Drag & Drop Contact Form Builder for WordPress \<= 1.9.244 - Reflected Cross-Site Scripting via URL (CVSS 6.1, westguard WS Form LITE – Drag & Drop Contact Form Builder)
- [CVE-2024-48325](https://cve.now/CVE-2024-48325.md): Portabilis i-Educar 2.8.0 is vulnerable to SQL Injection in the "getDocuments" function of the "InstituicaoDocumentacaoController" class. (CVSS 8.1)
- [CVE-2024-50637](https://cve.now/CVE-2024-50637.md): UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function. (CVSS 5.4, unopim/unopim)
- [CVE-2024-51409](https://cve.now/CVE-2024-51409.md): Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network packet in a fixed fo (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.