# CVEs published 2024-11-07

114 CVEs were published on November 7, 2024: 9 critical, 52 high. Days are UTC.

- [CVE-2024-47072](https://cve.now/CVE-2024-47072.md): XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream (CVSS 7.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2024-51987](https://cve.now/CVE-2024-51987.md): HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect (CVSS 5.4, DuendeSoftware Duende.AccessTokenManagement · Duende.Access…)
- [CVE-2024-51998](https://cve.now/CVE-2024-51998.md): Path traversal using file URI scheme without supplying hostname in changedetection.io (CVSS 8.6, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2024-8424](https://cve.now/CVE-2024-8424.md): WatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEM (CVSS 8.5, WatchGuard Endpoint Security · WatchGuard Panda Dome)
- [CVE-2024-49523](https://cve.now/CVE-2024-49523.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-49524](https://cve.now/CVE-2024-49524.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-8810](https://cve.now/CVE-2024-8810.md): Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed GitHub Apps to grant themselves write access (CVSS 8.7, GitHub Enterprise Server)
- [CVE-2024-10824](https://cve.now/CVE-2024-10824.md): Authorization Bypass Vulnerability was Identified in GitHub Enterprise Server that Allowed Unauthorized Internal Users to Access Secret Scanning Alert Data (CVSS 6.0, GitHub Enterprise Server)
- [CVE-2024-10975](https://cve.now/CVE-2024-10975.md): Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission (CVSS 7.7, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2024-10007](https://cve.now/CVE-2024-10007.md): Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation (CVSS 8.7, GitHub Enterprise Server)
- [CVE-2024-10969](https://cve.now/CVE-2024-10969.md): 1000 Projects Bookstore Management System Login login\_process.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-10968](https://cve.now/CVE-2024-10968.md): 1000 Projects Bookstore Management System contact\_process.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-10967](https://cve.now/CVE-2024-10967.md): code-projects E-Health Care System delete\_user\_appointment\_request.php sql injection (CVSS 6.9, code-projects E-Health Care System)
- [CVE-2024-10966](https://cve.now/CVE-2024-10966.md): TOTOLINK X18 cstecgi.cgi os command injection (CVSS 5.3, TOTOLINK X18)
- [CVE-2024-51993](https://cve.now/CVE-2024-51993.md): Password is stored in clear in the database in Combodo iTop (CVSS 3.4, Combodo iTop)
- [CVE-2024-51994](https://cve.now/CVE-2024-51994.md): Cross-site Scripting in portal picture upload in Combodo iTop (CVSS 7.1, Combodo iTop)
- [CVE-2024-51995](https://cve.now/CVE-2024-51995.md): Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop (CVSS 7.1, Combodo iTop)
- [CVE-2024-51989](https://cve.now/CVE-2024-51989.md): Cross-site Scripting (XSS) Vulnerability in PasswordPusher (CVSS 7.1, pglombardo PasswordPusher)
- [CVE-2024-51758](https://cve.now/CVE-2024-51758.md): Exported files stored in default (\`public\`) filesystem if not reconfigured in filament (CVSS 2.3, filamentphp filament · filament/actions)
- [CVE-2024-45794](https://cve.now/CVE-2024-45794.md): SQL Injection in CreateUser API in devtron (CVSS 8.3, devtron-labs devtron · github.com/devtron-labs/devtron)
- [CVE-2024-47073](https://cve.now/CVE-2024-47073.md): Dataease arbitrary interface access vulnerability (CVSS 9.3, dataease)
- [CVE-2024-10965](https://cve.now/CVE-2024-10965.md): emqx neuron JSON File schema information disclosure (CVSS 5.3, emqx neuron)
- [CVE-2024-10964](https://cve.now/CVE-2024-10964.md): emqx neuron plugin\_handle.c handle\_add\_plugin buffer overflow (CVSS 5.3, emqx neuron)
- [CVE-2024-40715](https://cve.now/CVE-2024-40715.md): A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypas (CVSS 7.7, Veeam Enterprise Manager)
- [CVE-2024-10963](https://cve.now/CVE-2024-10963.md): Pam: improper hostname interpretation in pam\_access leads to access control bypass (CVSS 7.4, pam · Red Hat Enterprise Linux +2)
- [CVE-2024-10668](https://cve.now/CVE-2024-10668.md): Auth Bypass in Quickshare (CVSS 5.9, Google Nearby)
- [CVE-2024-8378](https://cve.now/CVE-2024-8378.md): Safe SVG \< 2.2.6 - Author+ SVG Sanitisation Bypass (CVSS 4.8, Safe SVG)
- [CVE-2024-9926](https://cve.now/CVE-2024-9926.md): Jetpack \< 13.9.1 - Subscriber+ Arbitrary Feedback Access (CVSS 4.3, Jetpack)
- [CVE-2024-43440](https://cve.now/CVE-2024-43440.md): Moodle: lfi vulnerability when restoring malformed block backups (CVSS 7.5, moodle · moodle/moodle)
- [CVE-2024-43438](https://cve.now/CVE-2024-43438.md): Moodle: idor in feedback non-respondents report allows messaging arbitrary site users (CVSS 7.5, moodle · moodle/moodle)
- [CVE-2024-43436](https://cve.now/CVE-2024-43436.md): Moodle: site administration sql injection via xmldb editor (CVSS 7.2, moodle · moodle/moodle)
- [CVE-2024-43434](https://cve.now/CVE-2024-43434.md): Moodle: csrf risk in feedback non-respondents report (CVSS 8.1, moodle · moodle/moodle)
- [CVE-2024-43431](https://cve.now/CVE-2024-43431.md): Moodle: idor in badges allows deletion of arbitrary badges (CVSS 7.5, moodle · moodle/moodle)
- [CVE-2024-43428](https://cve.now/CVE-2024-43428.md): Moodle: cache poisoning via injection into storage (CVSS 7.7, moodle · moodle/moodle)
- [CVE-2024-43426](https://cve.now/CVE-2024-43426.md): Moodle: arbitrary file read risk through pdftex (CVSS 7.5, moodle · moodle/moodle)
- [CVE-2024-43425](https://cve.now/CVE-2024-43425.md): Moodle: remote code execution via calculated question types (CVSS 8.1, moodle · moodle/moodle)
- [CVE-2024-8442](https://cve.now/CVE-2024-8442.md): Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider \<= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2024-24914](https://cve.now/CVE-2024-24914.md): Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. (CVSS 8.0, checkpoint ClusterXL, Multi-Domain Security Management, Qua…)
- [CVE-2024-10526](https://cve.now/CVE-2024-10526.md): Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service (CVSS 8.6, Rapid7 Velociraptor)
- [CVE-2023-1973](https://cve.now/CVE-2023-1973.md): Undertow: unrestricted request storage leads to memory exhaustion (CVSS 7.5, Red Hat JBoss Enterprise Application Platform · io.undertow…)
- [CVE-2023-1932](https://cve.now/CVE-2023-1932.md): Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss (CVSS 6.1, Red Hat A-MQ Clients · Red Hat Cryostat +22)
- [CVE-2024-51504](https://cve.now/CVE-2024-51504.md): Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server (CVSS 9.1, Apache Software Foundation Apache ZooKeeper · org.apache.zo…)
- [CVE-2024-50172](https://cve.now/CVE-2024-50172.md): RDMA/bnxt\_re: Fix a possible memory leak (CVSS 5.5, Linux)
- [CVE-2024-50171](https://cve.now/CVE-2024-50171.md): net: systemport: fix potential memory leak in bcm\_sysport\_xmit() (CVSS 5.5, Linux)
- [CVE-2024-50170](https://cve.now/CVE-2024-50170.md): net: bcmasp: fix potential memory leak in bcmasp\_xmit() (CVSS 7.5, Linux)
- [CVE-2024-50169](https://cve.now/CVE-2024-50169.md): vsock: Update rx\_bytes on read\_skb() (CVSS 5.5, Linux)
- [CVE-2024-50168](https://cve.now/CVE-2024-50168.md): net/sun3\_82586: fix potential memory leak in sun3\_82586\_send\_packet() (CVSS 5.5, Linux)
- [CVE-2024-50167](https://cve.now/CVE-2024-50167.md): be2net: fix potential memory leak in be\_xmit() (CVSS 5.5, Linux)
- [CVE-2024-50166](https://cve.now/CVE-2024-50166.md): fsl/fman: Fix refcount handling of fman-related devices (CVSS 5.5, Linux)
- [CVE-2024-50165](https://cve.now/CVE-2024-50165.md): bpf: Preserve param-\>string when parsing mount options (CVSS 7.8, Linux)
- [CVE-2024-50164](https://cve.now/CVE-2024-50164.md): bpf: Fix overloading of MEM\_UNINIT's meaning (CVSS 7.8, Linux)
- [CVE-2024-50163](https://cve.now/CVE-2024-50163.md): bpf: Make sure internal and UAPI bpf\_redirect flags don't overlap (CVSS 5.5, Linux)
- [CVE-2024-50162](https://cve.now/CVE-2024-50162.md): bpf: devmap: provide rxq after redirect (CVSS 9.8, Linux)
- [CVE-2024-50161](https://cve.now/CVE-2024-50161.md): bpf: Check the remaining info\_cnt before repeating btf fields (CVSS 7.8, Linux)
- [CVE-2024-50160](https://cve.now/CVE-2024-50160.md): ALSA: hda/cs8409: Fix possible NULL dereference (CVSS 5.5, Linux)
- [CVE-2024-50159](https://cve.now/CVE-2024-50159.md): firmware: arm\_scmi: Fix the double free in scmi\_debugfs\_common\_setup() (CVSS 7.0, Linux)
- [CVE-2024-50158](https://cve.now/CVE-2024-50158.md): RDMA/bnxt\_re: Fix out of bound check (CVSS 7.8, Linux)
- [CVE-2024-50157](https://cve.now/CVE-2024-50157.md): RDMA/bnxt\_re: Avoid CPU lockups due fifo occupancy check loop (no CVSS, Linux)
- [CVE-2024-50156](https://cve.now/CVE-2024-50156.md): drm/msm: Avoid NULL dereference in msm\_disp\_state\_print\_regs() (CVSS 5.5, Linux)
- [CVE-2024-50155](https://cve.now/CVE-2024-50155.md): netdevsim: use cond\_resched() in nsim\_dev\_trap\_report\_work() (CVSS 7.8, Linux)
- [CVE-2024-50154](https://cve.now/CVE-2024-50154.md): tcp/dccp: Don't use timer\_pending() in reqsk\_queue\_unlink(). (CVSS 9.8, Linux)
- [CVE-2024-50153](https://cve.now/CVE-2024-50153.md): scsi: target: core: Fix null-ptr-deref in target\_alloc\_device() (CVSS 5.5, Linux)
- [CVE-2024-50152](https://cve.now/CVE-2024-50152.md): smb: client: fix possible double free in smb2\_set\_ea() (CVSS 9.8, Linux)
- [CVE-2024-50151](https://cve.now/CVE-2024-50151.md): smb: client: fix OOBs when building SMB2\_IOCTL request (CVSS 7.8, Linux)
- [CVE-2024-50150](https://cve.now/CVE-2024-50150.md): usb: typec: altmode should keep reference to parent (CVSS 7.8, Linux)
- [CVE-2024-50149](https://cve.now/CVE-2024-50149.md): drm/xe: Don't free job in TDR (CVSS 7.8, Linux)
- [CVE-2024-50148](https://cve.now/CVE-2024-50148.md): Bluetooth: bnep: fix wild-memory-access in proto\_unregister (CVSS 5.5, Linux)
- [CVE-2024-50147](https://cve.now/CVE-2024-50147.md): net/mlx5: Fix command bitmask initialization (CVSS 5.5, Linux)
- [CVE-2024-50146](https://cve.now/CVE-2024-50146.md): net/mlx5e: Don't call cleanup on profile rollback failure (no CVSS, Linux)
- [CVE-2024-50145](https://cve.now/CVE-2024-50145.md): octeon\_ep: Add SKB allocation failures handling in \_\_octep\_oq\_process\_rx() (CVSS 7.5, Linux)
- [CVE-2024-50144](https://cve.now/CVE-2024-50144.md): drm/xe: fix unbalanced rpm put() with fence\_fini() (CVSS 5.5, Linux)
- [CVE-2024-50143](https://cve.now/CVE-2024-50143.md): udf: fix uninit-value use in udf\_get\_fileshortad (CVSS 7.8, Linux)
- [CVE-2024-50142](https://cve.now/CVE-2024-50142.md): xfrm: validate new SA's prefixlen using SA family when sel.family is unset (CVSS 5.5, Linux)
- [CVE-2024-50141](https://cve.now/CVE-2024-50141.md): ACPI: PRM: Find EFI\_MEMORY\_RUNTIME block for PRM handler and context (CVSS 7.8, Linux)
- [CVE-2024-50140](https://cve.now/CVE-2024-50140.md): sched/core: Disable page allocation in task\_tick\_mm\_cid() (CVSS 5.5, Linux)
- [CVE-2024-50139](https://cve.now/CVE-2024-50139.md): KVM: arm64: Fix shift-out-of-bounds bug (CVSS 7.9, Linux)
- [CVE-2024-10203](https://cve.now/CVE-2024-10203.md): Agent Arbitrary File Deletion (CVSS 7.0, ManageEngine EndPoint Central)
- [CVE-2024-30142](https://cve.now/CVE-2024-30142.md): HCL BigFix Compliance is affected by a missing secure flag on a cookie (CVSS 3.8, HCL Software BigFix Compliance)
- [CVE-2024-30141](https://cve.now/CVE-2024-30141.md): HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information (CVSS 4.7, HCL Software BigFix Compliance)
- [CVE-2024-30140](https://cve.now/CVE-2024-30140.md): HCL BigFix Compliance is affected by unvalidated redirects and forwards (CVSS 5.4, HCL Software BigFix Compliance)
- [CVE-2024-38286](https://cve.now/CVE-2024-38286.md): Apache Tomcat: Denial of Service (CVSS 8.6, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2024-10027](https://cve.now/CVE-2024-10027.md): WP Booking Calendar \< 10.6.3 - Admin+ Stored XSS (CVSS 4.8, WP Booking Calendar)
- [CVE-2024-10947](https://cve.now/CVE-2024-10947.md): Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System BatchOrder sql injection (CVSS 5.1, Guangzhou Tuchuang Computer Software Development Interlib L…)
- [CVE-2024-10946](https://cve.now/CVE-2024-10946.md): Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System SysLib sql injection (CVSS 5.1, Guangzhou Tuchuang Computer Software Development Interlib L…)
- [CVE-2024-51990](https://cve.now/CVE-2024-51990.md): Path traversal via crafted Git repositories in jj (CVSS 9.3, martinvonz jj · jj-lib)
- [CVE-2019-20457](https://cve.now/CVE-2019-20457.md): An issue was discovered on Brother MFC-J491DW C1806180757 devices. (CVSS 9.1)
- [CVE-2019-20458](https://cve.now/CVE-2019-20458.md): An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. (CVSS 8.8)
- [CVE-2019-20459](https://cve.now/CVE-2019-20459.md): An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. (CVSS 8.4)
- [CVE-2019-20460](https://cve.now/CVE-2019-20460.md): An issue was discovered on Epson Expression Home XP255 20.08.FM10I8 devices. (CVSS 8.8)
- [CVE-2019-20461](https://cve.now/CVE-2019-20461.md): An issue was discovered on Alecto IVM-100 2019-11-12 devices. (CVSS 9.8)
- [CVE-2019-20462](https://cve.now/CVE-2019-20462.md): An issue was discovered on Alecto IVM-100 2019-11-12 devices. (CVSS 5.3)
- [CVE-2019-20469](https://cve.now/CVE-2019-20469.md): An issue was discovered on One2Track 2019-12-08 devices. (CVSS 4.6)
- [CVE-2019-20472](https://cve.now/CVE-2019-20472.md): An issue was discovered on One2Track 2019-12-08 devices. (CVSS 6.2)
- [CVE-2020-11916](https://cve.now/CVE-2020-11916.md): An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. (CVSS 6.3)
- [CVE-2020-11917](https://cve.now/CVE-2020-11917.md): An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. (CVSS 4.3)
- [CVE-2020-11918](https://cve.now/CVE-2020-11918.md): An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. (CVSS 5.4)
- [CVE-2020-11919](https://cve.now/CVE-2020-11919.md): An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. (CVSS 8.0)
- [CVE-2020-11921](https://cve.now/CVE-2020-11921.md): An issue was discovered in Lush 2 through 2020-02-25. (CVSS 8.8)
- [CVE-2020-11926](https://cve.now/CVE-2020-11926.md): An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. (CVSS 7.5)
- [CVE-2024-36062](https://cve.now/CVE-2024-36062.md): The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no pe (CVSS 4.0)
- [CVE-2024-36063](https://cve.now/CVE-2024-36063.md): The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place (CVSS 7.5)
- [CVE-2024-36064](https://cve.now/CVE-2024-36064.md): The NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (wi (CVSS 6.2)
- [CVE-2024-46960](https://cve.now/CVE-2024-46960.md): The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execut (CVSS 8.8)
- [CVE-2024-46961](https://cve.now/CVE-2024-46961.md): The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to ex (CVSS 8.1)
- [CVE-2024-48290](https://cve.now/CVE-2024-48290.md): An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) v (CVSS 4.3)
- [CVE-2024-48950](https://cve.now/CVE-2024-48950.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 7.5)
- [CVE-2024-48951](https://cve.now/CVE-2024-48951.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 7.5)
- [CVE-2024-48952](https://cve.now/CVE-2024-48952.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 6.4)
- [CVE-2024-48953](https://cve.now/CVE-2024-48953.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 7.5)
- [CVE-2024-48954](https://cve.now/CVE-2024-48954.md): An issue was discovered in Logpoint before 7.5.0. (CVSS 6.4)
- [CVE-2024-50599](https://cve.now/CVE-2024-50599.md): A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the we (CVSS 6.1)
- [CVE-2024-50766](https://cve.now/CVE-2024-50766.md): SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter. (CVSS 9.8)
- [CVE-2024-51428](https://cve.now/CVE-2024-51428.md): An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. (CVSS 7.5)
- [CVE-2024-51434](https://cve.now/CVE-2024-51434.md): Inconsistent \<plaintext\> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier. (CVSS 6.1, froala-editor · froala/wysiwyg-editor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.