# CVEs published 2024-11-11

114 CVEs were published on November 11, 2024: 22 critical, 30 high. Days are UTC.

- [CVE-2024-11079](https://cve.now/CVE-2024-11079.md): Ansible-core: unsafe tagging bypass via hostvars object in ansible-core (CVSS 5.5, ansible-core · Red Hat Ansible Automation Platform Execu… +2)
- [CVE-2024-23983](https://cve.now/CVE-2024-23983.md): Access rules for PingAccess may be circumvented with URL-encoded characters (CVSS 5.8, Ping Identity PingAccess)
- [CVE-2024-51484](https://cve.now/CVE-2024-51484.md): Insufficient Validation in Controllers (Activation/Deactivation) in Ampache (CVSS 5.3, ampache)
- [CVE-2024-51485](https://cve.now/CVE-2024-51485.md): Insufficient Validation in Plugins (Activation/Deactivation) in Ampache (CVSS 5.3, ampache)
- [CVE-2024-51486](https://cve.now/CVE-2024-51486.md): Stored Cross-Site Scripting in Ampache (CVSS 5.5, ampache)
- [CVE-2024-51487](https://cve.now/CVE-2024-51487.md): Insufficient Validation in Catalog (Activation/Deactivation) in Ampache (CVSS 5.3, ampache)
- [CVE-2024-51488](https://cve.now/CVE-2024-51488.md): Insufficient Validation in Delete Message in Ampache (CVSS 5.3, ampache)
- [CVE-2024-51489](https://cve.now/CVE-2024-51489.md): Insufficient Message Token Validation in Ampache (CVSS 5.3, ampache)
- [CVE-2024-51490](https://cve.now/CVE-2024-51490.md): Stored Cross-Site Scripting in Ampache (CVSS 5.5, ampache)
- [CVE-2024-11078](https://cve.now/CVE-2024-11078.md): code-projects Job Recruitment register.php cross site scripting (CVSS 5.3, code-projects Job Recruitment)
- [CVE-2024-51747](https://cve.now/CVE-2024-51747.md): Arbitrary File Read and Delete in kanboard (CVSS 9.1, kanboard)
- [CVE-2024-51748](https://cve.now/CVE-2024-51748.md): Remote code execution through language setting in kanboard (CVSS 9.1, kanboard)
- [CVE-2024-51992](https://cve.now/CVE-2024-51992.md): Method Exposure Vulnerability in Modals in orchid/platform (CVSS 4.1, orchidsoftware platform · orchid/platform)
- [CVE-2024-52286](https://cve.now/CVE-2024-52286.md): Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF (CVSS 2.0, Stirling-Tools Stirling-PDF)
- [CVE-2024-10315](https://cve.now/CVE-2024-10315.md): Insecure Configuration in Gliffy Online (CVSS 6.9, Gliffy Online)
- [CVE-2024-52288](https://cve.now/CVE-2024-52288.md): RMAC revert to the beginning of the session in libosdp (CVSS 5.1, goToMain libosdp · libosdp)
- [CVE-2024-11077](https://cve.now/CVE-2024-11077.md): code-projects Job Recruitment index.php sql injection (CVSS 6.9, code-projects Job Recruitment)
- [CVE-2024-11076](https://cve.now/CVE-2024-11076.md): code-projects Job Recruitment activation.php sql injection (CVSS 5.3, code-projects Job Recruitment)
- [CVE-2024-11074](https://cve.now/CVE-2024-11074.md): itsourcecode Tailoring Management System incadd.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-45087](https://cve.now/CVE-2024-45087.md): IBM WebSphere Application Server cross-site scripting (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2024-11073](https://cve.now/CVE-2024-11073.md): SourceCodester Hospital Management System delete-account.php improper authorization (CVSS 5.3, SourceCodester Hospital Management System)
- [CVE-2024-10917](https://cve.now/CVE-2024-10917.md): Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength (CVSS 3.7, Eclipse Foundation Open J9)
- [CVE-2024-45088](https://cve.now/CVE-2024-45088.md): IBM Maximo Asset Management cross-site scripting (CVSS 6.4, IBM Maximo Asset Management)
- [CVE-2024-43439](https://cve.now/CVE-2024-43439.md): Moodle: reflected xss via h5p error message (CVSS 5.4, moodle · moodle/moodle)
- [CVE-2024-39354](https://cve.now/CVE-2024-39354.md): Delta Electronics DIAScreen Stack-based Buffer Overflow (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2024-39605](https://cve.now/CVE-2024-39605.md): Delta Electronics DIAScreen Stack-based Buffer Overflow (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2024-47131](https://cve.now/CVE-2024-47131.md): Delta Electronics DIAScreen Stack-based Buffer Overflow (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2024-11070](https://cve.now/CVE-2024-11070.md): Sanluan PublicCMS Tag Type save cross site scripting (CVSS 5.3, Sanluan PublicCMS)
- [CVE-2024-10314](https://cve.now/CVE-2024-10314.md): Unauthenticated Denial of Service via Auto Generation Function (CVSS 8.7, Helix Core)
- [CVE-2024-10344](https://cve.now/CVE-2024-10344.md): Unauthenticated Denial of Service via Refuse Function (CVSS 8.7, Helix Core)
- [CVE-2024-50263](https://cve.now/CVE-2024-50263.md): fork: only invoke khugepaged, ksm hooks if no error (CVSS 7.8, Linux)
- [CVE-2024-10345](https://cve.now/CVE-2024-10345.md): Unauthenticated Denial of Service via Shutdown Function (CVSS 8.7, Helix Core)
- [CVE-2024-34015](https://cve.now/CVE-2024-34015.md): Sensitive information disclosure during file browsing due to improper symbolic link handling. (CVSS 3.3, Acronis Backup plugin for cPanel & WHM)
- [CVE-2024-34014](https://cve.now/CVE-2024-34014.md): Arbitrary file overwrite during recovery due to improper symbolic link handling. (CVSS 5.5, Acronis Backup plugin for cPanel & WHM · Acronis Backup… +1)
- [CVE-2024-43437](https://cve.now/CVE-2024-43437.md): Moodle: xss risk when restoring malicious course backup file (CVSS 5.4, moodle · moodle/moodle)
- [CVE-2024-43435](https://cve.now/CVE-2024-43435.md): Moodle: can create global glossary without being admin (CVSS 5.3, moodle · moodle/moodle)
- [CVE-2024-43433](https://cve.now/CVE-2024-43433.md): Moodle: matrix user/power level management not always working as expected with suspended users (CVSS 5.3, moodle · moodle/moodle)
- [CVE-2024-43432](https://cve.now/CVE-2024-43432.md): Moodle: authorization headers preserved between "emulated redirects" (CVSS 5.3, moodle · moodle/moodle)
- [CVE-2024-43430](https://cve.now/CVE-2024-43430.md): Moodle: lack of access control when using external methods for quiz overrides (CVSS 5.3, moodle · moodle/moodle)
- [CVE-2024-43429](https://cve.now/CVE-2024-43429.md): Moodle: user information visibility control issues in gradebook reports (CVSS 5.3, moodle · moodle/moodle)
- [CVE-2024-43427](https://cve.now/CVE-2024-43427.md): Moodle: admin presets export tool includes some secrets that should not be exported (CVSS 3.7, moodle · moodle/moodle)
- [CVE-2024-11068](https://cve.now/CVE-2024-11068.md): D-Link DSL6740C - Incorrect Use of Privileged APIs (CVSS 9.8, D-Link DSL6740C)
- [CVE-2024-11067](https://cve.now/CVE-2024-11067.md): D-Link DSL6740C - Arbitrary File Reading through Path Traversal (CVSS 7.5, D-Link DSL6740C)
- [CVE-2024-11066](https://cve.now/CVE-2024-11066.md): D-Link DSL6740C - OS Command Injection (CVSS 7.2, D-Link DSL6740C)
- [CVE-2024-11065](https://cve.now/CVE-2024-11065.md): D-Link DSL6740C - OS Command Injection (CVSS 7.2, D-Link DSL6740C)
- [CVE-2024-11064](https://cve.now/CVE-2024-11064.md): D-Link DSL6740C - OS Command Injection (CVSS 7.2, D-Link DSL6740C)
- [CVE-2024-11063](https://cve.now/CVE-2024-11063.md): D-Link DSL6740C - OS Command Injection (CVSS 7.2, D-Link DSL6740C)
- [CVE-2024-11062](https://cve.now/CVE-2024-11062.md): D-Link DSL6740C - OS Command Injection (CVSS 7.2, D-Link DSL6740C)
- [CVE-2024-11021](https://cve.now/CVE-2024-11021.md): Grand Vice info Webopac - Stored XSS (CVSS 5.4, Grand Vice info Webopac)
- [CVE-2024-11020](https://cve.now/CVE-2024-11020.md): Grand Vice info Webopac7 - SQL Injection (CVSS 9.8, Grand Vice info Webopac7)
- [CVE-2024-11019](https://cve.now/CVE-2024-11019.md): Grand Vice info Webopac7 - Reflected XSS (CVSS 6.1, Grand Vice info Webopac7)
- [CVE-2024-11018](https://cve.now/CVE-2024-11018.md): Grand Vice info Webopac - Arbitrary File Upload (CVSS 9.8, Grand Vice info Webopac)
- [CVE-2024-11017](https://cve.now/CVE-2024-11017.md): Grand Vice info Webopac - Arbitrary File Upload (CVSS 8.8, Grand Vice info Webopac)
- [CVE-2024-11016](https://cve.now/CVE-2024-11016.md): Grand Vice info Webopac - SQL Injection (CVSS 9.8, Grand Vice info Webopac)
- [CVE-2024-52350](https://cve.now/CVE-2024-52350.md): WordPress CRM 2go plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, nrmendez CRM 2go)
- [CVE-2024-52351](https://cve.now/CVE-2024-52351.md): WordPress BU Slideshow plugin \<= 2.3.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BU Web Team BU Slideshow)
- [CVE-2024-52352](https://cve.now/CVE-2024-52352.md): WordPress Postcasa Shortcode plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, miloandrew Postcasa Shortcode)
- [CVE-2024-52353](https://cve.now/CVE-2024-52353.md): WordPress Christian Science Bible Lesson Subjects plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Gabriel Serafini Christian Science Bible Lesson Subjects)
- [CVE-2024-52354](https://cve.now/CVE-2024-52354.md): WordPress Web Stories Widgets For Elementor plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Cool Plugins Web Stories Widgets For Elementor)
- [CVE-2024-52355](https://cve.now/CVE-2024-52355.md): WordPress OSM – OpenStreetMap plugin \<= 6.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MiKa OSM)
- [CVE-2024-52356](https://cve.now/CVE-2024-52356.md): WordPress The Pack Elementor addons plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webangon The Pack Elementor addons)
- [CVE-2024-52357](https://cve.now/CVE-2024-52357.md): WordPress LIQUID BLOCKS plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, lqd LIQUID BLOCKS)
- [CVE-2024-52358](https://cve.now/CVE-2024-52358.md): WordPress Responsive Addons for Elementor plugin \<= 1.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CyberChimps Responsive Addons for Elementor)
- [CVE-2024-51820](https://cve.now/CVE-2024-51820.md): WordPress L Squared Hub WP plugin \<= 1.0 - SQL Injection vulnerability (CVSS 8.5, wplsquared L Squared Hub WP)
- [CVE-2024-51837](https://cve.now/CVE-2024-51837.md): WordPress WP Contest plugin \<= 1.0.0 - SQL Injection vulnerability (CVSS 8.5, Sophia M Williams WP Contest)
- [CVE-2024-51843](https://cve.now/CVE-2024-51843.md): WordPress Horsemanager plugin \<= 1.3 - SQL Injection vulnerability (CVSS 8.5, fruitcakestudios Horsemanager)
- [CVE-2024-51845](https://cve.now/CVE-2024-51845.md): WordPress Share Buttons – Social Media plugin \<= 1.0.2 - SQL Injection vulnerability (CVSS 8.5, richteam Share Buttons – Social Media)
- [CVE-2024-51882](https://cve.now/CVE-2024-51882.md): WordPress Gboy Custom Google Map plugin \<= 1.2 - SQL Injection vulnerability (CVSS 8.5, gopalkumar315 Gboy Custom Google Map)
- [CVE-2024-51788](https://cve.now/CVE-2024-51788.md): WordPress The Novel Design Store Directory plugin \<= 4.3.0 - Arbitrary File Upload vulnerability (CVSS 10.0, Joshua Wolfe The Novel Design Store Directory)
- [CVE-2024-51789](https://cve.now/CVE-2024-51789.md): WordPress Image Classify plugin \<= 1.0.0 - Arbitrary File Upload vulnerability (CVSS 10.0, UjW0L Image Classify)
- [CVE-2024-51790](https://cve.now/CVE-2024-51790.md): WordPress HB AUDIO GALLERY plugin \<= 3.0 - Arbitrary File Upload vulnerability (CVSS 10.0, HB WEBSOL HB AUDIO GALLERY)
- [CVE-2024-51791](https://cve.now/CVE-2024-51791.md): WordPress Forms plugin \<= 2.8.0 - Arbitrary File Upload vulnerability (CVSS 10.0, Made I.T. Forms)
- [CVE-2024-51792](https://cve.now/CVE-2024-51792.md): WordPress Audio Record plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, Dang Ngoc Binh Audio Record)
- [CVE-2024-51793](https://cve.now/CVE-2024-51793.md): WordPress RepairBuddy plugin \<= 3.8115 - Arbitrary File Upload vulnerability (CVSS 10.0, Ateeq Rafeeq RepairBuddy)
- [CVE-2024-51571](https://cve.now/CVE-2024-51571.md): WordPress MasterBip para Elementor plugin \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MasterBip para Elementor)
- [CVE-2024-51572](https://cve.now/CVE-2024-51572.md): WordPress LH QR Codes plugin \<= 1.06 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, shawfactor LH QR Codes)
- [CVE-2024-51573](https://cve.now/CVE-2024-51573.md): WordPress ML Responsive Audio plugin \<= 0.2 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ersatzpole ML Responsive Audio player with playlist Shortco…)
- [CVE-2024-51574](https://cve.now/CVE-2024-51574.md): WordPress Simple Goods plugin \<= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Simple Goods)
- [CVE-2024-51575](https://cve.now/CVE-2024-51575.md): WordPress Extender All In One For Elementor plugin \<= 1.0.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Md. Abdullah Al Masum Extender All In One For Elementor)
- [CVE-2024-38826](https://cve.now/CVE-2024-38826.md): CVE-2024-38826 Cloud Controller Denial of Service Attack (CVSS 5.3, Cloud Foundry)
- [CVE-2024-11061](https://cve.now/CVE-2024-11061.md): Tenda AC10 fast\_setting\_wifi\_set FUN\_0044db3c stack-based overflow (CVSS 8.7, Tenda AC10)
- [CVE-2024-11060](https://cve.now/CVE-2024-11060.md): Jinher Network Collaborative Management Platform 金和数字化智能办公平台 AcceptShow.aspx sql injection (CVSS 5.3, Jinher Network Collaborative Management Platform 金和数字化智能办公平台)
- [CVE-2024-25253](https://cve.now/CVE-2024-25253.md): Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module. (CVSS 7.5)
- [CVE-2024-25254](https://cve.now/CVE-2024-25254.md): SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter. (CVSS 9.8)
- [CVE-2024-25255](https://cve.now/CVE-2024-25255.md): Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. (CVSS 9.8)
- [CVE-2024-36061](https://cve.now/CVE-2024-36061.md): EnGenius EWS356-FIT devices through 1.1.30 allow blind OS command injection. (CVSS 9.8)
- [CVE-2024-41992](https://cve.now/CVE-2024-41992.md): Wi-Fi Alliance wfa\_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library funct (CVSS 8.8)
- [CVE-2024-44546](https://cve.now/CVE-2024-44546.md): Powerjob \>= 3.20 is vulnerable to SQL injection via the version parameter. (CVSS 9.8)
- [CVE-2024-46962](https://cve.now/CVE-2024-46962.md): The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary (CVSS 9.1)
- [CVE-2024-46963](https://cve.now/CVE-2024-46963.md): The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attac (CVSS 8.1)
- [CVE-2024-46964](https://cve.now/CVE-2024-46964.md): The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaSc (CVSS 8.1)
- [CVE-2024-46965](https://cve.now/CVE-2024-46965.md): The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execut (CVSS 5.4)
- [CVE-2024-46966](https://cve.now/CVE-2024-46966.md): The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbit (CVSS 8.1)
- [CVE-2024-48322](https://cve.now/CVE-2024-48322.md): UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability. (CVSS 8.1)
- [CVE-2024-48939](https://cve.now/CVE-2024-48939.md): Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with (CVSS 7.5)
- [CVE-2024-50601](https://cve.now/CVE-2024-50601.md): Persistent and reflected XSS vulnerabilities in the themeMode cookie and \_h URL parameter of Axigen Mail Server up to version 10.5.28 allow (CVSS 6.1)
- [CVE-2024-50636](https://cve.now/CVE-2024-50636.md): PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM (CVSS 9.8)
- [CVE-2024-50667](https://cve.now/CVE-2024-50667.md): The boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/form (CVSS 9.8)
- [CVE-2024-50989](https://cve.now/CVE-2024-50989.md): A SQL injection vulnerability in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System v1.0 allows an attacker to execute (CVSS 9.8)
- [CVE-2024-50990](https://cve.now/CVE-2024-50990.md): A Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1. (CVSS 6.1)
- [CVE-2024-50991](https://cve.now/CVE-2024-50991.md): A Cross Site Scripting (XSS) vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which (CVSS 4.8)
- [CVE-2024-51026](https://cve.now/CVE-2024-51026.md): The NetAdmin IAM system (version 4.0.30319) has a Cross Site Scripting (XSS) vulnerability in the /BalloonSave.ashx endpoint, where it is po (CVSS 5.4)
- [CVE-2024-51054](https://cve.now/CVE-2024-51054.md): A Cross Site Scriptng (XSS) vulnerability was found in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System 1.0, which a (CVSS 4.8)
- [CVE-2024-51135](https://cve.now/CVE-2024-51135.md): An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sens (CVSS 9.8, org.powertac:server-interface)
- [CVE-2024-51186](https://cve.now/CVE-2024-51186.md): D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping\_addr parameter in the ping\_v4 and (CVSS 8.0)
- [CVE-2024-51187](https://cve.now/CVE-2024-51187.md): TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t (CVSS 4.8)
- [CVE-2024-51188](https://cve.now/CVE-2024-51188.md): TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t (CVSS 4.8)
- [CVE-2024-51189](https://cve.now/CVE-2024-51189.md): TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t (CVSS 4.8)
- [CVE-2024-51190](https://cve.now/CVE-2024-51190.md): TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via t (CVSS 4.8)
- [CVE-2024-51213](https://cve.now/CVE-2024-51213.md): Cross Site Scripting vulnerability in Online Shop Store v.1.0 allows a remote attacker to execute arbitrary code via the login.php component (CVSS 6.1)
- [CVE-2024-52530](https://cve.now/CVE-2024-52530.md): GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\\0' characters at the end of header names are ignor (CVSS 7.5)
- [CVE-2024-52531](https://cve.now/CVE-2024-52531.md): GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup\_header\_parse\_param\_list\_strict. (CVSS 6.5, GNOME libsoup)
- [CVE-2024-52532](https://cve.now/CVE-2024-52532.md): GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. (CVSS 7.5)
- [CVE-2024-52533](https://cve.now/CVE-2024-52533.md): gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4\_CONN\_MSG\_LEN is not suf (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.