# CVEs published 2024-11-12

332 CVEs were published on November 12, 2024: 19 critical, 177 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2024-11168](https://cve.now/CVE-2024-11168.md): Improper validation of IPv6 and IPvFuture addresses (CVSS 6.3, Python Software Foundation CPython)
- [CVE-2024-49510](https://cve.now/CVE-2024-49510.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49512](https://cve.now/CVE-2024-49512.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49509](https://cve.now/CVE-2024-49509.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-49511](https://cve.now/CVE-2024-49511.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-49507](https://cve.now/CVE-2024-49507.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-49508](https://cve.now/CVE-2024-49508.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-11117](https://cve.now/CVE-2024-11117.md): Inappropriate implementation in FileSystem in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass filesystem restrictio (CVSS 4.3, Google Chrome)
- [CVE-2024-11116](https://cve.now/CVE-2024-11116.md): Inappropriate implementation in Blink in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in sp (CVSS 4.3, Google Chrome)
- [CVE-2024-11115](https://cve.now/CVE-2024-11115.md): Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 131.0.6778.69 allowed a remote attacker to perform privilege (CVSS 8.8, Google Chrome)
- [CVE-2024-11114](https://cve.now/CVE-2024-11114.md): Inappropriate implementation in Views in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker who had compromised the r (CVSS 8.3, Google Chrome)
- [CVE-2024-11113](https://cve.now/CVE-2024-11113.md): Use after free in Accessibility in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who had compromised the renderer process t (CVSS 8.8, Google Chrome)
- [CVE-2024-11112](https://cve.now/CVE-2024-11112.md): Use after free in Media in Google Chrome on Windows prior to 131.0.6778.69 allowed a remote attacker to potentially exploit heap corruption (CVSS 7.5, Google Chrome)
- [CVE-2024-11111](https://cve.now/CVE-2024-11111.md): Inappropriate implementation in Autofill in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in (CVSS 4.3, Google Chrome)
- [CVE-2024-11110](https://cve.now/CVE-2024-11110.md): Inappropriate implementation in Extensions in Google Chrome prior to 131.0.6778.69 allowed a remote attacker to bypass site isolation via a (CVSS 6.5, Google Chrome)
- [CVE-2024-49525](https://cve.now/CVE-2024-49525.md): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47427](https://cve.now/CVE-2024-47427.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47437](https://cve.now/CVE-2024-47437.md): Substance3D - Painter | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-49515](https://cve.now/CVE-2024-49515.md): Substance3D - Painter | Untrusted Search Path (CWE-426) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47436](https://cve.now/CVE-2024-47436.md): Substance3D - Painter | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-49518](https://cve.now/CVE-2024-49518.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-49520](https://cve.now/CVE-2024-49520.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47429](https://cve.now/CVE-2024-47429.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47431](https://cve.now/CVE-2024-47431.md): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47428](https://cve.now/CVE-2024-47428.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47430](https://cve.now/CVE-2024-47430.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47439](https://cve.now/CVE-2024-47439.md): Substance3D - Painter | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-49519](https://cve.now/CVE-2024-49519.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47435](https://cve.now/CVE-2024-47435.md): Substance3D - Painter | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-49517](https://cve.now/CVE-2024-49517.md): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47440](https://cve.now/CVE-2024-47440.md): Substance3D - Painter | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-47432](https://cve.now/CVE-2024-47432.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47434](https://cve.now/CVE-2024-47434.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47433](https://cve.now/CVE-2024-47433.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47438](https://cve.now/CVE-2024-47438.md): Substance3D - Painter | Write-what-where Condition (CWE-123) (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-49516](https://cve.now/CVE-2024-49516.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-47426](https://cve.now/CVE-2024-47426.md): Substance3D - Painter | Double Free (CWE-415) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-2208](https://cve.now/CVE-2024-2208.md): Sound Research SECOMN64 Escalation of Privilege (CVSS 8.8, Sound Research SECOMN64 Driver)
- [CVE-2024-52301](https://cve.now/CVE-2024-52301.md): Laravel allows environment manipulation via query string (CVSS 8.7, laravel framework · laravel/framework)
- [CVE-2024-2207](https://cve.now/CVE-2024-2207.md): Sound Research SECOMN64 Escalation of Privilege (CVSS 6.0, Sound Research SECOMN64 Driver)
- [CVE-2024-10218](https://cve.now/CVE-2024-10218.md): TIBCO Hawk Stored-XEE Vulnerability (CVSS 9.2, TIBCO Software TIBCO Hawk · TIBCO Software TIBCO Operationa…)
- [CVE-2024-10217](https://cve.now/CVE-2024-10217.md): TIBCO Hawk Stored-XSS Vulnerability (CVSS 9.2, TIBCO Software TIBCO Hawk · TIBCO Software TIBCO Operationa…)
- [CVE-2024-47454](https://cve.now/CVE-2024-47454.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-47457](https://cve.now/CVE-2024-47457.md): Illustrator | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-45114](https://cve.now/CVE-2024-45114.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-47451](https://cve.now/CVE-2024-47451.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-47455](https://cve.now/CVE-2024-47455.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-47450](https://cve.now/CVE-2024-47450.md): Illustrator | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-47452](https://cve.now/CVE-2024-47452.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-47453](https://cve.now/CVE-2024-47453.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-47456](https://cve.now/CVE-2024-47456.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-31496](https://cve.now/CVE-2024-31496.md): A stack-based buffer overflow vulnerability \[CWE-121\] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer v (CVSS 6.3, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2024-36509](https://cve.now/CVE-2024-36509.md): An exposure of sensitive system information to an unauthorized control sphere vulnerability \[CWE-497\] in FortiWeb version 7.6.0, version 7.4 (CVSS 3.8, Fortinet FortiWeb)
- [CVE-2024-33505](https://cve.now/CVE-2024-33505.md): A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through (CVSS 5.3, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-26011](https://cve.now/CVE-2024-26011.md): A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, (CVSS 5.2, Fortinet FortiManager · Fortinet FortiOS +4)
- [CVE-2024-35274](https://cve.now/CVE-2024-35274.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability \[CWE-22\] in Fortinet FortiAnalyzer versions (CVSS 2.2, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-32118](https://cve.now/CVE-2024-32118.md): Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities \[CWE-78\] in Fortinet For (CVSS 6.3, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-32116](https://cve.now/CVE-2024-32116.md): Multiple relative path traversal vulnerabilities \[CWE-23\] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyz (CVSS 4.8, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2023-44255](https://cve.now/CVE-2023-44255.md): An exposure of sensitive information to an unauthorized actor \[CWE-200\] in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 an (CVSS 3.9, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2023-47543](https://cve.now/CVE-2023-47543.md): An authorization bypass through user-controlled key vulnerability \[CWE-639\] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an au (CVSS 5.1, Fortinet FortiPortal)
- [CVE-2024-32117](https://cve.now/CVE-2024-32117.md): An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability \[CWE-22\] in Fortinet FortiManager version 7. (CVSS 4.7, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2024-40592](https://cve.now/CVE-2024-40592.md): An improper verification of cryptographic signature vulnerability \[CWE-347\] in FortiClient MacOS version 7.4.0, version 7.2.4 and below, ver (CVSS 6.8, Fortinet FortiClientMac)
- [CVE-2024-36507](https://cve.now/CVE-2024-36507.md): A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an (CVSS 6.7, Fortinet FortiClientWindows)
- [CVE-2024-33510](https://cve.now/CVE-2024-33510.md): An improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability \[CWE-74\] in FortiOS vers (CVSS 3.6, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-50176](https://cve.now/CVE-2023-50176.md): A session fixation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.13 allows a (CVSS 4.0, Fortinet FortiOS)
- [CVE-2024-23666](https://cve.now/CVE-2024-23666.md): A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigData at least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0 (CVSS 7.1, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2024-36513](https://cve.now/CVE-2024-36513.md): A privilege context switching error vulnerability \[CWE-270\] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 al (CVSS 7.4, Fortinet FortiClientWindows)
- [CVE-2024-43613](https://cve.now/CVE-2024-43613.md): Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Azure Database for PostgreSQL Flexible Server)
- [CVE-2024-49042](https://cve.now/CVE-2024-49042.md): Azure Database for PostgreSQL Flexible Server Extension Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Azure Database for PostgreSQL Flexible Server)
- [CVE-2024-45147](https://cve.now/CVE-2024-45147.md): Bridge | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Bridge)
- [CVE-2024-47458](https://cve.now/CVE-2024-47458.md): Bridge | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Bridge)
- [CVE-2024-7516](https://cve.now/CVE-2024-7516.md): Brocade Fabric OS before 9.2.2 does not enforce strict host key checking (CVSS 7.0, Brocade Fabric OS)
- [CVE-2024-8535](https://cve.now/CVE-2024-8535.md): Authenticated user can access unintended user capabilities (CVSS 5.8, NetScaler ADC · NetScaler Gateway)
- [CVE-2024-47443](https://cve.now/CVE-2024-47443.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2024-47441](https://cve.now/CVE-2024-47441.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2024-47445](https://cve.now/CVE-2024-47445.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2024-47444](https://cve.now/CVE-2024-47444.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2024-47442](https://cve.now/CVE-2024-47442.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2024-47446](https://cve.now/CVE-2024-47446.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2024-8534](https://cve.now/CVE-2024-8534.md): Memory safety vulnerability leading to memory corruption and Denial of Service (CVSS 8.4, NetSclaer NetScaler ADC · NetScaler Gateway)
- [CVE-2024-47449](https://cve.now/CVE-2024-47449.md): Audition | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Audition)
- [CVE-2024-51722](https://cve.now/CVE-2024-51722.md): Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (CVSS 6.4, BlackBerry SecuSUITE)
- [CVE-2024-51721](https://cve.now/CVE-2024-51721.md): Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (CVSS 7.3, BlackBerry SecuSUITE)
- [CVE-2024-51720](https://cve.now/CVE-2024-51720.md): Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (CVSS 4.8, BlackBerry SecuSUITE)
- [CVE-2024-8069](https://cve.now/CVE-2024-8069.md): Limited remote code execution with privilege of a NetworkService Account access (CVSS 5.1, KEV, Citrix Session Recording)
- [CVE-2024-11138](https://cve.now/CVE-2024-11138.md): DedeCMS friendlink\_add.php unrestricted upload (CVSS 5.1, DedeCMS)
- [CVE-2024-49051](https://cve.now/CVE-2024-49051.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft PC Manager)
- [CVE-2024-49050](https://cve.now/CVE-2024-49050.md): Visual Studio Code Python Extension Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Python extension for Visual Studio Code)
- [CVE-2024-49048](https://cve.now/CVE-2024-49048.md): TorchGeo Remote Code Execution Vulnerability (CVSS 8.1, Microsoft TorchGeo · torchgeo)
- [CVE-2024-49039](https://cve.now/CVE-2024-49039.md): Windows Task Scheduler Elevation of Privilege Vulnerability (CVSS 8.8, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-49033](https://cve.now/CVE-2024-49033.md): Microsoft Word Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Office LTSC for Mac · Microsoft Office +2)
- [CVE-2024-49032](https://cve.now/CVE-2024-49032.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC for Mac · Microsoft Office +1)
- [CVE-2024-49031](https://cve.now/CVE-2024-49031.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC for Mac · Microsoft Office +1)
- [CVE-2024-49030](https://cve.now/CVE-2024-49030.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC for Mac · Microsoft Office +2)
- [CVE-2024-49029](https://cve.now/CVE-2024-49029.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC for Mac · Microsoft Office +2)
- [CVE-2024-49028](https://cve.now/CVE-2024-49028.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office LTSC for Mac · Microsoft Office +2)
- [CVE-2024-49027](https://cve.now/CVE-2024-49027.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2024-49026](https://cve.now/CVE-2024-49026.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2024-49021](https://cve.now/CVE-2024-49021.md): Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SQL Server)
- [CVE-2024-49019](https://cve.now/CVE-2024-49019.md): Active Directory Certificate Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2024-49018](https://cve.now/CVE-2024-49018.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49017](https://cve.now/CVE-2024-49017.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49016](https://cve.now/CVE-2024-49016.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49015](https://cve.now/CVE-2024-49015.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49014](https://cve.now/CVE-2024-49014.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49013](https://cve.now/CVE-2024-49013.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49012](https://cve.now/CVE-2024-49012.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49011](https://cve.now/CVE-2024-49011.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49010](https://cve.now/CVE-2024-49010.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49009](https://cve.now/CVE-2024-49009.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49008](https://cve.now/CVE-2024-49008.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49006](https://cve.now/CVE-2024-49006.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49007](https://cve.now/CVE-2024-49007.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49005](https://cve.now/CVE-2024-49005.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49004](https://cve.now/CVE-2024-49004.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49003](https://cve.now/CVE-2024-49003.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49002](https://cve.now/CVE-2024-49002.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49001](https://cve.now/CVE-2024-49001.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-49000](https://cve.now/CVE-2024-49000.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-48999](https://cve.now/CVE-2024-48999.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-48998](https://cve.now/CVE-2024-48998.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-48997](https://cve.now/CVE-2024-48997.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-48993](https://cve.now/CVE-2024-48993.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-38203](https://cve.now/CVE-2024-38203.md): Windows Package Library Manager Information Disclosure Vulnerability (CVSS 6.2, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43642](https://cve.now/CVE-2024-43642.md): Windows SMB Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43641](https://cve.now/CVE-2024-43641.md): Windows Registry Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43640](https://cve.now/CVE-2024-43640.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43639](https://cve.now/CVE-2024-43639.md): Windows KDC Proxy Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2024-43636](https://cve.now/CVE-2024-43636.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-43635](https://cve.now/CVE-2024-43635.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-43633](https://cve.now/CVE-2024-43633.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-43629](https://cve.now/CVE-2024-43629.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43624](https://cve.now/CVE-2024-43624.md): Windows Hyper-V Shared Virtual Disk Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-43622](https://cve.now/CVE-2024-43622.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-43621](https://cve.now/CVE-2024-43621.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43620](https://cve.now/CVE-2024-43620.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-43498](https://cve.now/CVE-2024-43498.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 9.8, Microsoft PowerShell · Microsoft Visual Studio +2)
- [CVE-2024-43598](https://cve.now/CVE-2024-43598.md): LightGBM Remote Code Execution Vulnerability (CVSS 8.1, Microsoft LightGBM · lightgbm)
- [CVE-2024-49056](https://cve.now/CVE-2024-49056.md): Airlift.microsoft.com Elevation of Privilege Vulnerability (CVSS 7.3, airlift.microsoft.com)
- [CVE-2024-49049](https://cve.now/CVE-2024-49049.md): Visual Studio Code Remote Extension Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Visual Studio Code Remote - SSH Extension)
- [CVE-2024-49046](https://cve.now/CVE-2024-49046.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-49044](https://cve.now/CVE-2024-49044.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Visual Studio)
- [CVE-2024-49043](https://cve.now/CVE-2024-49043.md): Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SQL Server)
- [CVE-2024-49040](https://cve.now/CVE-2024-49040.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 7.5, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2024-48996](https://cve.now/CVE-2024-48996.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-48995](https://cve.now/CVE-2024-48995.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-48994](https://cve.now/CVE-2024-48994.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-43462](https://cve.now/CVE-2024-43462.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-43459](https://cve.now/CVE-2024-43459.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-38264](https://cve.now/CVE-2024-38264.md): Microsoft Virtual Hard Disk (VHDX) Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-38255](https://cve.now/CVE-2024-38255.md): SQL Server Native Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-43452](https://cve.now/CVE-2024-43452.md): Windows Registry Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-43451](https://cve.now/CVE-2024-43451.md): NTLM Hash Disclosure Spoofing Vulnerability (CVSS 6.5, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43450](https://cve.now/CVE-2024-43450.md): Windows DNS Spoofing Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-43449](https://cve.now/CVE-2024-43449.md): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43447](https://cve.now/CVE-2024-43447.md): Windows SMBv3 Server Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2024-43646](https://cve.now/CVE-2024-43646.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43645](https://cve.now/CVE-2024-43645.md): Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-43644](https://cve.now/CVE-2024-43644.md): Windows Client-Side Caching Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43643](https://cve.now/CVE-2024-43643.md): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43638](https://cve.now/CVE-2024-43638.md): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-43637](https://cve.now/CVE-2024-43637.md): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-43634](https://cve.now/CVE-2024-43634.md): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-43631](https://cve.now/CVE-2024-43631.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43630](https://cve.now/CVE-2024-43630.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43628](https://cve.now/CVE-2024-43628.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-43627](https://cve.now/CVE-2024-43627.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-43626](https://cve.now/CVE-2024-43626.md): Windows Telephony Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-43625](https://cve.now/CVE-2024-43625.md): Microsoft Windows VMSwitch Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-43623](https://cve.now/CVE-2024-43623.md): Windows NT OS Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-43602](https://cve.now/CVE-2024-43602.md): Azure CycleCloud Remote Code Execution Vulnerability (CVSS 9.9, Microsoft Azure CycleCloud)
- [CVE-2024-43499](https://cve.now/CVE-2024-43499.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft Visual Studio · Microsoft PowerShell +2)
- [CVE-2024-43530](https://cve.now/CVE-2024-43530.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-8068](https://cve.now/CVE-2024-8068.md): Privilege escalation to NetworkService Account access (CVSS 5.1, KEV, Citrix Session Recording)
- [CVE-2024-21976](https://cve.now/CVE-2024-21976.md): Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary c (CVSS 8.8, AMD Ryzen™ AI Software)
- [CVE-2024-21975](https://cve.now/CVE-2024-21975.md): Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary c (CVSS 8.8, AMD Ryzen™ AI Software)
- [CVE-2024-21974](https://cve.now/CVE-2024-21974.md): Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary c (CVSS 8.8, AMD Ryzen™ AI Software)
- [CVE-2024-21958](https://cve.now/CVE-2024-21958.md): Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation (CVSS 7.3, AMD Provisioning Console (APC) Software)
- [CVE-2024-21957](https://cve.now/CVE-2024-21957.md): Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation p (CVSS 7.3, AMD Management Console)
- [CVE-2024-21949](https://cve.now/CVE-2024-21949.md): Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to (CVSS 5.5, AMD Ryzen™ AI Software)
- [CVE-2024-21946](https://cve.now/CVE-2024-21946.md): Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalati (CVSS 7.3, AMD Ryzen Master Utility for Overclocking Control)
- [CVE-2024-21945](https://cve.now/CVE-2024-21945.md): Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege e (CVSS 7.3, AMD Ryzen™ Master Monitoring SDK)
- [CVE-2024-21939](https://cve.now/CVE-2024-21939.md): Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achie (CVSS 7.3, AMD Cloud Manageability Service Software)
- [CVE-2024-21938](https://cve.now/CVE-2024-21938.md): Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation direct (CVSS 7.3, AMD Management Plug-In for SCCM)
- [CVE-2024-21937](https://cve.now/CVE-2024-21937.md): Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially (CVSS 7.3, AMD Software: PRO Edition · AMD Software: Adrenalin Edit… +1)
- [CVE-2024-10945](https://cve.now/CVE-2024-10945.md): FactoryTalk® Updater Local Privilege Escalation (CVSS 7.0, Rockwell Automation FactoryTalk Updater)
- [CVE-2024-10944](https://cve.now/CVE-2024-10944.md): FactoryTalk® Updater Remote Code Execution (CVSS 7.1, Rockwell Automation FactoryTalk Updater)
- [CVE-2024-49514](https://cve.now/CVE-2024-49514.md): Photoshop Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2024-10943](https://cve.now/CVE-2024-10943.md): FactoryTalk® Updater Authentication Bypass (CVSS 9.1, Rockwell Automation FactoryTalk Updater)
- [CVE-2024-10923](https://cve.now/CVE-2024-10923.md): Improper Neutralization vulnerability has been discovered in OpenText™ ALM Octane Management. (CVSS 8.6, OpenText™ ALM Octane Management)
- [CVE-2024-49369](https://cve.now/CVE-2024-49369.md): Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections (CVSS 9.8, icinga2)
- [CVE-2024-49521](https://cve.now/CVE-2024-49521.md): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 7.7, Adobe Commerce)
- [CVE-2024-50336](https://cve.now/CVE-2024-50336.md): matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal (CVSS 5.3, matrix-org matrix-js-sdk · matrix-js-sdk)
- [CVE-2024-51750](https://cve.now/CVE-2024-51750.md): Element allows a malicious homeserver can modify events leading to unrenderable events or rooms (CVSS 5.0, element-hq element-web)
- [CVE-2024-51749](https://cve.now/CVE-2024-51749.md): Element's thumbnails can be abused to misrepresent the content of an attachment (CVSS 3.5, element-hq element-web)
- [CVE-2024-9999](https://cve.now/CVE-2024-9999.md): Multi-Factor Authentication Bypass in Progress WS\_FTP Server (CVSS 6.5, Progress Software WS\_FTP Server)
- [CVE-2024-30133](https://cve.now/CVE-2024-30133.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability (CVSS 5.3, HCL Software HCL Traveler for Microsoft Outlook)
- [CVE-2024-49527](https://cve.now/CVE-2024-49527.md): Animate | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Animate)
- [CVE-2024-49528](https://cve.now/CVE-2024-49528.md): Animate | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Animate)
- [CVE-2024-49526](https://cve.now/CVE-2024-49526.md): Animate | Use After Free (CWE-416) (CVSS 7.8, Adobe Animate)
- [CVE-2024-7571](https://cve.now/CVE-2024-7571.md): Incorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2024-9843](https://cve.now/CVE-2024-9843.md): A buffer over-read in Ivanti Secure Access Client before 22.7R4 allows a local unauthenticated attacker to cause a denial of service. (CVSS 5.0, Ivanti Secure Access Client)
- [CVE-2024-9842](https://cve.now/CVE-2024-9842.md): Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders (CVSS 7.3, Ivanti Secure Access Client)
- [CVE-2024-8539](https://cve.now/CVE-2024-8539.md): Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive config (CVSS 7.1, Ivanti Secure Access Client)
- [CVE-2024-11004](https://cve.now/CVE-2024-11004.md): Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthentica (CVSS 6.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-11005](https://cve.now/CVE-2024-11005.md): Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1. (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-52010](https://cve.now/CVE-2024-52010.md): Zoraxy has an authenticated command injection in the Web SSH feature (CVSS 8.6, tobychui zoraxy · github.com/tobychui/zoraxy)
- [CVE-2024-11006](https://cve.now/CVE-2024-11006.md): Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1. (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-11007](https://cve.now/CVE-2024-11007.md): Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1. (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-8495](https://cve.now/CVE-2024-8495.md): A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote (CVSS 7.5, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-47909](https://cve.now/CVE-2024-47909.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a rem (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-47907](https://cve.now/CVE-2024-47907.md): A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2024-47906](https://cve.now/CVE-2024-47906.md): Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before versi (CVSS 7.8, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-52296](https://cve.now/CVE-2024-52296.md): libosdp has a null pointer deref in osdp\_reply\_name (CVSS 6.5, goToMain libosdp · libosdp)
- [CVE-2024-9420](https://cve.now/CVE-2024-9420.md): A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a r (CVSS 8.8, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-47905](https://cve.now/CVE-2024-47905.md): A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a rem (CVSS 4.9, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-52297](https://cve.now/CVE-2024-52297.md): Tolgee's configuration all configuration properties leaked in public configuration DTO (CVSS 9.8, tolgee-platform)
- [CVE-2024-10971](https://cve.now/CVE-2024-10971.md): Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to ob (CVSS 4.3, DVLS)
- [CVE-2024-47535](https://cve.now/CVE-2024-47535.md): Denial of Service attack on windows app using Netty (CVSS 5.5, netty · io.netty:netty-common)
- [CVE-2024-43415](https://cve.now/CVE-2024-43415.md): Decidim-Awesome: SQL injection in AdminAccountability (CVSS 9.0, decidim-ice decidim-module-decidim\_awesome · decidim-decidi…)
- [CVE-2024-50330](https://cve.now/CVE-2024-50330.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthent (CVSS 9.8, Ivanti Endpoint Manager)
- [CVE-2024-50329](https://cve.now/CVE-2024-50329.md): Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthen (CVSS 8.8, Ivanti Endpoint Manager)
- [CVE-2024-50328](https://cve.now/CVE-2024-50328.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2024-50327](https://cve.now/CVE-2024-50327.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2024-50326](https://cve.now/CVE-2024-50326.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2024-50324](https://cve.now/CVE-2024-50324.md): Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenti (CVSS 7.2, Ivanti Endpoint Manager)
- [CVE-2024-50323](https://cve.now/CVE-2024-50323.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenti (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-50322](https://cve.now/CVE-2024-50322.md): Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthent (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-50331](https://cve.now/CVE-2024-50331.md): An out-of-bounds read vulnerability in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to leak sensitive information (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-50321](https://cve.now/CVE-2024-50321.md): An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-50320](https://cve.now/CVE-2024-50320.md): An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-50319](https://cve.now/CVE-2024-50319.md): An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-50318](https://cve.now/CVE-2024-50318.md): A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-50317](https://cve.now/CVE-2024-50317.md): A null pointer dereference in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service. (CVSS 7.5, Ivanti Avalanche)
- [CVE-2024-45289](https://cve.now/CVE-2024-45289.md): Unbounded allocation in ctl(4) CAM Target Layer (CVSS 7.5, FreeBSD)
- [CVE-2024-39281](https://cve.now/CVE-2024-39281.md): Unbounded allocation in ctl(4) CAM Target Layer (CVSS 5.3, FreeBSD)
- [CVE-2024-2315](https://cve.now/CVE-2024-2315.md): SMM arbitrary code execution in Overclock (CVSS 6.8, AMI AptioV)
- [CVE-2024-33658](https://cve.now/CVE-2024-33658.md): Buffer Overflow Vulnerability In OFBD (CVSS 4.4, AMI AptioV)
- [CVE-2024-33660](https://cve.now/CVE-2024-33660.md): Potential Firmware update without integrity check (CVSS 5.2, AMI AptioV)
- [CVE-2024-42442](https://cve.now/CVE-2024-42442.md): Runtime Service Access outside SMRAM (CVSS 7.2, AMI AptioV)
- [CVE-2024-11130](https://cve.now/CVE-2024-11130.md): ZZCMS msg.php cross site scripting (CVSS 5.1, ZZCMS)
- [CVE-2024-11127](https://cve.now/CVE-2024-11127.md): code-projects Job Recruitment admin.php sql injection (CVSS 5.3, code-projects Job Recruitment)
- [CVE-2024-51566](https://cve.now/CVE-2024-51566.md): bhyve(8) NVMe driver to guest-induced infinite loops. (CVSS 6.5, FreeBSD)
- [CVE-2024-51565](https://cve.now/CVE-2024-51565.md): bhyve(8) hda driver buffer over-read (CVSS 6.5, FreeBSD)
- [CVE-2024-37365](https://cve.now/CVE-2024-37365.md): FactoryTalk View ME Remote Code Execution Vulnerability via Project Save Path (CVSS 7.3, Rockwell Automation FactoryTalk View Machine Edition)
- [CVE-2024-51564](https://cve.now/CVE-2024-51564.md): bhyve(8) infinite loop in the hda audio driver (CVSS 7.5, FreeBSD)
- [CVE-2024-51563](https://cve.now/CVE-2024-51563.md): bhyve(8) virtio\_vq\_recordon time-of-check to time-of-use race (CVSS 6.5, FreeBSD)
- [CVE-2024-8074](https://cve.now/CVE-2024-8074.md): Sensetive Data Exposure in Nomysoft Informatics' Nomysem (CVSS 9.3, Nomysoft Informatics Nomysem)
- [CVE-2024-51562](https://cve.now/CVE-2024-51562.md): bhyve(8) nvme\_opc\_get\_log\_page buffer over-read (CVSS 6.5, FreeBSD)
- [CVE-2024-50386](https://cve.now/CVE-2024-50386.md): Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure (CVSS 8.5, Apache Software Foundation Apache CloudStack)
- [CVE-2024-11126](https://cve.now/CVE-2024-11126.md): Digistar AG-30 Plus Login Page excessive authentication (CVSS 2.3, Digistar AG-30 Plus)
- [CVE-2024-11125](https://cve.now/CVE-2024-11125.md): GetSimpleCMS profile.php cross-site request forgery (CVSS 6.9, GetSimpleCMS)
- [CVE-2024-11124](https://cve.now/CVE-2024-11124.md): TimGeyssens UIOMatic uioMaticObject.r sql injection (CVSS 5.1, TimGeyssens UIOMatic)
- [CVE-2024-11123](https://cve.now/CVE-2024-11123.md): 上海灵当信息科技有限公司 Lingdang CRM pdf.php path traversal (CVSS 5.3, 上海灵当信息科技有限公司 Lingdang CRM)
- [CVE-2024-50572](https://cve.now/CVE-2024-50572.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 7.2, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2024-50561](https://cve.now/CVE-2024-50561.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 4.3, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2024-50560](https://cve.now/CVE-2024-50560.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 3.1, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2024-50559](https://cve.now/CVE-2024-50559.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 4.3, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2024-50558](https://cve.now/CVE-2024-50558.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 4.3, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2024-50557](https://cve.now/CVE-2024-50557.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 7.2, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2024-50313](https://cve.now/CVE-2024-50313.md): A vulnerability has been identified in Mendix Runtime V10 (All versions \< V10.16.0 only if the basic authentication mechanism is used by the (CVSS 5.3, Siemens Mendix Runtime)
- [CVE-2024-50310](https://cve.now/CVE-2024-50310.md): A vulnerability has been identified in SIMATIC CP 1543-1 V4.0 (6GK7543-1AX10-0XE0) (All versions \>= V4.0.44 \< V4.0.50). (CVSS 7.5, Siemens SIMATIC CP 1543-1)
- [CVE-2024-47942](https://cve.now/CVE-2024-47942.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 9). (CVSS 7.3, Siemens Solid Edge SE2024)
- [CVE-2024-47941](https://cve.now/CVE-2024-47941.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 9). (CVSS 7.8, Siemens Solid Edge SE2024)
- [CVE-2024-47940](https://cve.now/CVE-2024-47940.md): A vulnerability has been identified in Solid Edge SE2024 (All versions \< V224.0 Update 9). (CVSS 7.8, Siemens Solid Edge SE2024)
- [CVE-2024-47808](https://cve.now/CVE-2024-47808.md): A vulnerability has been identified in SINEC NMS (All versions \< V3.0 SP1). (CVSS 8.4, Siemens SINEC NMS)
- [CVE-2024-47783](https://cve.now/CVE-2024-47783.md): A vulnerability has been identified in SIPORT (All versions \< V3.4.0). (CVSS 7.8, Siemens SIPORT)
- [CVE-2024-46894](https://cve.now/CVE-2024-46894.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 3). (CVSS 6.3, Siemens SINEC INS)
- [CVE-2024-46892](https://cve.now/CVE-2024-46892.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 3). (CVSS 4.9, Siemens SINEC INS)
- [CVE-2024-46891](https://cve.now/CVE-2024-46891.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 3). (CVSS 5.3, Siemens SINEC INS)
- [CVE-2024-46890](https://cve.now/CVE-2024-46890.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 3). (CVSS 9.1, Siemens SINEC INS)
- [CVE-2024-46889](https://cve.now/CVE-2024-46889.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 3). (CVSS 5.3, Siemens SINEC INS)
- [CVE-2024-46888](https://cve.now/CVE-2024-46888.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 3). (CVSS 9.9, Siemens SINEC INS)
- [CVE-2024-44102](https://cve.now/CVE-2024-44102.md): A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions \< V3.1.2.1 with redu (CVSS 10.0, Siemens PP TeleControl Server Basic 1000 to 5000 · Siem… +11)
- [CVE-2024-36140](https://cve.now/CVE-2024-36140.md): A vulnerability has been identified in OZW672 (All versions \< V5.2), OZW772 (All versions \< V5.2). (CVSS 6.8, Siemens OZW672 · Siemens OZW772)
- [CVE-2024-29119](https://cve.now/CVE-2024-29119.md): A vulnerability has been identified in Spectrum Power 7 (All versions \< V24Q3). (CVSS 7.8, Siemens Spectrum Power)
- [CVE-2023-32736](https://cve.now/CVE-2023-32736.md): A vulnerability has been identified in SIMATIC S7-PLCSIM V16 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 Safety V16 (CVSS 7.3, Siemens SIMATIC S7-PLCSIM · Siemens SIMATIC STEP 7 Safe… +11)
- [CVE-2024-11122](https://cve.now/CVE-2024-11122.md): 上海灵当信息科技有限公司 Lingdang CRM index.php unrestricted upload (CVSS 5.3, 上海灵当信息科技有限公司 Lingdang CRM)
- [CVE-2024-11121](https://cve.now/CVE-2024-11121.md): 上海灵当信息科技有限公司 Lingdang CRM index.php sql injection (CVSS 5.3, 上海灵当信息科技有限公司 Lingdang CRM)
- [CVE-2024-10245](https://cve.now/CVE-2024-10245.md): Relais 2FA \<= 1.0 - Authentication Bypass (CVSS 9.8, mobisoft974 Relais 2FA)
- [CVE-2024-10323](https://cve.now/CVE-2024-10323.md): JetWidgets For Elementor \<= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, jetmonsters JetWidgets For Elementor)
- [CVE-2024-10179](https://cve.now/CVE-2024-10179.md): Slickstream: Engagement and Conversions \<= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode (CVSS 6.4, wpslickstream Slickstream: Engagement and Conversions)
- [CVE-2024-9836](https://cve.now/CVE-2024-9836.md): RSS Feed Widget \< 3.0.0 - Contributor+ Stored XSS (CVSS 5.9, RSS Feed Widget)
- [CVE-2024-9835](https://cve.now/CVE-2024-9835.md): RSS Feed Widget \< 3.0.1 - Reflected XSS (CVSS 4.8, RSS Feed Widget)
- [CVE-2024-47799](https://cve.now/CVE-2024-47799.md): Exposure of sensitive system information to an unauthorized control sphere issue exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 (CVSS 3.5, SoftBank Mesh Wi-Fi router RP562B)
- [CVE-2024-10790](https://cve.now/CVE-2024-10790.md): Admin and Site Enhancements (ASE) \<= 7.5.1 - Authenticated Stored Cross-Site Scripting via SVG (CVSS 5.4, qriouslad Admin and Site Enhancements)
- [CVE-2024-9357](https://cve.now/CVE-2024-9357.md): xili-tidy-tags \<= 1.12.04 - Reflected Cross-Site Scripting (CVSS 6.1, michelwppi xili-tidy-tags)
- [CVE-2024-45827](https://cve.now/CVE-2024-45827.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Mesh Wi-Fi router RP562B firmware (CVSS 8.0, SoftBank Mesh Wi-Fi router RP562B)
- [CVE-2024-29075](https://cve.now/CVE-2024-29075.md): Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. (CVSS 4.6, SoftBank Mesh Wi-Fi router RP562B)
- [CVE-2024-11102](https://cve.now/CVE-2024-11102.md): SourceCodester Hospital Management System edit-doc.php cross site scripting (CVSS 5.3, SourceCodester Hospital Management System)
- [CVE-2024-11101](https://cve.now/CVE-2024-11101.md): 1000 Projects Beauty Parlour Management System search-invoices.php sql injection (CVSS 5.1, 1000 Projects Beauty Parlour Management System)
- [CVE-2024-48838](https://cve.now/CVE-2024-48838.md): Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External (CVSS 3.3, Dell SmartFabric OS10 Software)
- [CVE-2024-48837](https://cve.now/CVE-2024-48837.md): Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulne (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2024-11100](https://cve.now/CVE-2024-11100.md): 1000 Projects Beauty Parlour Management System index.php sql injection (CVSS 6.9, 1000 Projects Beauty Parlour Management System)
- [CVE-2024-49557](https://cve.now/CVE-2024-49557.md): Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2024-10538](https://cve.now/CVE-2024-10538.md): Happy Addons for Elementor \<= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-10685](https://cve.now/CVE-2024-10685.md): Contact Form 7 Redirect & Thank You Page \<= 1.0.6 - Reflected Cross-Site Scripting (CVSS 6.1, scottpaterson Business Essentials for Contact Form)
- [CVE-2024-10672](https://cve.now/CVE-2024-10672.md): Multiple Page Generator Plugin – MPG \<= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion (CVSS 2.7, themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2024-10695](https://cve.now/CVE-2024-10695.md): Futurio Extra \<= 2.0.13 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, futuriowp Futurio Extra)
- [CVE-2024-49558](https://cve.now/CVE-2024-49558.md): Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2024-49560](https://cve.now/CVE-2024-49560.md): Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. (CVSS 7.8, Dell SmartFabric OS10 Software)
- [CVE-2024-49395](https://cve.now/CVE-2024-49395.md): Mutt: neomutt: bcc email header field is indirectly leaked by cryptographic info block (CVSS 5.3, mutt · Red Hat Enterprise Linux)
- [CVE-2024-49394](https://cve.now/CVE-2024-49394.md): Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing (CVSS 5.3, mutt · Red Hat Enterprise Linux)
- [CVE-2024-11099](https://cve.now/CVE-2024-11099.md): code-projects Job Recruitment login.php sql injection (CVSS 6.9, code-projects Job Recruitment)
- [CVE-2024-11097](https://cve.now/CVE-2024-11097.md): SourceCodester Student Record Management System Main Menu infinite loop (CVSS 4.8, SourceCodester Student Record Management System)
- [CVE-2024-49393](https://cve.now/CVE-2024-49393.md): Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing (CVSS 6.5, mutt · Red Hat Enterprise Linux)
- [CVE-2024-8882](https://cve.now/CVE-2024-8882.md): A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an (CVSS 4.5, Zyxel GS1900-48 firmware)
- [CVE-2024-8881](https://cve.now/CVE-2024-8881.md): A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and (CVSS 6.8, Zyxel GS1900-48 firmware)
- [CVE-2024-11096](https://cve.now/CVE-2024-11096.md): code-projects Task Manager newProject.php sql injection (CVSS 5.3, code-projects Task Manager)
- [CVE-2024-47595](https://cve.now/CVE-2024-47595.md): Local Privilege Escalation in SAP Host Agent (CVSS 6.3, SAP\_SE SAP Host Agent)
- [CVE-2024-47593](https://cve.now/CVE-2024-47593.md): Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2024-47592](https://cve.now/CVE-2024-47592.md): Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application) (CVSS 5.3, SAP\_SE SAP NetWeaver Application Server Java)
- [CVE-2024-47590](https://cve.now/CVE-2024-47590.md): Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher (CVSS 8.8, SAP\_SE SAP Web Dispatcher)
- [CVE-2024-47588](https://cve.now/CVE-2024-47588.md): Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager) (CVSS 4.7, SAP\_SE SAP NetWeaver Java)
- [CVE-2024-47587](https://cve.now/CVE-2024-47587.md): Missing authorization check in SAP Cash Management (Cash Operations) (CVSS 3.5, SAP\_SE SAP Cash Management)
- [CVE-2024-47586](https://cve.now/CVE-2024-47586.md): NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 5.3, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-42372](https://cve.now/CVE-2024-42372.md): Missing Authorization check in SAP NetWeaver AS Java (System Landscape Directory) (CVSS 6.5, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2021-27700](https://cve.now/CVE-2021-27700.md): SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. (CVSS 7.6)
- [CVE-2021-27701](https://cve.now/CVE-2021-27701.md): SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery (CSRF) via the Socifi wifi portal. (CVSS 4.7)
- [CVE-2021-27702](https://cve.now/CVE-2021-27702.md): Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard. (CVSS 7.3)
- [CVE-2021-27703](https://cve.now/CVE-2021-27703.md): Sercomm Model Etisalat Model S3- AC2100 is affected by Cross Site Scripting (XSS) via the firmware update page. (CVSS 5.4)
- [CVE-2021-27704](https://cve.now/CVE-2021-27704.md): Appspace 6.2.4 is affected by Incorrect Access Control via the Appspace Web Portal password reset page. (CVSS 6.5)
- [CVE-2023-52268](https://cve.now/CVE-2023-52268.md): The End-User Portal module before 1.0.65 for FreeScout sometimes allows an attacker to authenticate as an arbitrary user because a session t (CVSS 9.1)
- [CVE-2024-28726](https://cve.now/CVE-2024-28726.md): An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M\_1.34ME allows a local attacker to execute arbitrary cod (CVSS 8.0)
- [CVE-2024-28728](https://cve.now/CVE-2024-28728.md): Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M\_1.34ME allows a local attacke (CVSS 6.6)
- [CVE-2024-28729](https://cve.now/CVE-2024-28729.md): An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M\_1.34ME allows a local attacker to execute arbitrary cod (CVSS 7.8)
- [CVE-2024-28730](https://cve.now/CVE-2024-28730.md): Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M\_1.34ME allows a local attacke (CVSS 4.6)
- [CVE-2024-28731](https://cve.now/CVE-2024-28731.md): Cross Site Request Forgery vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M\_1.34ME allows a local a (CVSS 7.3)
- [CVE-2024-48075](https://cve.now/CVE-2024-48075.md): A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote att (CVSS 5.3)
- [CVE-2024-51093](https://cve.now/CVE-2024-51093.md): Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScrip (CVSS 8.7, snipe/snipe-it)
- [CVE-2024-51094](https://cve.now/CVE-2024-51094.md): An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into (CVSS 8.0)
- [CVE-2024-51179](https://cve.now/CVE-2024-51179.md): An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as t (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.