# CVEs published 2024-11-13

230 CVEs were published on November 13, 2024: 16 critical, 91 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-36284](https://cve.now/CVE-2024-36284.md): Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially ena (CVSS 5.1, Intel(R) Neural Compressor software)
- [CVE-2024-39766](https://cve.now/CVE-2024-39766.md): Improper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow an (CVSS 7.3, Intel(R) Neural Compressor software)
- [CVE-2024-28028](https://cve.now/CVE-2024-28028.md): Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially e (CVSS 7.7, Intel(R) Neural Compressor software)
- [CVE-2024-39368](https://cve.now/CVE-2024-39368.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') in some Intel(R) Neural Compressor software before vers (CVSS 8.6, Intel(R) Neural Compressor software)
- [CVE-2024-34165](https://cve.now/CVE-2024-34165.md): Uncontrolled search path in some Intel(R) oneAPI DPC++/C++ Compiler before version 2024.2 may allow an authenticated user to potentially ena (CVSS 5.4, Intel(R) oneAPI DPC++/C++ Compiler)
- [CVE-2024-34022](https://cve.now/CVE-2024-34022.md): Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enable (CVSS 5.4, Thunderbolt(TM) Share software)
- [CVE-2024-32483](https://cve.now/CVE-2024-32483.md): Improper access control for some Intel(R) EMA software before version 1.13.1.0 may allow an authenticated user to potentially enable escalat (CVSS 7.0, Intel(R) EMA software)
- [CVE-2024-36294](https://cve.now/CVE-2024-36294.md): Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable (CVSS 5.4, Intel(R) DSA software)
- [CVE-2024-36488](https://cve.now/CVE-2024-36488.md): Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of pr (CVSS 5.4, Intel(R) DSA)
- [CVE-2024-37025](https://cve.now/CVE-2024-37025.md): Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 m (CVSS 5.4, Intel(R) Advanced Link Analyzer Standard Edition software i…)
- [CVE-2024-38660](https://cve.now/CVE-2024-38660.md): Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially e (CVSS 2.0, Intel(R) Xeon(R) processor family)
- [CVE-2024-36242](https://cve.now/CVE-2024-36242.md): Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of pri (CVSS 7.3, Intel(R) Processors)
- [CVE-2024-38383](https://cve.now/CVE-2024-38383.md): Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated (CVSS 5.4, Intel(R) Quartus(R) Prime Pro Edition software for Windows)
- [CVE-2024-38668](https://cve.now/CVE-2024-38668.md): Uncontrolled search path for some Intel(R) Quartus(R) Prime Standard Edition software for Windows before version 23.1.1 may allow an authent (CVSS 5.4, Intel(R) Quartus(R) Prime Standard Edition software for Win…)
- [CVE-2024-38387](https://cve.now/CVE-2024-38387.md): Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authenticated user to potentia (CVSS 5.4, Intel(R) Graphics Driver installers)
- [CVE-2024-21799](https://cve.now/CVE-2024-21799.md): Path traversal for some Intel(R) Extension for Transformers software before version 1.5 may allow an authenticated user to potentially enabl (CVSS 6.9, Intel(R) Extension for Transformers software)
- [CVE-2024-36275](https://cve.now/CVE-2024-36275.md): NULL pointer dereference in some Intel(R) Optane(TM) PMem Management software versions before CR\_MGMT\_02.00.00.4040, CR\_MGMT\_03.00.00.0499 m (CVSS 5.8, Intel(R) Optane(TM) PMem Management software versions)
- [CVE-2024-34776](https://cve.now/CVE-2024-34776.md): Out-of-bounds write in some Intel(R) SGX SDK software may allow an authenticated user to potentially enable escalation of privilege via loca (CVSS 2.0, Intel(R) SGX SDK software)
- [CVE-2024-37027](https://cve.now/CVE-2024-37027.md): Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentiall (CVSS 5.2, Intel(R) VTune(TM) Profiler software)
- [CVE-2024-36245](https://cve.now/CVE-2024-36245.md): Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to pot (CVSS 5.4, Intel(R) VTune(TM) Profiler software)
- [CVE-2024-34167](https://cve.now/CVE-2024-34167.md): Uncontrolled search path for the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow an authentica (CVSS 5.4, Intel(R) Server Board S2600ST Family BIOS and Firmware Upda…)
- [CVE-2024-36282](https://cve.now/CVE-2024-36282.md): Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged (CVSS 7.1, Intel(R) Server Board S2600ST Family BIOS and Firmware Upda…)
- [CVE-2024-36482](https://cve.now/CVE-2024-36482.md): Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalatio (CVSS 7.1, Intel(R) CIP software)
- [CVE-2024-36276](https://cve.now/CVE-2024-36276.md): Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enable (CVSS 5.4, Intel(R) CIP software)
- [CVE-2024-36253](https://cve.now/CVE-2024-36253.md): Uncontrolled search path in the Intel(R) SDP Tool for Windows software all version may allow an authenticated user to potentially enable esc (CVSS 5.4, Intel(R) SDP Tool for Windows software)
- [CVE-2024-35201](https://cve.now/CVE-2024-35201.md): Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalatio (CVSS 5.4, Intel(R) SDP Tool for Windows software)
- [CVE-2024-31074](https://cve.now/CVE-2024-31074.md): Observable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via ne (CVSS 8.2, Intel(R) QAT Engine for OpenSSL software)
- [CVE-2024-28885](https://cve.now/CVE-2024-28885.md): Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network a (CVSS 8.2, Intel(R) QAT Engine for OpenSSL software)
- [CVE-2024-33617](https://cve.now/CVE-2024-33617.md): Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure (CVSS 8.2, Intel(R) QAT Engine for OpenSSL software)
- [CVE-2024-37024](https://cve.now/CVE-2024-37024.md): Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to (CVSS 5.4, ACAT software maintained by Intel(R) for Windows)
- [CVE-2024-39285](https://cve.now/CVE-2024-39285.md): Improper access control in UEFI firmware in some Intel(R) Server M20NTP Family may allow a privileged user to potentially enable information (CVSS 5.6, Intel(R) Server M20NTP Family)
- [CVE-2024-39609](https://cve.now/CVE-2024-39609.md): Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation (CVSS 8.7, Intel(R) Server Board M70KLP)
- [CVE-2024-39811](https://cve.now/CVE-2024-39811.md): Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potentially enable escalati (CVSS 5.3, Intel(R) Server M20NTP Family UEFI)
- [CVE-2024-40885](https://cve.now/CVE-2024-40885.md): Use after free in the UEFI firmware of some Intel(R) Server M20NTP BIOS may allow a privileged user to potentially enable escalation of priv (CVSS 8.7, Intel(R) Server M20NTP BIOS)
- [CVE-2024-41167](https://cve.now/CVE-2024-41167.md): Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable (CVSS 8.7, Intel(R) Server Board M10JNP2SB Family)
- [CVE-2024-31154](https://cve.now/CVE-2024-31154.md): Improper input validation in UEFI firmware for some Intel(R) Server S2600BPBR may allow a privileged user to potentially enable escalation o (CVSS 8.7, Intel(R) Server S2600BPBR)
- [CVE-2024-31158](https://cve.now/CVE-2024-31158.md): Improper input validation in UEFI firmware in some Intel(R) Server Board S2600BP Family may allow a privileged user to potentially enable es (CVSS 8.7, Intel(R) Server Board S2600BP Family)
- [CVE-2024-28881](https://cve.now/CVE-2024-28881.md): Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to poten (CVSS 5.4, Intel(R) Fortran Compiler Classic software)
- [CVE-2024-35245](https://cve.now/CVE-2024-35245.md): Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated (CVSS 5.4, Intel(R) PROSet/Wireless WiFi software for Windows)
- [CVE-2024-33611](https://cve.now/CVE-2024-33611.md): Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a privileged user to po (CVSS 4.6, Intel(R) PROSet/Wireless WiFi software for Windows)
- [CVE-2024-33624](https://cve.now/CVE-2024-33624.md): Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated user (CVSS 5.3, Intel(R) PROSet/Wireless WiFi software for Windows)
- [CVE-2024-29083](https://cve.now/CVE-2024-29083.md): Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to pot (CVSS 5.4, Intel(R) Distribution for Python software)
- [CVE-2024-32667](https://cve.now/CVE-2024-32667.md): Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service via local access. (CVSS 2.4, OpenCL(TM) software)
- [CVE-2024-34028](https://cve.now/CVE-2024-34028.md): Uncontrolled search path in some Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows before version 2024.1.0.142, gr (CVSS 5.4, Intel(R) Graphics Offline Compiler for OpenCL(TM) Code soft…)
- [CVE-2024-32044](https://cve.now/CVE-2024-32044.md): Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated u (CVSS 5.4, Intel(R) Arc(TM) Pro Graphics for Windows drivers)
- [CVE-2024-34164](https://cve.now/CVE-2024-34164.md): Uncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to potentially enable esca (CVSS 5.4, Intel(R) MAS software)
- [CVE-2024-32048](https://cve.now/CVE-2024-32048.md): Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthentica (CVSS 6.0, Intel(R) Distribution of OpenVINO(TM) Model Server software)
- [CVE-2024-28950](https://cve.now/CVE-2024-28950.md): Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may allow an authenticated (CVSS 5.4, Intel(R) oneAPI Math Kernel Library software for Windows)
- [CVE-2024-32485](https://cve.now/CVE-2024-32485.md): Improper Input Validation in some Intel(R) VROC software before version 8.6.0.2003 may allow an authenticated user to potentially enable den (CVSS 2.4, Intel(R) VROC software)
- [CVE-2024-29079](https://cve.now/CVE-2024-29079.md): Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentially (CVSS 6.9, Intel(R) VROC software)
- [CVE-2024-29077](https://cve.now/CVE-2024-29077.md): Improper access control in some JAM STAPL Player software before version 2.6.1 may allow an authenticated user to potentially enable escalat (CVSS 5.4, JAM STAPL Player software)
- [CVE-2024-31407](https://cve.now/CVE-2024-31407.md): Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before v (CVSS 5.4, Intel(R) High Level Synthesis Compiler software for Intel(R…)
- [CVE-2024-28169](https://cve.now/CVE-2024-28169.md): Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticat (CVSS 4.3, BigDL software maintained by Intel)
- [CVE-2024-29085](https://cve.now/CVE-2024-29085.md): Improper access control for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially e (CVSS 5.1, BigDL software maintained by Intel)
- [CVE-2024-27200](https://cve.now/CVE-2024-27200.md): Improper access control in some Intel(R) Granulate(TM) software before version 4.30.1 may allow a authenticated user to potentially enable e (CVSS 4.8, Intel(R) Granulate(TM) software)
- [CVE-2024-26017](https://cve.now/CVE-2024-26017.md): Uncontrolled search path in some Intel(R) Rendering Toolkit software before version 2024.1.0 may allow an authenticated user to potentially (CVSS 5.4, Intel(R) Rendering Toolkit software)
- [CVE-2024-28952](https://cve.now/CVE-2024-28952.md): Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated user to potentially (CVSS 5.4, Intel(R) IPP software for Windows)
- [CVE-2024-23312](https://cve.now/CVE-2024-23312.md): Uncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated us (CVSS 5.4, Intel(R) Binary Configuration Tool software for Windows)
- [CVE-2024-25647](https://cve.now/CVE-2024-25647.md): Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticat (CVSS 5.4, Intel(R) Binary Configuration Tool software for Windows)
- [CVE-2024-34170](https://cve.now/CVE-2024-34170.md): Improper buffer restrictions in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via l (CVSS 6.9, Intel(R) Graphics Drivers)
- [CVE-2024-34023](https://cve.now/CVE-2024-34023.md): Untrusted pointer dereference in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privileg (CVSS 6.9, Intel(R) Graphics Drivers)
- [CVE-2024-23919](https://cve.now/CVE-2024-23919.md): Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privileg (CVSS 4.8, Intel(R) Graphics software)
- [CVE-2024-38665](https://cve.now/CVE-2024-38665.md): Out-of-bounds write in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilege via loca (CVSS 6.9, Intel(R) Graphics Drivers)
- [CVE-2024-28030](https://cve.now/CVE-2024-28030.md): NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable denial of (CVSS 1.0, Intel(R) VPL software)
- [CVE-2024-11193](https://cve.now/CVE-2024-11193.md): An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application (CVSS 5.0, YugabyteDB Anywhere)
- [CVE-2024-28051](https://cve.now/CVE-2024-28051.md): Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information dis (CVSS 1.0, Intel(R) VPL software)
- [CVE-2024-21808](https://cve.now/CVE-2024-21808.md): Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escal (CVSS 1.0, Intel(R) VPL software)
- [CVE-2024-21783](https://cve.now/CVE-2024-21783.md): Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of pr (CVSS 2.4, Intel(R) VPL software)
- [CVE-2024-24985](https://cve.now/CVE-2024-24985.md): Exposure of resource to wrong sphere in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escala (CVSS 8.5, Intel(R) processors with Intel(R) ACTM)
- [CVE-2024-22185](https://cve.now/CVE-2024-22185.md): Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable es (CVSS 8.5, Intel(R) processors with Intel(R) ACTM)
- [CVE-2024-25563](https://cve.now/CVE-2024-25563.md): Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow (CVSS 4.6, Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) W…)
- [CVE-2024-21853](https://cve.now/CVE-2024-21853.md): Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authoriz (CVSS 5.7, 4th and 5th Generation Intel(R) Xeon(R) Processors)
- [CVE-2024-52554](https://cve.now/CVE-2024-52554.md): Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that the (CVSS 8.8, Jenkins Project Jenkins Shared Library · io.jenkins.plugins…)
- [CVE-2024-52553](https://cve.now/CVE-2024-52553.md): Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b\_6d and earlier does not invalidate the previous session on login. (CVSS 8.8, Jenkins Project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2024-52552](https://cve.now/CVE-2024-52552.md): Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, res (CVSS 8.0, Jenkins Project Jenkins Authorize Project Plugin · org.jenk…)
- [CVE-2024-52551](https://cve.now/CVE-2024-52551.md): Jenkins Pipeline: Declarative Plugin 2.2214.vb\_b\_34b\_2ea\_9b\_83 and earlier does not check whether the main (Jenkinsfile) script used to rest (CVSS 8.0, Jenkins Project Jenkins Pipeline: Declarative Plugin · org.…)
- [CVE-2024-52550](https://cve.now/CVE-2024-52550.md): Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a\_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile (CVSS 8.0, Jenkins Project Jenkins Pipeline: Groovy Plugin · org.jenki…)
- [CVE-2024-52549](https://cve.now/CVE-2024-52549.md): Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va\_3b\_b\_89f8a\_95b\_ and 1362.1364.v4cf2dc5d8776, does not per (CVSS 4.3, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2024-28049](https://cve.now/CVE-2024-28049.md): Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before vers (CVSS 6.8, Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) W…)
- [CVE-2024-24984](https://cve.now/CVE-2024-24984.md): Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow an unauthenticated use (CVSS 6.8, Intel(R) Wireless Bluetooth(R) products for Windows)
- [CVE-2024-23198](https://cve.now/CVE-2024-23198.md): Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40 (CVSS 6.8, Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) W…)
- [CVE-2024-25565](https://cve.now/CVE-2024-25565.md): Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated user to enable denial (CVSS 4.8, Intel(R) Xeon(R) Processors)
- [CVE-2024-21820](https://cve.now/CVE-2024-21820.md): Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privil (CVSS 8.5, Intel(R) Xeon(R) processor memory controller configurations…)
- [CVE-2024-23918](https://cve.now/CVE-2024-23918.md): Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged (CVSS 8.8, Intel(R) Xeon(R) processor memory controller configurations…)
- [CVE-2024-21850](https://cve.now/CVE-2024-21850.md): Sensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow a (CVSS 8.3, Intel(R) TDX Seamldr module software)
- [CVE-2024-29076](https://cve.now/CVE-2024-29076.md): Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of s (CVSS 6.8, Intel(R) CST software)
- [CVE-2024-43093](https://cve.now/CVE-2024-43093.md): In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensit (CVSS 7.3, KEV, Google Android)
- [CVE-2024-43091](https://cve.now/CVE-2024-43091.md): In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow. (CVSS 9.8, Google Android)
- [CVE-2024-43090](https://cve.now/CVE-2024-43090.md): In multiple locations, there is a possible cross-user image read due to a missing permission check. (CVSS 5.0, Google Android)
- [CVE-2024-43089](https://cve.now/CVE-2024-43089.md): In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2024-43088](https://cve.now/CVE-2024-43088.md): In multiple functions in AppInfoBase.java, there is a possible way to manipulate app permission settings belonging to another user on the de (CVSS 8.4, Google Android)
- [CVE-2024-43087](https://cve.now/CVE-2024-43087.md): In getInstalledAccessibilityPreferences of AccessibilitySettings.java, there is a possible way to hide an enabled accessibility service in t (CVSS 8.4, Google Android)
- [CVE-2024-43086](https://cve.now/CVE-2024-43086.md): In validateAccountsInternal of AccountManagerService.java, there is a possible way to leak account credentials to a third party app due to a (CVSS 5.5, Google Android)
- [CVE-2024-43085](https://cve.now/CVE-2024-43085.md): In handleMessage of UsbDeviceManager.java, there is a possible method to access device contents over USB without unlocking the device due to (CVSS 7.8, Google Android)
- [CVE-2024-43084](https://cve.now/CVE-2024-43084.md): In visitUris of multiple files, there is a possible information disclosure due to a confused deputy. (CVSS 6.2, Google Android)
- [CVE-2024-43083](https://cve.now/CVE-2024-43083.md): In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. (CVSS 6.2, Google Android)
- [CVE-2024-43082](https://cve.now/CVE-2024-43082.md): In onActivityResult of EditUserPhotoController.java, there is a possible cross-user media read due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2024-43081](https://cve.now/CVE-2024-43081.md): In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the cod (CVSS 7.8, Google Android)
- [CVE-2024-43080](https://cve.now/CVE-2024-43080.md): In onReceive of AppRestrictionsFragment.java, there is a possible escalation of privilege due to unsafe deserialization. (CVSS 7.8, Google Android)
- [CVE-2024-40671](https://cve.now/CVE-2024-40671.md): In DevmemIntChangeSparse2 of devicemem\_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission che (CVSS 7.8, Google Android)
- [CVE-2024-40661](https://cve.now/CVE-2024-40661.md): In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permis (CVSS 7.8, Google Android)
- [CVE-2024-40660](https://cve.now/CVE-2024-40660.md): In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the cod (CVSS 7.8, Google Android)
- [CVE-2024-49379](https://cve.now/CVE-2024-49379.md): Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel (CVSS 5.3, getumbrel umbrel)
- [CVE-2024-34747](https://cve.now/CVE-2024-34747.md): In DevmemXIntMapPages of devicemem\_server.c, there is a possible use-after-free due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2024-34729](https://cve.now/CVE-2024-34729.md): In multiple locations, there is a possible arbitrary code execution due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2024-34719](https://cve.now/CVE-2024-34719.md): In multiple locations, there is a possible permissions bypass due to a missing null check. (CVSS 8.4, Google Android)
- [CVE-2024-31337](https://cve.now/CVE-2024-31337.md): In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. (CVSS 8.4, Google Android)
- [CVE-2024-23715](https://cve.now/CVE-2024-23715.md): In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2023-35686](https://cve.now/CVE-2023-35686.md): In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2023-35659](https://cve.now/CVE-2023-35659.md): In DevmemIntChangeSparse of devicemem\_server.c, there is a possible arbitrary code execution due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-9476](https://cve.now/CVE-2024-9476.md): Privilege escalation vulnerability for Organizations in Grafana (CVSS 5.1, Grafana Labs Grafana OSS and Enterprise)
- [CVE-2024-45594](https://cve.now/CVE-2024-45594.md): Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds (CVSS 7.7, decidim · decidim-meetings)
- [CVE-2024-51996](https://cve.now/CVE-2024-51996.md): Symphony has an Authentication Bypass via RememberMe (CVSS 7.5, symfony · symfony/security-http)
- [CVE-2024-52291](https://cve.now/CVE-2024-52291.md): Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution (CVSS 8.5, craftcms cms · craftcms/cms)
- [CVE-2024-9413](https://cve.now/CVE-2024-9413.md): The transport\_message\_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing (CVSS 8.0, Arm SCP-Firmware)
- [CVE-2024-52292](https://cve.now/CVE-2024-52292.md): Craft Allows Attackers to Read Arbitrary System Files (CVSS 7.7, craftcms cms · craftcms/cms)
- [CVE-2024-52293](https://cve.now/CVE-2024-52293.md): Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI (CVSS 7.2, craftcms cms · craftcms/cms)
- [CVE-2024-52295](https://cve.now/CVE-2024-52295.md): DataEase has a forged JWT token vulnerability (CVSS 9.3, dataease)
- [CVE-2024-52298](https://cve.now/CVE-2024-52298.md): macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author (CVSS 7.5, xwikisas macro-pdfviewer)
- [CVE-2024-11175](https://cve.now/CVE-2024-11175.md): Public CMS Voting Management save cross site scripting (CVSS 5.3, Public CMS)
- [CVE-2024-52299](https://cve.now/CVE-2024-52299.md): The PDF viewer macro allows accessing any attachment without access right checks (CVSS 7.5, xwikisas macro-pdfviewer)
- [CVE-2024-52300](https://cve.now/CVE-2024-52300.md): macro-pdfviewer has a XSS through the width parameter (CVSS 9.1, xwikisas macro-pdfviewer)
- [CVE-2024-7295](https://cve.now/CVE-2024-7295.md): Hard-coded credentials used for temporary and cache data encryption (CVSS 7.1, Progress Software Telerik Report Server)
- [CVE-2024-8049](https://cve.now/CVE-2024-8049.md): Telerik Document Processing Improper Handling of Memory Resources (CVSS 6.5, Progress Software Telerik Document Processing Libraries)
- [CVE-2024-52305](https://cve.now/CVE-2024-52305.md): UnoPim Stored XSS : Cookie hijacking through Create User function (CVSS 6.5, unopim · unopim/unopim)
- [CVE-2024-10012](https://cve.now/CVE-2024-10012.md): Progress UI for WPF format provider unsafe deserialization vulnerability (CVSS 7.8, Progress Software Telerik UI for WPF)
- [CVE-2024-10013](https://cve.now/CVE-2024-10013.md): Progress UI for WinForms format provider unsafe deserialization vulnerability (CVSS 7.8, Progress Software Telerik UI for WinForms)
- [CVE-2024-52306](https://cve.now/CVE-2024-52306.md): FileManager Deserialization of Untrusted Data (CVSS 7.7, Laravel-Backpack FileManager · backpack/filemanager)
- [CVE-2024-49504](https://cve.now/CVE-2024-49504.md): grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images (CVSS 7.0, openSUSE Tumbleweed)
- [CVE-2024-9477](https://cve.now/CVE-2024-9477.md): XSS in AirTies' Air4443 Firmware (CVSS 4.6, AirTies Air4443 Firmware)
- [CVE-2024-48900](https://cve.now/CVE-2024-48900.md): Moodle: idor when accessing list of badge recipients (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-49505](https://cve.now/CVE-2024-49505.md): XSS vulnerability found in OpenSuse MirrorCache (CVSS 5.3, openSUSE Tumbleweed)
- [CVE-2024-11165](https://cve.now/CVE-2024-11165.md): An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration re (CVSS 5.7, YugabyteDB Anywhere)
- [CVE-2024-49506](https://cve.now/CVE-2024-49506.md): Fixed temporary file path in aeon-checks allows fixing of disk encryption key (CVSS 7.3, openSUSE Tumbleweed)
- [CVE-2024-11159](https://cve.now/CVE-2024-11159.md): Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. (CVSS 5.3, Mozilla Thunderbird)
- [CVE-2024-48989](https://cve.now/CVE-2024-48989.md): A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial (CVSS 7.5, Bosch Rexroth AG IndraDrive FWA-INDRV\*-MP\*)
- [CVE-2022-45157](https://cve.now/CVE-2022-45157.md): Exposure of vSphere's CPI and CSI credentials in Rancher (CVSS 9.1, SUSE rancher · github.com/rancher/rancher)
- [CVE-2024-47574](https://cve.now/CVE-2024-47574.md): A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versi (CVSS 7.4, Fortinet FortiClientWindows)
- [CVE-2024-4741](https://cve.now/CVE-2024-4741.md): Use After Free with SSL\_free\_buffers (CVSS 7.5, OpenSSL)
- [CVE-2024-8001](https://cve.now/CVE-2024-8001.md): VIWIS LMS Print authorization (CVSS 6.9, VIWIS LMS)
- [CVE-2024-11028](https://cve.now/CVE-2024-11028.md): MultiManager WP – Manage All Your WordPress Sites Easily \<= 1.0.5 - Authentication Bypass via User Impersonation (CVSS 9.8, icdsoft MultiManager WP – Manage All Your WordPress Sites E…)
- [CVE-2024-9682](https://cve.now/CVE-2024-9682.md): Royal Elementor Addons and Templates \<= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-9668](https://cve.now/CVE-2024-9668.md): Royal Elementor Addons and Templates \<= 1.7.1001 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-9059](https://cve.now/CVE-2024-9059.md): Royal Elementor Addons and Template \<= 1.7.1001 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-10877](https://cve.now/CVE-2024-10877.md): AFI – The Easiest Integration Plugin \<= 1.92.0 - Reflected Cross-Site Scripting (CVSS 6.1, nasirahmed AFI – The Easiest Integration Plugin)
- [CVE-2024-52268](https://cve.now/CVE-2024-52268.md): Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. (CVSS 4.8, Vektor VK All in One Expansion Unit)
- [CVE-2024-21541](https://cve.now/CVE-2024-21541.md): Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without (CVSS 6.9, dom-iterator · org.webjars.npm:dom-iterator)
- [CVE-2024-10575](https://cve.now/CVE-2024-10575.md): CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacti (CVSS 10.0, Schneider Electric EcoStruxure IT Gateway)
- [CVE-2024-11150](https://cve.now/CVE-2024-11150.md): WordPress User Extra Fields \<= 16.6 - Unauthenticated Arbitrary File Deletion (CVSS 9.8, vanquish WordPress User Extra Fields)
- [CVE-2024-10800](https://cve.now/CVE-2024-10800.md): WordPress User Extra Fields \<= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, vanquish WordPress User Extra Fields)
- [CVE-2024-9409](https://cve.now/CVE-2024-9409.md): CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communica (CVSS 8.7, Schneider Electric PowerLogic PM5320 · Schneider Electri… +1)
- [CVE-2024-8936](https://cve.now/CVE-2024-8936.md): CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Ma (CVSS 8.3, Schneider Electric Modicon M340 CPU)
- [CVE-2024-8938](https://cve.now/CVE-2024-8938.md): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary (CVSS 9.2, Schneider Electric Modicon M340 CPU · Schneider Electric… +1)
- [CVE-2024-8937](https://cve.now/CVE-2024-8937.md): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary (CVSS 8.3, Schneider Electric Modicon M340 CPU · Schneider Electric… +1)
- [CVE-2024-8935](https://cve.now/CVE-2024-8935.md): CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integri (CVSS 7.7, Schneider Electric Modicon M340 CPU · Schneider Electric… +1)
- [CVE-2024-8933](https://cve.now/CVE-2024-8933.md): CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retr (CVSS 7.5, Schneider Electric Modicon M340 CPU · Schneider Electric… +1)
- [CVE-2024-10816](https://cve.now/CVE-2024-10816.md): LUNA RADIO PLAYER \<= 6.24.01.24 - Unauthenticated Arbitrary File Read (CVSS 7.5, sodah LUNA RADIO PLAYER)
- [CVE-2024-10174](https://cve.now/CVE-2024-10174.md): WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts \<= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass (CVSS 7.3, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2024-10820](https://cve.now/CVE-2024-10820.md): WooCommerce Upload Files \<= 84.3 - Unauthenticated Arbitrary File Upload (CVSS 9.8, WooCommerce Upload Files)
- [CVE-2024-10828](https://cve.now/CVE-2024-10828.md): Advanced Order Export For WooCommerce \<= 3.5.5 - Unauthenticated PHP Object Injection via Order Details (CVSS 8.1, algolplus Advanced Order Export For WooCommerce)
- [CVE-2024-10794](https://cve.now/CVE-2024-10794.md): Boostify Header Footer Builder for Elementor \<= 1.3.6 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, duongancol Boostify Header Footer Builder for Elementor)
- [CVE-2024-10802](https://cve.now/CVE-2024-10802.md): Hash Elements \<= 1.4.7 - Missing Authorization to Unauthenticated Draft Post Title Exposure (CVSS 5.3, hashthemes Hash Elements)
- [CVE-2024-10529](https://cve.now/CVE-2024-10529.md): Kognetiks Chatbot for WordPress \<= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion (CVSS 5.3, Kognetiks Chatbot for WordPress)
- [CVE-2024-11143](https://cve.now/CVE-2024-11143.md): Kognetiks Chatbot for WordPress \<= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification (CVSS 4.3, Kognetiks Chatbot for WordPress)
- [CVE-2024-10684](https://cve.now/CVE-2024-10684.md): Kognetiks Chatbot for WordPress \<= 2.1.7 - Reflected Cross-Site Scripting (CVSS 6.1, Kognetiks Chatbot for WordPress)
- [CVE-2024-10531](https://cve.now/CVE-2024-10531.md): Kognetiks Chatbot for WordPress \<= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update (CVSS 5.3, Kognetiks Chatbot for WordPress)
- [CVE-2024-10530](https://cve.now/CVE-2024-10530.md): Kognetiks Chatbot for WordPress \<= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition (CVSS 4.3, Kognetiks Chatbot for WordPress)
- [CVE-2024-10593](https://cve.now/CVE-2024-10593.md): WPForms – Easy Form Builder for WordPress \<= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion (CVSS 4.3, smub WPForms – Easy Form Builder for WordPress – Contact Fo…)
- [CVE-2024-10882](https://cve.now/CVE-2024-10882.md): Product Delivery Date for WooCommerce - Lite \<= 2.8.0 - Reflected Cross-Site Scripting (CVSS 6.1, tychesoftwares Product Delivery Date for WooCommerce – Lite)
- [CVE-2024-9426](https://cve.now/CVE-2024-9426.md): Aqua SVG Sprite \<= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, thinkaquamarine Aqua SVG Sprite)
- [CVE-2024-10629](https://cve.now/CVE-2024-10629.md): GPX Viewer \<= 2.2.9 - Authenticated (Subscriber+) Arbitrary File Creation (CVSS 8.8, axelkeller GPX Viewer)
- [CVE-2024-8874](https://cve.now/CVE-2024-8874.md): AJAX Login and Registration modal popup + inline form \<= 2.24 - Reflected Cross-Site Scripting (CVSS 6.1, kaminskym AJAX Login and Registration modal popup + inline…)
- [CVE-2024-10854](https://cve.now/CVE-2024-10854.md): Buy one click WooCommerce \<= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import (CVSS 4.3, northmule Buy one click WooCommerce)
- [CVE-2024-10853](https://cve.now/CVE-2024-10853.md): Buy one click WooCommerce \<= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion (CVSS 4.3, northmule Buy one click WooCommerce)
- [CVE-2024-10717](https://cve.now/CVE-2024-10717.md): Styler for Ninja Forms \<= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate\_license (CVSS 6.5, wpmonks Styler for Ninja Forms)
- [CVE-2024-10038](https://cve.now/CVE-2024-10038.md): WP-Strava \<= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 6.1, cmanon WP-Strava)
- [CVE-2024-10850](https://cve.now/CVE-2024-10850.md): Razorpay Payment Button for Elementor \<= 1.2.5 - Reflected Cross-Site Scripting (CVSS 6.1, Razorpay Payment Button Elementor Plugin)
- [CVE-2024-9614](https://cve.now/CVE-2024-9614.md): Constant Contact Forms by MailMunch \<= 2.1.2 - Reflected Cross-Site Scripting (CVSS 6.1, Constant Contact Forms by MailMunch)
- [CVE-2024-10577](https://cve.now/CVE-2024-10577.md): Fat Rat Collect \<= 2.7.3 - Reflected Cross-Site Scripting (CVSS 6.1, fbtopcn 胖鼠采集)
- [CVE-2024-10887](https://cve.now/CVE-2024-10887.md): NiceJob \<= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, NiceJob)
- [CVE-2024-10851](https://cve.now/CVE-2024-10851.md): Razorpay Payment Button \<= 2.4.6 - Reflected Cross-Site Scripting (CVSS 6.1, Razorpay Payment Button Plugin)
- [CVE-2024-8985](https://cve.now/CVE-2024-8985.md): Social Proof (Testimonials) Slider \<= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode (CVSS 6.4, kimberlynorris Social Proof (Testimonial) Slider)
- [CVE-2024-9578](https://cve.now/CVE-2024-9578.md): Hide Links \<= 1.4.2 - Unauthenticated Shortcode Execution (CVSS 5.3, egolacrima Hide Links)
- [CVE-2024-10852](https://cve.now/CVE-2024-10852.md): Buy one click WooCommerce \<= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export (CVSS 4.3, northmule Buy one click WooCommerce)
- [CVE-2024-10778](https://cve.now/CVE-2024-10778.md): BuddyPress Builder for Elementor – BuddyBuilder \<= 1.7.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, staxwp BuddyPress Builder for Elementor – BuddyBuilder)
- [CVE-2024-38655](https://cve.now/CVE-2024-38655.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18 (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-34784](https://cve.now/CVE-2024-34784.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-34780](https://cve.now/CVE-2024-34780.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-29211](https://cve.now/CVE-2024-29211.md): A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuratio (CVSS 7.1, Ivanti Secure Access Client)
- [CVE-2024-39712](https://cve.now/CVE-2024-39712.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-34781](https://cve.now/CVE-2024-34781.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-37400](https://cve.now/CVE-2024-37400.md): An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2024-32839](https://cve.now/CVE-2024-32839.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-38654](https://cve.now/CVE-2024-38654.md): Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to (CVSS 4.4, Ivanti Secure Access Client)
- [CVE-2024-38649](https://cve.now/CVE-2024-38649.md): An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated at (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2024-39711](https://cve.now/CVE-2024-39711.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-39709](https://cve.now/CVE-2024-39709.md): Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version (CVSS 7.8, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-38656](https://cve.now/CVE-2024-38656.md): Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-32844](https://cve.now/CVE-2024-32844.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-34787](https://cve.now/CVE-2024-34787.md): Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthent (CVSS 7.8, Ivanti EPM)
- [CVE-2024-32847](https://cve.now/CVE-2024-32847.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-37398](https://cve.now/CVE-2024-37398.md): Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2024-32841](https://cve.now/CVE-2024-32841.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-34782](https://cve.now/CVE-2024-34782.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2024-39710](https://cve.now/CVE-2024-39710.md): Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-37376](https://cve.now/CVE-2024-37376.md): SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic (CVSS 7.2, Ivanti EPM)
- [CVE-2023-38920](https://cve.now/CVE-2023-38920.md): Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted scr (CVSS 4.8)
- [CVE-2024-40404](https://cve.now/CVE-2024-40404.md): Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Socke (CVSS 9.8)
- [CVE-2024-40405](https://cve.now/CVE-2024-40405.md): Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via (CVSS 8.1)
- [CVE-2024-40407](https://cve.now/CVE-2024-40407.md): A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application (CVSS 7.5)
- [CVE-2024-40408](https://cve.now/CVE-2024-40408.md): Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the Create Profile section. (CVSS 7.3)
- [CVE-2024-40410](https://cve.now/CVE-2024-40410.md): Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption. (CVSS 4.8)
- [CVE-2024-40443](https://cve.now/CVE-2024-40443.md): SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of s (CVSS 4.3)
- [CVE-2024-42834](https://cve.now/CVE-2024-42834.md): A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows a (CVSS 6.1)
- [CVE-2024-45875](https://cve.now/CVE-2024-45875.md): The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewU (CVSS 5.4)
- [CVE-2024-45876](https://cve.now/CVE-2024-45876.md): The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injecti (CVSS 6.5)
- [CVE-2024-45877](https://cve.now/CVE-2024-45877.md): baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManag (CVSS 6.5)
- [CVE-2024-45878](https://cve.now/CVE-2024-45878.md): The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable (CVSS 6.1)
- [CVE-2024-45879](https://cve.now/CVE-2024-45879.md): The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QW (CVSS 6.1)
- [CVE-2024-48510](https://cve.now/CVE-2024-48510.md): Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared (CVSS 9.1, DotNetZip · ProDotNetZip)
- [CVE-2024-50852](https://cve.now/CVE-2024-50852.md): Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function. (CVSS 8.8)
- [CVE-2024-50853](https://cve.now/CVE-2024-50853.md): Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function. (CVSS 8.8)
- [CVE-2024-50854](https://cve.now/CVE-2024-50854.md): Tenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping function. (CVSS 8.8)
- [CVE-2024-50955](https://cve.now/CVE-2024-50955.md): An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a (CVSS 7.5)
- [CVE-2024-50956](https://cve.now/CVE-2024-50956.md): A buffer overflow in the RecvSocketData function of Inovance HCPLC\_AM401-CPU1608TPTN 21.38.0.0, HCPLC\_AM402-CPU1608TPTN 41.38.0.0, and HCPLC (CVSS 6.5)
- [CVE-2024-50969](https://cve.now/CVE-2024-50969.md): A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbi (CVSS 6.1)
- [CVE-2024-50970](https://cve.now/CVE-2024-50970.md): A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arb (CVSS 6.5)
- [CVE-2024-50971](https://cve.now/CVE-2024-50971.md): A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary S (CVSS 6.5)
- [CVE-2024-50972](https://cve.now/CVE-2024-50972.md): A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitra (CVSS 6.5)
- [CVE-2024-51027](https://cve.now/CVE-2024-51027.md): Ruijie NBR800G gateway NBR\_RGOS\_11.1(6)B4P9 is vulnerable to command execution in /itbox\_pi/networksafe.php via the province parameter. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.