# CVEs published 2024-11-14

147 CVEs were published on November 14, 2024: 29 critical, 44 high. Days are UTC.

- [CVE-2024-52308](https://cve.now/CVE-2024-52308.md): Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer (CVSS 8.0, cli · github.com/cli/cli +1)
- [CVE-2017-13227](https://cve.now/CVE-2017-13227.md): In the autofill service, the package name that is provided by the app process is trusted inappropriately. (CVSS 5.5, Google Android)
- [CVE-2024-48967](https://cve.now/CVE-2024-48967.md): Life2000 ventilator and Service PC lack sufficient audit logging capabilities (CVSS 10.0, Baxter Life2000 Ventilation System)
- [CVE-2024-48966](https://cve.now/CVE-2024-48966.md): Life2000 service tools for test and calibration do not support user authentication (CVSS 10.0, Baxter Life2000 Ventilation System)
- [CVE-2024-51658](https://cve.now/CVE-2024-51658.md): WordPress WP Course Manager plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Henrik Hoff WP Course Manager)
- [CVE-2024-51659](https://cve.now/CVE-2024-51659.md): WordPress Twitter @Anywhere Plus plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, GeekRMX Twitter @Anywhere Plus)
- [CVE-2024-51679](https://cve.now/CVE-2024-51679.md): WordPress Appointmind plugin \<= 4.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, gentlesource Appointmind)
- [CVE-2024-48970](https://cve.now/CVE-2024-48970.md): Life2000 Ventilator microcontroller lacks memory protection (CVSS 9.3, Baxter Life2000 Ventilation System)
- [CVE-2024-48974](https://cve.now/CVE-2024-48974.md): Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates (CVSS 9.3, Baxter Life2000 Ventilation System)
- [CVE-2024-48973](https://cve.now/CVE-2024-48973.md): Debug port on Life2000 Ventilator serial interface is enabled by default (CVSS 9.3, Baxter Life2000 Ventilation System)
- [CVE-2024-48971](https://cve.now/CVE-2024-48971.md): Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator (CVSS 9.3, Baxter Life2000 Ventilation System)
- [CVE-2024-9832](https://cve.now/CVE-2024-9832.md): No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator (CVSS 9.3, Baxter Life2000 Ventilation System)
- [CVE-2024-9834](https://cve.now/CVE-2024-9834.md): Improper data protection on Life2000 ventilator serial interface (CVSS 9.3, Baxter Life2000 Ventilation System)
- [CVE-2024-51684](https://cve.now/CVE-2024-51684.md): WordPress W3P SEO plugin \< 1.8.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ciprian Popescu W3P SEO)
- [CVE-2024-51687](https://cve.now/CVE-2024-51687.md): WordPress Platform.ly Official plugin \<= 1.1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Platform.ly Official)
- [CVE-2024-51688](https://cve.now/CVE-2024-51688.md): WordPress FraudLabs Pro SMS Verification plugin \<= 1.10.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, fraudlabspro FraudLabs Pro SMS Verification)
- [CVE-2024-49025](https://cve.now/CVE-2024-49025.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 5.4, Microsoft Edge)
- [CVE-2024-10397](https://cve.now/CVE-2024-10397.md): Preallocated buffer overflows in XDR responses (CVSS 7.7, The OpenAFS Foundation OpenAFS)
- [CVE-2024-10396](https://cve.now/CVE-2024-10396.md): Fileserver crash and possible information leak on StoreACL/FetchACL (CVSS 6.5, The OpenAFS Foundation OpenAFS)
- [CVE-2024-10394](https://cve.now/CVE-2024-10394.md): Theft of credentials in Unix client PAGs (CVSS 8.4, The OpenAFS Foundation OpenAFS)
- [CVE-2024-3760](https://cve.now/CVE-2024-3760.md): Email Bombing Vulnerability in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-52369](https://cve.now/CVE-2024-52369.md): WordPress KBucket plugin \<= 4.2.2 - Arbitrary File Upload vulnerability (CVSS 9.9, Optimal Access KBucket)
- [CVE-2024-52370](https://cve.now/CVE-2024-52370.md): WordPress Hive Support – WordPress Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin \<= 1.1.1 - Arbitrary File Upload vulnerability (CVSS 9.9, Hive Support)
- [CVE-2024-52372](https://cve.now/CVE-2024-52372.md): WordPress Easy CSV Importer plugin \<= 7.0.0 - Arbitrary File Upload vulnerability (CVSS 10.0, WebTechGlobal Easy CSV Importer BETA)
- [CVE-2024-52373](https://cve.now/CVE-2024-52373.md): WordPress Devexhub Gallery plugin \<= 2.0.1 - Arbitrary File Upload vulnerability (CVSS 10.0, Team Devexhub Devexhub Gallery)
- [CVE-2024-52374](https://cve.now/CVE-2024-52374.md): WordPress Do That Task plugin \<= 1.5.5 - Arbitrary File Upload vulnerability (CVSS 10.0, DoThatTask Do That Task)
- [CVE-2024-52375](https://cve.now/CVE-2024-52375.md): WordPress Datasets Manager by Arttia Creative plugin \<= 1.5 - Arbitrary File Upload vulnerability (CVSS 10.0, Datasets Manager by Arttia Creative)
- [CVE-2024-52376](https://cve.now/CVE-2024-52376.md): WordPress Boat Rental Plugin for WordPress plugin \<= 1.0.1 - Arbitrary File Upload vulnerability (CVSS 10.0, cmsMinds Boat Rental Plugin for WordPress)
- [CVE-2024-52377](https://cve.now/CVE-2024-52377.md): WordPress Instant Image Generator (One Click Image Uploads from Pixabay, Pexels and OpenAI) plugin \<= 1.5.2 - Arbitrary File Upload vulnerability (CVSS 10.0, bdthemes Instant Image Generator)
- [CVE-2024-52378](https://cve.now/CVE-2024-52378.md): WordPress DigiPass plugin \<= 0.3.0 - Arbitrary File Download vulnerability (CVSS 7.5, labs64 DigiPass)
- [CVE-2024-52379](https://cve.now/CVE-2024-52379.md): WordPress kineticPay for WooCommerce plugin \<= 2.0.8 - Arbitrary File Upload vulnerability (CVSS 10.0, faizalbahasan kineticPay for WooCommerce)
- [CVE-2024-52380](https://cve.now/CVE-2024-52380.md): WordPress Picsmize plugin \<= 1.0.0 - Arbitrary File Upload vulnerability (CVSS 10.0, softpulseinfotech Picsmize)
- [CVE-2024-52382](https://cve.now/CVE-2024-52382.md): WordPress Matix Popup Builder plugin \<= 1.0.0 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 9.8, medmatech Matix Popup Builder)
- [CVE-2024-49362](https://cve.now/CVE-2024-49362.md): Remote Code Execution on click of \<a\> Link in markdown preview (CVSS 7.7, laurent22 joplin · joplin)
- [CVE-2024-52383](https://cve.now/CVE-2024-52383.md): WordPress Ai Auto Tool Content Writing Assistant plugin \<= 2.1.2 - Broken Access Control vulnerability (CVSS 7.5, aitool Ai Auto Tool Content Writing Assistant (Gemini Write…)
- [CVE-2024-5125](https://cve.now/CVE-2024-5125.md): XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui (CVSS 7.3, parisneo/lollms-webui)
- [CVE-2024-4311](https://cve.now/CVE-2024-4311.md): Lack of login attempt rate-limiting in zenml-io/zenml (CVSS 5.4, zenml-io/zenml · zenml)
- [CVE-2024-52384](https://cve.now/CVE-2024-52384.md): WordPress Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation plugin \<= 2.4.9 - Arbitrary File Upload vulnerability (CVSS 9.9, wpmonks Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dall…)
- [CVE-2024-3502](https://cve.now/CVE-2024-3502.md): Exposure of Sensitive Information in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-3501](https://cve.now/CVE-2024-3501.md): Exposure of Sensitive Information in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-3379](https://cve.now/CVE-2024-3379.md): Incorrect Authorization in lunary-ai/lunary (CVSS 9.6, lunary-ai/lunary)
- [CVE-2024-52381](https://cve.now/CVE-2024-52381.md): WordPress ZIJ KART plugin \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1, Shoaib Rehmat ZIJ KART)
- [CVE-2024-4343](https://cve.now/CVE-2024-4343.md): Python Command Injection in imartinez/privategpt (CVSS 9.8, imartinez/privategpt)
- [CVE-2024-1682](https://cve.now/CVE-2024-1682.md): Unclaimed S3 Bucket Reference in psf/requests Documentation (CVSS 4.3, psf/requests)
- [CVE-2024-52396](https://cve.now/CVE-2024-52396.md): WordPress WOLF plugin \<= 1.0.8.3 - CSV Limited Path Traversal vulnerability (CVSS 4.9, RealMag777 WOLF)
- [CVE-2024-52371](https://cve.now/CVE-2024-52371.md): WordPress Global Gateway e4 plugin \<= 2.0 - Arbitrary File Deletion vulnerability (CVSS 8.6, DonnellC Global Gateway e4 | Payeezy Gateway |)
- [CVE-2024-52393](https://cve.now/CVE-2024-52393.md): WordPress Podlove Podcast Publisher plugin \<= 4.1.15 - Admin+ Remote Code Execution (RCE) vulnerability (CVSS 9.1, Eric Teubert Podlove Podcast Publisher)
- [CVE-2024-52524](https://cve.now/CVE-2024-52524.md): ReDoS in Giskard Scan text perturbation (CVSS 6.9, Giskard-AI giskard · giskard)
- [CVE-2024-37285](https://cve.now/CVE-2024-37285.md): Kibana arbitrary code execution via YAML deserialization (CVSS 9.1, Elastic Kibana)
- [CVE-2024-6068](https://cve.now/CVE-2024-6068.md): Input Validation Vulnerability exists in Arena® Input Analyzer (CVSS 7.0, Rockwell Automation Arena Input Analyzer)
- [CVE-2024-10921](https://cve.now/CVE-2024-10921.md): Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server (CVSS 6.8, MongoDB Server)
- [CVE-2024-11214](https://cve.now/CVE-2024-11214.md): SourceCodester Best Employee Management System profile.php unrestricted upload (CVSS 5.1, SourceCodester Best Employee Management System)
- [CVE-2024-11213](https://cve.now/CVE-2024-11213.md): SourceCodester Best Employee Management System edit\_role.php sql injection (CVSS 5.1, SourceCodester Best Employee Management System)
- [CVE-2024-42188](https://cve.now/CVE-2024-42188.md): HCL Connections is vulnerable to a broken access control vulnerability (CVSS 3.7, HCL Software Connections)
- [CVE-2024-52505](https://cve.now/CVE-2024-52505.md): matrix-appservice-irc allows IRC Command injection in provisioning API (CVSS 5.4, matrix-org matrix-appservice-irc)
- [CVE-2024-52302](https://cve.now/CVE-2024-52302.md): common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE) (CVSS 8.7, OsamaTaher Java-springboot-codebase)
- [CVE-2024-11136](https://cve.now/CVE-2024-11136.md): Arbitrary file removal via path traversal in TCL Camera (CVSS 8.2, TCL Camera)
- [CVE-2024-7124](https://cve.now/CVE-2024-7124.md): Reflected XSS in DInGO dLibra (CVSS 5.3, Poznan Supercomputing and Networking Center DInGO dLIbra)
- [CVE-2024-11212](https://cve.now/CVE-2024-11212.md): SourceCodester Best Employee Management System fetch\_product\_details.php sql injection (CVSS 5.3, SourceCodester Best Employee Management System)
- [CVE-2024-11211](https://cve.now/CVE-2024-11211.md): EyouCMS Website Logo unrestricted upload (CVSS 5.1, EyouCMS)
- [CVE-2022-2232](https://cve.now/CVE-2022-2232.md): Keycloak: ldap injection on username input (CVSS 7.5, Red Hat Single Sign-On · org.keycloak:keycloak-ldap-fede… +1)
- [CVE-2024-11210](https://cve.now/CVE-2024-11210.md): EyouCMS FilemanagerLogic.php editFile path traversal (CVSS 5.3, EyouCMS)
- [CVE-2024-10962](https://cve.now/CVE-2024-10962.md): Migration, Backup, Staging – WPvivid \<= 0.9.107 - Unauthenticated PHP Object Injection (CVSS 8.8, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2024-11215](https://cve.now/CVE-2024-11215.md): Path traversal vulnerability in EasyPHP (CVSS 6.5, EasyPHP web server)
- [CVE-2024-11209](https://cve.now/CVE-2024-11209.md): Apereo CAS 2FA login improper authentication (CVSS 5.3, Apereo CAS)
- [CVE-2024-11208](https://cve.now/CVE-2024-11208.md): Apereo CAS login session expiration (CVSS 6.3, Apereo CAS)
- [CVE-2024-9633](https://cve.now/CVE-2024-9633.md): Incorrect Ownership Assignment in GitLab (CVSS 3.1, GitLab)
- [CVE-2024-7404](https://cve.now/CVE-2024-7404.md): Improper Restriction of Rendered UI Layers or Frames in GitLab (CVSS 6.8, GitLab)
- [CVE-2024-8648](https://cve.now/CVE-2024-8648.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 6.1, GitLab)
- [CVE-2024-10979](https://cve.now/CVE-2024-10979.md): PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2024-10978](https://cve.now/CVE-2024-10978.md): PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVSS 4.2, PostgreSQL)
- [CVE-2024-10977](https://cve.now/CVE-2024-10977.md): PostgreSQL libpq retains an error message from man-in-the-middle (CVSS 3.1, PostgreSQL)
- [CVE-2024-10976](https://cve.now/CVE-2024-10976.md): PostgreSQL row security below e.g. subqueries disregards user ID changes (CVSS 4.2, PostgreSQL)
- [CVE-2024-11207](https://cve.now/CVE-2024-11207.md): Apereo CAS login redirect (CVSS 5.3, Apereo CAS)
- [CVE-2024-7730](https://cve.now/CVE-2024-7730.md): Qemu-kvm: virtio-snd: heap buffer overflow in virtio\_snd\_pcm\_in\_cb() (CVSS 7.4, qemu · Red Hat Enterprise Linux)
- [CVE-2024-3447](https://cve.now/CVE-2024-3447.md): Qemu: sdhci: heap buffer overflow in sdhci\_write\_dataport() (CVSS 6.0, qemu · Red Hat Enterprise Linux)
- [CVE-2023-4458](https://cve.now/CVE-2023-4458.md): Kernel: ksmbd: smb2\_open out-of-bounds read information disclosure vulnerability (CVSS 4.0, kernel · Red Hat Enterprise Linux)
- [CVE-2024-45642](https://cve.now/CVE-2024-45642.md): IBM Security ReaQta information disclosure (CVSS 5.3, IBM Security ReaQta)
- [CVE-2024-45099](https://cve.now/CVE-2024-45099.md): IBM Security ReaQta cross-site scripting (CVSS 3.1, IBM Security ReaQta)
- [CVE-2022-31668](https://cve.now/CVE-2022-31668.md): User permission validation failure and disclosure of P2P preheat execution logs (CVSS 7.4, Harbor · github.com/goharbor/harbor +1)
- [CVE-2022-31667](https://cve.now/CVE-2022-31667.md): Harbor fails to validate the user permissions when updating a robot account (CVSS 6.4, Harbor · github.com/goharbor/harbor)
- [CVE-2024-45670](https://cve.now/CVE-2024-45670.md): IBM Security SOAR weak password recovery mechanism (CVSS 5.6, IBM Security SOAR)
- [CVE-2022-31669](https://cve.now/CVE-2022-31669.md): Harbor fails to validate the user permissions when updating tag immutability policies (CVSS 6.4, Harbor · github.com/goharbor/harbor)
- [CVE-2022-31670](https://cve.now/CVE-2022-31670.md): Harbor fails to validate the user permissions when updating tag retention policies (CVSS 7.7, Harbor · github.com/goharbor/harbor)
- [CVE-2022-31671](https://cve.now/CVE-2022-31671.md): Harbor fails to validate the user permissions when reading and updating job execution logs through the P2P preheat execution logs (CVSS 7.4, Harbor · github.com/goharbor/harbor)
- [CVE-2022-31666](https://cve.now/CVE-2022-31666.md): Harbor fails to validate user permissions while Viewing, updating and deleting Webhook policies (CVSS 7.7, Harbor · github.com/goharbor/harbor)
- [CVE-2024-8180](https://cve.now/CVE-2024-8180.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab)
- [CVE-2024-9693](https://cve.now/CVE-2024-9693.md): Incorrect Authorization in GitLab (CVSS 8.5, GitLab)
- [CVE-2024-10571](https://cve.now/CVE-2024-10571.md): Chartify – WordPress Chart Plugin \<= 2.9.5 - Unauthenticated Local File Inclusion via source (CVSS 9.8, ays-pro Chartify – WordPress Chart Plugin)
- [CVE-2023-4134](https://cve.now/CVE-2023-4134.md): Kernel: cyttsp4\_core: use-after-free in cyttsp4\_watchdog\_work() (CVSS 5.5, kernel · Red Hat Enterprise Linux)
- [CVE-2024-47916](https://cve.now/CVE-2024-47916.md): Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 7.5, Boa web server 0.94.14rc21)
- [CVE-2024-47915](https://cve.now/CVE-2024-47915.md): VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, VaeMendis Ubooquity)
- [CVE-2024-47914](https://cve.now/CVE-2024-47914.md): VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF) (CVSS 4.5, VaeMendis Ubooquity)
- [CVE-2024-50306](https://cve.now/CVE-2024-50306.md): Apache Traffic Server: Server process can fail to drop privilege (CVSS 9.1, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-50305](https://cve.now/CVE-2024-50305.md): Apache Traffic Server: Valid Host field value can cause crashes (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-38479](https://cve.now/CVE-2024-38479.md): Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-45254](https://cve.now/CVE-2024-45254.md): VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 7.5, VaeMendis Ubooquity)
- [CVE-2024-45253](https://cve.now/CVE-2024-45253.md): Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 7.5, Avigilon VideoIQ iCVR HD camera)
- [CVE-2024-2550](https://cve.now/CVE-2024-2550.md): PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet (CVSS 8.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-5920](https://cve.now/CVE-2024-5920.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator (CVSS 4.6, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-5917](https://cve.now/CVE-2024-5917.md): PAN-OS: Server-Side Request Forgery in WildFire (CVSS 2.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS)
- [CVE-2024-2552](https://cve.now/CVE-2024-2552.md): PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI) (CVSS 6.8, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-5918](https://cve.now/CVE-2024-5918.md): PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User (CVSS 5.3, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-5919](https://cve.now/CVE-2024-5919.md): PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability (CVSS 5.1, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-2551](https://cve.now/CVE-2024-2551.md): PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet (CVSS 8.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-9472](https://cve.now/CVE-2024-9472.md): PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic (CVSS 8.7, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-7787](https://cve.now/CVE-2024-7787.md): Reflected XSS in ITG Computer Technology's vSRM Supplier Relationship Management System (CVSS 5.1, ITG Computer Technology vSRM Supplier Relationship Manageme…)
- [CVE-2024-11206](https://cve.now/CVE-2024-11206.md): Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information. (CVSS 7.5, TECNO com.transsion.phoenix)
- [CVE-2024-9186](https://cve.now/CVE-2024-9186.md): Automation By Autonami \< 3.3.0 - Unauthenticated SQLi (CVSS 8.6, Recover WooCommerce Cart Abandonment, Newsletter, Email Mar…)
- [CVE-2024-10146](https://cve.now/CVE-2024-10146.md): Simple File List \< 6.1.13 - Reflected Cross-Site Scripting (CVSS 5.4, Simple File List)
- [CVE-2023-34049](https://cve.now/CVE-2023-34049.md): Salt security advisory release - 2023-OCT-27 (CVSS 6.7, SALT)
- [CVE-2024-5082](https://cve.now/CVE-2024-5082.md): Nexus Repository 2 - Remote Code Execution (CVSS 7.1, Sonatype Nexus Repository)
- [CVE-2024-5083](https://cve.now/CVE-2024-5083.md): Nexus Repository 2 - Stored XSS (CVSS 5.1, Sonatype Nexus Repository)
- [CVE-2024-31695](https://cve.now/CVE-2024-31695.md): A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authenti (CVSS 9.8)
- [CVE-2024-39707](https://cve.now/CVE-2024-39707.md): Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could le (CVSS 5.3)
- [CVE-2024-40579](https://cve.now/CVE-2024-40579.md): Cross Site Scripting vulnerability in Virtuozzo Hybrid Server for WHMCS Open Source v.1.7.1 allows a remote attacker to obtain sensitive inf (CVSS 6.1)
- [CVE-2024-41206](https://cve.now/CVE-2024-41206.md): A stack-based buffer over-read in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Information Disclosure via a crafted (CVSS 6.5)
- [CVE-2024-41209](https://cve.now/CVE-2024-41209.md): A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS) and Code Execu (CVSS 8.8)
- [CVE-2024-41217](https://cve.now/CVE-2024-41217.md): A heap-based buffer overflow in tsMuxer version nightly-2024-05-10-02-00-45 allows attackers to cause Denial of Service (DoS) via a crafted (CVSS 6.5)
- [CVE-2024-48284](https://cve.now/CVE-2024-48284.md): A Reflected Cross-Site Scripting (XSS) vulnerability was found in the /search-result.php page of the PHPGurukul User Registration & Login an (CVSS 6.1)
- [CVE-2024-49776](https://cve.now/CVE-2024-49776.md): A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS vide (CVSS 6.5)
- [CVE-2024-49777](https://cve.now/CVE-2024-49777.md): A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS), Information D (CVSS 8.8)
- [CVE-2024-49778](https://cve.now/CVE-2024-49778.md): A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) and Code Execu (CVSS 8.8)
- [CVE-2024-50823](https://cve.now/CVE-2024-50823.md): A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and passw (CVSS 3.5)
- [CVE-2024-50824](https://cve.now/CVE-2024-50824.md): A SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class\_name paramet (CVSS 3.5)
- [CVE-2024-50825](https://cve.now/CVE-2024-50825.md): A SQL Injection vulnerability was found in /admin/school\_year.php in kashipara E-learning Management System Project 1.0 via the school\_year (CVSS 3.5)
- [CVE-2024-50826](https://cve.now/CVE-2024-50826.md): A SQL Injection vulnerability was found in /admin/add\_content.php in kashipara E-learning Management System Project 1.0 via the title and co (CVSS 3.5)
- [CVE-2024-50827](https://cve.now/CVE-2024-50827.md): A SQL Injection vulnerability was found in /admin/add\_subject.php in kashipara E-learning Management System Project 1.0 via the subject\_code (CVSS 3.5)
- [CVE-2024-50828](https://cve.now/CVE-2024-50828.md): A SQL Injection vulnerability was found in /admin/edit\_department.php in kashipara E-learning Management System Project 1.0 via the d parame (CVSS 3.5)
- [CVE-2024-50829](https://cve.now/CVE-2024-50829.md): A SQL Injection vulnerability was found in /admin/edit\_subject.php in kashipara E-learning Management System Project 1.0 via the unit parame (CVSS 3.5)
- [CVE-2024-50830](https://cve.now/CVE-2024-50830.md): A SQL Injection vulnerability was found in /admin/calendar\_of\_events.php in kashipara E-learning Management System Project 1.0 via the date\_ (CVSS 3.5)
- [CVE-2024-50831](https://cve.now/CVE-2024-50831.md): A SQL Injection was found in /admin/admin\_user.php in kashipara E-learning Management System Project 1.0 via the username and password param (CVSS 3.5)
- [CVE-2024-50832](https://cve.now/CVE-2024-50832.md): A SQL Injection vulnerability was found in /admin/edit\_class.php in kashipara E-learning Management System Project 1.0 via the class\_name pa (CVSS 3.5)
- [CVE-2024-50833](https://cve.now/CVE-2024-50833.md): A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password pa (CVSS 3.5)
- [CVE-2024-50834](https://cve.now/CVE-2024-50834.md): A SQL Injection was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0 via the firstname and lastname parame (CVSS 3.5)
- [CVE-2024-50835](https://cve.now/CVE-2024-50835.md): A SQL Injection vulnerability was found in /admin/edit\_student.php in KASHIPARA E-learning Management System Project 1.0 via the cys, un, ln (CVSS 3.5)
- [CVE-2024-50836](https://cve.now/CVE-2024-50836.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. (CVSS 6.1)
- [CVE-2024-50837](https://cve.now/CVE-2024-50837.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/admin\_user.php in KASHIPARA E-learning Management System Project 1.0. (CVSS 5.4)
- [CVE-2024-50838](https://cve.now/CVE-2024-50838.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/department.php in KASHIPARA E-learning Management System Project 1.0. (CVSS 5.4)
- [CVE-2024-50839](https://cve.now/CVE-2024-50839.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/add\_subject.php in KASHIPARA E-learning Management System Project 1.0. (CVSS 5.4)
- [CVE-2024-50840](https://cve.now/CVE-2024-50840.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/class.php in KASHIPARA E-learning Management System Project 1.0. (CVSS 5.4)
- [CVE-2024-50841](https://cve.now/CVE-2024-50841.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar\_of\_events.php in KASHIPARA E-learning Management System Proje (CVSS 5.4)
- [CVE-2024-50842](https://cve.now/CVE-2024-50842.md): A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school\_year.php in KASHIPARA E-learning Management System Project 1.0. (CVSS 5.4)
- [CVE-2024-50843](https://cve.now/CVE-2024-50843.md): A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers at (CVSS 5.3)
- [CVE-2024-50968](https://cve.now/CVE-2024-50968.md): A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remo (CVSS 7.5)
- [CVE-2024-51156](https://cve.now/CVE-2024-51156.md): 07FLYCMS V1.3.9 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component 'erp.07fly.net:80/admin/SysNotifyUser/del.ht (CVSS 4.7)
- [CVE-2024-52613](https://cve.now/CVE-2024-52613.md): A heap-based buffer under-read in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) via a crafte (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.