CVEs published November 17, 2024
11 CVEs were published on November 17, 2024: 1 critical, 7 high.
- Published
- 11
- Critical
- 1
- High
- 7
- Medium
- 2
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- gnome-maps
- 1
- keycloak · Red Hat build of Keycloak +2
- 1
- kube-controller-manager · Red Hat OpenShift Container Pl… +1
- 1
- Red Hat build of Debezium · Red Hat Integration Change D… +3
- 1
- Red Hat Migration Toolkit for Runtimes 1 on RHEL · Red… +15
- 1
- Red Hat OpenStack Platform 17.1 for RHEL · Red Hat OpenS… +1
- 1
- samba · Red Hat Enterprise Linux +2
- 1
Critical 1
High 7
- CVE-2024-0793Kube-controller-manager: malformed hpa v1 manifest causes crashkube-controller-manager · Red Hat OpenShift Container Pl… +1
- CVE-2023-4639Undertow: cookie smuggling/spoofingRed Hat Migration Toolkit for Runtimes 1 on RHEL · Red… +15
- CVE-2020-25720Samba: check attribute access rights for ldap adds of computerssamba · Red Hat Enterprise Linux +2
- CVE-2024-52867guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata
- CVE-2024-52871In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.
- CVE-2024-52872In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.
- CVE-2024-52876Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote
Medium, low and unrated 3
- CVE-2023-6110Openstack: deleting a non existing access rule deletes another existing access rule in it's scopeRed Hat OpenStack Platform 17.1 for RHEL · Red Hat OpenS… +1
- CVE-2023-1419Debezium: script injection via connector parameterRed Hat build of Debezium · Red Hat Integration Change D… +3
- CVE-2023-0657Keycloak: impersonation via logout token exchangekeycloak · Red Hat build of Keycloak +2