# CVEs published 2024-11-17

11 CVEs were published on November 17, 2024: 1 critical, 7 high. Days are UTC.

- [CVE-2023-43091](https://cve.now/CVE-2023-43091.md): Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json (CVSS 9.8, gnome-maps)
- [CVE-2024-0793](https://cve.now/CVE-2024-0793.md): Kube-controller-manager: malformed hpa v1 manifest causes crash (CVSS 7.7, kube-controller-manager · Red Hat OpenShift Container Pl… +1)
- [CVE-2023-6110](https://cve.now/CVE-2023-6110.md): Openstack: deleting a non existing access rule deletes another existing access rule in it's scope (CVSS 5.5, Red Hat OpenStack Platform 17.1 for RHEL · Red Hat OpenS… +1)
- [CVE-2023-4639](https://cve.now/CVE-2023-4639.md): Undertow: cookie smuggling/spoofing (CVSS 7.4, Red Hat Migration Toolkit for Runtimes 1 on RHEL · Red… +15)
- [CVE-2023-1419](https://cve.now/CVE-2023-1419.md): Debezium: script injection via connector parameter (CVSS 5.9, Red Hat build of Debezium · Red Hat Integration Change D… +3)
- [CVE-2023-0657](https://cve.now/CVE-2023-0657.md): Keycloak: impersonation via logout token exchange (CVSS 3.4, keycloak · Red Hat build of Keycloak +2)
- [CVE-2020-25720](https://cve.now/CVE-2020-25720.md): Samba: check attribute access rights for ldap adds of computers (CVSS 7.5, samba · Red Hat Enterprise Linux +2)
- [CVE-2024-52867](https://cve.now/CVE-2024-52867.md): guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata (CVSS 8.1)
- [CVE-2024-52871](https://cve.now/CVE-2024-52871.md): In Flagsmith before 2.134.1, it is possible to bypass the ALLOW\_REGISTRATION\_WITHOUT\_INVITE setting. (CVSS 7.5)
- [CVE-2024-52872](https://cve.now/CVE-2024-52872.md): In Flagsmith before 2.134.1, the get\_document endpoint is not correctly protected by permissions. (CVSS 7.5)
- [CVE-2024-52876](https://cve.now/CVE-2024-52876.md): Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.