# CVEs published 2024-11-18

184 CVEs were published on November 18, 2024: 21 critical, 65 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-51939](https://cve.now/CVE-2024-51939.md): WordPress Stylish Internal Links plugin \<= 1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Santhosh veer Stylish Internal Links)
- [CVE-2024-51940](https://cve.now/CVE-2024-51940.md): WordPress WP Responsive Video plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sohelwpexpert WP Responsive Video)
- [CVE-2024-52339](https://cve.now/CVE-2024-52339.md): WordPress Mage Front End Forms plugin \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Maximilian Ruthe Mage Front End Forms)
- [CVE-2024-52340](https://cve.now/CVE-2024-52340.md): WordPress Photographer Connections plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MartyThornley Photographer Connections)
- [CVE-2024-52587](https://cve.now/CVE-2024-52587.md): Harden-Runner has command injection weaknesses in \`setup.ts\` and \`arc-runner.ts\` (CVSS 2.7, step-security harden-runner)
- [CVE-2024-52341](https://cve.now/CVE-2024-52341.md): WordPress OS Our Team plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Offshorent Solutions Pvt OS Our Team)
- [CVE-2024-52342](https://cve.now/CVE-2024-52342.md): WordPress OS BXSlider plugin \<= 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Offshorent Solutions Pvt OS BXSlider)
- [CVE-2024-52343](https://cve.now/CVE-2024-52343.md): WordPress OS Pricing Tables plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Offshorent Solutions Pvt OS Pricing Tables)
- [CVE-2024-52344](https://cve.now/CVE-2024-52344.md): WordPress Provide Forex Signals plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Codeies Pvt Provide Forex Signals)
- [CVE-2024-52345](https://cve.now/CVE-2024-52345.md): WordPress ra\_qrcode plugin \<= 2.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RobertoAlicata ra\_qrcode)
- [CVE-2024-52346](https://cve.now/CVE-2024-52346.md): WordPress SimpleGMaps plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, JavierMendezPWG SimpleGMaps)
- [CVE-2024-52347](https://cve.now/CVE-2024-52347.md): WordPress Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera plugin \<= 4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpwebsitecreator Website remote Install vor Gravity, WPForm…)
- [CVE-2024-52348](https://cve.now/CVE-2024-52348.md): WordPress AA Audio Player plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AA Extensions AA Audio Player)
- [CVE-2024-21287](https://cve.now/CVE-2024-21287.md): Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). (CVSS 7.5, KEV, Oracle Agile PLM Framework)
- [CVE-2024-52349](https://cve.now/CVE-2024-52349.md): WordPress Awesome Tool Tip plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Md. Shiddikur Rahman Awesome Tool Tip)
- [CVE-2024-10486](https://cve.now/CVE-2024-10486.md): Google for WooCommerce \<= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File (CVSS 5.3, Google for WooCommerce)
- [CVE-2024-52389](https://cve.now/CVE-2024-52389.md): WordPress WP Job Portal plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpjobportal WP Job Portal)
- [CVE-2024-52390](https://cve.now/CVE-2024-52390.md): WordPress CYAN Backup plugin \<= 2.5.3 - Arbitrary File Download vulnerability (CVSS 4.9, Greg Ross CYAN Backup)
- [CVE-2024-52394](https://cve.now/CVE-2024-52394.md): WordPress Print PDF Generator and Publisher plugin \<= 1.1.6 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, verkkovaraani Print PDF Generator and Publisher)
- [CVE-2024-52417](https://cve.now/CVE-2024-52417.md): WordPress ReConstruction theme \<= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, BoldThemes ReConstruction)
- [CVE-2024-52418](https://cve.now/CVE-2024-52418.md): WordPress Gameplan theme \<= 1.5.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, CactusThemes Gameplan)
- [CVE-2024-52585](https://cve.now/CVE-2024-52585.md): Autolab has HTML Injection Vulnerability (CVSS 1.2, Autolab)
- [CVE-2024-52584](https://cve.now/CVE-2024-52584.md): Autolab has vulnerable submission endpoints (CVSS 4.9, Autolab)
- [CVE-2024-52583](https://cve.now/CVE-2024-52583.md): WesHacks code includes links to Leostop tracking spyware infested files (CVSS 8.2, DefinetlyNotAI WesHacks)
- [CVE-2024-52506](https://cve.now/CVE-2024-52506.md): Graylog can leak other users' reports via concurrent PDF report rendering (CVSS 7.1, graylog2-server · org.graylog:graylog-parent)
- [CVE-2024-52304](https://cve.now/CVE-2024-52304.md): aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVSS 6.3, aio-libs aiohttp · aiohttp)
- [CVE-2024-52303](https://cve.now/CVE-2024-52303.md): aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method (CVSS 8.7, aio-libs aiohttp · aiohttp)
- [CVE-2024-51743](https://cve.now/CVE-2024-51743.md): Arbitrary File Write leading up to remote code execution (instructor accounts) (CVSS 7.1, MarkUsProject Markus)
- [CVE-2024-51499](https://cve.now/CVE-2024-51499.md): MarkUs Arbitrary File Write leading up to remote code execution (student accounts) (CVSS 7.1, MarkUsProject Markus)
- [CVE-2024-48917](https://cve.now/CVE-2024-48917.md): XXE in PHPSpreadsheet's XLSX reader (CVSS 7.5, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-47873](https://cve.now/CVE-2024-47873.md): PhpSpreadsheet XmlScanner bypass leads to XXE (CVSS 7.5, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-47820](https://cve.now/CVE-2024-47820.md): MarkUs vulnerable to Path Traversal (CVSS 5.7, MarkUsProject Markus)
- [CVE-2024-47533](https://cve.now/CVE-2024-47533.md): Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes (CVSS 9.8, cobbler)
- [CVE-2024-10390](https://cve.now/CVE-2024-10390.md): Elfsight Telegram Chat CC \<= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, Elfsight Telegram Chat CC)
- [CVE-2024-43416](https://cve.now/CVE-2024-43416.md): GLPI vulnerable to enumeration of users' email addresses by unauthenticated user (CVSS 7.5, glpi-project glpi)
- [CVE-2020-26066](https://cve.now/CVE-2020-26066.md): Cisco SD-WAN vManage Software XML External Entity Vulnerability (CVSS 6.5, Cisco Catalyst SD-WAN Manager)
- [CVE-2020-26067](https://cve.now/CVE-2020-26067.md): Cisco Webex Teams Web Interface Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Webex Teams)
- [CVE-2024-52419](https://cve.now/CVE-2024-52419.md): WordPress Copy Anything to Clipboard plugin \<= 4.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Clipboard Agency Copy Anything to Clipboard)
- [CVE-2020-26062](https://cve.now/CVE-2020-26062.md): Cisco Integrated Management Controller Username Enumeration Vulnerability (CVSS 5.3, Cisco Unified Computing System)
- [CVE-2020-26063](https://cve.now/CVE-2020-26063.md): Cisco Integrated Management Controller Software Authorization Bypass Vulnerability (CVSS 5.4, Cisco Unified Computing System)
- [CVE-2024-52422](https://cve.now/CVE-2024-52422.md): WordPress WP Githuber MD plugin \<= 1.16.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Terry L. WP Githuber MD)
- [CVE-2020-26071](https://cve.now/CVE-2020-26071.md): Cisco SD-WAN vEdge Arbitrary File Creation Vulnerability (CVSS 8.4, Cisco Catalyst SD-WAN Manager · Cisco SD-WAN vContainer +2)
- [CVE-2024-52423](https://cve.now/CVE-2024-52423.md): WordPress Themify Builder plugin \<= 7.6.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themifyme Themify Builder)
- [CVE-2020-27124](https://cve.now/CVE-2020-27124.md): Cisco Adaptive Security Appliance Software SSL/TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2020-3420](https://cve.now/CVE-2020-3420.md): Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Unified Communications Manager)
- [CVE-2020-3431](https://cve.now/CVE-2020-3431.md): Cisco Small Business RV Series Routers Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-52424](https://cve.now/CVE-2024-52424.md): WordPress wp-login customizer plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, sureshdsk wp-login customizer)
- [CVE-2020-26073](https://cve.now/CVE-2020-26073.md): Cisco SD-WAN vManage Directory Traversal Vulnerability (CVSS 7.5, Cisco Catalyst SD-WAN Manager)
- [CVE-2020-26074](https://cve.now/CVE-2020-26074.md): Cisco SD-WAN vManage Privilege Escalation Vulnerability (CVSS 7.8, Cisco Catalyst SD-WAN Manager)
- [CVE-2020-3525](https://cve.now/CVE-2020-3525.md): Cisco Identity Services Engine Password Disclosure to an Unauthorized Actor Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2020-3532](https://cve.now/CVE-2020-3532.md): Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unity Connection · Cisco Unified Communications Manag…)
- [CVE-2020-3538](https://cve.now/CVE-2020-3538.md): Cisco Data Center Network Manager Path Traversal Vulnerability (CVSS 4.6, Cisco Data Center Network Manager)
- [CVE-2020-3539](https://cve.now/CVE-2020-3539.md): Cisco Data Center Network Manager Authorization Bypass Vulnerability (CVSS 6.3, Cisco Data Center Network Manager)
- [CVE-2020-3548](https://cve.now/CVE-2020-3548.md): Cisco Email Security Appliance Denial Of Service Vulnerability (CVSS 5.3, Cisco Secure Email)
- [CVE-2024-9474](https://cve.now/CVE-2024-9474.md): PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface (CVSS 6.9, KEV, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2024-0012](https://cve.now/CVE-2024-0012.md): PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) (CVSS 9.3, KEV, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1)
- [CVE-2021-1234](https://cve.now/CVE-2021-1234.md): Cisco SD-WAN vManage Information Disclosure Vulnerabilities (CVSS 5.3, Cisco Catalyst SD-WAN Manager)
- [CVE-2021-1132](https://cve.now/CVE-2021-1132.md): Cisco Network Services Orchestrator Path Traversal Vulnerability (CVSS 5.3, Cisco Network Services Orchestrator)
- [CVE-2021-1379](https://cve.now/CVE-2021-1379.md): Cisco IP Phones Cisco Discovery Protocol and Link Layer Discovery Protocol Remote Code Execution and Denial of Service Vulnerabilities (CVSS 6.5, Cisco IP Phones with Multiplatform Firmware · Cisco Sess… +1)
- [CVE-2021-1285](https://cve.now/CVE-2021-1285.md): Multiple Cisco Products SNORT Ethernet Frame Decoder Denial of Service Vulnerability (CVSS 7.4, Cisco UTD SNORT IPS Engine Software)
- [CVE-2021-1232](https://cve.now/CVE-2021-1232.md): Cisco SD-WAN vManage Information Disclosure Vulnerability (CVSS 6.5, Cisco Catalyst SD-WAN Manager)
- [CVE-2024-52574](https://cve.now/CVE-2024-52574.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52573](https://cve.now/CVE-2024-52573.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52572](https://cve.now/CVE-2024-52572.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52571](https://cve.now/CVE-2024-52571.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52570](https://cve.now/CVE-2024-52570.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52569](https://cve.now/CVE-2024-52569.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52568](https://cve.now/CVE-2024-52568.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52567](https://cve.now/CVE-2024-52567.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52566](https://cve.now/CVE-2024-52566.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2024-52565](https://cve.now/CVE-2024-52565.md): A vulnerability has been identified in Teamcenter Visualization V14.2 (All versions \< V14.2.0.14), Teamcenter Visualization V14.3 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2021-1410](https://cve.now/CVE-2021-1410.md): Cisco Webex Meetings Unauthorized Distribution List Update Vulnerability (CVSS 4.3, Cisco Webex Meetings)
- [CVE-2021-1425](https://cve.now/CVE-2021-1425.md): Cisco Cisco Email Security Appliance and Content Security Management Appliance Information Disclosure Vulnerability (CVSS 4.3, Cisco Secure Email and Web Manager)
- [CVE-2021-1424](https://cve.now/CVE-2021-1424.md): Cisco ASR 5000 Series Software (StarOS) ipsecmgr Process Denial of Service Vulnerability (CVSS 5.3, Cisco ASR 5000 Series Software)
- [CVE-2021-1440](https://cve.now/CVE-2021-1440.md): Cisco IOS XR Software BGP Resource Public Key Infrastructure Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XR Software)
- [CVE-2021-1461](https://cve.now/CVE-2021-1461.md): Cisco SD-WAN Software Signature Verification Bypass Vulnerability (CVSS 4.9, Cisco Catalyst SD-WAN Manager · Cisco SD-WAN vEdge Router)
- [CVE-2021-1444](https://cve.now/CVE-2021-1444.md): Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software Web Services Interface Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1462](https://cve.now/CVE-2021-1462.md): Cisco SD-WAN vManage Software Privilege Escalation Vulnerability (CVSS 4.4, Cisco Catalyst SD-WAN Manager)
- [CVE-2024-52425](https://cve.now/CVE-2024-52425.md): WordPress Drozd – Addons for Elementor plugin \<= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vladislav Urchenko Drozd – Addons for Elementor)
- [CVE-2024-52426](https://cve.now/CVE-2024-52426.md): WordPress Linear plugin \<= 2.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Linear Oy Linear)
- [CVE-2021-1465](https://cve.now/CVE-2021-1465.md): A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to cond (CVSS 4.3, Cisco Catalyst SD-WAN Manager)
- [CVE-2024-37155](https://cve.now/CVE-2024-37155.md): OpenCTI May Bypass Introspection Restriction (CVSS 6.5, OpenCTI-Platform opencti · pycti)
- [CVE-2024-52431](https://cve.now/CVE-2024-52431.md): WordPress WP Video Robot plugin \<= 1.20.0 - SQL Injection vulnerability (CVSS 9.3, Pressaholic WordPress Video Robot - The Ultimate Video Impo…)
- [CVE-2024-52435](https://cve.now/CVE-2024-52435.md): WordPress Premium Packages – Sell Digital Products Securely plugin \<= 6.0.5 - SQL Injection vulnerability (CVSS 7.6, Shahjada WPDM – Premium Packages)
- [CVE-2024-52436](https://cve.now/CVE-2024-52436.md): WordPress Post SMTP plugin \<= 2.9.9 - SQL Injection vulnerability (CVSS 7.6, Saad Iqbal Post SMTP)
- [CVE-2024-52428](https://cve.now/CVE-2024-52428.md): WordPress Ads Booster by Ads Pro plugin \<= 1.12 - Local File Inclusion vulnerability (CVSS 8.1, Peter Ads Booster by Ads Pro)
- [CVE-2024-52430](https://cve.now/CVE-2024-52430.md): WordPress Lis Video Gallery plugin \<= 0.2.1 - PHP Object Injection vulnerability (CVSS 9.8, bublick Lis Video Gallery)
- [CVE-2024-11304](https://cve.now/CVE-2024-11304.md): Multiple Stored Cross-Site Scripting (CVSS 5.1, SEH Computertechnik utnserver Pro · SEH Computertechnik… +1)
- [CVE-2024-52432](https://cve.now/CVE-2024-52432.md): WordPress NIX Anti-Spam Light plugin \<= 0.0.4 - PHP Object Injection vulnerability (CVSS 9.8, NIX Solutions NIX Anti-Spam Light)
- [CVE-2024-52433](https://cve.now/CVE-2024-52433.md): WordPress My Geo Posts Free plugin \<= 1.2 - PHP Object Injection vulnerability (CVSS 9.8, Mindstien Technologies My Geo Posts Free)
- [CVE-2024-52427](https://cve.now/CVE-2024-52427.md): WordPress Event Tickets with Ticket Scanner plugin \<= 2.3.11 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Vollstart Event Tickets with Ticket Scanner)
- [CVE-2024-52429](https://cve.now/CVE-2024-52429.md): WordPress WP Quick Setup plugin \<= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability (CVSS 9.9, AntonHoelstad WP Quick Setup)
- [CVE-2024-52434](https://cve.now/CVE-2024-52434.md): WordPress Popup by Supsystic plugin \<= 1.10.29 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Popup by Supsystic)
- [CVE-2024-8781](https://cve.now/CVE-2024-8781.md): Container Escape Vulnerability in TR7's Application Security Platform (ASP) (CVSS 8.7, TR7 Application Security Platform)
- [CVE-2024-11318](https://cve.now/CVE-2024-11318.md): IDOR vulnerability in AbsysNet (CVSS 7.5, Baratz Innovación AbsysNet)
- [CVE-2024-9526](https://cve.now/CVE-2024-9526.md): Stored XSS in Kubeflow Pipeline View (CVSS 7.1, Kubeflow Pipeline View · github.com/kubeflow/pipelines)
- [CVE-2024-11303](https://cve.now/CVE-2024-11303.md): Path Traversal (CVSS 8.7, Korenix JetPort)
- [CVE-2024-3370](https://cve.now/CVE-2024-3370.md): SQLi in Egebilgi Software's Website Template (CVSS 8.8, Egebilgi Software Website Template)
- [CVE-2024-52318](https://cve.now/CVE-2024-52318.md): Apache Tomcat: Incorrect JSP tag recycling leads to XSS (CVSS 6.1, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2024-11319](https://cve.now/CVE-2024-11319.md): Stored XSS in Open Source Project "django-cms" (CVSS 4.8, django CMS Association django-cms · django-cms)
- [CVE-2024-52317](https://cve.now/CVE-2024-52317.md): Apache Tomcat: Request/response mix-up with HTTP/2 (CVSS 6.5, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2024-52316](https://cve.now/CVE-2024-52316.md): Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVSS 9.8, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2024-48901](https://cve.now/CVE-2024-48901.md): Moodle: idor when fetching report schedules (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-48898](https://cve.now/CVE-2024-48898.md): Moodle: some users can delete audiences of other reports (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2024-48897](https://cve.now/CVE-2024-48897.md): Moodle: idor in edit/delete rss feed (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2024-48896](https://cve.now/CVE-2024-48896.md): Moodle: users' names returned in messaging error message (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-11023](https://cve.now/CVE-2024-11023.md): Session Hijacking in Firebase JavaScript SDK (CVSS 5.2, Firebase JavaScript SDK · firebase)
- [CVE-2023-39180](https://cve.now/CVE-2023-39180.md): Kernel: ksmbd: read request memory leak denial-of-service vulnerability (CVSS 4.0, kernel · Red Hat Enterprise Linux)
- [CVE-2023-39179](https://cve.now/CVE-2023-39179.md): Kernel: ksmbd: read request out-of-bounds read information disclosure vulnerability (CVSS 7.5, kernel · Red Hat Enterprise Linux)
- [CVE-2023-39176](https://cve.now/CVE-2023-39176.md): Kernel: ksmbd: transform header out-of-bounds read information disclosure vulnerability (CVSS 5.8, kernel · Red Hat Enterprise Linux)
- [CVE-2024-42392](https://cve.now/CVE-2024-42392.md): Improper Neutralization of Delimiters in Mongoose Web Server library (CVSS 4.0, Cesanta Mongoose Web Server)
- [CVE-2024-42391](https://cve.now/CVE-2024-42391.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 4.3, Cesanta Mongoose Web Server)
- [CVE-2024-42390](https://cve.now/CVE-2024-42390.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 4.3, Cesanta Mongoose Web Server)
- [CVE-2024-42389](https://cve.now/CVE-2024-42389.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 5.3, Cesanta Mongoose Web Server)
- [CVE-2024-42388](https://cve.now/CVE-2024-42388.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 5.3, Cesanta Mongoose Web Server)
- [CVE-2024-42387](https://cve.now/CVE-2024-42387.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 5.3, Cesanta Mongoose Web Server)
- [CVE-2024-41974](https://cve.now/CVE-2024-41974.md): WAGO: BACNet Service Property Modification Due to Permission Misconfiguration in Multiple Devices (CVSS 7.1, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +10)
- [CVE-2024-42386](https://cve.now/CVE-2024-42386.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 8.2, Cesanta Mongoose Web Server)
- [CVE-2024-41973](https://cve.now/CVE-2024-41973.md): WAGO: Remote Arbitrary File Write with Root Privileges in multiple Devices (CVSS 8.1, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +10)
- [CVE-2024-42385](https://cve.now/CVE-2024-42385.md): Improper Neutralization of Delimiters in Mongoose Web Server library (CVSS 4.0, Cesanta Mongoose Web Server)
- [CVE-2024-41972](https://cve.now/CVE-2024-41972.md): WAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices (CVSS 6.5, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +10)
- [CVE-2024-42384](https://cve.now/CVE-2024-42384.md): Integer Overflow or Wraparound in Mongoose Web Server library (CVSS 7.5, Cesanta Mongoose Web Server)
- [CVE-2024-41971](https://cve.now/CVE-2024-41971.md): WAGO: Arbitrary File Overwrite in Multiple Devices (CVSS 8.1, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +10)
- [CVE-2024-41970](https://cve.now/CVE-2024-41970.md): WAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices (CVSS 5.7, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +10)
- [CVE-2024-42383](https://cve.now/CVE-2024-42383.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 4.2, Cesanta Mongoose Web Server)
- [CVE-2024-41969](https://cve.now/CVE-2024-41969.md): WAGO: CODESYS V3 Configuration Authentication Bypass in Multiple Devices (CVSS 8.8, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +13)
- [CVE-2024-41967](https://cve.now/CVE-2024-41967.md): WAGO: Boot Mode Manipulation in Multiple Devices (CVSS 8.1, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +13)
- [CVE-2024-41968](https://cve.now/CVE-2024-41968.md): WAGO: Docker Settings Manipulation in Multiple Devices (CVSS 5.4, WAGO CC100 0751-9x01 · WAGO PFC100 G2 0750-811x-xxxx-xx… +13)
- [CVE-2024-41151](https://cve.now/CVE-2024-41151.md): Apache HertzBeat: RCE by notice template injection vulnerability (CVSS 8.8, Apache Software Foundation Apache HertzBeat)
- [CVE-2024-45791](https://cve.now/CVE-2024-45791.md): Apache HertzBeat: Exposure sensitive token via http GET method with query string (CVSS 7.5, Apache Software Foundation Apache HertzBeat)
- [CVE-2024-45505](https://cve.now/CVE-2024-45505.md): Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities (CVSS 8.8, Apache Software Foundation Apache HertzBeat)
- [CVE-2024-47208](https://cve.now/CVE-2024-47208.md): Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE (CVSS 9.8, Apache Software Foundation Apache OFBiz)
- [CVE-2024-48962](https://cve.now/CVE-2024-48962.md): Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE) (CVSS 8.9, Apache Software Foundation Apache OFBiz)
- [CVE-2024-49574](https://cve.now/CVE-2024-49574.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-11315](https://cve.now/CVE-2024-11315.md): TRCore DVC - Arbitrary File Upload through Path Traversal (CVSS 9.8, TRCore DVC)
- [CVE-2024-22067](https://cve.now/CVE-2024-22067.md): ZTE NH8091 product has an improper permission control vulnerability (CVSS 6.8, ZTE NH8091)
- [CVE-2024-11314](https://cve.now/CVE-2024-11314.md): TRCore DVC - Arbitrary File Upload through Path Traversal (CVSS 9.8, TRCore DVC)
- [CVE-2024-11313](https://cve.now/CVE-2024-11313.md): TRCore DVC - Arbitrary File Upload through Path Traversal (CVSS 9.8, TRCore DVC)
- [CVE-2024-11312](https://cve.now/CVE-2024-11312.md): TRCore DVC - Arbitrary File Upload through Path Traversal (CVSS 9.8, TRCore DVC)
- [CVE-2024-11311](https://cve.now/CVE-2024-11311.md): TRCore DVC - Arbitrary File Upload through Path Traversal (CVSS 9.8, TRCore DVC)
- [CVE-2024-11310](https://cve.now/CVE-2024-11310.md): TRCore DVC - Arbitrary File Read through Path Traversal (CVSS 7.5, TRCore DVC)
- [CVE-2024-11309](https://cve.now/CVE-2024-11309.md): TRCore DVC - Arbitrary File Read through Path Traversal (CVSS 7.5, TRCore DVC)
- [CVE-2024-5030](https://cve.now/CVE-2024-5030.md): CM Table Of Contents – WordPress TOC Plugin \< 1.2.3 - Settings Reset via CSRF (CVSS 3.8, CM Table Of Contents)
- [CVE-2024-11308](https://cve.now/CVE-2024-11308.md): TRCore DVC - Use of Hard-coded Cryptographic Key (CVSS 6.2, TRCore DVC)
- [CVE-2024-43704](https://cve.now/CVE-2024-43704.md): GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused (CVSS 8.4, Imagination Technologies Graphics DDK)
- [CVE-2024-38828](https://cve.now/CVE-2024-38828.md): CVE-2024-38828: DoS via Spring MVC controller method with byte\[\] parameter (CVSS 5.3, Spring · org.springframework:spring-webmvc)
- [CVE-2024-11306](https://cve.now/CVE-2024-11306.md): Altenergy Power Control Software database improper authorization (CVSS 6.9, Altenergy Power Control Software)
- [CVE-2024-11305](https://cve.now/CVE-2024-11305.md): Altenergy Power Control Software status\_zigbee get\_status\_zigbee sql injection (CVSS 5.3, Altenergy Power Control Software)
- [CVE-2015-20111](https://cve.now/CVE-2015-20111.md): miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffe (CVSS 9.8)
- [CVE-2019-25220](https://cve.now/CVE-2019-25220.md): Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains ( (CVSS 7.5)
- [CVE-2023-49952](https://cve.now/CVE-2023-49952.md): Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. (CVSS 7.5)
- [CVE-2024-28058](https://cve.now/CVE-2024-28058.md): In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an i (CVSS 7.5)
- [CVE-2024-33231](https://cve.now/CVE-2024-33231.md): Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to th (CVSS 6.1)
- [CVE-2024-44756](https://cve.now/CVE-2024-44756.md): NUS-M9 ERP Management Software v3.0.0 was discovered to contain a SQL injection vulnerability via the usercode parameter at /UserWH/checkLog (CVSS 9.8)
- [CVE-2024-44757](https://cve.now/CVE-2024-44757.md): An arbitrary file download vulnerability in the component /Basics/DownloadInpFile of NUS-M9 ERP Management Software v3.0.0 allows attackers (CVSS 7.5)
- [CVE-2024-48292](https://cve.now/CVE-2024-48292.md): An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attacke (CVSS 8.8)
- [CVE-2024-48293](https://cve.now/CVE-2024-48293.md): Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbit (CVSS 6.5)
- [CVE-2024-48294](https://cve.now/CVE-2024-48294.md): A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Servi (CVSS 5.5)
- [CVE-2024-50804](https://cve.now/CVE-2024-50804.md): Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via (CVSS 7.8)
- [CVE-2024-50848](https://cve.now/CVE-2024-50848.md): An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to acce (CVSS 6.5)
- [CVE-2024-50849](https://cve.now/CVE-2024-50849.md): A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker (CVSS 4.8)
- [CVE-2024-50919](https://cve.now/CVE-2024-50919.md): Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. (CVSS 9.8)
- [CVE-2024-51051](https://cve.now/CVE-2024-51051.md): AVSCMS v8.2.0 was discovered to contain weak default credentials for the Administrator account. (CVSS 9.8)
- [CVE-2024-51053](https://cve.now/CVE-2024-51053.md): An arbitrary file upload vulnerability in the component /main/fileupload.php of AVSCMS v8.2.0 allows attackers to execute arbitrary code via (CVSS 9.8)
- [CVE-2024-52912](https://cve.now/CVE-2024-52912.md): Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecti (CVSS 7.5)
- [CVE-2024-52913](https://cve.now/CVE-2024-52913.md): In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-reque (CVSS 5.3)
- [CVE-2024-52914](https://cve.now/CVE-2024-52914.md): In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction. (CVSS 7.5)
- [CVE-2024-52915](https://cve.now/CVE-2024-52915.md): Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message. (CVSS 7.5)
- [CVE-2024-52916](https://cve.now/CVE-2024-52916.md): Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers. (CVSS 7.5)
- [CVE-2024-52917](https://cve.now/CVE-2024-52917.md): Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e. (CVSS 6.5)
- [CVE-2024-52918](https://cve.now/CVE-2024-52918.md): Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via (CVSS 6.5)
- [CVE-2024-52919](https://cve.now/CVE-2024-52919.md): Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr mess (CVSS 6.5)
- [CVE-2024-52920](https://cve.now/CVE-2024-52920.md): Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message. (CVSS 7.5)
- [CVE-2024-52921](https://cve.now/CVE-2024-52921.md): In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block. (CVSS 5.3)
- [CVE-2024-52922](https://cve.now/CVE-2024-52922.md): In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an an (CVSS 6.5)
- [CVE-2024-52926](https://cve.now/CVE-2024-52926.md): Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent. (CVSS 6.5, Delinea Privilege Manager)
- [CVE-2024-52940](https://cve.now/CVE-2024-52940.md): AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic (CVSS 7.5)
- [CVE-2024-52941](https://cve.now/CVE-2024-52941.md): An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. (CVSS 5.4)
- [CVE-2024-52942](https://cve.now/CVE-2024-52942.md): An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. (CVSS 5.4)
- [CVE-2024-52943](https://cve.now/CVE-2024-52943.md): An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. (CVSS 5.4)
- [CVE-2024-52944](https://cve.now/CVE-2024-52944.md): An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. (CVSS 5.4)
- [CVE-2024-52945](https://cve.now/CVE-2024-52945.md): An issue was discovered in Veritas NetBackup before 10.5. (CVSS 7.8)
- [CVE-2024-52946](https://cve.now/CVE-2024-52946.md): An issue was discovered in LemonLDAP::NG before 2.20.1. (CVSS 8.8)
- [CVE-2024-52947](https://cve.now/CVE-2024-52947.md): A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.