# CVEs published 2024-11-20

122 CVEs were published on November 20, 2024: 19 critical, 46 high. Days are UTC.

- [CVE-2024-9875](https://cve.now/CVE-2024-9875.md): Okta Privileged Access server agent (SFTD) versions 1.82.0 to 1.84.0 are affected by a privilege escalation vulnerability when the sudo comm (CVSS 7.1, Okta Privileged Access Server Agent)
- [CVE-2024-52581](https://cve.now/CVE-2024-52581.md): Litestar allows unbounded resource consumption (DoS vulnerability) (CVSS 8.2, litestar-org litestar · litestar +1)
- [CVE-2018-9487](https://cve.now/CVE-2018-9487.md): In setVpnForcedLocked of Vpn.java, there is a possible blocking of internet traffic through vpn due to a bad uid check. (CVSS 6.5, Google Android)
- [CVE-2018-9486](https://cve.now/CVE-2018-9486.md): In hidh\_l2cif\_data\_ind of hidh\_conn.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2018-9485](https://cve.now/CVE-2018-9485.md): In l2cble\_process\_sig\_cmd of l2c\_ble.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2018-9484](https://cve.now/CVE-2018-9484.md): In l2cu\_send\_peer\_config\_rej of l2c\_utils.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2018-9483](https://cve.now/CVE-2018-9483.md): In bta\_dm\_remove\_sec\_dev\_entry of bta\_dm\_act.cc, there is a possible out of bounds read due to a use after free. (CVSS 6.5, Google Android)
- [CVE-2018-9482](https://cve.now/CVE-2018-9482.md): In intr\_data\_copy\_cb of btif\_hd.cc, there is a possible out of bounds read due to an integer overflow. (CVSS 6.2, Google Android)
- [CVE-2018-9481](https://cve.now/CVE-2018-9481.md): In bta\_hd\_set\_report\_act of bta\_hd\_act.cc, there is a possible out-of-bounds read due to an integer overflow. (CVSS 6.2, Google Android)
- [CVE-2018-9480](https://cve.now/CVE-2018-9480.md): In bta\_hd\_get\_report\_act of bta\_hd\_act.cc, there is a possible out-of-bounds read due to improper input validation. (CVSS 6.5, Google Android)
- [CVE-2018-9479](https://cve.now/CVE-2018-9479.md): In process\_service\_attr\_req and process\_service\_search\_attr\_req of sdp\_server.cc, there is an out of bounds write due to a missing bounds ch (CVSS 9.8, Google Android)
- [CVE-2024-11493](https://cve.now/CVE-2024-11493.md): 115cms pageAE.html cross site scripting (CVSS 5.3, 115cms)
- [CVE-2024-11492](https://cve.now/CVE-2024-11492.md): 115cms appurladd.html cross site scripting (CVSS 5.3, 115cms)
- [CVE-2018-9478](https://cve.now/CVE-2018-9478.md): In process\_service\_attr\_req and process\_service\_search\_attr\_req of sdp\_server.cc, there is an out of bounds write due to a missing bounds ch (CVSS 9.8, Google Android)
- [CVE-2018-9477](https://cve.now/CVE-2018-9477.md): In the development options section of the Settings app, there is a possible authentication bypass due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2018-9475](https://cve.now/CVE-2018-9475.md): In HeadsetInterface::ClccResponse of btif\_hf.cc, there is a possible out of bounds stack write due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2018-9474](https://cve.now/CVE-2018-9474.md): In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. (CVSS 8.4, Google Android)
- [CVE-2018-9472](https://cve.now/CVE-2018-9472.md): In xmlMemStrdupLoc of xmlmemory.c, there is a possible out-of-bounds write due to an integer overflow. (CVSS 8.8, Google Android)
- [CVE-2018-9471](https://cve.now/CVE-2018-9471.md): In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. (CVSS 9.8, Google Android)
- [CVE-2018-9470](https://cve.now/CVE-2018-9470.md): In bff\_Scanner\_addOutPos of Scanner.c, there is a possible out-of-bounds write due to an incorrect bounds check. (CVSS 8.8, Google Android)
- [CVE-2024-11491](https://cve.now/CVE-2024-11491.md): 115cms useradmin.html cross site scripting (CVSS 5.3, 115cms)
- [CVE-2024-11490](https://cve.now/CVE-2024-11490.md): 115cms set.html cross site scripting (CVSS 5.3, 115cms)
- [CVE-2018-9469](https://cve.now/CVE-2018-9469.md): In multiple functions of ShortcutService.java, there is a possible creation of a spoofed shortcut due to a missing permission check. (CVSS 8.4, Google Android)
- [CVE-2018-9468](https://cve.now/CVE-2018-9468.md): In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. (CVSS 7.7, Google Android)
- [CVE-2024-11489](https://cve.now/CVE-2024-11489.md): 115cms file.html cross site scripting (CVSS 5.3, 115cms)
- [CVE-2024-11488](https://cve.now/CVE-2024-11488.md): 115cms web\_user.html cross site scripting (CVSS 5.3, 115cms)
- [CVE-2024-52796](https://cve.now/CVE-2024-52796.md): Password Pusher's rate limiter can be bypassed by forging proxy headers (CVSS 5.3, pglombardo PasswordPusher · pwpush)
- [CVE-2024-11487](https://cve.now/CVE-2024-11487.md): Code4Berry Decoration Management System Between Dates Reports btndates\_report.php sql injection (CVSS 5.3, Code4Berry Decoration Management System)
- [CVE-2024-11486](https://cve.now/CVE-2024-11486.md): Code4Berry Decoration Management System User Permission user\_permission.php (CVSS 5.3, Code4Berry Decoration Management System)
- [CVE-2024-11485](https://cve.now/CVE-2024-11485.md): Code4Berry Decoration Management System User userregister.php permission (CVSS 5.3, Code4Berry Decoration Management System)
- [CVE-2024-11484](https://cve.now/CVE-2024-11484.md): Code4Berry Decoration Management System User Image update\_image.php access control (CVSS 5.3, Code4Berry Decoration Management System)
- [CVE-2024-10094](https://cve.now/CVE-2024-10094.md): Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code (CVSS 9.1, Pegasystems Pega Infinity)
- [CVE-2024-52470](https://cve.now/CVE-2024-52470.md): WordPress Dynamic URL SEO plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, brainvireinfo Dynamic URL SEO)
- [CVE-2024-52471](https://cve.now/CVE-2024-52471.md): WordPress Extensions for Elementor plugin \<= 2.0.37 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, petesheppard84 Extensions for Elementor)
- [CVE-2024-52472](https://cve.now/CVE-2024-52472.md): WordPress Weather Atlas Widget plugin \<= 3.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Weather Atlas Widget)
- [CVE-2024-52473](https://cve.now/CVE-2024-52473.md): WordPress HTML5 Lyrics Karaoke Player plugin \<= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sandeep Verma HTML5 Lyrics Karaoke Player)
- [CVE-2024-52598](https://cve.now/CVE-2024-52598.md): 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview (CVSS 7.5, Bubka 2FAuth)
- [CVE-2024-52597](https://cve.now/CVE-2024-52597.md): 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render (CVSS 6.1, Bubka 2FAuth)
- [CVE-2024-11154](https://cve.now/CVE-2024-11154.md): PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \<= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, PublishPress Revisions: Duplicate Posts, Submit, Approve an…)
- [CVE-2024-10913](https://cve.now/CVE-2024-10913.md): Clone \<= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive\_unserialized\_replace' (CVSS 8.8, migrate Clone)
- [CVE-2024-9479](https://cve.now/CVE-2024-9479.md): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue a (CVSS 10.0, upKeeper Solutions upKeeper Instant Privilege Access)
- [CVE-2024-9478](https://cve.now/CVE-2024-9478.md): Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue a (CVSS 10.0, upKeeper Solutions upKeeper Instant Privilege Access)
- [CVE-2024-11495](https://cve.now/CVE-2024-11495.md): Buffer overflow in OllyDbg (CVSS 7.5, OllyDbg.exe)
- [CVE-2024-52437](https://cve.now/CVE-2024-52437.md): WordPress Banner System plugin \<= 1.0.0 - Privilege Escalation vulnerability (CVSS 8.8, Saul Morales Pacheco Banner System)
- [CVE-2024-11406](https://cve.now/CVE-2024-11406.md): Stored XSS in django CMS Attributes Fields (CVSS 6.9, django CMS Association django CMS Attributes Fields · djang…)
- [CVE-2024-52438](https://cve.now/CVE-2024-52438.md): WordPress de:branding plugin \<= 1.0.2 - Privilege Escalation vulnerability (CVSS 8.8, deco.agency de:branding)
- [CVE-2024-52442](https://cve.now/CVE-2024-52442.md): WordPress UserPlus plugin \<= 2.0 - Privilege Escalation vulnerability (CVSS 9.8, UserPlus)
- [CVE-2024-11404](https://cve.now/CVE-2024-11404.md): File Upload Bypass in django Filer (CVSS 5.5, django CMS Association django Filer · django-filer)
- [CVE-2024-52451](https://cve.now/CVE-2024-52451.md): WordPress Post Ideas plugin \<= 2 - CSRF to SQL Injection vulnerability (CVSS 8.2, aaronrobbins Post Ideas)
- [CVE-2024-52448](https://cve.now/CVE-2024-52448.md): WordPress Ultimate Classified Listings plugin \<= 1.7 - Local File Inclusion vulnerability (CVSS 7.5, webcodingplace Ultimate Classified Listings)
- [CVE-2024-10520](https://cve.now/CVE-2024-10520.md): WP Project Manager \<= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion (CVSS 5.3, wedevs Project Manager – AI Powered Project Management, Tas…)
- [CVE-2024-52449](https://cve.now/CVE-2024-52449.md): WordPress WordPress Bootscraper plugin \<= 2.1.0 - Local File Inclusion vulnerability (CVSS 7.5, Navneil Naicer Bootscraper)
- [CVE-2024-52450](https://cve.now/CVE-2024-52450.md): WordPress nBlocks plugin \<= 1.0.2 - Local File Inclusion vulnerability (CVSS 7.5, officialprocoders nBlocks)
- [CVE-2024-52439](https://cve.now/CVE-2024-52439.md): WordPress Team Rosters plugin \<= 4.8.2 - PHP Object Injection vulnerability (CVSS 9.8, Mark O'Donnell Team Rosters)
- [CVE-2024-52440](https://cve.now/CVE-2024-52440.md): WordPress Xpresslane Fast Checkout plugin \<= 1.0.0 - PHP Object Injection vulnerability (CVSS 9.8, Xpresslane Fast Checkout)
- [CVE-2024-52441](https://cve.now/CVE-2024-52441.md): WordPress Quick Learn plugin \<= 1.0.1 - PHP Object Injection vulnerability (CVSS 9.8, Rajesh Thanoch Quick Learn)
- [CVE-2024-52443](https://cve.now/CVE-2024-52443.md): WordPress Geolocator plugin \<= 1.1 - PHP Object Injection vulnerability (CVSS 9.8, masikonis Geolocator)
- [CVE-2024-52445](https://cve.now/CVE-2024-52445.md): WordPress QRMenu Restaurant QR Menu Lite plugin \<= 1.0.4 - PHP Object Injection vulnerability (CVSS 8.8, ModelTheme QRMenu Restaurant QR Menu Lite)
- [CVE-2024-52446](https://cve.now/CVE-2024-52446.md): WordPress Buying Buddy IDX CRM plugin \<= 1.2.8 - CSRF to PHP Object Injection vulnerability (CVSS 8.8, Buying Buddy IDX CRM)
- [CVE-2024-52444](https://cve.now/CVE-2024-52444.md): WordPress Opal Woo Custom Product Variation plugin \<= 1.1.3 - Arbitrary File Deletion vulnerability (CVSS 7.5, wpopal Opal Woo Custom Product Variation)
- [CVE-2024-52447](https://cve.now/CVE-2024-52447.md): WordPress Contact Page With Google Map plugin \<= 1.6.1 - Arbitrary File Deletion vulnerability (CVSS 8.6, corporatezen222 Contact Page With Google Map)
- [CVE-2024-10872](https://cve.now/CVE-2024-10872.md): Getwid – Gutenberg Blocks \<= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2024-48899](https://cve.now/CVE-2024-48899.md): Moodle: idor when accessing list of course badges (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-45691](https://cve.now/CVE-2024-45691.md): Moodle: lesson activity password bypass through php loose comparison (CVSS 5.4, moodle · moodle/moodle)
- [CVE-2024-45690](https://cve.now/CVE-2024-45690.md): Moodle: idor when deleting oauth2 linked accounts (CVSS 7.5, moodle · moodle/moodle)
- [CVE-2024-45689](https://cve.now/CVE-2024-45689.md): Moodle: unprotected access to sensitive information via dynamic tables (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2024-10382](https://cve.now/CVE-2024-10382.md): Arbitrary Code execution in Car App Android Jetpack Library (CVSS 7.3, Google Android)
- [CVE-2024-11494](https://cve.now/CVE-2024-11494.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP\_201403 (CVSS 7.5, Zyxel P-6101C firmware)
- [CVE-2024-11179](https://cve.now/CVE-2024-11179.md): MStore API \<= 4.15.7 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2024-10891](https://cve.now/CVE-2024-10891.md): Save as PDF Plugin by Pdfcrowd \<= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Save as PDF Plugin by PDFCrowd)
- [CVE-2024-10665](https://cve.now/CVE-2024-10665.md): Yaad Sarig Payment Gateway For WC \<= 2.2.4 - Missing Authorization to Authenticated (Subscriber+) Log Read/Deletion (CVSS 5.4, yaadsarig Yaad Sarig Payment Gateway For WC)
- [CVE-2024-10126](https://cve.now/CVE-2024-10126.md): Local file inclusion vulnerability in M-Files Server (CVSS 5.3, M-Files Corporation" M-Files Server)
- [CVE-2024-10127](https://cve.now/CVE-2024-10127.md): Support for authentication bypass condition in M-Files LDAP authentication (CVSS 9.2, M-Files Server)
- [CVE-2024-11176](https://cve.now/CVE-2024-11176.md): Incorrect evaluation of effective permissions in M-Files Aino (CVSS 5.3, M-Files Aino)
- [CVE-2024-47865](https://cve.now/CVE-2024-47865.md): Missing authentication for critical function vulnerability exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. (CVSS 5.3, Rakuten Mobile Rakuten Turbo)
- [CVE-2024-48895](https://cve.now/CVE-2024-48895.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version (CVSS 8.8, Rakuten Mobile Rakuten Turbo)
- [CVE-2024-52033](https://cve.now/CVE-2024-52033.md): Exposure of sensitive system information to an unauthorized control sphere issue exists in Rakuten Turbo 5G firmware version V1.3.18 and ear (CVSS 5.3, Rakuten Mobile Rakuten Turbo)
- [CVE-2024-10365](https://cve.now/CVE-2024-10365.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 6.0.3 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-10855](https://cve.now/CVE-2024-10855.md): Image Optimizer, Resizer and CDN – Sirv \<= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion (CVSS 8.1, Image Optimizer, Resizer and CDN – Sirv)
- [CVE-2024-10899](https://cve.now/CVE-2024-10899.md): WooCommerce Product Table Lite \<= 3.8.6 - Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting (CVSS 7.3, wcproducttable Product Table and List Builder for WooCommer…)
- [CVE-2024-9239](https://cve.now/CVE-2024-9239.md): Booster for WooCommerce \<= 7.2.3 - Reflected Cross-Site Scripting (CVSS 6.1, pluggabl Booster for WooCommerce – PDF Invoices, Abandoned…)
- [CVE-2024-8726](https://cve.now/CVE-2024-8726.md): MailChimp Forms by MailMunch \<= 3.2.3 - Reflected Cross-Site Scripting (CVSS 6.1, MailChimp Forms by MailMunch)
- [CVE-2024-10900](https://cve.now/CVE-2024-10900.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion (CVSS 6.5, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-11277](https://cve.now/CVE-2024-11277.md): 404 Solution \<= 2.35.19 - Reflected Cross-Site Scripting (CVSS 6.1, aaron13100 404 Solution)
- [CVE-2024-10515](https://cve.now/CVE-2024-10515.md): SEO Plugin by Squirrly SEO \< 12.3.21 - Editor+ Stored XSS (CVSS 3.5, SEO Plugin by Squirrly SEO)
- [CVE-2024-9653](https://cve.now/CVE-2024-9653.md): Restaurant Menu – Food Ordering System – Table Reservation \<= 2.4.2 - Reflected Cross-Site Scripting (CVSS 6.1, gloriafood Restaurant Menu – Food Ordering System – Table R…)
- [CVE-2024-52614](https://cve.now/CVE-2024-52614.md): Use of hard-coded cryptographic key issue exists in "Kura Sushi Official App Produced by EPARK" for Android versions prior to 3.8.5. (CVSS 4.0, Kura Sushi Official App Produced by EPARK)
- [CVE-2024-11278](https://cve.now/CVE-2024-11278.md): GD bbPress Attachments \<= 4.7.2 - Reflected Cross-Site Scripting (CVSS 6.1, gdragon GD bbPress Attachments)
- [CVE-2024-29292](https://cve.now/CVE-2024-29292.md): Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 \<= v1.3 enable an authenticated remote attacker to exe (CVSS 9.1)
- [CVE-2024-33439](https://cve.now/CVE-2024-33439.md): An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi p (CVSS 9.1)
- [CVE-2024-45510](https://cve.now/CVE-2024-45510.md): An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. (CVSS 6.1)
- [CVE-2024-45511](https://cve.now/CVE-2024-45511.md): An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. (CVSS 6.1)
- [CVE-2024-48530](https://cve.now/CVE-2024-48530.md): An issue in the Instructor Appointment Availability module of eSoft Planner 3.24.08271-USA allows attackers to cause a Denial of Service (Do (CVSS 7.5)
- [CVE-2024-48531](https://cve.now/CVE-2024-48531.md): A reflected cross-site scripting (XSS) vulnerability on the Rental Availability module of eSoft Planner 3.24.08271-USA allows attackers to e (CVSS 6.1)
- [CVE-2024-48533](https://cve.now/CVE-2024-48533.md): A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allow (CVSS 5.3)
- [CVE-2024-48534](https://cve.now/CVE-2024-48534.md): A reflected cross-site scripting (XSS) vulnerability on the Camp Details module of eSoft Planner 3.24.08271-USA allows attackers to execute (CVSS 6.1)
- [CVE-2024-48535](https://cve.now/CVE-2024-48535.md): A stored cross-site scripting (XSS) vulnerability in eSoft Planner 3.24.08271-USA allows attackers to execute arbitrary web scripts or HTML (CVSS 6.1)
- [CVE-2024-48536](https://cve.now/CVE-2024-48536.md): Incorrect access control in eSoft Planner 3.24.08271-USA allow attackers to view all transactions performed by the company via supplying a c (CVSS 7.5)
- [CVE-2024-48981](https://cve.now/CVE-2024-48981.md): An issue was discovered in MBed OS 6.16.0. (CVSS 7.5)
- [CVE-2024-48982](https://cve.now/CVE-2024-48982.md): An issue was discovered in MBed OS 6.16.0. (CVSS 7.5)
- [CVE-2024-48983](https://cve.now/CVE-2024-48983.md): An issue was discovered in MBed OS 6.16.0. (CVSS 7.5)
- [CVE-2024-48984](https://cve.now/CVE-2024-48984.md): An issue was discovered in MBed OS 6.16.0. (CVSS 9.8)
- [CVE-2024-48985](https://cve.now/CVE-2024-48985.md): An issue was discovered in MBed OS 6.16.0. (CVSS 7.5)
- [CVE-2024-48986](https://cve.now/CVE-2024-48986.md): An issue was discovered in MBed OS 6.16.0. (CVSS 7.5)
- [CVE-2024-49203](https://cve.now/CVE-2024-49203.md): Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. (no CVSS, io.github.openfeign.querydsl:querydsl-jpa · io.github.op… +2)
- [CVE-2024-51151](https://cve.now/CVE-2024-51151.md): D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the msp\_info\_htm function via the flag parameter and cmd parameter. (CVSS 8.0)
- [CVE-2024-51162](https://cve.now/CVE-2024-51162.md): An issue in Audimex EE versions 15.1.20 and earlier allowing a remote attacker to escalate privileges. (CVSS 8.8)
- [CVE-2024-51163](https://cve.now/CVE-2024-51163.md): A Local File Inclusion vulnerability in Vegam Solutions Vegam 4i versions 6.3.47.0 and earlier allows a remote attacker to obtain sensitive (CVSS 7.5)
- [CVE-2024-51208](https://cve.now/CVE-2024-51208.md): File Upload vulnerability in change-image.php in Anuj Kumar's Boat Booking System version 1.0 allows local attackers to upload a malicious P (CVSS 7.2)
- [CVE-2024-51209](https://cve.now/CVE-2024-51209.md): Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary we (CVSS 6.1)
- [CVE-2024-52677](https://cve.now/CVE-2024-52677.md): HkCms \<= v2.3.2.240702 is vulnerable to file upload in the getFileName method in /app/common/library/Upload.php. (CVSS 9.8)
- [CVE-2024-52701](https://cve.now/CVE-2024-52701.md): A stored cross-site scripting (XSS) vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scri (CVSS 5.4)
- [CVE-2024-52702](https://cve.now/CVE-2024-52702.md): A stored cross-site scripting (XSS) vulnerability in the component install\\index.php of MyBB v1.8.38 allows attackers to execute arbitrary w (CVSS 6.1)
- [CVE-2024-52725](https://cve.now/CVE-2024-52725.md): SemCms v4.8 was discovered to contain a SQL injection vulnerability. (CVSS 4.9)
- [CVE-2024-52739](https://cve.now/CVE-2024-52739.md): D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp\_info\_htm function vi (CVSS 8.0)
- [CVE-2024-52754](https://cve.now/CVE-2024-52754.md): D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the fn parameter in the tgfile\_htm function. (CVSS 3.5)
- [CVE-2024-52755](https://cve.now/CVE-2024-52755.md): D-LINK DI-8003 v16.07.26A1 was discovered to contain a buffer overflow via the host\_ip parameter in the ipsec\_road\_asp function. (CVSS 3.5)
- [CVE-2024-52757](https://cve.now/CVE-2024-52757.md): D-LINK DI-8003 v16.07.16A1 was discovered to contain a buffer overflow via the notify parameter in the arp\_sys\_asp function. (CVSS 3.5)
- [CVE-2024-52765](https://cve.now/CVE-2024-52765.md): H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter. (CVSS 9.8)
- [CVE-2024-52769](https://cve.now/CVE-2024-52769.md): An arbitrary file upload vulnerability in the component /admin/friendlink\_edit of DedeBIZ v6.3.0 allows attackers to execute arbitrary code (CVSS 7.2)
- [CVE-2024-52770](https://cve.now/CVE-2024-52770.md): An arbitrary file upload vulnerability in the component /admin/file\_manage\_control of DedeBIZ v6.3.0 allows attackers to execute arbitrary c (CVSS 9.8)
- [CVE-2024-52771](https://cve.now/CVE-2024-52771.md): DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file\_manage\_view. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.