# CVEs published 2024-11-21

130 CVEs were published on November 21, 2024: 10 critical, 28 high. Days are UTC.

- [CVE-2024-52056](https://cve.now/CVE-2024-52056.md): Application Delete Path Traversal in Wowza Streaming Engine (CVSS 6.9, Wowza Streaming Engine)
- [CVE-2024-52055](https://cve.now/CVE-2024-52055.md): Application Copy Path Traversal in Wowza Streaming Engine (CVSS 8.2, Wowza Streaming Engine)
- [CVE-2024-52054](https://cve.now/CVE-2024-52054.md): Application Creation Path Traversal in Wowza Streaming Engine (CVSS 5.1, Wowza Streaming Engine)
- [CVE-2024-52053](https://cve.now/CVE-2024-52053.md): Stored Cross-Site Scripting in Wowza Streaming Engine (CVSS 8.7, Wowza Streaming Engine)
- [CVE-2024-52052](https://cve.now/CVE-2024-52052.md): Stream Target Remote Code Execution in Wowza Streaming Engine (CVSS 9.4, Wowza Streaming Engine)
- [CVE-2024-52616](https://cve.now/CVE-2024-52616.md): Avahi: avahi wide-area dns predictable transaction ids (CVSS 5.3, avahi · Red Hat Enterprise Linux +1)
- [CVE-2024-52615](https://cve.now/CVE-2024-52615.md): Avahi: avahi wide-area dns uses constant source port (CVSS 5.3, avahi · Red Hat Enterprise Linux +1)
- [CVE-2024-49588](https://cve.now/CVE-2024-49588.md): Multiple authenticated SQL injections in oracle-sidecar (CVSS 6.8, com.palantir.srx.prometheus.sls-oracle-sidecar:sls-oracle-s…)
- [CVE-2024-53095](https://cve.now/CVE-2024-53095.md): smb: client: Fix use-after-free of network namespace. (CVSS 9.8, Linux)
- [CVE-2024-53094](https://cve.now/CVE-2024-53094.md): RDMA/siw: Add sendpage\_ok() check to disable MSG\_SPLICE\_PAGES (CVSS 9.8, Linux)
- [CVE-2024-53093](https://cve.now/CVE-2024-53093.md): nvme-multipath: defer partition scanning (CVSS 7.5, Linux)
- [CVE-2024-53092](https://cve.now/CVE-2024-53092.md): virtio\_pci: Fix admin vq cleanup by using correct info pointer (CVSS 8.4, Linux)
- [CVE-2024-53091](https://cve.now/CVE-2024-53091.md): bpf: Add sk\_is\_inet and IS\_ICSK check in tls\_sw\_has\_ctx\_tx/rx (CVSS 7.8, Linux)
- [CVE-2024-53090](https://cve.now/CVE-2024-53090.md): afs: Fix lock recursion (CVSS 7.5, Linux)
- [CVE-2024-53089](https://cve.now/CVE-2024-53089.md): LoongArch: KVM: Mark hrtimer to expire in hard interrupt context (CVSS 5.5, Linux)
- [CVE-2024-52287](https://cve.now/CVE-2024-52287.md): authentik performs insufficient validation of OAuth scopes (CVSS 6.4, goauthentik authentik)
- [CVE-2024-52289](https://cve.now/CVE-2024-52289.md): authentik has an insecure default configuration for OAuth2 Redirect URIs (CVSS 7.9, goauthentik authentik)
- [CVE-2024-52307](https://cve.now/CVE-2024-52307.md): authentik allows a timing attack due to missing constant time comparison for metrics view (CVSS 6.3, goauthentik authentik)
- [CVE-2024-52309](https://cve.now/CVE-2024-52309.md): SFTPGo allows administrators to restrict command execution from the EventManager (CVSS 5.1, drakkan sftpgo · github.com/drakkan/sftpgo/v2 +2)
- [CVE-2024-52799](https://cve.now/CVE-2024-52799.md): Argo Workflows Chart: Excessive Privileges in Workflow Role (CVSS 8.3, argoproj argo-helm)
- [CVE-2024-52803](https://cve.now/CVE-2024-52803.md): LLama Factory Remote OS Command Injection Vulnerability (CVSS 7.5, hiyouga LLaMA-Factory · llamafactory)
- [CVE-2024-49529](https://cve.now/CVE-2024-49529.md): InDesign Desktop | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-8525](https://cve.now/CVE-2024-8525.md): Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload (CVSS 10.0, Automated Logic, a Carrier company WebCTRL · Carrier i-Vu)
- [CVE-2024-8526](https://cve.now/CVE-2024-8526.md): Automated Logic WebCTRL and Carrier i-Vu Open Redirect (CVSS 5.9, Automated Logic, a Carrier company WebCTRL · Carrier i-Vu)
- [CVE-2024-28892](https://cve.now/CVE-2024-28892.md): An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. (CVSS 9.8, GoCast · github.com/mayuresh82/gocast)
- [CVE-2024-29224](https://cve.now/CVE-2024-29224.md): An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. (CVSS 9.8, GoCast)
- [CVE-2024-21855](https://cve.now/CVE-2024-21855.md): A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. (CVSS 9.8, GoCast)
- [CVE-2024-28027](https://cve.now/CVE-2024-28027.md): Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5 (CVSS 7.2, MC Technologies MC LR Router)
- [CVE-2024-28026](https://cve.now/CVE-2024-28026.md): Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5 (CVSS 7.2, MC Technologies MC LR Router)
- [CVE-2024-28025](https://cve.now/CVE-2024-28025.md): Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5 (CVSS 7.2, MC Technologies MC LR Router)
- [CVE-2024-21786](https://cve.now/CVE-2024-21786.md): An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies MC LR Router 2.10.5. (CVSS 7.2, MC Technologies MC LR Router)
- [CVE-2024-11592](https://cve.now/CVE-2024-11592.md): 1000 Projects Beauty Parlour Management System about-us.php sql injection (CVSS 6.9, 1000 Projects Beauty Parlour Management System)
- [CVE-2024-11591](https://cve.now/CVE-2024-11591.md): 1000 Projects Beauty Parlour Management System add-services.php sql injection (CVSS 6.9, 1000 Projects Beauty Parlour Management System)
- [CVE-2024-11088](https://cve.now/CVE-2024-11088.md): Simple Membership \<= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor (CVSS 5.3, wpinsider-1 Simple Membership)
- [CVE-2024-11089](https://cve.now/CVE-2024-11089.md): Anonymous Restricted Content \<= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, cayenne Anonymous Restricted Content)
- [CVE-2024-7130](https://cve.now/CVE-2024-7130.md): Reflected XSS in Kion Computer's KION Exchange Programs Software (CVSS 5.5, Kion Computer KION Exchange Programs Software)
- [CVE-2024-7026](https://cve.now/CVE-2024-7026.md): SQLi in Teknogis Informatics' Closed Circuit Vehicle Tracking Software (CVSS 7.5, Teknogis Informatics Closed Circuit Vehicle Tracking Softwa…)
- [CVE-2024-11590](https://cve.now/CVE-2024-11590.md): 1000 Projects Bookstore Management System forget\_password\_process.php sql injection (CVSS 6.9, 1000 Projects Bookstore Management System)
- [CVE-2024-11589](https://cve.now/CVE-2024-11589.md): itsourcecode Tailoring Management System expcatedit.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-11588](https://cve.now/CVE-2024-11588.md): AVL-DiTEST-DiagDev libdoip DoIPConnection.cpp reactOnReceivedTcpMessage null pointer dereference (CVSS 5.1, AVL-DiTEST-DiagDev libdoip)
- [CVE-2024-11587](https://cve.now/CVE-2024-11587.md): idcCMS classProvCity.php GetCityOptionJs cross site scripting (CVSS 5.3, idcCMS)
- [CVE-2024-7016](https://cve.now/CVE-2024-7016.md): Stored XSS in Smarttek Informatics' Smart Doctor (CVSS 4.8, Smarttek Informatics Smart Doctor)
- [CVE-2024-9542](https://cve.now/CVE-2024-9542.md): Sky Addons for Elementor \<= 2.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Content Switcher Widget Elementor Template (CVSS 4.3, wowdevs Sky Addons – Elementor Addons with Widgets & Templa…)
- [CVE-2024-10316](https://cve.now/CVE-2024-10316.md): Stratum – Elementor Widgets \<= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, jetmonsters Stratum Widgets for Elementor)
- [CVE-2024-11320](https://cve.now/CVE-2024-11320.md): Command Injection leading to RCE via LDAP Misconfiguration (CVSS 6.9, Pandora FMS)
- [CVE-2024-10792](https://cve.now/CVE-2024-10792.md): Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels \<= 3.5.5 - Reflected Cross-Site Scripting (CVSS 6.1, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2024-11596](https://cve.now/CVE-2024-11596.md): Buffer Over-read in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-11595](https://cve.now/CVE-2024-11595.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-52067](https://cve.now/CVE-2024-52067.md): Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log (CVSS 6.9, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2024-10675](https://cve.now/CVE-2024-10675.md): affiliate-toolkit \<= 3.6.7 - Reflected Cross-Site Scripting (CVSS 6.1, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2024-11371](https://cve.now/CVE-2024-11371.md): Theater for WordPress \<= 0.18.6.2 - Reflected Cross-Site Scripting (CVSS 6.1, slimndap Theater for WordPress)
- [CVE-2024-11456](https://cve.now/CVE-2024-11456.md): Run Contests, Raffles, and Giveaways with ContestsWP \<= 2.0.3 - Reflected Cross-Site Scripting (CVSS 6.1, mdedev Run Contests, Raffles, and Giveaways with ContestsWP)
- [CVE-2024-10400](https://cve.now/CVE-2024-10400.md): Tutor LMS \<= 2.7.6 - Unauthenticated SQL Injection via rating\_filter (CVSS 7.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-10890](https://cve.now/CVE-2024-10890.md): WPAdverts – Classifieds Plugin \<= 2.1.7 - Reflected Cross-Site Scripting (CVSS 6.1, gwin WPAdverts – Classifieds Plugin)
- [CVE-2024-10393](https://cve.now/CVE-2024-10393.md): Tutor LMS \<= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration (CVSS 5.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-9828](https://cve.now/CVE-2024-9828.md): Taskbuilder \< 3.0.5 - Admin+ SQL Injection (CVSS 4.1, Taskbuilder)
- [CVE-2024-9768](https://cve.now/CVE-2024-9768.md): Formidable Forms \< 6.14.1 - Admin+ Stored XSS (CVSS 4.8, Formidable Forms)
- [CVE-2024-9600](https://cve.now/CVE-2024-9600.md): Ditty \< 3.1.47 - Author+ Stored XSS (CVSS 4.8, Ditty)
- [CVE-2024-8157](https://cve.now/CVE-2024-8157.md): Alphabetical List \<= 1.0.3 - Settings Update via CSRF (CVSS 4.3, Alphabetical List)
- [CVE-2024-5029](https://cve.now/CVE-2024-5029.md): CM Table Of Contents – WordPress TOC Plugin \< 1.2.4 - Stored XSS via CSRF (CVSS 4.8, CM Table Of Contents)
- [CVE-2024-10482](https://cve.now/CVE-2024-10482.md): Media Library Tools \< 1.5.0 - Author+ Stored XSS via SVG (CVSS 5.4, Media File Rename, Find Unused File, Add Alt text, Caption,…)
- [CVE-2024-7517](https://cve.now/CVE-2024-7517.md): Privileged escalation via crafted use of portcfg command (CVSS 8.5, Brocade Fabric OS)
- [CVE-2024-10403](https://cve.now/CVE-2024-10403.md): SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav (CVSS 5.9, Brocade Fabric OS)
- [CVE-2024-10671](https://cve.now/CVE-2024-10671.md): Button Block – Get fully customizable & multi-functional buttons \<= 1.1.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, bplugins Button Block – Design Stylish, Interactive, and Mu…)
- [CVE-2024-11334](https://cve.now/CVE-2024-11334.md): My Contador lesr \<= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export (CVSS 4.3, luydjmi My Contador lesr)
- [CVE-2024-10788](https://cve.now/CVE-2024-10788.md): Activity Log – Monitor & Record User Changes \<= 2.11.1 - Unauthenticated Stored Cross-Site Scripting via Event Context (CVSS 7.2, elemntor Activity Log – Monitor & Record User Changes)
- [CVE-2024-10782](https://cve.now/CVE-2024-10782.md): Theme Builder For Elementor \<= 1.2.2 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, theblockswp Theme Builder For Elementor)
- [CVE-2024-11438](https://cve.now/CVE-2024-11438.md): StreamWeasels Online Status Bar \<= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jburleigh1 StreamWeasels Online Status Bar)
- [CVE-2024-10528](https://cve.now/CVE-2024-10528.md): Ultimate Member \<= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update (CVSS 4.3, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-9371](https://cve.now/CVE-2024-9371.md): Branda – White Label & Branding, Custom Login Page Customizer \<= 3.4.19 - Reflected Cross-Site Scripting (CVSS 6.1, wpmudev Branda – White Label & Branding, Free Login Page Cu…)
- [CVE-2024-10623](https://cve.now/CVE-2024-10623.md): ForumEngine \<= 1.8 - Reflected Cross-Site Scripting (CVSS 6.1, EngineThemes ForumEngine)
- [CVE-2024-10796](https://cve.now/CVE-2024-10796.md): If-So Dynamic Content Personalization \<= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, ifso If-So Dynamic Content Personalization)
- [CVE-2024-10785](https://cve.now/CVE-2024-10785.md): Gutenberg Blocks with AI by Kadence WP – Page Builder Features \<= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2022-43937](https://cve.now/CVE-2022-43937.md): Brocade SANnav Information Disclosure Vulnerability (CVSS 5.7, Brocade SANnav)
- [CVE-2022-43936](https://cve.now/CVE-2022-43936.md): Brocade Fabric OS switch passwords when debugging is enabled (CVSS 6.8, Brocade SANnav)
- [CVE-2024-11440](https://cve.now/CVE-2024-11440.md): Grey Owl Lightbox \<= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, greyowl0015 Grey Owl Lightbox)
- [CVE-2024-10177](https://cve.now/CVE-2024-10177.md): Beds24 Online Booking \<= 2.0.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode (CVSS 6.4, markkinchin Beds24 Online Booking)
- [CVE-2024-11365](https://cve.now/CVE-2024-11365.md): Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes \<= 1.1.6 - Reflected Cross-Site Scripting (CVSS 6.1, securityforce Crypto and DeFi Widgets – Web3 Cryptocurrency…)
- [CVE-2024-11416](https://cve.now/CVE-2024-11416.md): WIP Incoming Lite \<= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, alexvtn WIP Incoming Lite)
- [CVE-2024-10898](https://cve.now/CVE-2024-10898.md): Contact Form 7 Email Add on \<= 1.9 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, krishaweb Email addon for CF7)
- [CVE-2024-10172](https://cve.now/CVE-2024-10172.md): WPBakery Visual Composer WHMCS Elements \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via void\_wbwhmcse\_laouts\_search Shortcode (CVSS 6.4, voidcoders Innovs WPBakery Visual Composer WHMCS Elements)
- [CVE-2024-11385](https://cve.now/CVE-2024-11385.md): Pure CSS Circle Progress bar \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, safi-mohammad Pure CSS Circle Progress bar)
- [CVE-2024-9442](https://cve.now/CVE-2024-9442.md): F4 Improvements \<= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, faktorvier F4 Improvements)
- [CVE-2024-11388](https://cve.now/CVE-2024-11388.md): Dino Game – Embed Google Chrome Dinosaur Game in WordPress \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tahmidulkarim Dino Game – Embed Google Chrome Dinosaur Game…)
- [CVE-2024-11409](https://cve.now/CVE-2024-11409.md): Grid View Gallery \<= 1.0 - Authenticated (Editor+) PHP Object Injection (CVSS 7.2, priyajain2802 Grid View Gallery)
- [CVE-2024-11424](https://cve.now/CVE-2024-11424.md): Slick Sitemap \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pengbos Slick Sitemap)
- [CVE-2024-11360](https://cve.now/CVE-2024-11360.md): Page Parts \<= 1.4.3 - Reflected Cross-Site Scripting (CVSS 6.1, husobj Page Parts)
- [CVE-2024-10696](https://cve.now/CVE-2024-10696.md): UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) \<= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA\_Template Shortcode (CVSS 4.3, codersaiful UltraAddons for Elementor)
- [CVE-2024-10522](https://cve.now/CVE-2024-10522.md): Co-marquage service-public.fr \<= 0.5.76 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, seb-emendo Co-marquage service-public.fr)
- [CVE-2024-11197](https://cve.now/CVE-2024-11197.md): Lock User Account \<= 1.0.5 - User Lock Bypass (CVSS 4.2, babatechs Lock User Account)
- [CVE-2024-11412](https://cve.now/CVE-2024-11412.md): Shine PDF Embeder \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, sabbirislam397 Shine PDF Embeder)
- [CVE-2024-11435](https://cve.now/CVE-2024-11435.md): salavat counter Plugin \<= 0.9.4 - Reflected Cross-Site Scripting (CVSS 6.1, goback2 salavat counter Plugin)
- [CVE-2024-11432](https://cve.now/CVE-2024-11432.md): SuevaFree Essential Kit \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, alexvtn SuevaFree Essential Kit)
- [CVE-2024-11428](https://cve.now/CVE-2024-11428.md): Lazy load videos and sticky control \<= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, aishan Lazy load videos and sticky control)
- [CVE-2024-11354](https://cve.now/CVE-2024-11354.md): Ultimate YouTube Video & Shorts Player With Vimeo \<= 3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion (CVSS 4.3, codelizarplugs Ultimate YouTube Video & Shorts Player With…)
- [CVE-2024-10726](https://cve.now/CVE-2024-10726.md): Friendly Functions for Welcart \<= 1.2.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 6.1, mainichiweb Friendly Functions for Welcart)
- [CVE-2024-11370](https://cve.now/CVE-2024-11370.md): Subaccounts for WooCommerce \<= 1.6.0 - Reflected Cross-Site Scripting (CVSS 6.1, mediaticus Subaccounts for WooCommerce)
- [CVE-2024-9111](https://cve.now/CVE-2024-9111.md): Product Designer \<= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, PickPlugins Product Designer for WooCommerce)
- [CVE-2024-11455](https://cve.now/CVE-2024-11455.md): Include Mastodon Feed \<= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wolfgang101 Include Mastodon Feed)
- [CVE-2024-10532](https://cve.now/CVE-2024-10532.md): Bard Extra \<= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import (CVSS 4.3, wproyal Bard Extra)
- [CVE-2024-11414](https://cve.now/CVE-2024-11414.md): RecipePress Reloaded \<= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dasmaeh RecipePress Reloaded)
- [CVE-2024-10164](https://cve.now/CVE-2024-10164.md): Premium Packages - Sell Digital Products Securely \<= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp\_pay\_link Shortcode (CVSS 6.4, codename065 Premium Packages – Sell Digital Products Secure…)
- [CVE-2024-9851](https://cve.now/CVE-2024-9851.md): LSX Tour Operator \<= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, feedmymedia Tour Operator)
- [CVE-2024-10682](https://cve.now/CVE-2024-10682.md): Bulletin Announcements \<= 3.11.7 - Reflected Cross-Site Scripting (CVSS 6.1, mikewire\_rocksolid Announcement & Notification Banner – Bul…)
- [CVE-2024-11447](https://cve.now/CVE-2024-11447.md): Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App \<=7.0.3.0 - Reflected Cross-Site Scripting (CVSS 6.1, Community by PeepSo – Download from PeepSo.com)
- [CVE-2022-43935](https://cve.now/CVE-2022-43935.md): Switch passwords and authorization IDs are printed in the embedded MLS DB file (CVSS 5.3, Brocade SANnav)
- [CVE-2022-43934](https://cve.now/CVE-2022-43934.md): Weak Key-exchange algorithms (CVSS 6.5, Brocade SANnav)
- [CVE-2022-43933](https://cve.now/CVE-2022-43933.md): configuration secrets are logged in support-save (CVSS 4.4, Brocade SANnav)
- [CVE-2024-52797](https://cve.now/CVE-2024-52797.md): Searching Opencast may cause a denial of service (CVSS 6.5, opencast · org.opencastproject:opencast-elasticsearch-impl)
- [CVE-2024-45663](https://cve.now/CVE-2024-45663.md): IBM Db2 denial of service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-30896](https://cve.now/CVE-2024-30896.md): InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with r (CVSS 9.1)
- [CVE-2024-45194](https://cve.now/CVE-2024-45194.md): In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) p (CVSS 4.8)
- [CVE-2024-45512](https://cve.now/CVE-2024-45512.md): An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. (CVSS 6.1)
- [CVE-2024-45513](https://cve.now/CVE-2024-45513.md): An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. (CVSS 4.8)
- [CVE-2024-45514](https://cve.now/CVE-2024-45514.md): An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. (CVSS 6.1)
- [CVE-2024-45517](https://cve.now/CVE-2024-45517.md): An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. (CVSS 6.1)
- [CVE-2024-48286](https://cve.now/CVE-2024-48286.md): Linksys E3000 1.0.06.002\_US is vulnerable to command injection via the diag\_ping\_start function. (CVSS 8.0)
- [CVE-2024-48288](https://cve.now/CVE-2024-48288.md): TP-Link TL-IPC42C V4.0\_20211227\_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the fronten (CVSS 8.0)
- [CVE-2024-48747](https://cve.now/CVE-2024-48747.md): An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file. (CVSS 6.8)
- [CVE-2024-51337](https://cve.now/CVE-2024-51337.md): Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive informatio (CVSS 3.5)
- [CVE-2024-51364](https://cve.now/CVE-2024-51364.md): An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. (CVSS 8.8)
- [CVE-2024-51366](https://cve.now/CVE-2024-51366.md): An arbitrary file upload vulnerability in the component \\Roaming\\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploa (CVSS 9.8)
- [CVE-2024-51367](https://cve.now/CVE-2024-51367.md): An arbitrary file upload vulnerability in the component \\Users\\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitr (CVSS 9.8)
- [CVE-2024-53333](https://cve.now/CVE-2024-53333.md): TOTOLINK EX200 v4.0.3c.7646\_B20201211 was found to contain a command insertion vulnerability in the setUssd function. (CVSS 6.3)
- [CVE-2024-53334](https://cve.now/CVE-2024-53334.md): TOTOLINK A810R V4.1.2cu.5182\_B20201026 is vulnerable to Buffer Overflow in infostat.cgi. (CVSS 8.8)
- [CVE-2024-53335](https://cve.now/CVE-2024-53335.md): TOTOLINK A810R V4.1.2cu.5182\_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi. (CVSS 7.8)
- [CVE-2024-53425](https://cve.now/CVE-2024-53425.md): A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. (CVSS 6.2, pyassimp)
- [CVE-2024-53426](https://cve.now/CVE-2024-53426.md): A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function. (CVSS 6.2)
- [CVE-2024-53429](https://cve.now/CVE-2024-53429.md): Open62541 v1.4.6 is has an assertion failure in fuzz\_binary\_decode, which leads to a crash. (CVSS 7.5)
- [CVE-2024-53432](https://cve.now/CVE-2024-53432.md): While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out\_of\_range exception in PCLPointCloud2::at. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.