# CVEs published 2024-11-26

162 CVEs were published on November 26, 2024: 22 critical, 61 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-53849](https://cve.now/CVE-2024-53849.md): Several stack buffer overflows and pointer overflows in editorconfig-core-c (CVSS 4.8, editorconfig-core-c)
- [CVE-2024-11819](https://cve.now/CVE-2024-11819.md): 1000 Projects Portfolio Management System MCA forgot\_password\_process.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA)
- [CVE-2024-11818](https://cve.now/CVE-2024-11818.md): PHPGurukul User Registration & Login and User Management System signup.php sql injection (CVSS 6.9, PHPGurukul User Registration & Login and User Management Sy…)
- [CVE-2024-11817](https://cve.now/CVE-2024-11817.md): PHPGurukul User Registration & Login and User Management System index.php sql injection (CVSS 6.9, PHPGurukul User Registration & Login and User Management Sy…)
- [CVE-2024-53675](https://cve.now/CVE-2024-53675.md): An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain (CVSS 7.3, Hewlett Packard Enterprise (HPE) HPE Insight Remote Support)
- [CVE-2024-53674](https://cve.now/CVE-2024-53674.md): An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain (CVSS 7.3, Hewlett Packard Enterprise (HPE) HPE Insight Remote Support)
- [CVE-2024-53673](https://cve.now/CVE-2024-53673.md): A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code. (CVSS 8.1, Hewlett Packard Enterprise (HPE) Insight Remote Support)
- [CVE-2024-11622](https://cve.now/CVE-2024-11622.md): An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain (CVSS 7.3, Hewlett Packard Enterprise (HPE) HPE Insight Remote Support)
- [CVE-2024-11745](https://cve.now/CVE-2024-11745.md): Tenda AC8 SetStaticRouteCfg route\_static\_check stack-based overflow (CVSS 8.7, Tenda AC8)
- [CVE-2024-11744](https://cve.now/CVE-2024-11744.md): 1000 Projects Portfolio Management System MCA register.php sql injection (CVSS 6.9, 1000 Projects Portfolio Management System MCA)
- [CVE-2024-43784](https://cve.now/CVE-2024-43784.md): Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion (CVSS 5.7, treeverse lakeFS · github.com/treeverse/lakefs)
- [CVE-2024-11743](https://cve.now/CVE-2024-11743.md): SourceCodester Best House Rental Management System POST Request ajax.php cross-site request forgery (CVSS 6.9, SourceCodester Best House Rental Management System)
- [CVE-2024-11742](https://cve.now/CVE-2024-11742.md): SourceCodester Best House Rental Management System ajax.php cross site scripting (CVSS 5.3, SourceCodester Best House Rental Management System)
- [CVE-2024-49053](https://cve.now/CVE-2024-49053.md): Microsoft Dynamics 365 Sales Spoofing Vulnerability (CVSS 7.6, Microsoft Dynamics 365 Sales for Android · Microsoft Dynami…)
- [CVE-2024-49052](https://cve.now/CVE-2024-49052.md): Microsoft Azure PolicyWatch Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Azure Functions)
- [CVE-2024-49038](https://cve.now/CVE-2024-49038.md): Microsoft Copilot Studio Elevation Of Privilege Vulnerability (CVSS 9.3, Microsoft Copilot Studio)
- [CVE-2024-49035](https://cve.now/CVE-2024-49035.md): Partner.Microsoft.Com Elevation of Privilege Vulnerability (CVSS 8.7, KEV, Microsoft Partner Center)
- [CVE-2019-17082](https://cve.now/CVE-2019-17082.md): Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. (CVSS 9.0, OpenText™ AccuRev)
- [CVE-2024-10240](https://cve.now/CVE-2024-10240.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab (CVSS 5.3, GitLab)
- [CVE-2024-11145](https://cve.now/CVE-2024-11145.md): Easy Folder Listing Pro deserialization vulnerability (CVSS 9.8, Valor Apps Easy Folder Listing Pro)
- [CVE-2024-8676](https://cve.now/CVE-2024-8676.md): Cri-o: checkpoint restore can be triggered from different namespaces (CVSS 7.4, cri-o · Red Hat OpenShift Container Platform +2)
- [CVE-2024-52008](https://cve.now/CVE-2024-52008.md): Password Policy Bypass Vulnerability in Fides Webserver (CVSS 2.0, ethyca fides · ethyca-fides)
- [CVE-2024-53267](https://cve.now/CVE-2024-53267.md): Vulnerability with bundle verification in sigstore-java (CVSS 5.5, sigstore-java · dev.sigstore:sigstore-java)
- [CVE-2024-11828](https://cve.now/CVE-2024-11828.md): Inefficient Algorithmic Complexity in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-11669](https://cve.now/CVE-2024-11669.md): Incorrect Authorization in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-53844](https://cve.now/CVE-2024-53844.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in labsai/eddi (CVSS 6.3, labsai EDDI)
- [CVE-2024-8114](https://cve.now/CVE-2024-8114.md): Missing Authorization in GitLab (CVSS 8.2, GitLab)
- [CVE-2024-8177](https://cve.now/CVE-2024-8177.md): Inefficient Algorithmic Complexity in GitLab (CVSS 5.3, GitLab)
- [CVE-2024-8237](https://cve.now/CVE-2024-8237.md): Inefficient Algorithmic Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-11668](https://cve.now/CVE-2024-11668.md): Insufficient Session Expiration in GitLab (CVSS 4.2, GitLab)
- [CVE-2024-32965](https://cve.now/CVE-2024-32965.md): ssrf vulnerability in lobe-chat (CVSS 8.1, lobehub lobe-chat · @lobehub/chat)
- [CVE-2024-10878](https://cve.now/CVE-2024-10878.md): Sugar Calendar (Lite) \<= 3.3.0 - Reflected Cross-Site Scripting (CVSS 6.1, smub Sugar Calendar – Events Calendar, Event Tickets, and E…)
- [CVE-2024-11407](https://cve.now/CVE-2024-11407.md): Denial of Service through Data corruption in gRPC-C++ (CVSS 6.9, gRPC-C++)
- [CVE-2024-52337](https://cve.now/CVE-2024-52337.md): Tuned: improper sanitization of \`instance\_name\` parameter of the \`instance\_create()\` method (CVSS 5.5, tuned · Fast Datapath for Red Hat Enterprise Linux +2)
- [CVE-2024-52336](https://cve.now/CVE-2024-52336.md): Tuned: \`script\_pre\` and \`script\_post\` options allow to pass arbitrary scripts executed by root (CVSS 7.8, tuned · Fast Datapath for Red Hat Enterprise Linux +2)
- [CVE-2024-36463](https://cve.now/CVE-2024-36463.md): The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objec (CVSS 6.5, Zabbix)
- [CVE-2024-22117](https://cve.now/CVE-2024-22117.md): Value of sysmap\_element\_url can be de-synchronized causing the map element to crash when new URLs is added (CVSS 2.2, Zabbix)
- [CVE-2024-8236](https://cve.now/CVE-2024-8236.md): Elementor Website Builder – More than Just a Page Builder \<= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2024-9461](https://cve.now/CVE-2024-9461.md): Total Upkeep \<= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings (CVSS 7.2, Total Upkeep – WordPress Backup Plugin plus Restore & Migra…)
- [CVE-2018-5852](https://cve.now/CVE-2018-5852.md): Buffer Over-read in IPA (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2018-11816](https://cve.now/CVE-2018-11816.md): Use After Free in Video (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2017-18307](https://cve.now/CVE-2017-18307.md): Information Exposure in Kernel (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2017-18306](https://cve.now/CVE-2017-18306.md): Information Exposure in Camera Driver (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2016-10408](https://cve.now/CVE-2016-10408.md): Improper Access Control in Core. (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-53976](https://cve.now/CVE-2024-53976.md): Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what t (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2024-53975](https://cve.now/CVE-2024-53975.md): Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appe (CVSS 5.4, Mozilla Firefox for iOS)
- [CVE-2024-11699](https://cve.now/CVE-2024-11699.md): Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11708](https://cve.now/CVE-2024-11708.md): Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11706](https://cve.now/CVE-2024-11706.md): A null pointer dereference may have inadvertently occurred in \`pk12util\`, and specifically in the \`SEC\_ASN1DecodeItem\_Util\` function, when h (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11705](https://cve.now/CVE-2024-11705.md): \`NSC\_DeriveKey\` inadvertently assumed that the \`phKey\` parameter is always non-NULL. (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11698](https://cve.now/CVE-2024-11698.md): A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dial (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11704](https://cve.now/CVE-2024-11704.md): A double-free issue could have occurred in \`sec\_pkcs7\_decoder\_start\_decrypt()\` when handling an error path. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11697](https://cve.now/CVE-2024-11697.md): When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11696](https://cve.now/CVE-2024-11696.md): The application failed to account for exceptions thrown by the \`loadManifestFromFile\` method during add-on signature verification. (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11703](https://cve.now/CVE-2024-11703.md): On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. (CVSS 5.7, Mozilla Firefox)
- [CVE-2024-11695](https://cve.now/CVE-2024-11695.md): A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spo (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11694](https://cve.now/CVE-2024-11694.md): Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP \`frame-src\` bypass and DOM-based XSS through the Google Safe (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11693](https://cve.now/CVE-2024-11693.md): The executable file warning was not presented when downloading .library-ms files. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11702](https://cve.now/CVE-2024-11702.md): Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-base (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11701](https://cve.now/CVE-2024-11701.md): The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11692](https://cve.now/CVE-2024-11692.md): An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11700](https://cve.now/CVE-2024-11700.md): Malicious websites may have been able to perform user intent confirmation through tapjacking. (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-11691](https://cve.now/CVE-2024-11691.md): Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9929](https://cve.now/CVE-2024-9929.md): A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps. (CVSS 4.3, Hitachi Energy NSD570 Teleprotection Equipment)
- [CVE-2024-9928](https://cve.now/CVE-2024-9928.md): A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. (CVSS 5.3, Hitachi Energy NSD570 Teleprotection Equipment)
- [CVE-2024-38834](https://cve.now/CVE-2024-38834.md): Stored cross-site scripting vulnerability (CVE-2024-38834) (CVSS 6.5, VMware Aria Operations)
- [CVE-2024-38833](https://cve.now/CVE-2024-38833.md): Stored cross-site scripting vulnerability (CVE-2024-38833) (CVSS 6.8, VMware Aria Operations)
- [CVE-2024-38832](https://cve.now/CVE-2024-38832.md): Stored cross-site scripting vulnerability (CVE-2024-38832) (CVSS 7.1, VMware Aria Operations)
- [CVE-2024-38831](https://cve.now/CVE-2024-38831.md): Local privilege escalation vulnerability (CVE-2024-38831) (CVSS 7.8, VMware Aria Operations)
- [CVE-2024-38830](https://cve.now/CVE-2024-38830.md): Local privilege escalation vulnerability (CVSS 7.8, VMware Aria Operations)
- [CVE-2023-0163](https://cve.now/CVE-2023-0163.md): Prototype Pollution in convict (CVSS 8.4, Mozilla Convict · convict)
- [CVE-2023-2142](https://cve.now/CVE-2023-2142.md): Nunjucks autoescape bypass leads to cross site scripting (CVSS 6.1, Mozilla Nunjucks · nunjucks)
- [CVE-2024-51569](https://cve.now/CVE-2024-51569.md): Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler (CVSS 7.5, Apache Software Foundation Apache NimBLE)
- [CVE-2024-47250](https://cve.now/CVE-2024-47250.md): Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound access (CVSS 5.0, Apache Software Foundation Apache NimBLE)
- [CVE-2024-47249](https://cve.now/CVE-2024-47249.md): Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler (CVSS 5.0, Apache Software Foundation Apache NimBLE)
- [CVE-2023-1521](https://cve.now/CVE-2023-1521.md): Local Privilege Escalation in sccache (CVSS 7.8, Mozilla sccache · sccache)
- [CVE-2024-47248](https://cve.now/CVE-2024-47248.md): Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack (CVSS 6.3, Apache Software Foundation Apache NimBLE)
- [CVE-2024-10579](https://cve.now/CVE-2024-10579.md): Hustle – Email Marketing, Lead Generation, Optins, Popups \<= 7.8.5 - Missing Authorization to Unpublished Form Exposure (CVSS 4.3, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2024-10308](https://cve.now/CVE-2024-10308.md): Jeg Elementor Kit \<= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-8899](https://cve.now/CVE-2024-8899.md): Jeg Elementor Kit \<= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg\_content\_template (CVSS 4.3, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-11024](https://cve.now/CVE-2024-11024.md): AppPresser – Mobile App Framework \<= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset (CVSS 9.8, scottopolis AppPresser – Mobile App Framework)
- [CVE-2024-50377](https://cve.now/CVE-2024-50377.md): A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (\<= 1.6.3) (CVSS 6.5, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50376](https://cve.now/CVE-2024-50376.md): A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affecting the following devic (CVSS 7.3, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50375](https://cve.now/CVE-2024-50375.md): A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333A (CVSS 9.8, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50374](https://cve.now/CVE-2024-50374.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 9.8, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50373](https://cve.now/CVE-2024-50373.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 9.8, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50372](https://cve.now/CVE-2024-50372.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 9.8, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50371](https://cve.now/CVE-2024-50371.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 9.8, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50370](https://cve.now/CVE-2024-50370.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 9.8, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50369](https://cve.now/CVE-2024-50369.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50368](https://cve.now/CVE-2024-50368.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50367](https://cve.now/CVE-2024-50367.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50366](https://cve.now/CVE-2024-50366.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50365](https://cve.now/CVE-2024-50365.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50364](https://cve.now/CVE-2024-50364.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50363](https://cve.now/CVE-2024-50363.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50362](https://cve.now/CVE-2024-50362.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50361](https://cve.now/CVE-2024-50361.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50360](https://cve.now/CVE-2024-50360.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50359](https://cve.now/CVE-2024-50359.md): A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-50358](https://cve.now/CVE-2024-50358.md): A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI (CVSS 7.2, Advantech EKI-6333AC-2G · Advantech EKI-6333AC-2GD +1)
- [CVE-2024-11680](https://cve.now/CVE-2024-11680.md): ProjectSend Unauthenticated Configuration Modification (CVSS 9.8, KEV, ProjectSend)
- [CVE-2024-11032](https://cve.now/CVE-2024-11032.md): Parsi Date \<= 5.1.1 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, man4toman پارسی دیت – Parsi Date)
- [CVE-2018-11952](https://cve.now/CVE-2018-11952.md): Improper Authentication in TrustZone (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2018-11922](https://cve.now/CVE-2018-11922.md): Configurations in Android Build (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2017-18153](https://cve.now/CVE-2017-18153.md): Use After Free in WLAN (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2017-17772](https://cve.now/CVE-2017-17772.md): Multiple buffer overread vulnerabilities in WLAN (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2017-15832](https://cve.now/CVE-2017-15832.md): Buffer overwrite due to improper input validation in WLAN host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2017-11076](https://cve.now/CVE-2017-11076.md): Use of Out-of-range Pointer Offset in Video (CVSS 8.8, Qualcomm Snapdragon)
- [CVE-2016-10394](https://cve.now/CVE-2016-10394.md): Improper Authentication in Core (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2024-11091](https://cve.now/CVE-2024-11091.md): Support SVG – Upload svg files in wordpress without hassle \<= 1.1.0 - Authenticated (Author+) Stored Cross-site Scripting via SVG File Upload (CVSS 6.4, sayedulsayem Support SVG – Upload svg files in wordpress wi…)
- [CVE-2024-11192](https://cve.now/CVE-2024-11192.md): Spotify Play Button for WordPress \<= 2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode (CVSS 6.4, jonkastonka Sp\*tify Play Button for WordPress)
- [CVE-2024-11119](https://cve.now/CVE-2024-11119.md): BNE Gallery Extended \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode (CVSS 6.4, bluenotes BNE Gallery Extended)
- [CVE-2024-9170](https://cve.now/CVE-2024-9170.md): Booster for WooCommerce \<= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj\_product\_meta Shortcode (CVSS 5.5, pluggabl Booster for WooCommerce – PDF Invoices, Abandoned…)
- [CVE-2024-36254](https://cve.now/CVE-2024-36254.md): Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may l (CVSS 7.5, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-36251](https://cve.now/CVE-2024-36251.md): The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. (CVSS 7.5, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-36249](https://cve.now/CVE-2024-36249.md): Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). (CVSS 7.4, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-36248](https://cve.now/CVE-2024-36248.md): API keys for some cloud services are hardcoded in the "main" binary. (CVSS 9.1, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-35244](https://cve.now/CVE-2024-35244.md): There are several hidden accounts. (CVSS 9.1, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-34162](https://cve.now/CVE-2024-34162.md): The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. (CVSS 5.3, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-33616](https://cve.now/CVE-2024-33616.md): Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. (CVSS 5.3, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-33610](https://cve.now/CVE-2024-33610.md): "sessionlist.html" and "sys\_trayentryreboot.html" are accessible with no authentication. (CVSS 9.1, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-33605](https://cve.now/CVE-2024-33605.md): Improper processing of some parameters of installed\_emanual\_list.html leads to a path traversal vulnerability. (CVSS 7.5, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-32151](https://cve.now/CVE-2024-32151.md): User passwords are decrypted and stored on memory before any user logged in. (CVSS 5.9, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-29978](https://cve.now/CVE-2024-29978.md): User passwords are decrypted and stored on memory before any user logged in. (CVSS 5.9, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-29146](https://cve.now/CVE-2024-29146.md): User passwords are decrypted and stored on memory before any user logged in. (CVSS 5.9, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-28955](https://cve.now/CVE-2024-28955.md): Affected devices create coredump files when crashed, storing them with world-readable permission. (CVSS 5.9, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-28038](https://cve.now/CVE-2024-28038.md): The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. (CVSS 9.0, Sharp Multiple MFPs · Toshiba Tec Multiple MFPs)
- [CVE-2024-11202](https://cve.now/CVE-2024-11202.md): Multiple Plugins \<= (Various Versions) - Reflected Cross-Site Scripting via cminds\_free\_guide Shortcode (CVSS 6.1, creativemindssolutions CM Header and Footer – Add custo… +5)
- [CVE-2024-9504](https://cve.now/CVE-2024-9504.md): Booking calendar, Appointment Booking System \<= 3.2.15 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2, wpdevart Booking calendar, Appointment Booking System)
- [CVE-2024-8160](https://cve.now/CVE-2024-8160.md): Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficient input validation (CVSS 3.8, Axis Communications AB AXIS OS)
- [CVE-2024-8772](https://cve.now/CVE-2024-8772.md): 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition (CVSS 4.3, Axis Communications AB AXIS OS)
- [CVE-2024-47257](https://cve.now/CVE-2024-47257.md): Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead to the Axis device (CVSS 7.5, Axis Communications AB AXIS Q6128-E PTZ Network Camera · Ax…)
- [CVE-2024-6831](https://cve.now/CVE-2024-6831.md): Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the neces (CVSS 4.4, Axis Communications AB AXIS Camera Station Pro · Axis Commu…)
- [CVE-2024-6749](https://cve.now/CVE-2024-6749.md): Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may expose sensitive creden (CVSS 6.3, Axis Communications AB AXIS Camera Station Pro · Axis Commu…)
- [CVE-2024-6476](https://cve.now/CVE-2024-6476.md): Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user to gain system privi (CVSS 4.2, Axis Communications AB AXIS Camera Station Pro · Axis Commu…)
- [CVE-2024-10857](https://cve.now/CVE-2024-10857.md): Product Input Fields for WooCommerce \<= 1.9 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, tychesoftwares Product Input Fields for WooCommerce)
- [CVE-2024-11002](https://cve.now/CVE-2024-11002.md): InPost Gallery \<= 2.1.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost\_gallery\_get\_shortcode\_template (CVSS 6.3, realmag777 InPost Gallery)
- [CVE-2024-10471](https://cve.now/CVE-2024-10471.md): Everest Forms \< 3.0.4.2 - Admin+ Stored XSS (CVSS 4.8, Everest Forms)
- [CVE-2024-10542](https://cve.now/CVE-2024-10542.md): Spam protection, Anti-Spam, FireWall by CleanTalk \<= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation (CVSS 9.8, Spam protection, Honeypot, Anti-Spam by CleanTalk)
- [CVE-2024-10781](https://cve.now/CVE-2024-10781.md): Spam protection, Anti-Spam, FireWall by CleanTalk \<= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation (CVSS 8.1, Spam protection, Honeypot, Anti-Spam by CleanTalk)
- [CVE-2024-10570](https://cve.now/CVE-2024-10570.md): Security & Malware scan by CleanTalk \<= 2.145 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated SQL Injection (CVSS 7.5, Login Security, FireWall, Malware removal by CleanTalk)
- [CVE-2024-53278](https://cve.now/CVE-2024-53278.md): Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. (CVSS 4.8, gqevu6bsiz WP Admin UI Customize)
- [CVE-2024-11418](https://cve.now/CVE-2024-11418.md): Additional Order Filters for WooCommerce \<= 1.21 - Reflected Cross-Site Scripting (CVSS 6.1, antonbond Additional Order Filters for WooCommerce)
- [CVE-2024-11342](https://cve.now/CVE-2024-11342.md): Skt NURCaptcha \<= 3.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, sanskritforum Skt NURCaptcha)
- [CVE-2024-49353](https://cve.now/CVE-2024-49353.md): IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data denial of service (CVSS 7.5, Watson Speech Services Cartridge for IBM Cloud Pak for Data)
- [CVE-2024-49351](https://cve.now/CVE-2024-49351.md): IBM Workload Scheduler information disclosure (CVSS 5.5, IBM Workload Scheduler)
- [CVE-2024-49596](https://cve.now/CVE-2024-49596.md): Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. (CVSS 5.9, Dell Wyse Management Suite)
- [CVE-2024-49597](https://cve.now/CVE-2024-49597.md): Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Attempts vulnerability. (CVSS 7.6, Dell Wyse Management Suite)
- [CVE-2024-49595](https://cve.now/CVE-2024-49595.md): Dell Wyse Management Suite, version WMS 4.4 and before, contain an Authentication Bypass by Capture-replay vulnerability. (CVSS 7.6, Dell Wyse Management Suite)
- [CVE-2024-10729](https://cve.now/CVE-2024-10729.md): Booking & Appointment Plugin for WooCommerce \<= 6.9.0 - Authenticated (Subscriber+) Arbitrary Option Update (CVSS 8.8, Tyche Softwares Booking & Appointment Plugin for WooCommerce)
- [CVE-2024-11678](https://cve.now/CVE-2024-11678.md): CodeAstro Hospital Management System his\_doc\_register\_patient.php cross site scripting (CVSS 5.3, CodeAstro Hospital Management System)
- [CVE-2024-11677](https://cve.now/CVE-2024-11677.md): CodeAstro Hospital Management System Add Vendor Details Page his\_admin\_add\_vendor.php cross site scripting (CVSS 5.3, CodeAstro Hospital Management System)
- [CVE-2024-52899](https://cve.now/CVE-2024-52899.md): IBM Data Virtualization Manager code execution (CVSS 8.5, IBM Data Virtualization Manager for z/OS)
- [CVE-2024-11676](https://cve.now/CVE-2024-11676.md): CodeAstro Hospital Management System Add Laboratory Equipment Page his\_admin\_add\_lab\_equipment.php cross site scripting (CVSS 5.3, CodeAstro Hospital Management System)
- [CVE-2024-11675](https://cve.now/CVE-2024-11675.md): CodeAstro Hospital Management System Add Patient Details Page his\_admin\_register\_patient.php cross site scripting (CVSS 5.3, CodeAstro Hospital Management System)
- [CVE-2024-50942](https://cve.now/CVE-2024-50942.md): qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml. (CVSS 9.8)
- [CVE-2024-51058](https://cve.now/CVE-2024-51058.md): Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. (CVSS 6.2, tecnickcom/tcpdf)
- [CVE-2024-53365](https://cve.now/CVE-2024-53365.md): A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/profile.php (CVSS 6.1)
- [CVE-2024-53555](https://cve.now/CVE-2024-53555.md): A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file. (CVSS 8.8)
- [CVE-2024-53619](https://cve.now/CVE-2024-53619.md): An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute arbitrary code via u (CVSS 6.3)
- [CVE-2024-53620](https://cve.now/CVE-2024-53620.md): A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execute arbitrary web scri (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.