# CVEs published 2024-11-27

82 CVEs were published on November 27, 2024: 7 critical, 36 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-9374](https://cve.now/CVE-2018-9374.md): In installPackageLI of PackageManagerService.java, there is a possible permissions bypass. (CVSS 7.8, Google Android)
- [CVE-2024-11933](https://cve.now/CVE-2024-11933.md): Fuji Electric Monitouch V-SFT X1 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11803](https://cve.now/CVE-2024-11803.md): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Tellus Lite)
- [CVE-2024-11802](https://cve.now/CVE-2024-11802.md): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-Based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Tellus Lite)
- [CVE-2024-11801](https://cve.now/CVE-2024-11801.md): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Tellus Lite)
- [CVE-2024-11800](https://cve.now/CVE-2024-11800.md): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Tellus Lite)
- [CVE-2024-11799](https://cve.now/CVE-2024-11799.md): Fuji Electric Tellus Lite V-Simulator 5 V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Tellus Lite)
- [CVE-2024-11798](https://cve.now/CVE-2024-11798.md): Fuji Electric Monitouch V-SFT X1 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11797](https://cve.now/CVE-2024-11797.md): Fuji Electric Monitouch V-SFT V8 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11796](https://cve.now/CVE-2024-11796.md): Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11795](https://cve.now/CVE-2024-11795.md): Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11794](https://cve.now/CVE-2024-11794.md): Fuji Electric Monitouch V-SFT V10 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11793](https://cve.now/CVE-2024-11793.md): Fuji Electric Monitouch V-SFT V9C File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11792](https://cve.now/CVE-2024-11792.md): Fuji Electric Monitouch V-SFT V8 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11791](https://cve.now/CVE-2024-11791.md): Fuji Electric Monitouch V-SFT V8C File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11790](https://cve.now/CVE-2024-11790.md): Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11789](https://cve.now/CVE-2024-11789.md): Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-11787](https://cve.now/CVE-2024-11787.md): Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2018-9354](https://cve.now/CVE-2018-9354.md): In VideoFrameScheduler.cpp of VideoFrameScheduler::PLL::fit, there is a possible remote denial of service due to divide by 0. (CVSS 6.5, Google Android)
- [CVE-2018-9353](https://cve.now/CVE-2018-9353.md): In ihevcd\_parse\_slice\_data of ihevcd\_parse\_slice.c there is a possible heap buffer out of bound read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2018-9352](https://cve.now/CVE-2018-9352.md): In ihevcd\_allocate\_dynamic\_bufs of ihevcd\_api.c there is a possible resource exhaustion due to integer overflow. (CVSS 6.5, Google Android)
- [CVE-2018-9351](https://cve.now/CVE-2018-9351.md): In ih264e\_fmt\_conv\_420p\_to\_420sp of ih264e\_fmt\_conv.c there is a possible out of bound read due to missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2018-9350](https://cve.now/CVE-2018-9350.md): In ih264d\_assign\_pic\_num of ih264d\_utils.c there is a possible out of bound read due to missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2018-9349](https://cve.now/CVE-2018-9349.md): In mv\_err\_cost of mcomp.c there is a possible out of bounds read due to missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2017-13323](https://cve.now/CVE-2017-13323.md): In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow. (CVSS 8.4, Google Android)
- [CVE-2024-53860](https://cve.now/CVE-2024-53860.md): Potential Abuse for Sending Arbitrary Emails in sp-php-email-handler (CVSS 8.6, Spencer14420 SPEmailHandler-PHP · spencer14420/sp-php-email…)
- [CVE-2017-13321](https://cve.now/CVE-2017-13321.md): In SensorService::isDataInjectionEnabled of frameworks/native/services/sensorservice/SensorService.cpp, there is a possible out of bounds re (CVSS 6.2, Google Android)
- [CVE-2024-53260](https://cve.now/CVE-2024-53260.md): Course Roster vulnerable to CSV Injection in Autolab (CVSS 6.8, Autolab)
- [CVE-2024-53858](https://cve.now/CVE-2024-53858.md): Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli (CVSS 6.5, cli · github.com/cli/cli +1)
- [CVE-2024-53859](https://cve.now/CVE-2024-53859.md): go-gh \`auth.TokenForHost\` violates GitHub host security boundary within a codespace (CVSS 6.5, cli go-gh · github.com/cli/go-gh/v2 +1)
- [CVE-2017-13320](https://cve.now/CVE-2017-13320.md): In impeg2d\_bit\_stream\_flush() of libmpeg2dec there is a possible OOB read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2017-13319](https://cve.now/CVE-2017-13319.md): In pvmp3\_get\_main\_data\_size of pvmp3\_get\_main\_data\_size.cpp, there is a possible buffer overread due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2017-13316](https://cve.now/CVE-2017-13316.md): In checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. (CVSS 8.4, Google Android)
- [CVE-2024-53264](https://cve.now/CVE-2024-53264.md): Open Redirect Vulnerability in Loading Page in bunkerweb (CVSS 5.1, bunkerity bunkerweb · github.com/bunkerity/bunkerweb)
- [CVE-2024-53855](https://cve.now/CVE-2024-53855.md): User can view tickets from organizations they're not apart of in centurion\_erp (CVSS 1.9, nofusscomputing centurion\_erp)
- [CVE-2023-29001](https://cve.now/CVE-2023-29001.md): Uncontrolled recursion due to insufficient validation of the IPv6 source routing header in Contiki-NG (CVSS 8.7, contiki-ng)
- [CVE-2024-41125](https://cve.now/CVE-2024-41125.md): Out-of-bounds read in SNMP when decoding a string in Contiki-NG (CVSS 8.4, contiki-ng)
- [CVE-2024-41126](https://cve.now/CVE-2024-41126.md): Out-of-bounds read when decoding SNMP messages in Contiki-NG (CVSS 8.4, contiki-ng)
- [CVE-2024-47181](https://cve.now/CVE-2024-47181.md): Unaligned memory access in RPL option processing in Contiki-NG (CVSS 7.5, contiki-ng)
- [CVE-2024-9369](https://cve.now/CVE-2024-9369.md): Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer proc (CVSS 8.8, Google Chrome)
- [CVE-2024-7025](https://cve.now/CVE-2024-7025.md): Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2024-54004](https://cve.now/CVE-2024-54004.md): Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allo (CVSS 4.3, Jenkins Project Jenkins Filesystem List Parameter Plugin ·…)
- [CVE-2024-54003](https://cve.now/CVE-2024-54003.md): Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability (CVSS 8.0, Jenkins Project Jenkins Simple Queue Plugin · io.jenkins.pl…)
- [CVE-2024-21703](https://cve.now/CVE-2024-21703.md): This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Window (CVSS 6.4, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2024-11860](https://cve.now/CVE-2024-11860.md): SourceCodester Best House Rental Management System POST Request ajax.php improper authorization (CVSS 6.9, SourceCodester Best House Rental Management System)
- [CVE-2024-11862](https://cve.now/CVE-2024-11862.md): Non constant time cryptographic operation in Devolutions.XTS.NET 2024.11.19 and earlier allows an attacker to render half of the encryption (CVSS 5.1, Devolutions XTS.NET · Devolutions.XTS.NET)
- [CVE-2024-36464](https://cve.now/CVE-2024-36464.md): Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported (CVSS 2.7, Zabbix)
- [CVE-2024-42333](https://cve.now/CVE-2024-42333.md): Heap buffer over-read (CVSS 2.7, Zabbix)
- [CVE-2024-42332](https://cve.now/CVE-2024-42332.md): New line injection in Zabbix SNMP traps (CVSS 3.7, Zabbix)
- [CVE-2024-42331](https://cve.now/CVE-2024-42331.md): Use after free in browser\_push\_error (CVSS 3.3, Zabbix)
- [CVE-2024-42330](https://cve.now/CVE-2024-42330.md): JS - Internal strings in HTTP headers (CVSS 9.1, Zabbix)
- [CVE-2024-42329](https://cve.now/CVE-2024-42329.md): JS - Crash on unexpected HTTP server response (CVSS 3.3, Zabbix)
- [CVE-2024-42328](https://cve.now/CVE-2024-42328.md): JS - Crash on empty HTTP server response (CVSS 3.3, Zabbix)
- [CVE-2024-42327](https://cve.now/CVE-2024-42327.md): SQL injection in user.get API (CVSS 9.9, Zabbix)
- [CVE-2024-42326](https://cve.now/CVE-2024-42326.md): Use after free vulnerability in browser.c (CVSS 4.4, Zabbix)
- [CVE-2024-36468](https://cve.now/CVE-2024-36468.md): Stack buffer overflow in zbx\_snmp\_cache\_handle\_engineid (CVSS 3.0, Zabbix)
- [CVE-2024-11009](https://cve.now/CVE-2024-11009.md): Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) \<= 1.2.1 - Authenticated (Administrator+) SQL Injection via post\_id Parameter (CVSS 4.9, Automatic Internal Links for SEO by Pagup)
- [CVE-2024-10521](https://cve.now/CVE-2024-10521.md): WordPress Contact Forms by Cimatti \<= 1.9.2 - Cross-Site Request Forgery via process\_bulk\_action Function (CVSS 4.3, Contact Forms by Cimatti)
- [CVE-2024-11025](https://cve.now/CVE-2024-11025.md): SMA: SQL injection in Sunny Central UP (CVSS 5.4, SMA Sunny Central SC 1760-US · SMA Sunny Central SC 185… +54)
- [CVE-2024-52323](https://cve.now/CVE-2024-52323.md): Sensitive Data Exposure (CVSS 8.1, ManageEngine Analytics Plus)
- [CVE-2024-11667](https://cve.now/CVE-2024-11667.md): A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX seri (CVSS 7.5, KEV, Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2)
- [CVE-2024-10175](https://cve.now/CVE-2024-10175.md): Pricing Tables For WPBakery Page Builder (formerly Visual Composer) \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wdo\_pricing\_tables Shortcode (CVSS 6.4, labibahmed42 Pricing Tables For WPBakery Page Builder)
- [CVE-2024-10580](https://cve.now/CVE-2024-10580.md): Hustle – Email Marketing, Lead Generation, Optins, Popups \<= 7.8.5 - Missing Authorization to Unauthorized Form Submission (CVSS 5.3, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2024-10895](https://cve.now/CVE-2024-10895.md): Counter Up – Animated Number Counter & Milestone Showcase \<= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, logichunt Counter Up – Animated Number Counter & Milestone…)
- [CVE-2024-36467](https://cve.now/CVE-2024-36467.md): Authentication privilege escalation via user groups due to missing authorization checks (CVSS 7.5, Zabbix)
- [CVE-2024-11219](https://cve.now/CVE-2024-11219.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 3.0.6 - Unauthetnicated Path Traversal to Arbitrary Image View (CVSS 5.3, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2024-11083](https://cve.now/CVE-2024-11083.md): ProfilePress \<= 4.15.18 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-52959](https://cve.now/CVE-2024-52959.md): iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection') (CVSS 9.3, Galaxy Software Services iota C.ai Conversational Platform)
- [CVE-2024-52958](https://cve.now/CVE-2024-52958.md): iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature (CVSS 9.3, Galaxy Software Services iota C.ai Conversational Platform)
- [CVE-2024-5921](https://cve.now/CVE-2024-5921.md): GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation (CVSS 6.0, Palo Alto Networks GlobalProtect App)
- [CVE-2024-53676](https://cve.now/CVE-2024-53676.md): A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Insight Remote Support)
- [CVE-2024-11820](https://cve.now/CVE-2024-11820.md): code-projects Crud Operation System add.php cross site scripting (CVSS 5.3, code-projects Crud Operation System)
- [CVE-2024-31976](https://cve.now/CVE-2024-31976.md): EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity para (CVSS 8.0)
- [CVE-2024-37816](https://cve.now/CVE-2024-37816.md): Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow. (CVSS 4.2)
- [CVE-2024-46054](https://cve.now/CVE-2024-46054.md): OpenVidReview 1.0 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2024-46055](https://cve.now/CVE-2024-46055.md): OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names. (CVSS 4.8)
- [CVE-2024-51228](https://cve.now/CVE-2024-51228.md): An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1 (CVSS 6.8)
- [CVE-2024-52951](https://cve.now/CVE-2024-52951.md): Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to e (CVSS 8.0)
- [CVE-2024-53603](https://cve.now/CVE-2024-53603.md): A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which all (CVSS 7.3)
- [CVE-2024-53604](https://cve.now/CVE-2024-53604.md): A SQL Injection vulnerability was found in /covid-tms/check\_availability.php in PHPGurukul COVID 19 Testing Management System v1.0, which al (CVSS 9.8)
- [CVE-2024-53635](https://cve.now/CVE-2024-53635.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Manage (CVSS 4.8)
- [CVE-2024-53920](https://cve.now/CVE-2024-53920.md): In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs L (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.