# CVEs published 2024-11-28

75 CVEs were published on November 28, 2024: 8 critical, 29 high. Days are UTC.

- [CVE-2024-9852](https://cve.now/CVE-2024-9852.md): Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32 (CVSS 7.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric ICON… +7)
- [CVE-2024-8300](https://cve.now/CVE-2024-8300.md): Malicious Code Execution Vulnerability in GENESIS64 and ICONICS Suite (CVSS 7.0, Mitsubishi Electric GENESIS64 · Mitsubishi Electric Icon… +2)
- [CVE-2024-8299](https://cve.now/CVE-2024-8299.md): Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32 (CVSS 7.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric ICON… +7)
- [CVE-2024-11971](https://cve.now/CVE-2024-11971.md): Guizhou Xiaoma Technology jpress Avatar upload cross site scripting (CVSS 5.3, Guizhou Xiaoma Technology jpress)
- [CVE-2024-11970](https://cve.now/CVE-2024-11970.md): code-projects Concert Ticket Ordering System tour(cor).php sql injection (CVSS 6.9, code-projects Concert Ticket Ordering System)
- [CVE-2024-11968](https://cve.now/CVE-2024-11968.md): code-projects Farmacia pagamento.php sql injection (CVSS 5.3, code-projects Farmacia)
- [CVE-2024-11967](https://cve.now/CVE-2024-11967.md): PHPGurukul Complaint Management system reset-password.php sql injection (CVSS 6.9, PHPGurukul Complaint Management system)
- [CVE-2024-11966](https://cve.now/CVE-2024-11966.md): PHPGurukul Complaint Management system index.php sql injection (CVSS 6.9, PHPGurukul Complaint Management system)
- [CVE-2024-11965](https://cve.now/CVE-2024-11965.md): PHPGurukul Complaint Management system reset-password.php sql injection (CVSS 6.9, PHPGurukul Complaint Management system)
- [CVE-2024-11964](https://cve.now/CVE-2024-11964.md): PHPGurukul Complaint Management system index.php sql injection (CVSS 6.9, PHPGurukul Complaint Management system)
- [CVE-2024-52338](https://cve.now/CVE-2024-52338.md): Apache Arrow R package: Arbitrary code execution when loading a malicious data file (CVSS 9.8, Apache Software Foundation Apache Arrow R package · pyarrow)
- [CVE-2024-11969](https://cve.now/CVE-2024-11969.md): Incorrect default permissions in Cradlepoint NetCloud Exchange (CVSS 8.8, Cradlepoint NetCloud Exchange Client)
- [CVE-2024-11963](https://cve.now/CVE-2024-11963.md): code-projects Responsive Hotel Site room.php sql injection (CVSS 5.3, code-projects Responsive Hotel Site)
- [CVE-2024-11962](https://cve.now/CVE-2024-11962.md): code-projects Simple Car Rental System login.php sql injection (CVSS 6.9, code-projects Simple Car Rental System)
- [CVE-2023-52922](https://cve.now/CVE-2023-52922.md): can: bcm: Fix UAF in bcm\_proc\_show() (CVSS 7.8, Linux)
- [CVE-2024-11961](https://cve.now/CVE-2024-11961.md): Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure (CVSS 6.9, Guangzhou Huayi Intelligent Technology Jeewms)
- [CVE-2024-11960](https://cve.now/CVE-2024-11960.md): D-Link DIR-605L formSetPortTr buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-11959](https://cve.now/CVE-2024-11959.md): D-Link DIR-605L formResetStatistic buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-7747](https://cve.now/CVE-2024-7747.md): Wallet for WooCommerce \<= 1.5.6 - Authenticated (Subscriber+) Incorrect Conversion between Numeric Types (CVSS 6.5, subratamal Wallet for WooCommerce)
- [CVE-2024-53731](https://cve.now/CVE-2024-53731.md): WordPress Fintelligence Calculator plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Fintelligence Calculator)
- [CVE-2024-53732](https://cve.now/CVE-2024-53732.md): WordPress Footer Flyout Widget plugin \<= 1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, wpwox Footer Flyout Widget)
- [CVE-2024-53733](https://cve.now/CVE-2024-53733.md): WordPress Fence URL plugin \<= 2.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, harshtohit111 Fence URL)
- [CVE-2024-53734](https://cve.now/CVE-2024-53734.md): WordPress Idealien Category Enhancements plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jamie O Idealien Category Enhancements)
- [CVE-2024-53736](https://cve.now/CVE-2024-53736.md): WordPress Custom Shortcode Sidebars plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Jason Grim Custom Shortcode Sidebars)
- [CVE-2024-11402](https://cve.now/CVE-2024-11402.md): WordPress Block Editor Bootstrap Blocks plugin \<= 6.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kubiq Block Editor Bootstrap Blocks)
- [CVE-2024-53737](https://cve.now/CVE-2024-53737.md): WordPress WP Mailster plugin \<= 1.8.16.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, brandtoss WP Mailster)
- [CVE-2024-52474](https://cve.now/CVE-2024-52474.md): WordPress Express Payments plugin \<= 1.1.8 - SQL Injection vulnerability (CVSS 9.3, Сервис “Экспресс Платежи” Express Payments Module)
- [CVE-2024-52495](https://cve.now/CVE-2024-52495.md): WordPress Distance Based Shipping Calculator plugin \<= 2.0.23 - SQL Injection vulnerability (CVSS 8.5, enituretechnology Distance Based Shipping Calculator)
- [CVE-2024-52490](https://cve.now/CVE-2024-52490.md): WordPress Pathomation plugin \<= 2.5.1 - Arbitrary File Upload vulnerability (CVSS 10.0, Pathomation)
- [CVE-2024-52496](https://cve.now/CVE-2024-52496.md): WordPress Absolute Addons For Elementor plugin \<= 1.0.14 - Local File Inclusion vulnerability (CVSS 7.5, AbsolutePlugins Absolute Addons For Elementor)
- [CVE-2024-52497](https://cve.now/CVE-2024-52497.md): WordPress Shopready plugin \<= 3.6 - Local File Inclusion vulnerability (CVSS 7.5, quomodosoft Shopready)
- [CVE-2024-52498](https://cve.now/CVE-2024-52498.md): WordPress SP Blog Designer plugin \<= 1.0.0 - Local File Inclusion vulnerability (CVSS 7.5, softpulseinfotech SP Blog Designer)
- [CVE-2024-52499](https://cve.now/CVE-2024-52499.md): WordPress Pricing table addon for elementor plugin \<= 1.0.0 - Local File Inclusion vulnerability (CVSS 7.5, Ibrahim Pricing table addon for elementor)
- [CVE-2024-52501](https://cve.now/CVE-2024-52501.md): WordPress Office Locator plugin \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 7.5, WebbyTemplate Office Locator)
- [CVE-2024-52481](https://cve.now/CVE-2024-52481.md): WordPress Jobify theme \< 4.3.0 - Unauthenticated Arbitrary File Read vulnerability (CVSS 7.5, Astoundify Jobify)
- [CVE-2024-11620](https://cve.now/CVE-2024-11620.md): WordPress Rank Math SEO plugin \<= 1.0.231 - Arbitrary .htaccess Overwrite to Remote Code Execution (RCE) vulnerability (CVSS 7.2, Rank Math SEO)
- [CVE-2024-52475](https://cve.now/CVE-2024-52475.md): WordPress Wawp plugin \< 3.0.18 - Account Takeover vulnerability (CVSS 9.8, Information Technology Wawp)
- [CVE-2024-8308](https://cve.now/CVE-2024-8308.md): Siempelkamp: SQL injection due to improper handling of HTTP request input data (CVSS 6.5, Siempelkamp UmweltOffice)
- [CVE-2024-11082](https://cve.now/CVE-2024-11082.md): Tumult Hype Animations \<= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations\_panel Function (CVSS 9.9, tumultinc Tumult Hype Animations)
- [CVE-2024-10780](https://cve.now/CVE-2024-10780.md): Restaurant & Cafe Addon for Elementor \<= 1.5.9 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, nicheaddons Restaurant & Cafe Addon for Elementor)
- [CVE-2024-8672](https://cve.now/CVE-2024-8672.md): Widget Options – The #1 WordPress Widget & Block Control Plugin \<= 4.0.7 - Authenticated (Contributor+) Remote Code Execution (CVSS 9.9, marketingfire Widget Options – Advanced Conditional Visibil…)
- [CVE-2024-10670](https://cve.now/CVE-2024-10670.md): Primary Addon for Elementor \<= 1.6.2 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, nicheaddons Primary Addon for Elementor)
- [CVE-2024-10798](https://cve.now/CVE-2024-10798.md): Royal Elementor Addons and Templates \<= 1.7.1003 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-11103](https://cve.now/CVE-2024-11103.md): Contest Gallery \<= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover (CVSS 9.8, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2024-22037](https://cve.now/CVE-2024-22037.md): Database password leaked by systemd uyuni-server-attestation service (CVSS 5.5, SUSE Manager Server)
- [CVE-2024-11599](https://cve.now/CVE-2024-11599.md): Domain Restriction Bypass on Registration (CVSS 8.2, Mattermost)
- [CVE-2024-22038](https://cve.now/CVE-2024-22038.md): DoS attacks, information leaks etc. with crafted Git repositories in obs-scm-bridge (CVSS 7.3, openSUSE Factory)
- [CVE-2024-49502](https://cve.now/CVE-2024-49502.md): Reflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-web (CVSS 4.6, Container suse/manager/5.0/x86\_64/server:5.0.2.7.8.1 · SUSE…)
- [CVE-2024-49503](https://cve.now/CVE-2024-49503.md): Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-web (CVSS 4.6, Container suse/manager/5.0/x86\_64/server:5.0.2.7.8.1 · SUSE…)
- [CVE-2024-52283](https://cve.now/CVE-2024-52283.md): Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project (CVSS 5.7, SUSE hackweek)
- [CVE-2024-11684](https://cve.now/CVE-2024-11684.md): Kudos Donations – Easy donations and payments with Mollie \<= 3.2.9 - Reflected Cross-Site Scripting (CVSS 6.1, iseardmedia Kudos Donations: Easy Donations with Mollie | O…)
- [CVE-2024-11786](https://cve.now/CVE-2024-11786.md): Login with Vipps and MobilePay \<= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wphostingdev Login with Vipps and MobilePay)
- [CVE-2024-11458](https://cve.now/CVE-2024-11458.md): FAQ Builder AYS \<= 1.7.1 - Reflected Cross-Site Scripting (CVSS 6.1, ays-pro FAQ Builder AYS)
- [CVE-2024-11685](https://cve.now/CVE-2024-11685.md): Kudos Donations – Easy donations and payments with Mollie \<= 3.2.9 - Reflected Cross-Site Scripting via 'add\_query\_arg' (CVSS 6.1, iseardmedia Kudos Donations: Easy Donations with Mollie | O…)
- [CVE-2024-11366](https://cve.now/CVE-2024-11366.md): SEO Landing Page Generator \<= 1.66.2 - Reflected Cross-Site Scripting (CVSS 6.1, intellasoftsolutions SEO Landing Page Generator)
- [CVE-2024-11333](https://cve.now/CVE-2024-11333.md): HLS Player \<= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, r00tsector HLS Player)
- [CVE-2024-9669](https://cve.now/CVE-2024-9669.md): File Manager Pro – Filester \<= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion (CVSS 7.2, ninjateam File Manager Pro – Filester)
- [CVE-2024-11431](https://cve.now/CVE-2024-11431.md): Ragic Shortcode \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ragicsupport Ragic Shortcode)
- [CVE-2024-8066](https://cve.now/CVE-2024-8066.md): File Manager Pro – Filester \<= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, ninjateam File Manager Pro – Filester)
- [CVE-2024-11203](https://cve.now/CVE-2024-11203.md): EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor \<= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider\_name' (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-11788](https://cve.now/CVE-2024-11788.md): StreamWeasels YouTube Integration \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, StreamWeasels YouTube Integration)
- [CVE-2024-11761](https://cve.now/CVE-2024-11761.md): LegalWeb Cloud \<= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, LegalWeb Cloud)
- [CVE-2024-36466](https://cve.now/CVE-2024-36466.md): Unauthenticated Zabbix frontend takeover when SSO is being used (CVSS 8.8, Zabbix)
- [CVE-2024-11925](https://cve.now/CVE-2024-11925.md): WP JobSearch \<= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation (CVSS 9.8, eyecix JobSearch WP Job Board)
- [CVE-2024-10896](https://cve.now/CVE-2024-10896.md): Logo Slider \< 4.5.0 - Contributor+ Stored XSS (CVSS 5.4, Logo Slider)
- [CVE-2024-10510](https://cve.now/CVE-2024-10510.md): adBuddy+ (AdBlocker Detection) by NetfunkDesign \<= 1.1.3 - Admin+ Stored XSS (CVSS 4.8, adBuddy+ (AdBlocker Detection) by NetfunkDesign)
- [CVE-2024-10493](https://cve.now/CVE-2024-10493.md): Element Pack Elementor Addons \< 5.10.3 - Contributor+ Stored XSS (CVSS 5.4, Element Pack Elementor Addons)
- [CVE-2024-10473](https://cve.now/CVE-2024-10473.md): Logo Slider \< 4.5.0 - Author+ Stored XSS (CVSS 5.4, Logo Slider)
- [CVE-2024-11918](https://cve.now/CVE-2024-11918.md): Image Alt Text \<= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update (CVSS 4.3, rswebstudios Image Alt Text)
- [CVE-2024-46939](https://cve.now/CVE-2024-46939.md): Game Extension Engine Path Traversal Vulnerability (CVSS 2.4, vivo Game Extension Engine)
- [CVE-2024-38658](https://cve.now/CVE-2024-38658.md): There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier). (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2024-38389](https://cve.now/CVE-2024-38389.md): There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS)
- [CVE-2024-53008](https://cve.now/CVE-2024-53008.md): Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. (CVSS 5.3, HAProxy Project HAProxy)
- [CVE-2024-38309](https://cve.now/CVE-2024-38309.md): There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS L (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT · F…)
- [CVE-2018-9377](https://cve.now/CVE-2018-9377.md): In getIntentForIntentSender of ActivityManagerService.java, there is a possible way to access user metadata due to a pending intent. (CVSS 8.4, Google Android)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-11-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.