# CVEs published 2024-12-02

194 CVEs were published on December 2, 2024: 10 critical, 117 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-9435](https://cve.now/CVE-2018-9435.md): In gatt\_process\_error\_rsp of gatt\_cl.cc, there is a possible out of bound read due to a missing bounds check. (CVSS 6.2, Google Android)
- [CVE-2018-9431](https://cve.now/CVE-2018-9431.md): In OSUInfo of OSUInfo.java, there is a possible escalation of privilege due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2018-9430](https://cve.now/CVE-2018-9430.md): In prop2cfg of btif\_storage.cc, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, Google Android)
- [CVE-2018-9429](https://cve.now/CVE-2018-9429.md): In buildImageItemsIfPossible of ItemTable.cpp there is a possible out of bound read due to uninitialized data. (CVSS 6.5, Google Android)
- [CVE-2018-9426](https://cve.now/CVE-2018-9426.md): In RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause weak RSA key pairs being (CVSS 6.5, Google Android)
- [CVE-2018-9423](https://cve.now/CVE-2018-9423.md): In ihevcd\_parse\_slice\_header of ihevcd\_parse\_slice\_header.c there is a possible out of bound read due to missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2018-9418](https://cve.now/CVE-2018-9418.md): In handle\_app\_cur\_val\_response of dtif\_rc.cc, there is a possible stack buffer overflow due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2024-53985](https://cve.now/CVE-2024-53985.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-53987](https://cve.now/CVE-2024-53987.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-53986](https://cve.now/CVE-2024-53986.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2024-53988](https://cve.now/CVE-2024-53988.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2018-9414](https://cve.now/CVE-2018-9414.md): In gattServerSendResponseNative of com\_android\_bluetooth\_gatt.cpp, there is a possible out of bounds stack write due to a missing bounds che (CVSS 7.8, Google Android)
- [CVE-2024-53989](https://cve.now/CVE-2024-53989.md): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (CVSS 2.3, rails-html-sanitizer)
- [CVE-2018-9413](https://cve.now/CVE-2018-9413.md): In handle\_notification\_response of btif\_rc.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.0, Google Android)
- [CVE-2018-9376](https://cve.now/CVE-2018-9376.md): In rpc\_msg\_handler and related handlers of drivers/misc/mediatek/eccci/port\_rpc.c, there is a possible out of bounds write due to an incorre (CVSS 7.8, Google Android)
- [CVE-2024-49581](https://cve.now/CVE-2024-49581.md): Access control issue impacting RV backed objects (CVSS 6.5, com.palantir.gotham:external-artifacts)
- [CVE-2018-9381](https://cve.now/CVE-2018-9381.md): In gatts\_process\_read\_by\_type\_req of gatt\_sr.c, there is a possible information disclosure due to uninitialized data. (CVSS 7.5, Google Android)
- [CVE-2018-9380](https://cve.now/CVE-2018-9380.md): In l2c\_lcc\_proc\_pdu of l2c\_fcr.cc, there is a possible out of bounds write due to improper input validation. (CVSS 8.8, Google Android)
- [CVE-2024-5890](https://cve.now/CVE-2024-5890.md): HTML Injection in the Assessment plugin (CVSS 5.1, ServiceNow Now Platform)
- [CVE-2024-53990](https://cve.now/CVE-2024-53990.md): AsyncHttpClient (AHC) library's \`CookieStore\` replaces explicitly defined \`Cookie\`s (CVSS 9.2, AsyncHttpClient async-http-client · org.asynchttpclient:asy…)
- [CVE-2024-53992](https://cve.now/CVE-2024-53992.md): unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload (CVSS 8.8, EDM115 unzip-bot)
- [CVE-2024-49763](https://cve.now/CVE-2024-49763.md): PlexRipper allows API leak due to open CORS policy (CVSS 8.7, PlexRipper)
- [CVE-2024-50381](https://cve.now/CVE-2024-50381.md): Missing Authentication for Critical Function in Snap One OVRC cloud (CVSS 8.8, Snap One OVRC cloud)
- [CVE-2024-50380](https://cve.now/CVE-2024-50380.md): Authentication Bypass by Spoofing in Snap One OVRC cloud (CVSS 8.7, Snap One OVRC cloud)
- [CVE-2024-52596](https://cve.now/CVE-2024-52596.md): SimpleSAMLphp xml-common XXE vulnerability (CVSS 8.8, simplesamlphp xml-common · simplesamlphp/xml-common)
- [CVE-2024-52806](https://cve.now/CVE-2024-52806.md): SimpleSAMLphp SAML2 has an XXE in parsing SAML messages (CVSS 8.3, simplesamlphp saml2 · simplesamlphp/saml2 +1)
- [CVE-2024-53259](https://cve.now/CVE-2024-53259.md): quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (CVSS 6.5, quic-go · github.com/quic-go/quic-go)
- [CVE-2024-53862](https://cve.now/CVE-2024-53862.md): Argo Workflows Allows Access to Archived Workflows with Fake Token in \`client\` mode (CVSS 6.3, argoproj argo-workflows · github.com/argoproj/argo-workf… +2)
- [CVE-2024-53981](https://cve.now/CVE-2024-53981.md): python-multipart has a Denial of service (DoS) via deformation \`multipart/form-data\` boundary (CVSS 7.5, Kludex python-multipart · python-multipart)
- [CVE-2024-53984](https://cve.now/CVE-2024-53984.md): Nanopb does not release memory on error return when using PB\_DECODE\_DELIMITED (CVSS 4.3, nanopb)
- [CVE-2024-10905](https://cve.now/CVE-2024-10905.md): IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability (CVSS 10.0, SailPoint Technologies IdentityIQ)
- [CVE-2024-8785](https://cve.now/CVE-2024-8785.md): WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability (CVSS 9.8, Progress Software WhatsUp Gold)
- [CVE-2024-46909](https://cve.now/CVE-2024-46909.md): WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability (CVSS 9.8, Progress Software WhatsUp Gold)
- [CVE-2024-46905](https://cve.now/CVE-2024-46905.md): WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2024-46906](https://cve.now/CVE-2024-46906.md): WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2024-46907](https://cve.now/CVE-2024-46907.md): WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2024-46908](https://cve.now/CVE-2024-46908.md): WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2024-38827](https://cve.now/CVE-2024-38827.md): Spring Security Authorization Bypass for Case Sensitive Comparisons (CVSS 4.8, Spring by VMware Tanzu Spring Security · org.springframewor…)
- [CVE-2024-51900](https://cve.now/CVE-2024-51900.md): WordPress What Would Seth Godin Do plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, James Hunt What Would Seth Godin Do)
- [CVE-2024-52452](https://cve.now/CVE-2024-52452.md): WordPress Open edX LMS plugin \<= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, eduNEXT Open edX LMS)
- [CVE-2024-52453](https://cve.now/CVE-2024-52453.md): WordPress Library Bookshelves plugin \<= 5.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, photonicgnostic Library Bookshelves)
- [CVE-2024-52454](https://cve.now/CVE-2024-52454.md): WordPress GoQMieruca plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, goqsystem GoQMieruca)
- [CVE-2024-52455](https://cve.now/CVE-2024-52455.md): WordPress GoQSmile plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, goqsystem GoQSmile)
- [CVE-2024-52456](https://cve.now/CVE-2024-52456.md): WordPress Awesome Studio plugin \<= 2.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpoets Awesome Studio)
- [CVE-2024-52457](https://cve.now/CVE-2024-52457.md): WordPress Youneeq Recommendations plugin \<= 3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Youneeq Recommendations)
- [CVE-2024-52458](https://cve.now/CVE-2024-52458.md): WordPress TM Islamic Helper plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, zaymund TM Islamic Helper)
- [CVE-2024-52459](https://cve.now/CVE-2024-52459.md): WordPress Chameleoni Jobs plugin \<= 2.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Chameleoni Jobs)
- [CVE-2024-52460](https://cve.now/CVE-2024-52460.md): WordPress AtaraPay WooCommerce Payment Gateway plugin \<= 2.0.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AtaraPay WooCommerce Payment Gateway)
- [CVE-2024-52461](https://cve.now/CVE-2024-52461.md): WordPress Infinite Slider plugin \<= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kinsta Infinite Slider)
- [CVE-2024-52462](https://cve.now/CVE-2024-52462.md): WordPress WP e-Commerce Style Email plugin \<= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jacob Schwartz WP e-Commerce Style Email)
- [CVE-2024-52463](https://cve.now/CVE-2024-52463.md): WordPress Post By Email plugin \<= 1.0.4b - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Peter Westwood Post By Email)
- [CVE-2024-52464](https://cve.now/CVE-2024-52464.md): WordPress amr shortcodes plugin \<= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, anmari amr shortcodes)
- [CVE-2024-52465](https://cve.now/CVE-2024-52465.md): WordPress LGPD Framework plugin \<= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Data443 Risk Mitigation LGPD Framework)
- [CVE-2024-52466](https://cve.now/CVE-2024-52466.md): WordPress Explara Events plugin \<= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Explara Events)
- [CVE-2024-52467](https://cve.now/CVE-2024-52467.md): WordPress AI Responsive Gallery Album plugin \<= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, August Infotech AI Responsive Gallery Album)
- [CVE-2024-52468](https://cve.now/CVE-2024-52468.md): WordPress LeadBoxer plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, LeadBoxer)
- [CVE-2024-52469](https://cve.now/CVE-2024-52469.md): WordPress WooCommerce Price Alert plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dhrubok Infotech Services WooCommerce Price Alert)
- [CVE-2024-52476](https://cve.now/CVE-2024-52476.md): WordPress Fediverse Embeds plugin \<= 1.5.3 - Arbitrary File Upload vulnerability (CVSS 10.0, Stefan Bohacek Fediverse Embeds)
- [CVE-2024-52477](https://cve.now/CVE-2024-52477.md): WordPress Document & Data Automation plugin \<= 1.6.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, docxpresso Document & Data Automation)
- [CVE-2024-52478](https://cve.now/CVE-2024-52478.md): WordPress Jobify theme \< 4.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Astoundify Jobify)
- [CVE-2024-52479](https://cve.now/CVE-2024-52479.md): WordPress Jobify plugin \< 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Astoundify Jobify)
- [CVE-2024-52482](https://cve.now/CVE-2024-52482.md): WordPress Ortto plugin \<= 1.0.19 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rafalautopilot Ortto)
- [CVE-2024-52483](https://cve.now/CVE-2024-52483.md): WordPress LeanPress plugin \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Igor Benic LeanPress)
- [CVE-2024-52484](https://cve.now/CVE-2024-52484.md): WordPress Wc Recently viewed products plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, deepintowp Wc Recently viewed products)
- [CVE-2024-52486](https://cve.now/CVE-2024-52486.md): WordPress Elementor Portfolio Builder plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SolverWp Elementor Portfolio Builder)
- [CVE-2024-52487](https://cve.now/CVE-2024-52487.md): WordPress Ultimate Classified Listings plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webcodingplace Ultimate Classified Listings)
- [CVE-2024-52489](https://cve.now/CVE-2024-52489.md): WordPress Add Chat App Button plugin \<= 2.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, udidol Add Chat App Button)
- [CVE-2024-52491](https://cve.now/CVE-2024-52491.md): WordPress Sticky Social Icons plugin \<= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Sanil Shakya Sticky Social Icons)
- [CVE-2024-52492](https://cve.now/CVE-2024-52492.md): WordPress Image horizontal reel scroll slideshow plugin \<= 13.4 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, gopiplus Image horizontal reel scroll slideshow)
- [CVE-2024-52493](https://cve.now/CVE-2024-52493.md): WordPress Meteor Slides plugin \<= 1.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Josh Leuze Meteor Slides)
- [CVE-2024-52494](https://cve.now/CVE-2024-52494.md): WordPress Dynamic To Top plugin \<= 3.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Matt Varone, Tim Berneman Dynamic "To Top")
- [CVE-2024-52502](https://cve.now/CVE-2024-52502.md): WordPress ImbaChat plugin \<= 3.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ImbaSynergy ImbaChat)
- [CVE-2024-52503](https://cve.now/CVE-2024-52503.md): WordPress Tailored Tools plugin \<= 1.8.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tailored Media Tailored Tools)
- [CVE-2024-53707](https://cve.now/CVE-2024-53707.md): WordPress Ahmeti Wp Güzel Sözler plugin \<= 4.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ahmeti Wp Güzel Sözler)
- [CVE-2024-53708](https://cve.now/CVE-2024-53708.md): WordPress AI Quiz plugin \<= 1.1 - Broken Access Control vulnerability (CVSS 5.3, kekotron AI Quiz)
- [CVE-2024-53709](https://cve.now/CVE-2024-53709.md): WordPress Generic Elements plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nasir Uddin Generic Elements)
- [CVE-2024-53710](https://cve.now/CVE-2024-53710.md): WordPress ITERAS plugin \<= 1.8.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, ITERAS)
- [CVE-2024-53711](https://cve.now/CVE-2024-53711.md): WordPress Hotlink2Watermark plugin \<= 0.3.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, tranchesdunet Hotlink2Watermark)
- [CVE-2024-53712](https://cve.now/CVE-2024-53712.md): WordPress Kevin's plugin \<= 2.0.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, kevmimcc Kevin's)
- [CVE-2024-53713](https://cve.now/CVE-2024-53713.md): WordPress Silverlight Video Player plugin \<= 1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, rickota Silverlight Video Player)
- [CVE-2024-53714](https://cve.now/CVE-2024-53714.md): WordPress Continue Shopping From Cart plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Irish\_Cathal Continue Shopping From Cart)
- [CVE-2024-53715](https://cve.now/CVE-2024-53715.md): WordPress Simple Travel Map plugin \<= 0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Thomas Hoefter Simple Travel Map)
- [CVE-2024-53716](https://cve.now/CVE-2024-53716.md): WordPress wp auto top plugin \<= 2.9.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, overtrue wp auto top)
- [CVE-2024-53717](https://cve.now/CVE-2024-53717.md): WordPress yPHPlista plugin \<= 1.1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, yonisink yPHPlista)
- [CVE-2024-53718](https://cve.now/CVE-2024-53718.md): WordPress Multi Feed Reader plugin \<= 2.2.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Eric Teubert Multi Feed Reader)
- [CVE-2024-53719](https://cve.now/CVE-2024-53719.md): WordPress Zajax – Ajax Navigation plugin \<= 0.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, onigetoc Zajax – Ajax Navigation)
- [CVE-2024-53720](https://cve.now/CVE-2024-53720.md): WordPress WP-ISPConfig 3 plugin \<= 1.5.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, ole1986 WP-ISPConfig)
- [CVE-2024-53721](https://cve.now/CVE-2024-53721.md): WordPress Advanced Event Manager plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Stachethemes Advanced Event Manager)
- [CVE-2024-53722](https://cve.now/CVE-2024-53722.md): WordPress Favicon My Blog plugin \<= 1.0.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, rockemmusic Favicon My Blog)
- [CVE-2024-53723](https://cve.now/CVE-2024-53723.md): WordPress Google Plus Share and +1 Button plugin \<= 1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, acbaltaci Google Plus Share and +1 Button)
- [CVE-2024-53724](https://cve.now/CVE-2024-53724.md): WordPress IceStats plugin \<= 1.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ronnybull IceStats)
- [CVE-2024-53725](https://cve.now/CVE-2024-53725.md): WordPress Post Hits Counter plugin \<= 2.8.23 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, aMiT Post Hits Counter)
- [CVE-2024-53726](https://cve.now/CVE-2024-53726.md): WordPress RealtyCandy IDX Broker Extended plugin \<= 1.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RealtyCandy.com RealtyCandy IDX Broker Extended)
- [CVE-2024-53727](https://cve.now/CVE-2024-53727.md): WordPress LinkLaunder SEO plugin \<= 0.92.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Lars Koudal LinkLaunder SEO)
- [CVE-2024-53728](https://cve.now/CVE-2024-53728.md): WordPress Protect Your Content plugin \<= 1.0.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Oliver Lindner Protect Your Content)
- [CVE-2024-53729](https://cve.now/CVE-2024-53729.md): WordPress Blizzard Quotes plugin \<= 1.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, plumwd Blizzard Quotes)
- [CVE-2024-53741](https://cve.now/CVE-2024-53741.md): WordPress Simple Popup plugin \<= 4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Garrett Grimm Simple Popup)
- [CVE-2024-53751](https://cve.now/CVE-2024-53751.md): WordPress Build App Online plugin \<= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, hakeemnala Build App Online)
- [CVE-2024-53753](https://cve.now/CVE-2024-53753.md): WordPress CultBooking Hotel Booking Engine plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, CultBooking Hotel Booking Engine)
- [CVE-2024-53754](https://cve.now/CVE-2024-53754.md): WordPress Out Of Stock Badge plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Irish\_Cathal Out Of Stock Badge)
- [CVE-2024-53755](https://cve.now/CVE-2024-53755.md): WordPress Third Party Cookie Eraser plugin \<= 1.0.2 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Andrea Pernici Third Party Cookie Eraser)
- [CVE-2024-53759](https://cve.now/CVE-2024-53759.md): WordPress ArCa Payment Gateway plugin \<= 1.3.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Planet Studio ArCa Payment Gateway)
- [CVE-2024-53761](https://cve.now/CVE-2024-53761.md): WordPress WP Revisions Manager plugin \<= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, P Roy WP Revisions Manager)
- [CVE-2024-53762](https://cve.now/CVE-2024-53762.md): WordPress FastBook plugin \<= 1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FasterThemes FastBook)
- [CVE-2024-53765](https://cve.now/CVE-2024-53765.md): WordPress Mins To Read plugin \<= 1.2.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Think201 Mins To Read)
- [CVE-2024-53769](https://cve.now/CVE-2024-53769.md): WordPress Custom Post Type to Map Store plugin \<= 1.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, lriaudel Custom Post Type to Map Store)
- [CVE-2024-53770](https://cve.now/CVE-2024-53770.md): WordPress RingCentral Communications plugin \<= 1.7.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, pbmacintyre RingCentral Communications)
- [CVE-2024-53775](https://cve.now/CVE-2024-53775.md): WordPress DancePress (TRWA) plugin \<= 3.1.11 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, benmoreassynt DancePress)
- [CVE-2024-53776](https://cve.now/CVE-2024-53776.md): WordPress Donate Me plugin \<= 1.2.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, raphaelheide Donate Me)
- [CVE-2024-53777](https://cve.now/CVE-2024-53777.md): WordPress Simple Header and Footer plugin \<= 1.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Alberto Reineri Simple Header and Footer)
- [CVE-2024-53779](https://cve.now/CVE-2024-53779.md): WordPress Yahoo! WebPlayer plugin \<= 2.0.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, 8bitkid Yahoo! WebPlayer)
- [CVE-2024-53780](https://cve.now/CVE-2024-53780.md): WordPress Load More Posts plugin \<= 1.5.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, rajeevglocify Load More Posts)
- [CVE-2024-53781](https://cve.now/CVE-2024-53781.md): WordPress SpatialMatch IDX plugin \<= 3.0.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, homejunction SpatialMatch IDX)
- [CVE-2024-53782](https://cve.now/CVE-2024-53782.md): WordPress Photo Video Store plugin \<= 21.07 - CSRF to Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cmsaccount Photo Video Store)
- [CVE-2024-53784](https://cve.now/CVE-2024-53784.md): WordPress Smart Marketing SMS and Newsletters Forms plugin \<= 5.0.4 - Broken Access Control vulnerability (CVSS 4.3, E-goi Smart Marketing SMS and Newsletters Forms)
- [CVE-2024-53789](https://cve.now/CVE-2024-53789.md): WordPress Advanced What should we write next about plugin \<=1.0.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ritesh Sanap Advanced What should we write next about)
- [CVE-2024-53792](https://cve.now/CVE-2024-53792.md): WordPress Watu Quiz plugin \<= 3.4.1.2 - SQL Injection vulnerability (CVSS 8.5, Bob Watu Quiz)
- [CVE-2024-53793](https://cve.now/CVE-2024-53793.md): WordPress eDoc Easy Tables plugin \<= 1.29 - CSRF to SQL Injection vulnerability (CVSS 8.2, jerodmoore eDoc Easy Tables)
- [CVE-2024-53124](https://cve.now/CVE-2024-53124.md): net: fix data-races around sk-\>sk\_forward\_alloc (CVSS 7.5, Linux)
- [CVE-2024-53123](https://cve.now/CVE-2024-53123.md): mptcp: error out earlier on disconnect (CVSS 5.5, Linux)
- [CVE-2024-53122](https://cve.now/CVE-2024-53122.md): mptcp: cope racing subflow creation in mptcp\_rcv\_space\_adjust (CVSS 7.5, Linux)
- [CVE-2024-53121](https://cve.now/CVE-2024-53121.md): net/mlx5: fs, lock FTE when checking if active (CVSS 7.8, Linux)
- [CVE-2024-53120](https://cve.now/CVE-2024-53120.md): net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (CVSS 7.5, Linux)
- [CVE-2024-53119](https://cve.now/CVE-2024-53119.md): virtio/vsock: Fix accept\_queue memory leak (no CVSS, Linux)
- [CVE-2024-53118](https://cve.now/CVE-2024-53118.md): vsock: Fix sk\_error\_queue memory leak (CVSS 5.5, Linux)
- [CVE-2024-53117](https://cve.now/CVE-2024-53117.md): virtio/vsock: Improve MSG\_ZEROCOPY error handling (CVSS 5.5, Linux)
- [CVE-2024-53116](https://cve.now/CVE-2024-53116.md): drm/panthor: Fix handling of partial GPU mapping of BOs (CVSS 5.5, Linux)
- [CVE-2024-53115](https://cve.now/CVE-2024-53115.md): drm/vmwgfx: avoid null\_ptr\_deref in vmw\_framebuffer\_surface\_create\_handle (CVSS 5.5, Linux)
- [CVE-2024-53114](https://cve.now/CVE-2024-53114.md): x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client (CVSS 5.5, Linux)
- [CVE-2024-53113](https://cve.now/CVE-2024-53113.md): mm: fix NULL pointer dereference in alloc\_pages\_bulk\_noprof (no CVSS, Linux)
- [CVE-2024-53112](https://cve.now/CVE-2024-53112.md): ocfs2: uncache inode which has failed entering the group (no CVSS, Linux)
- [CVE-2024-53111](https://cve.now/CVE-2024-53111.md): mm/mremap: fix address wraparound in move\_page\_tables() (CVSS 7.1, Linux)
- [CVE-2024-53110](https://cve.now/CVE-2024-53110.md): vp\_vdpa: fix id\_table array not null terminated error (CVSS 7.3, Linux)
- [CVE-2024-53109](https://cve.now/CVE-2024-53109.md): nommu: pass NULL argument to vma\_iter\_prealloc() (CVSS 7.8, Linux)
- [CVE-2024-53108](https://cve.now/CVE-2024-53108.md): drm/amd/display: Adjust VSDB parser for replay feature (CVSS 7.3, Linux)
- [CVE-2024-53107](https://cve.now/CVE-2024-53107.md): fs/proc/task\_mmu: prevent integer overflow in pagemap\_scan\_get\_args() (CVSS 7.8, Linux)
- [CVE-2024-53106](https://cve.now/CVE-2024-53106.md): ima: fix buffer overrun in ima\_eventdigest\_init\_common (CVSS 7.3, Linux)
- [CVE-2024-53105](https://cve.now/CVE-2024-53105.md): mm: page\_alloc: move mlocked flag clearance into free\_pages\_prepare() (CVSS 5.5, Linux)
- [CVE-2024-53730](https://cve.now/CVE-2024-53730.md): WordPress April's Call Posts plugin \<= 2.1.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, springthistle April's Call Posts)
- [CVE-2024-53740](https://cve.now/CVE-2024-53740.md): WordPress WooCommerce Ultimate Gift Card plugin \< 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPSwings WooCommerce Ultimate Gift Card)
- [CVE-2024-12015](https://cve.now/CVE-2024-12015.md): SQL Injection in WordPress Project Manager Plugin (CVSS 7.7, WeDevs WP Project Manager)
- [CVE-2024-43053](https://cve.now/CVE-2024-43053.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43052](https://cve.now/CVE-2024-43052.md): Improper Input Validation in Video Analytics and Processing (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43050](https://cve.now/CVE-2024-43050.md): Stack-based Buffer Overflow in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43049](https://cve.now/CVE-2024-43049.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-43048](https://cve.now/CVE-2024-43048.md): Stack-based Buffer Overflow in Performance (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-33063](https://cve.now/CVE-2024-33063.md): Integer Overflow or Wraparound in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33056](https://cve.now/CVE-2024-33056.md): Buffer Over-read in MProc (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33053](https://cve.now/CVE-2024-33053.md): Use After Free in Video (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33044](https://cve.now/CVE-2024-33044.md): Improper Validation of Array Index in Hypervisor (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33040](https://cve.now/CVE-2024-33040.md): Use After Free in Camera Driver (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33039](https://cve.now/CVE-2024-33039.md): Untrusted Pointer Dereference in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-33037](https://cve.now/CVE-2024-33037.md): Buffer Over-read in Neural Processing Unit (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2024-33036](https://cve.now/CVE-2024-33036.md): Use of Out-of-range Pointer Offset in Camera Driver (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-10490](https://cve.now/CVE-2024-10490.md): Authentication bypass flaw in several mapp components (CVSS 8.4, B&R Industrial Automation B&R mapp Cockpit · B&R Industr… +3)
- [CVE-2024-53104](https://cve.now/CVE-2024-53104.md): media: uvcvideo: Skip parsing frames of type UVC\_VS\_UNDEFINED in uvc\_parse\_format (CVSS 7.8, KEV, Linux)
- [CVE-2024-53103](https://cve.now/CVE-2024-53103.md): hv\_sock: Initializing vsk-\>trans to NULL to prevent a dangling pointer (CVSS 7.8, Linux)
- [CVE-2024-20139](https://cve.now/CVE-2024-20139.md): In Bluetooth firmware, there is a possible firmware asssert due to improper handling of exceptional conditions. (CVSS 6.5, MediaTek MT2737, MT3605, MT6985, MT6989, MT6990, MT7925, MT…)
- [CVE-2024-20138](https://cve.now/CVE-2024-20138.md): In wlan driver, there is a possible out of bound read due to improper input validation. (CVSS 7.5, MediaTek MT3605, MT6985, MT6989, MT6990, MT7925, MT7927, MT…)
- [CVE-2024-20116](https://cve.now/CVE-2024-20116.md): In cmdq, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6765, MT6768, MT6779, MT6781, MT6785, MT6789, MT…)
- [CVE-2024-20137](https://cve.now/CVE-2024-20137.md): In wlan driver, there is a possible client disconnection due to improper handling of exceptional conditions. (CVSS 7.5, MediaTek MT6890, MT7622, MT7915, MT7916, MT7981, MT7986)
- [CVE-2024-20136](https://cve.now/CVE-2024-20136.md): In da, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.2, MediaTek MT2737, MT6781, MT6789, MT6855, MT6878, MT6879, MT…)
- [CVE-2024-20135](https://cve.now/CVE-2024-20135.md): In soundtrigger, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6768, MT6781, MT6833, MT6853, MT6877, MT6878, MT…)
- [CVE-2024-20134](https://cve.now/CVE-2024-20134.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6835, MT6878, MT6879, MT6895, MT6896, MT6897, MT…)
- [CVE-2024-20133](https://cve.now/CVE-2024-20133.md): In Modem, there is a possible escalation of privilege due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6879, MT6886, MT6895, MT6895T, MT6896, MT6980, M…)
- [CVE-2024-20132](https://cve.now/CVE-2024-20132.md): In Modem, there is a possible out of bonds write due to a mission bounds check. (CVSS 6.7, MediaTek MT2737, MT6298, MT6879, MT6886, MT6895, MT6895T, M…)
- [CVE-2024-20131](https://cve.now/CVE-2024-20131.md): In Modem, there is a possible escalation of privilege due to an incorrect bounds check. (CVSS 6.7, MediaTek MT2737, MT2739, MT6789, MT6813, MT6815, MT6835, MT…)
- [CVE-2024-20130](https://cve.now/CVE-2024-20130.md): In power, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT…)
- [CVE-2024-20127](https://cve.now/CVE-2024-20127.md): In Telephony, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20128](https://cve.now/CVE-2024-20128.md): In Telephony, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20129](https://cve.now/CVE-2024-20129.md): In Telephony, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20125](https://cve.now/CVE-2024-20125.md): In vdec, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6761, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2024-11856](https://cve.now/CVE-2024-11856.md): HPE IceWall Products, Remote Unauthorized Data Modification (CVSS 3.7, Hewlett Packard Enterprise HPE IceWall)
- [CVE-2024-29645](https://cve.now/CVE-2024-29645.md): Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the parse\_die function. (CVSS 7.8)
- [CVE-2024-31669](https://cve.now/CVE-2024-31669.md): rizin before Release v0.6.3 is vulnerable to Uncontrolled Resource Consumption via bin\_pe\_parse\_imports, Pe\_r\_bin\_pe\_parse\_var, and estimate (CVSS 7.5)
- [CVE-2024-39343](https://cve.now/CVE-2024-39343.md): An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, Modem 5123 (CVSS 7.0)
- [CVE-2024-39890](https://cve.now/CVE-2024-39890.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, (CVSS 8.1)
- [CVE-2024-52724](https://cve.now/CVE-2024-52724.md): ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php. (CVSS 9.8)
- [CVE-2024-52732](https://cve.now/CVE-2024-52732.md): Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused. (CVSS 9.1)
- [CVE-2024-53364](https://cve.now/CVE-2024-53364.md): A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. (CVSS 5.4)
- [CVE-2024-53375](https://cve.now/CVE-2024-53375.md): An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. (CVSS 8.0)
- [CVE-2024-53459](https://cve.now/CVE-2024-53459.md): Sysax Multi Server 6.99 is vulnerable to Cross Site Scripting (XSS) via the /scgi?sid parameter. (CVSS 6.1)
- [CVE-2024-53477](https://cve.now/CVE-2024-53477.md): JFinal CMS 5.1.0 is vulnerable to Command Execution via unauthorized execution of deserialization in the file ApiForm.java (CVSS 9.8)
- [CVE-2024-53484](https://cve.now/CVE-2024-53484.md): Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key. (CVSS 8.8)
- [CVE-2024-53564](https://cve.now/CVE-2024-53564.md): A vulnerability was discovered in FreePBX 17.0.19.17. (CVSS 2.2, Sangoma FreePBX)
- [CVE-2024-53566](https://cve.now/CVE-2024-53566.md): An issue in the action\_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execut (CVSS 5.5)
- [CVE-2024-53605](https://cve.now/CVE-2024-53605.md): Incorrect access control in the component content://com.handcent.messaging.provider.MessageProvider/ of Handcent NextSMS v10.9.9.7 allows at (CVSS 7.5)
- [CVE-2024-53617](https://cve.now/CVE-2024-53617.md): A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file (CVSS 4.8)
- [CVE-2024-53900](https://cve.now/CVE-2024-53900.md): Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. (CVSS 9.1, mongoose)
- [CVE-2024-53937](https://cve.now/CVE-2024-53937.md): An issue was discovered on Victure RX1800 WiFi 6 Router (software EN\_V1.0.0\_r12\_110933, hardware 1.0) devices. (CVSS 8.8)
- [CVE-2024-53938](https://cve.now/CVE-2024-53938.md): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN\_V1.0.0\_r12\_110933, hardware 1.0) devices. (CVSS 8.8)
- [CVE-2024-53939](https://cve.now/CVE-2024-53939.md): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN\_V1.0.0\_r12\_110933, hardware 1.0) devices. (CVSS 8.8)
- [CVE-2024-53940](https://cve.now/CVE-2024-53940.md): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN\_V1.0.0\_r12\_110933, hardware 1.0) devices. (CVSS 8.8)
- [CVE-2024-53941](https://cve.now/CVE-2024-53941.md): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN\_V1.0.0\_r12\_110933, hardware 1.0) devices. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.