# CVEs published 2024-10-10

118 CVEs were published on October 10, 2024: 7 critical, 28 high. Days are UTC.

- [CVE-2024-9818](https://cve.now/CVE-2024-9818.md): SourceCodester Online Veterinary Appointment System manage\_category.php sql injection (CVSS 6.9, SourceCodester Online Veterinary Appointment System)
- [CVE-2024-9817](https://cve.now/CVE-2024-9817.md): code-projects Blood Bank System update.php sql injection (CVSS 5.3, code-projects Blood Bank System)
- [CVE-2024-47867](https://cve.now/CVE-2024-47867.md): Lack of integrity check on the downloaded FRP client in Gradio (CVSS 2.1, gradio-app gradio · gradio)
- [CVE-2024-47868](https://cve.now/CVE-2024-47868.md): Several components’ post-process steps may allow arbitrary file leaks in Gradio (CVSS 6.3, gradio-app gradio · gradio)
- [CVE-2024-47869](https://cve.now/CVE-2024-47869.md): Non-constant-time comparison when comparing hashes in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-47870](https://cve.now/CVE-2024-47870.md): Race condition in update\_root\_in\_config may redirect user traffic in Gradio (CVSS 7.1, gradio-app gradio · gradio)
- [CVE-2024-47871](https://cve.now/CVE-2024-47871.md): Insecure communication between the FRP client and server in Gradio (CVSS 8.2, gradio-app gradio · gradio)
- [CVE-2024-47872](https://cve.now/CVE-2024-47872.md): Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-9816](https://cve.now/CVE-2024-9816.md): Codezips Tourist Management System change-image.php unrestricted upload (CVSS 5.1, Codezips Tourist Management System)
- [CVE-2024-47084](https://cve.now/CVE-2024-47084.md): CORS origin validation is not performed when the request has a cookie in Gradio (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-47164](https://cve.now/CVE-2024-47164.md): The \`is\_in\_or\_equal\` function may be bypassed in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-47165](https://cve.now/CVE-2024-47165.md): CORS origin validation accepts the null origin in Gradio (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-47166](https://cve.now/CVE-2024-47166.md): One-level read path traversal in \`/custom\_component\` in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-47167](https://cve.now/CVE-2024-47167.md): SSRF in the path parameter of /queue/join in Gradio (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-47168](https://cve.now/CVE-2024-47168.md): The \`enable\_monitoring\` flag set to \`False\` does not disable monitoring in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-9815](https://cve.now/CVE-2024-9815.md): Codezips Tourist Management System create-package.php unrestricted upload (CVSS 5.1, Codezips Tourist Management System)
- [CVE-2024-9814](https://cve.now/CVE-2024-9814.md): Codezips Pharmacy Management System update.php sql injection (CVSS 6.9, Codezips Pharmacy Management System)
- [CVE-2024-9487](https://cve.now/CVE-2024-9487.md): An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO… (CVSS 9.5, GitHub Enterprise Server)
- [CVE-2024-9813](https://cve.now/CVE-2024-9813.md): Codezips Pharmacy Management System register.php sql injection (CVSS 6.9, Codezips Pharmacy Management System)
- [CVE-2024-9812](https://cve.now/CVE-2024-9812.md): code-projects Crud Operation System delete.php sql injection (CVSS 6.9, code-projects Crud Operation System)
- [CVE-2024-9180](https://cve.now/CVE-2024-9180.md): Vault Operators in Root Namespace May Elevate Their Privileges (CVSS 7.2, HashiCorp Vault · github.com/hashicorp/vault +1)
- [CVE-2024-9811](https://cve.now/CVE-2024-9811.md): code-projects Restaurant Reservation System filter3.php sql injection (CVSS 6.9, code-projects Restaurant Reservation System)
- [CVE-2024-9810](https://cve.now/CVE-2024-9810.md): SourceCodester Record Management System sort2\_user.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-9809](https://cve.now/CVE-2024-9809.md): SourceCodester Online Eyewear Shop Master.php delete\_product sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9808](https://cve.now/CVE-2024-9808.md): SourceCodester Online Eyewear Shop sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9807](https://cve.now/CVE-2024-9807.md): Craig Rodway Classroombookings Session Page sessions cross site scripting (CVSS 5.1, Craig Rodway Classroombookings)
- [CVE-2024-9806](https://cve.now/CVE-2024-9806.md): Craig Rodway Classroombookings Room Page fields cross site scripting (CVSS 5.3, Craig Rodway Classroombookings)
- [CVE-2024-47354](https://cve.now/CVE-2024-47354.md): WordPress Simple Membership After Login Redirection plugin \<= 1.6 - Open Redirection vulnerability (CVSS 4.7, wp.insider Simple Membership After Login Redirection)
- [CVE-2024-47648](https://cve.now/CVE-2024-47648.md): WordPress EventPrime plugin \<= 4.0.4.5 - Open Redirection vulnerability (CVSS 4.7, Metagauss EventPrime)
- [CVE-2024-47636](https://cve.now/CVE-2024-47636.md): WordPress WP JobSearch plugin \<= 2.5.9 - PHP Object Injection vulnerability (CVSS 9.8, eyecix JobSearch)
- [CVE-2024-9805](https://cve.now/CVE-2024-9805.md): code-projects Blood Bank System campsdetails.php cross site scripting (CVSS 5.3, code-projects Blood Bank System)
- [CVE-2024-9804](https://cve.now/CVE-2024-9804.md): code-projects Blood Bank System campsdetails.php sql injection (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2024-47966](https://cve.now/CVE-2024-47966.md): Use of Uninitialized Variable vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47965](https://cve.now/CVE-2024-47965.md): Out-of-bounds Read vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47964](https://cve.now/CVE-2024-47964.md): Heap-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47963](https://cve.now/CVE-2024-47963.md): Out-of-bounds Write vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47962](https://cve.now/CVE-2024-47962.md): Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-9803](https://cve.now/CVE-2024-9803.md): code-projects Blood Bank Management System blooddetails.php cross site scripting (CVSS 5.3, code-projects Blood Bank Management System)
- [CVE-2024-9799](https://cve.now/CVE-2024-9799.md): SourceCodester Profile Registration without Reload Refresh add.php cross site scripting (CVSS 5.3, SourceCodester Profile Registration without Reload Refresh)
- [CVE-2024-9797](https://cve.now/CVE-2024-9797.md): code-projects Blood Bank System register.php sql injection (CVSS 6.9, code-projects Blood Bank System)
- [CVE-2024-9794](https://cve.now/CVE-2024-9794.md): Codezips Online Shopping Portal update-image1.php unrestricted upload (CVSS 5.3, Codezips Online Shopping Portal)
- [CVE-2023-25581](https://cve.now/CVE-2023-25581.md): Deserialization of untrusted data in InternalAttributeHandler in pac4j (CVSS 9.2, pac4j · org.pac4j:pac4j-core)
- [CVE-2024-9793](https://cve.now/CVE-2024-9793.md): Tenda AC1206 ate ate\_ifconfig\_set command injection (CVSS 5.3, Tenda AC1206)
- [CVE-2024-9792](https://cve.now/CVE-2024-9792.md): D-Link DSL-2750U Port Forwarding Page cross site scripting (CVSS 5.1, D-Link DSL-2750U)
- [CVE-2024-9790](https://cve.now/CVE-2024-9790.md): LyLme\_spage sou.php sql injection (CVSS 5.1, LyLme\_spage)
- [CVE-2024-9789](https://cve.now/CVE-2024-9789.md): LyLme\_spage apply.php sql injection (CVSS 5.1, LyLme\_spage)
- [CVE-2024-9788](https://cve.now/CVE-2024-9788.md): LyLme\_spage tag.php sql injection (CVSS 5.1, LyLme\_spage)
- [CVE-2024-9312](https://cve.now/CVE-2024-9312.md): Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. (CVSS 7.5, Canonical Authd · github.com/ubuntu/authd)
- [CVE-2024-4658](https://cve.now/CVE-2024-4658.md): SQLi in TE Informatics' Nova CMS (CVSS 6.9, TE Informatics Nova CMS)
- [CVE-2024-9787](https://cve.now/CVE-2024-9787.md): Contemporary Control System BASrouter BACnet BASRT-B UDP Packet denial of service (CVSS 6.9, Contemporary Control System BASrouter BACnet BASRT-B)
- [CVE-2024-9786](https://cve.now/CVE-2024-9786.md): D-Link DIR-619L B1 formSetLog buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9785](https://cve.now/CVE-2024-9785.md): D-Link DIR-619L B1 formSetDDNS buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-6157](https://cve.now/CVE-2024-6157.md): An attacker who successfully exploited these vulnerabilities could cause the robot to stop. (CVSS 5.1, ABB RobotWare)
- [CVE-2024-6530](https://cve.now/CVE-2024-6530.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.3, GitLab)
- [CVE-2024-9784](https://cve.now/CVE-2024-9784.md): D-Link DIR-619L B1 formResetStatistic buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9783](https://cve.now/CVE-2024-9783.md): D-Link DIR-619L B1 formLogDnsquery buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9782](https://cve.now/CVE-2024-9782.md): D-Link DIR-619L B1 formEasySetupWWConfig buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-48902](https://cve.now/CVE-2024-48902.md): In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via… (CVSS 5.4, JetBrains YouTrack)
- [CVE-2024-9201](https://cve.now/CVE-2024-9201.md): SQL injection vulnerability in SEUR plugin (CVSS 9.4, SEUR plugin)
- [CVE-2024-8977](https://cve.now/CVE-2024-8977.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 8.2, GitLab)
- [CVE-2024-9596](https://cve.now/CVE-2024-9596.md): Inclusion of Sensitive Information in Source Code in GitLab (CVSS 3.7, GitLab)
- [CVE-2024-45127](https://cve.now/CVE-2024-45127.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Commerce · magento/community-edition)
- [CVE-2024-45128](https://cve.now/CVE-2024-45128.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.4, Adobe Commerce · magento/community-edition)
- [CVE-2024-45133](https://cve.now/CVE-2024-45133.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45124](https://cve.now/CVE-2024-45124.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 5.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45123](https://cve.now/CVE-2024-45123.md): Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Commerce · magento/community-edition)
- [CVE-2024-45121](https://cve.now/CVE-2024-45121.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45115](https://cve.now/CVE-2024-45115.md): Adobe Commerce | Improper Authentication (CWE-287) (CVSS 9.8, Adobe Commerce)
- [CVE-2024-45117](https://cve.now/CVE-2024-45117.md): Adobe Commerce | Improper Input Validation (CWE-20) (CVSS 7.6, Adobe Commerce · magento/community-edition)
- [CVE-2024-45116](https://cve.now/CVE-2024-45116.md): Adobe Commerce | Cross-site Scripting (XSS) (CWE-79) (CVSS 8.1, Adobe Commerce · magento/community-edition)
- [CVE-2024-45119](https://cve.now/CVE-2024-45119.md): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 4.9, Adobe Commerce · magento/community-edition)
- [CVE-2024-45122](https://cve.now/CVE-2024-45122.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45135](https://cve.now/CVE-2024-45135.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45120](https://cve.now/CVE-2024-45120.md): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) (CVSS 3.1, Adobe Commerce · magento/community-edition)
- [CVE-2024-45130](https://cve.now/CVE-2024-45130.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45132](https://cve.now/CVE-2024-45132.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 6.5, Adobe Commerce · magento/community-edition)
- [CVE-2024-45131](https://cve.now/CVE-2024-45131.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.4, Adobe Commerce · magento/community-edition)
- [CVE-2024-45148](https://cve.now/CVE-2024-45148.md): Adobe Commerce | Improper Authentication (CWE-287) (CVSS 8.8, Adobe Commerce)
- [CVE-2024-45134](https://cve.now/CVE-2024-45134.md): Adobe Commerce | Information Exposure (CWE-200) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45129](https://cve.now/CVE-2024-45129.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45118](https://cve.now/CVE-2024-45118.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 6.5, Adobe Commerce · magento/community-edition)
- [CVE-2024-45149](https://cve.now/CVE-2024-45149.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45125](https://cve.now/CVE-2024-45125.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-9623](https://cve.now/CVE-2024-9623.md): Incorrect Authorization in GitLab (CVSS 4.9, GitLab)
- [CVE-2024-22068](https://cve.now/CVE-2024-22068.md): Weak Password Vulnerability in ZTE ZSR V2 Intelligent Multi Service Router (CVSS 6.0, ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 1…)
- [CVE-2024-6747](https://cve.now/CVE-2024-6747.md): Information leak in mknotifyd (CVSS 5.3, Checkmk)
- [CVE-2024-9802](https://cve.now/CVE-2024-9802.md): Conformance validation endpoint discloses detail about service to unauthenticated users (CVSS 5.3, Open Mainframe Project Zowe)
- [CVE-2024-9796](https://cve.now/CVE-2024-9796.md): WP-Advanced-Search \< 3.3.9.2 - Unauthenticated SQL Injection (CVSS 5.9, WP-Advanced-Search)
- [CVE-2024-9798](https://cve.now/CVE-2024-9798.md): Health endpoint offers list of onboarded services to unauthenticated users (CVSS 5.3, Open Mainframe Project Zowe)
- [CVE-2024-9781](https://cve.now/CVE-2024-9781.md): Improper Handling of Missing Values in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-9780](https://cve.now/CVE-2024-9780.md): Missing Initialization of a Variable in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-9156](https://cve.now/CVE-2024-9156.md): TI WooCommerce Wishlist \<= 2.8.2 - Unauthenticated SQL Injection via lang parameters (CVSS 5.9, TI WooCommerce Wishlist)
- [CVE-2024-9074](https://cve.now/CVE-2024-9074.md): Advanced Blocks Pro \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, essamamdani Advanced Blocks Pro)
- [CVE-2024-9520](https://cve.now/CVE-2024-9520.md): UserPlus \<= 2.0 - Missing Authorization via Multiple Functions (CVSS 6.3, User registration & user profile – UserPlus)
- [CVE-2024-9067](https://cve.now/CVE-2024-9067.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress \<= 1.3.0 - Missing Authorization to… (CVSS 4.3, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-8477](https://cve.now/CVE-2024-8477.md): Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) \<= 3.1.87 - Cross-Site Request Forgery (CVSS 4.3, neeraj\_slit Brevo – Email, SMS, Web Push, Chat, and more.)
- [CVE-2024-9022](https://cve.now/CVE-2024-9022.md): TS Poll – Survey, Versus Poll, Image Poll, Video Poll \<= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter (CVSS 7.2, totalsoft TS Poll – Survey, Versus Poll, Image Poll, Video…)
- [CVE-2024-8729](https://cve.now/CVE-2024-8729.md): Easy Social Share Buttons \<= 1.4.5 - Reflected Cross-Site Scripting (CVSS 6.1, brianbrey Easy Social Share Buttons)
- [CVE-2024-9685](https://cve.now/CVE-2024-9685.md): Notification for Telegram \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message (CVSS 4.3, rainafarai Notification for Telegram)
- [CVE-2024-9057](https://cve.now/CVE-2024-9057.md): Curator.io: Show all your social media posts in a beautiful feed. \<= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via… (CVSS 6.4, curatorio Curator.io)
- [CVE-2024-9581](https://cve.now/CVE-2024-9581.md): Shortcodes AnyWhere \<= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, happyplugins Shortcodes AnyWhere)
- [CVE-2024-9377](https://cve.now/CVE-2024-9377.md): Products, Order & Customers Export for WooCommerce \<= 2.0.15 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory Export Products, Orders & Customers for WooCo…)
- [CVE-2024-9065](https://cve.now/CVE-2024-9065.md): WP Helper Premium \<= 4.6.1 - Missing Authorization in whp\_smtp\_send\_mail\_test (CVSS 5.3, matbao WP Helper Premium)
- [CVE-2024-9064](https://cve.now/CVE-2024-9064.md): Elementor Inline SVG \<= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, namogo Elementor Inline SVG)
- [CVE-2024-9066](https://cve.now/CVE-2024-9066.md): Marketing and SEO Booster \<= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, dale668 Marketing and SEO Booster)
- [CVE-2024-9522](https://cve.now/CVE-2024-9522.md): WP Users Masquerade \<= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass (CVSS 8.8, lagunaisw WP Users Masquerade)
- [CVE-2024-9518](https://cve.now/CVE-2024-9518.md): UserPlus \<= 2.0 - Unauthenticated Privilege Escalation (CVSS 9.8, User registration & user profile – UserPlus)
- [CVE-2024-8987](https://cve.now/CVE-2024-8987.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress \<= 1.3.0 - Authenticated (Contributor+)… (CVSS 6.4, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-8513](https://cve.now/CVE-2024-8513.md): QA Analytics \<= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, quarka QA Assistants – Driven by data)
- [CVE-2024-9205](https://cve.now/CVE-2024-9205.md): Maximum Products per User for WooCommerce \<= 4.2.8 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory Maximum Products per User for WooCommerce)
- [CVE-2024-9519](https://cve.now/CVE-2024-9519.md): UserPlus \<= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation (CVSS 7.2, User registration & user profile – UserPlus)
- [CVE-2024-9072](https://cve.now/CVE-2024-9072.md): GDPR-Extensions-com – Consent Manager \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, gdprextensionscom GDPR-Extensions-com – Consent Manager)
- [CVE-2024-9457](https://cve.now/CVE-2024-9457.md): WP Builder \<= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, cssjockey WP Builder)
- [CVE-2024-7048](https://cve.now/CVE-2024-7048.md): IDOR in open-webui/open-webui (CVSS 6.3, open-webui/open-webui)
- [CVE-2024-35202](https://cve.now/CVE-2024-35202.md): Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by… (CVSS 7.5)
- [CVE-2024-48949](https://cve.now/CVE-2024-48949.md): The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n)… (CVSS 9.1, elliptic)
- [CVE-2024-48957](https://cve.now/CVE-2024-48957.md): execute\_filter\_audio in archive\_read\_support\_format\_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive… (CVSS 7.8)
- [CVE-2024-48958](https://cve.now/CVE-2024-48958.md): execute\_filter\_delta in archive\_read\_support\_format\_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive… (CVSS 7.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.