# CVEs published 2024-10-15

188 CVEs were published on October 15, 2024: 20 critical, 72 high. Days are UTC.

- [CVE-2024-49340](https://cve.now/CVE-2024-49340.md): IBM Watson Studio Local cross-site request forgery (CVSS 4.3, IBM Watson Studio Local)
- [CVE-2024-38190](https://cve.now/CVE-2024-38190.md): Power Platform Information Disclosure Vulnerability (CVSS 8.6, Microsoft Power Platform)
- [CVE-2024-38204](https://cve.now/CVE-2024-38204.md): Imagine Cup site Information Disclosure Vulnerability (CVSS 7.5, Microsoft Azure Functions)
- [CVE-2024-38139](https://cve.now/CVE-2024-38139.md): Microsoft Dataverse Elevation of Privilege Vulnerability (CVSS 8.7, Microsoft Dataverse)
- [CVE-2024-10004](https://cve.now/CVE-2024-10004.md): Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in… (CVSS 9.1, Mozilla Firefox for iOS)
- [CVE-2024-45085](https://cve.now/CVE-2024-45085.md): IBM WebSphere Application Server denial of service (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2024-9594](https://cve.now/CVE-2024-9594.md): VM images built with Image Builder with some providers use default credentials during builds (CVSS 6.3, Kubernetes Image Builder · github.com/kubernetes-sigs/image…)
- [CVE-2024-9486](https://cve.now/CVE-2024-9486.md): VM images built with Image Builder and Proxmox provider use default credentials (CVSS 9.8, Kubernetes Image Builder · github.com/kubernetes-sigs/image…)
- [CVE-2024-9966](https://cve.now/CVE-2024-9966.md): Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security… (CVSS 5.3, Google Chrome)
- [CVE-2024-9965](https://cve.now/CVE-2024-9965.md): Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user… (CVSS 8.8, Google Chrome)
- [CVE-2024-9964](https://cve.now/CVE-2024-9964.md): Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage… (CVSS 4.3, Google Chrome)
- [CVE-2024-9963](https://cve.now/CVE-2024-9963.md): Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage… (CVSS 4.3, Google Chrome)
- [CVE-2024-9962](https://cve.now/CVE-2024-9962.md): Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to… (CVSS 4.3, Google Chrome)
- [CVE-2024-9961](https://cve.now/CVE-2024-9961.md): Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage… (CVSS 8.8, Google Chrome)
- [CVE-2024-9960](https://cve.now/CVE-2024-9960.md): Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2024-9959](https://cve.now/CVE-2024-9959.md): Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.8, Google Chrome)
- [CVE-2024-9958](https://cve.now/CVE-2024-9958.md): Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing… (CVSS 4.3, Google Chrome)
- [CVE-2024-9957](https://cve.now/CVE-2024-9957.md): Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific… (CVSS 8.8, Google Chrome)
- [CVE-2024-9956](https://cve.now/CVE-2024-9956.md): Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform… (CVSS 7.8, Google Chrome)
- [CVE-2024-9955](https://cve.now/CVE-2024-9955.md): Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap… (CVSS 8.8, Google Chrome)
- [CVE-2024-9954](https://cve.now/CVE-2024-9954.md): Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2024-21286](https://cve.now/CVE-2024-21286.md): Vulnerability in the PeopleSoft Enterprise ELM Enterprise Learning Management product of Oracle PeopleSoft (component: Enterprise Learning… (CVSS 5.4, Oracle PeopleSoft Enterprise ELM Enterprise Learning Manage…)
- [CVE-2024-21285](https://cve.now/CVE-2024-21285.md): Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). (CVSS 7.1, Oracle Banking Liquidity Management)
- [CVE-2024-21284](https://cve.now/CVE-2024-21284.md): Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). (CVSS 7.1, Oracle Banking Liquidity Management)
- [CVE-2024-21283](https://cve.now/CVE-2024-21283.md): Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). (CVSS 8.1, Oracle PeopleSoft Enterprise HCM Global Payroll Core)
- [CVE-2024-21282](https://cve.now/CVE-2024-21282.md): Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). (CVSS 8.1, Oracle Financials)
- [CVE-2024-21281](https://cve.now/CVE-2024-21281.md): Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.3, Oracle Banking Liquidity Management)
- [CVE-2024-21280](https://cve.now/CVE-2024-21280.md): Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). (CVSS 8.1, Oracle Service Contracts)
- [CVE-2024-21279](https://cve.now/CVE-2024-21279.md): Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). (CVSS 8.1, Oracle Sourcing)
- [CVE-2024-21278](https://cve.now/CVE-2024-21278.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes). (CVSS 8.1, Oracle Contract Lifecycle Management for Public Sector)
- [CVE-2024-21277](https://cve.now/CVE-2024-21277.md): Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). (CVSS 8.1, Oracle MES for Process Manufacturing)
- [CVE-2024-21276](https://cve.now/CVE-2024-21276.md): Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages). (CVSS 8.1, Oracle Work in Process)
- [CVE-2024-21275](https://cve.now/CVE-2024-21275.md): Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface). (CVSS 8.1, Oracle Quoting)
- [CVE-2024-21274](https://cve.now/CVE-2024-21274.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21273](https://cve.now/CVE-2024-21273.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2024-21272](https://cve.now/CVE-2024-21272.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). (CVSS 7.5, Oracle MySQL Connectors · mysql-connector-python)
- [CVE-2024-21271](https://cve.now/CVE-2024-21271.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal). (CVSS 8.1, Oracle Field Service)
- [CVE-2024-21270](https://cve.now/CVE-2024-21270.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). (CVSS 8.1, Oracle Common Applications Calendar)
- [CVE-2024-21269](https://cve.now/CVE-2024-21269.md): Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan). (CVSS 8.1, Oracle Incentive Compensation)
- [CVE-2024-21268](https://cve.now/CVE-2024-21268.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). (CVSS 8.1, Oracle Applications Manager)
- [CVE-2024-21267](https://cve.now/CVE-2024-21267.md): Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). (CVSS 8.1, Oracle Cost Management)
- [CVE-2024-21266](https://cve.now/CVE-2024-21266.md): Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). (CVSS 8.1, Oracle Advanced Pricing)
- [CVE-2024-21265](https://cve.now/CVE-2024-21265.md): Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). (CVSS 8.1, Oracle Site Hub)
- [CVE-2024-21264](https://cve.now/CVE-2024-21264.md): Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Activity Guide Composer). (CVSS 5.4, Oracle PeopleSoft Enterprise CC Common Application Objects)
- [CVE-2024-21263](https://cve.now/CVE-2024-21263.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.1, Oracle VM VirtualBox)
- [CVE-2024-21262](https://cve.now/CVE-2024-21262.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). (CVSS 6.5, Oracle MySQL Connectors)
- [CVE-2024-21261](https://cve.now/CVE-2024-21261.md): Vulnerability in Oracle Application Express (component: General). (CVSS 4.9, Oracle Application Express)
- [CVE-2024-21260](https://cve.now/CVE-2024-21260.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21259](https://cve.now/CVE-2024-21259.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2024-21258](https://cve.now/CVE-2024-21258.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). (CVSS 5.3, Oracle Installed Base)
- [CVE-2024-21257](https://cve.now/CVE-2024-21257.md): Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization). (CVSS 3.0, Oracle Hyperion BI+)
- [CVE-2024-21255](https://cve.now/CVE-2024-21255.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). (CVSS 8.8, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2024-21254](https://cve.now/CVE-2024-21254.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 8.8, Oracle BI Publisher)
- [CVE-2024-21253](https://cve.now/CVE-2024-21253.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 2.3, Oracle VM VirtualBox)
- [CVE-2024-21252](https://cve.now/CVE-2024-21252.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 8.1, Oracle Product Hub)
- [CVE-2024-21251](https://cve.now/CVE-2024-21251.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 3.1, Oracle Database Server)
- [CVE-2024-21250](https://cve.now/CVE-2024-21250.md): Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager… (CVSS 8.1, Oracle Process Manufacturing Product Development)
- [CVE-2024-21249](https://cve.now/CVE-2024-21249.md): Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). (CVSS 4.3, Oracle PeopleSoft Enterprise FIN Expenses)
- [CVE-2024-21248](https://cve.now/CVE-2024-21248.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.3, Oracle VM VirtualBox)
- [CVE-2024-21247](https://cve.now/CVE-2024-21247.md): Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). (CVSS 3.8, Oracle MySQL Cluster · Oracle MySQL Client)
- [CVE-2024-21246](https://cve.now/CVE-2024-21246.md): Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). (CVSS 7.5, Oracle Service Bus)
- [CVE-2024-21244](https://cve.now/CVE-2024-21244.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21243](https://cve.now/CVE-2024-21243.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21242](https://cve.now/CVE-2024-21242.md): Vulnerability in the XML Database component of Oracle Database Server. (CVSS 3.5, Oracle Database Server)
- [CVE-2024-21241](https://cve.now/CVE-2024-21241.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21239](https://cve.now/CVE-2024-21239.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21238](https://cve.now/CVE-2024-21238.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). (CVSS 5.3, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21237](https://cve.now/CVE-2024-21237.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21236](https://cve.now/CVE-2024-21236.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21235](https://cve.now/CVE-2024-21235.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component… (CVSS 4.8, Oracle Java SE)
- [CVE-2024-21234](https://cve.now/CVE-2024-21234.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21233](https://cve.now/CVE-2024-21233.md): Vulnerability in the Oracle Database Core component of Oracle Database Server. (CVSS 4.3, Oracle Database Server)
- [CVE-2024-21232](https://cve.now/CVE-2024-21232.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21231](https://cve.now/CVE-2024-21231.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). (CVSS 3.1, Oracle MySQL Server)
- [CVE-2024-21230](https://cve.now/CVE-2024-21230.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21219](https://cve.now/CVE-2024-21219.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21218](https://cve.now/CVE-2024-21218.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21217](https://cve.now/CVE-2024-21217.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component… (CVSS 3.7, Oracle Java SE)
- [CVE-2024-21216](https://cve.now/CVE-2024-21216.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2024-21215](https://cve.now/CVE-2024-21215.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21214](https://cve.now/CVE-2024-21214.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2024-21213](https://cve.now/CVE-2024-21213.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.2, Oracle MySQL Server)
- [CVE-2024-21212](https://cve.now/CVE-2024-21212.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2024-21211](https://cve.now/CVE-2024-21211.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component… (CVSS 3.7, Oracle GraalVM · Oracle Java SE)
- [CVE-2024-21210](https://cve.now/CVE-2024-21210.md): Vulnerability in Oracle Java SE (component: Hotspot). (CVSS 3.7, Oracle Java SE)
- [CVE-2024-21209](https://cve.now/CVE-2024-21209.md): Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). (CVSS 2.0, Oracle MySQL Client)
- [CVE-2024-21208](https://cve.now/CVE-2024-21208.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component… (CVSS 3.7, Oracle Java SE)
- [CVE-2024-21207](https://cve.now/CVE-2024-21207.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21206](https://cve.now/CVE-2024-21206.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics). (CVSS 4.3, Oracle Enterprise Command Center Framework)
- [CVE-2024-21205](https://cve.now/CVE-2024-21205.md): Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). (CVSS 6.5, Oracle Service Bus)
- [CVE-2024-21204](https://cve.now/CVE-2024-21204.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21203](https://cve.now/CVE-2024-21203.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21202](https://cve.now/CVE-2024-21202.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 6.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2024-21201](https://cve.now/CVE-2024-21201.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21200](https://cve.now/CVE-2024-21200.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21199](https://cve.now/CVE-2024-21199.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21198](https://cve.now/CVE-2024-21198.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21197](https://cve.now/CVE-2024-21197.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21196](https://cve.now/CVE-2024-21196.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-21195](https://cve.now/CVE-2024-21195.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). (CVSS 7.6, Oracle BI Publisher)
- [CVE-2024-21194](https://cve.now/CVE-2024-21194.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21193](https://cve.now/CVE-2024-21193.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21192](https://cve.now/CVE-2024-21192.md): Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt). (CVSS 4.4, Oracle Enterprise Manager for Fusion Middleware)
- [CVE-2024-21191](https://cve.now/CVE-2024-21191.md): Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control… (CVSS 7.6, Oracle Enterprise Manager Fusion Middleware Control)
- [CVE-2024-21190](https://cve.now/CVE-2024-21190.md): Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). (CVSS 7.5, Oracle Global Lifecycle Management FMW Installer)
- [CVE-2024-21172](https://cve.now/CVE-2024-21172.md): Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). (CVSS 9.0, Oracle Hospitality OPERA)
- [CVE-2024-5749](https://cve.now/CVE-2024-5749.md): Certain HP DesignJet products – Credential reflection (CVSS 7.5, Certain HP DesignJet products)
- [CVE-2024-48915](https://cve.now/CVE-2024-48915.md): Agent Dart missing certificate verification checks (CVSS 8.7, AstroxNetwork agent\_dart)
- [CVE-2024-48914](https://cve.now/CVE-2024-48914.md): Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy (CVSS 9.1, vendure-ecommerce vendure · @vendure/asset-server-plugin)
- [CVE-2024-48913](https://cve.now/CVE-2024-48913.md): Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. (CVSS 5.9, honojs hono · hono)
- [CVE-2024-47876](https://cve.now/CVE-2024-47876.md): Sakai: Kernel users created with type roleview can login as a normal user (CVSS 8.7, sakaiproject sakai · org.sakaiproject.kernel:sakai-kernel-i…)
- [CVE-2024-47874](https://cve.now/CVE-2024-47874.md): Starlette Denial of service (DoS) via multipart/form-data (CVSS 8.7, encode starlette · starlette)
- [CVE-2024-47824](https://cve.now/CVE-2024-47824.md): Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room (CVSS 8.7, matrix-org matrix-react-sdk · matrix-react-sdk)
- [CVE-2024-9506](https://cve.now/CVE-2024-9506.md): Regular Expression Denial of Service (ReDoS) (CVSS 3.7, vue)
- [CVE-2024-47779](https://cve.now/CVE-2024-47779.md): Element Web vulnerable to potential exposure of access token via authenticated media (CVSS 7.0, element-hq element-web)
- [CVE-2024-9676](https://cve.now/CVE-2024-9676.md): Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos) (CVSS 6.5, containers/storage · Red Hat Enterprise Linux +3)
- [CVE-2024-47771](https://cve.now/CVE-2024-47771.md): Element Desktop vulnerable to potential exposure of access token via authenticated media (CVSS 7.0, element-hq element-desktop)
- [CVE-2024-47080](https://cve.now/CVE-2024-47080.md): matrix-js-sdk keys sent via \`sendSharedHistoryKeys\` vulnerable to interception by malicious homeserver (CVSS 8.7, matrix-org matrix-js-sdk · matrix-js-sdk)
- [CVE-2024-9979](https://cve.now/CVE-2024-9979.md): Pyo3: risk of use-after-free in \`borrowed\` reads from python weak references (CVSS 5.3, pyo3 · Red Hat Ansible Automation Platform +1)
- [CVE-2024-9986](https://cve.now/CVE-2024-9986.md): code-projects Blood Bank Management System member\_register.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2024-9977](https://cve.now/CVE-2024-9977.md): MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection (CVSS 5.1, MitraStar GPT-2541GNAC)
- [CVE-2024-9976](https://cve.now/CVE-2024-9976.md): code-projects Pharmacy Management System manage\_customer.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-9975](https://cve.now/CVE-2024-9975.md): SourceCodester Drag and Drop Image Upload upload.php unrestricted upload (CVSS 5.3, SourceCodester Drag and Drop Image Upload)
- [CVE-2024-47674](https://cve.now/CVE-2024-47674.md): mm: avoid leaving partial pfn mappings around in error case (CVSS 7.8, Linux)
- [CVE-2024-49388](https://cve.now/CVE-2024-49388.md): Sensitive information manipulation due to improper authorization. (CVSS 3.1, Acronis Cyber Protect)
- [CVE-2024-49387](https://cve.now/CVE-2024-49387.md): Cleartext transmission of sensitive information in acep-collector service. (CVSS 5.4, Acronis Cyber Protect)
- [CVE-2024-49384](https://cve.now/CVE-2024-49384.md): Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. (CVSS 3.5, Acronis Cyber Protect)
- [CVE-2024-49383](https://cve.now/CVE-2024-49383.md): Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. (CVSS 3.5, Acronis Cyber Protect)
- [CVE-2024-49382](https://cve.now/CVE-2024-49382.md): Excessive attack surface in archive-server service due to binding to an unrestricted IP address. (CVSS 3.5, Acronis Cyber Protect)
- [CVE-2024-45276](https://cve.now/CVE-2024-45276.md): MB connect line/Helmholz: tmp directory exposed via webservice (CVSS 7.5, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-45275](https://cve.now/CVE-2024-45275.md): MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords (CVSS 9.8, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-45274](https://cve.now/CVE-2024-45274.md): MB connect line/Helmholz: Remote code execution via confnet service (CVSS 9.8, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-45273](https://cve.now/CVE-2024-45273.md): MB connect line/Helmholz: Weak encryption of configuration file (CVSS 8.4, MB connect line mbNET.mini · MB connect line mbNET/mbNET… +9)
- [CVE-2024-45272](https://cve.now/CVE-2024-45272.md): MB connect line/Helmholz: Generation of weak passwords vulnerability (CVSS 7.5, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2024-45271](https://cve.now/CVE-2024-45271.md): MB connect line/Helmholz: Remote code execution due to improper input validation (CVSS 8.4, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-47945](https://cve.now/CVE-2024-47945.md): Predictable Session ID (CVSS 9.1, RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit)
- [CVE-2024-9974](https://cve.now/CVE-2024-9974.md): SourceCodester Online Eyewear Shop POST Request Master.php sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9973](https://cve.now/CVE-2024-9973.md): SourceCodester Online Eyewear Shop Report Viewing Page page sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-47944](https://cve.now/CVE-2024-47944.md): Missing Protection Mechanism for Alternate Hardware Interface (CVSS 6.8, RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit)
- [CVE-2024-47943](https://cve.now/CVE-2024-47943.md): Improper signature verification of firmware upgrade files (CVSS 9.8, RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit)
- [CVE-2024-9925](https://cve.now/CVE-2024-9925.md): SQL injection in QPLANT by TAI Smart Factory (CVSS 9.8, TAI Smart Factory QPLANT SF)
- [CVE-2024-9895](https://cve.now/CVE-2024-9895.md): Smart Online Order for Clover \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo\_receipt\_link Shortcode (CVSS 6.4, elbanyaoui Smart Online Order for Clover)
- [CVE-2024-9985](https://cve.now/CVE-2024-9985.md): Ragic Enterprise Cloud Database - Arbitrary File Upload (CVSS 10.0, Ragic Enterprise Cloud Database)
- [CVE-2024-9984](https://cve.now/CVE-2024-9984.md): Ragic Enterprise Cloud Database - Missing Authentication (CVSS 9.8, Ragic Enterprise Cloud Database)
- [CVE-2024-9983](https://cve.now/CVE-2024-9983.md): Ragic Enterprise Cloud Database - Arbitrary File Read through Path Traversal (CVSS 7.5, Ragic Enterprise Cloud Database)
- [CVE-2024-9982](https://cve.now/CVE-2024-9982.md): ESi Technology AIM LINE Marketing Platform - SQL Injection (CVSS 9.8, ESi Technology AIM LINE Marketing Platform)
- [CVE-2024-9981](https://cve.now/CVE-2024-9981.md): FormosaSoft ee-class - Local File Inclusion (CVSS 8.8, FormosaSoft ee-class)
- [CVE-2024-9980](https://cve.now/CVE-2024-9980.md): FormosaSoft ee-class - SQL Injection (CVSS 8.8, FormosaSoft ee-class)
- [CVE-2024-9837](https://cve.now/CVE-2024-9837.md): AADMY – Add Auto Date Month Year Into Posts \<= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, numanrki AADMY – Add Auto Date Month Year Into Posts)
- [CVE-2024-9972](https://cve.now/CVE-2024-9972.md): ChanGate Property Management System - SQL Injection (CVSS 9.8, ChanGate Property Management System)
- [CVE-2024-46898](https://cve.now/CVE-2024-46898.md): SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. (CVSS 8.6, SHIRASAGI Project SHIRASAGI)
- [CVE-2024-0129](https://cve.now/CVE-2024-0129.md): NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file… (CVSS 6.3, NVIDIA NeMo)
- [CVE-2024-9944](https://cve.now/CVE-2024-9944.md): WooCommerce \<= 9.0.2 - Unauthenticated HTML Injection (CVSS 5.3, automattic WooCommerce)
- [CVE-2024-21535](https://cve.now/CVE-2024-21535.md): Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper… (CVSS 6.1, markdown-to-jsx)
- [CVE-2024-9971](https://cve.now/CVE-2024-9971.md): NewType FlowMaster BPM Plus - SQL Injection (CVSS 8.8, NewType FlowMaster BPM Plus)
- [CVE-2024-9970](https://cve.now/CVE-2024-9970.md): NewType FlowMaster BPM Plus - Privilege Escalation (CVSS 8.8, NewType FlowMaster BPM Plus)
- [CVE-2024-9969](https://cve.now/CVE-2024-9969.md): NewType WebEIP v3.0 - Reflected XSS (CVSS 5.4, NewType WebEIP)
- [CVE-2024-9968](https://cve.now/CVE-2024-9968.md): NewType WebEIP v3.0 - SQL injection (CVSS 8.8, NewType WebEIP)
- [CVE-2024-9820](https://cve.now/CVE-2024-9820.md): WP 2FA with Telegram \<= 3.0 - Two-Factor Authentication Bypass (CVSS 6.5, dueclic AuthPress)
- [CVE-2024-6757](https://cve.now/CVE-2024-6757.md): Elementor \<= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get\_image\_alt Function (CVSS 4.3, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2024-9687](https://cve.now/CVE-2024-9687.md): WP 2FA with Telegram \<= 3.0 - Authenticated (Subscriber+) Authentication Bypass (CVSS 8.8, dueclic AuthPress)
- [CVE-2024-9952](https://cve.now/CVE-2024-9952.md): SourceCodester Online Eyewear Shop Contact Information Page contact\_info cross site scripting (CVSS 5.1, SourceCodester Online Eyewear Shop)
- [CVE-2023-31493](https://cve.now/CVE-2023-31493.md): RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while… (CVSS 6.6)
- [CVE-2024-31955](https://cve.now/CVE-2024-31955.md): An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. (CVSS 4.9)
- [CVE-2024-35584](https://cve.now/CVE-2024-35584.md): SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in… (CVSS 8.8)
- [CVE-2024-41311](https://cve.now/CVE-2024-41311.md): In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can… (CVSS 8.1)
- [CVE-2024-41344](https://cve.now/CVE-2024-41344.md): A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate… (CVSS 7.5)
- [CVE-2024-44337](https://cve.now/CVE-2024-44337.md): The package \`github.com/gomarkdown/markdown\` is a Go library for parsing Markdown text and rendering as HTML. (CVSS 5.1, github.com/gomarkdown/markdown)
- [CVE-2024-44775](https://cve.now/CVE-2024-44775.md): kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. (CVSS 7.5)
- [CVE-2024-48278](https://cve.now/CVE-2024-48278.md): Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) via… (CVSS 5.5)
- [CVE-2024-48279](https://cve.now/CVE-2024-48279.md): A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. (CVSS 7.6)
- [CVE-2024-48280](https://cve.now/CVE-2024-48280.md): A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2… (CVSS 7.6)
- [CVE-2024-48282](https://cve.now/CVE-2024-48282.md): A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2… (CVSS 7.6)
- [CVE-2024-48283](https://cve.now/CVE-2024-48283.md): Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-result.php via the… (CVSS 9.8)
- [CVE-2024-48411](https://cve.now/CVE-2024-48411.md): itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email… (CVSS 9.8)
- [CVE-2024-48622](https://cve.now/CVE-2024-48622.md): A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via… (CVSS 6.6)
- [CVE-2024-48623](https://cve.now/CVE-2024-48623.md): In queue\\index.php of DomainMOD below v4.12.0, the list\_id and domain\_id parameters in the GET request can be exploited to cause a… (CVSS 5.3)
- [CVE-2024-48624](https://cve.now/CVE-2024-48624.md): In segments\\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site… (CVSS 5.3)
- [CVE-2024-48710](https://cve.now/CVE-2024-48710.md): In TP-Link TL-WDR7660 1.0, the wlanTimerRuleJsonToBin function handles the parameter string name without checking it, which can lead to… (CVSS 6.5)
- [CVE-2024-48712](https://cve.now/CVE-2024-48712.md): In TP-Link TL-WDR7660 1.0, the rtRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack… (CVSS 6.5)
- [CVE-2024-48713](https://cve.now/CVE-2024-48713.md): In TP-Link TL-WDR7660 1.0, the wacWhitelistJsonToBin function handles the parameter string name without checking it, which can lead to… (CVSS 6.5)
- [CVE-2024-48714](https://cve.now/CVE-2024-48714.md): In TP-Link TL-WDR7660 v1.0, the guestRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack… (CVSS 6.5)
- [CVE-2024-48779](https://cve.now/CVE-2024-48779.md): An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the… (CVSS 9.8)
- [CVE-2024-48781](https://cve.now/CVE-2024-48781.md): An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a… (CVSS 9.8)
- [CVE-2024-48782](https://cve.now/CVE-2024-48782.md): File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application… (CVSS 9.8)
- [CVE-2024-48783](https://cve.now/CVE-2024-48783.md): An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf… (CVSS 4.3)
- [CVE-2024-48948](https://cve.now/CVE-2024-48948.md): The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains… (CVSS 4.8, elliptic)
- [CVE-2024-49195](https://cve.now/CVE-2024-49195.md): Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-10-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.