CVEs published September 30, 2024
66 CVEs were published on September 30, 2024: 3 critical, 28 high.
- Published
- 66
- Critical
- 3
- High
- 28
- Medium
- 32
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- 10
- Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- 6
- cvat-ai cvat
- 3
- Clinical-Genomics scout
- 2
- PLANET Technology GS-4210-24PL4C hardware · PLANET Techn… +1
- 2
- TECHNO SUPPORT COMPANY Smart-tab Android app
- 2
- alist-org alist · github.com/alist-org/alist/v3 +1
- 1
- Apache Software Foundation Apache Lucene Replicator · org.a…
- 1
- Cost Calculator Builder
- 1
- Eclipse Foundation Glassfish · org.glassfish.main.admin:res…
- 1
Critical 3
- CVE-2024-8456PLANET Technology switch devices - Missing Authentication for multiple HTTP routesPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-42017An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11.
- CVE-2024-46293Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control.
High 28
- CVE-2024-9194SQL Injection in the Octopus Server REST APILinux and Microsoft Windows Octopus Server
- CVE-2024-7675DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-7674DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-7673DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-7672DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-7671DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-7670DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop SoftwareAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2024-9158XSSTenable Nessus Network Monitor
- CVE-2024-46869Bluetooth: btintel_pcie: Allocate memory for driver private dataLinux
- CVE-2024-47532RestrictedPython information leakage via `AttributeError.obj` and the `string` modulezopefoundation RestrictedPython · restrictedpython
- CVE-2024-47178basic-auth-connect's callback uses time unsafe string comparisonexpressjs basic-auth-connect · basic-auth-connect
- CVE-2024-6394Local File Inclusion in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-8459PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwordsPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8458PLANET Technology switch devices - Cross-site Request ForgeryPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8455PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwordsPLANET Technology GS-4210-24PL4C hardware · PLANET Techn… +1
- CVE-2024-8452PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentialsPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8451PLANET Technology switch devices - SSH server DoS attackPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8450PLANET Technology switch devices - Hard-coded SNMPv1 read-write community stringPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8448PLANET Technology switch devices - Remote privilege escalation using hard-coded credentialsPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8379Cost Calculator Builder < 3.2.29 - Admin+ SQL InjectionCost Calculator Builder
- CVE-2024-28809An issue was discovered in Infinera hiT 7300 5.60.50.
- CVE-2024-28812An issue was discovered in Infinera hiT 7300 5.60.50.
- CVE-2024-28813An issue was discovered in Infinera hiT 7300 5.60.50.
- CVE-2024-46280PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control.
- CVE-2024-46313TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm.
- CVE-2024-46510ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface
- CVE-2024-46511LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitr
- CVE-2024-46549An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating
Medium, low and unrated 35
- CVE-2024-45073IBM WebSphere Application Server cross-site scriptingIBM WebSphere Application Server
- CVE-2024-47536starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldStarCitizenTools mediawiki-skins-Citizen · starcitizentools…
- CVE-2024-47067Alist Contains a Reflected Cross-Site Scripting Vulnerabilityalist-org alist · github.com/alist-org/alist/v3 +1
- CVE-2024-47531Scout contains insufficient output escaping of attachment namesClinical-Genomics scout
- CVE-2024-47530Scout contains an Open Redirect on Login via `next`Clinical-Genomics scout
- CVE-2024-47172Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpointscvat-ai cvat
- CVE-2024-47064Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpointscvat-ai cvat
- CVE-2024-47063Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpointcvat-ai cvat
- CVE-2024-45792MantisBT vulnerable to information disclosure with user profilesmantisbt · mantisbt/mantisbt
- CVE-2024-6051Cross Application Scripting in Redlink SDKVercom S.A. Redlink SDK
- CVE-2024-47641WordPress Confetti Fall Animation plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityMuhammad Shakeel Confetti Fall Animation
- CVE-2024-45772Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization IssueApache Software Foundation Apache Lucene Replicator · org.a…
- CVE-2024-42496Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password.TECHNO SUPPORT COMPANY Smart-tab Android app
- CVE-2024-41999Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability.TECHNO SUPPORT COMPANY Smart-tab Android app
- CVE-2024-8457PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User ManagementPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8454PLANET Technology switch devices - Swctrl service DoS attackPLANET Technology GS-4210-24PL4C hardware · PLANET Techn… +1
- CVE-2024-8453PLANET Technology switch devices - Weak hash for users' passwordsPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-9329Glassfish redirect to untrusted siteEclipse Foundation Glassfish · org.glassfish.main.admin:res…
- CVE-2024-8449PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentialsPLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…
- CVE-2024-8536Ultimate Blocks < 3.2.2 - Contributor+ Stored XSSUltimate Blocks
- CVE-2024-8283Slider by 10Web < 1.2.59 - Admin+ Stored XSSSlider by 10Web
- CVE-2024-8239Starbox < 3.5.3 - Contributor+ Stored XSSStarbox
- CVE-2024-3635The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid CreationThe Post Grid
- CVE-2024-28807An issue was discovered in Infinera hiT 7300 5.60.50.
- CVE-2024-28808An issue was discovered in Infinera hiT 7300 5.60.50.
- CVE-2024-28810An issue was discovered in Infinera hiT 7300 5.60.50.
- CVE-2024-28811An issue was discovered in Infinera hiT 7300 5.60.50.
- CVE-2024-35495An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.14394
- CVE-2024-45200In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based
- CVE-2024-45920A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application
- CVE-2024-45993Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.
- CVE-2024-46475A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute a
- CVE-2024-46540A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote fil
- CVE-2024-46548TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communicati
- CVE-2024-46635An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information