# CVEs published 2024-09-30

66 CVEs were published on September 30, 2024: 3 critical, 28 high. Days are UTC.

- [CVE-2024-9194](https://cve.now/CVE-2024-9194.md): SQL Injection in the Octopus Server REST API (CVSS 8.7, Linux and Microsoft Windows Octopus Server)
- [CVE-2024-45073](https://cve.now/CVE-2024-45073.md): IBM WebSphere Application Server cross-site scripting (CVSS 4.8, IBM WebSphere Application Server)
- [CVE-2024-7675](https://cve.now/CVE-2024-7675.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-7674](https://cve.now/CVE-2024-7674.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-7673](https://cve.now/CVE-2024-7673.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-7672](https://cve.now/CVE-2024-7672.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-7671](https://cve.now/CVE-2024-7671.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-7670](https://cve.now/CVE-2024-7670.md): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (CVSS 7.8, Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1)
- [CVE-2024-47536](https://cve.now/CVE-2024-47536.md): starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field (CVSS 4.8, StarCitizenTools mediawiki-skins-Citizen · starcitizentools…)
- [CVE-2024-9158](https://cve.now/CVE-2024-9158.md): XSS (CVSS 8.4, Tenable Nessus Network Monitor)
- [CVE-2024-46869](https://cve.now/CVE-2024-46869.md): Bluetooth: btintel\_pcie: Allocate memory for driver private data (CVSS 7.8, Linux)
- [CVE-2024-47067](https://cve.now/CVE-2024-47067.md): Alist Contains a Reflected Cross-Site Scripting Vulnerability (CVSS 5.1, alist-org alist · github.com/alist-org/alist/v3 +1)
- [CVE-2024-47532](https://cve.now/CVE-2024-47532.md): RestrictedPython information leakage via \`AttributeError.obj\` and the \`string\` module (CVSS 8.7, zopefoundation RestrictedPython · restrictedpython)
- [CVE-2024-47531](https://cve.now/CVE-2024-47531.md): Scout contains insufficient output escaping of attachment names (CVSS 4.6, Clinical-Genomics scout)
- [CVE-2024-47530](https://cve.now/CVE-2024-47530.md): Scout contains an Open Redirect on Login via \`next\` (CVSS 5.4, Clinical-Genomics scout)
- [CVE-2024-47178](https://cve.now/CVE-2024-47178.md): basic-auth-connect's callback uses time unsafe string comparison (CVSS 8.7, expressjs basic-auth-connect · basic-auth-connect)
- [CVE-2024-47172](https://cve.now/CVE-2024-47172.md): Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints (CVSS 5.4, cvat-ai cvat)
- [CVE-2024-47064](https://cve.now/CVE-2024-47064.md): Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints (CVSS 6.3, cvat-ai cvat)
- [CVE-2024-47063](https://cve.now/CVE-2024-47063.md): Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint (CVSS 6.2, cvat-ai cvat)
- [CVE-2024-45792](https://cve.now/CVE-2024-45792.md): MantisBT vulnerable to information disclosure with user profiles (CVSS 5.3, mantisbt · mantisbt/mantisbt)
- [CVE-2024-6051](https://cve.now/CVE-2024-6051.md): Cross Application Scripting in Redlink SDK (CVSS 4.3, Vercom S.A. Redlink SDK)
- [CVE-2024-47641](https://cve.now/CVE-2024-47641.md): WordPress Confetti Fall Animation plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Muhammad Shakeel Confetti Fall Animation)
- [CVE-2024-45772](https://cve.now/CVE-2024-45772.md): Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue (CVSS 5.1, Apache Software Foundation Apache Lucene Replicator · org.a…)
- [CVE-2024-6394](https://cve.now/CVE-2024-6394.md): Local File Inclusion in parisneo/lollms-webui (CVSS 7.5, parisneo/lollms-webui)
- [CVE-2024-8459](https://cve.now/CVE-2024-8459.md): PLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords (CVSS 7.2, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-42496](https://cve.now/CVE-2024-42496.md): Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. (CVSS 2.4, TECHNO SUPPORT COMPANY Smart-tab Android app)
- [CVE-2024-41999](https://cve.now/CVE-2024-41999.md): Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. (CVSS 6.8, TECHNO SUPPORT COMPANY Smart-tab Android app)
- [CVE-2024-8458](https://cve.now/CVE-2024-8458.md): PLANET Technology switch devices - Cross-site Request Forgery (CVSS 8.8, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8457](https://cve.now/CVE-2024-8457.md): PLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management (CVSS 4.8, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8456](https://cve.now/CVE-2024-8456.md): PLANET Technology switch devices - Missing Authentication for multiple HTTP routes (CVSS 9.8, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8455](https://cve.now/CVE-2024-8455.md): PLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords (CVSS 8.1, PLANET Technology GS-4210-24PL4C hardware · PLANET Techn… +1)
- [CVE-2024-8454](https://cve.now/CVE-2024-8454.md): PLANET Technology switch devices - Swctrl service DoS attack (CVSS 5.3, PLANET Technology GS-4210-24PL4C hardware · PLANET Techn… +1)
- [CVE-2024-8453](https://cve.now/CVE-2024-8453.md): PLANET Technology switch devices - Weak hash for users' passwords (CVSS 4.9, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-9329](https://cve.now/CVE-2024-9329.md): Glassfish redirect to untrusted site (CVSS 6.9, Eclipse Foundation Glassfish · org.glassfish.main.admin:res…)
- [CVE-2024-8452](https://cve.now/CVE-2024-8452.md): PLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials (CVSS 7.5, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8451](https://cve.now/CVE-2024-8451.md): PLANET Technology switch devices - SSH server DoS attack (CVSS 7.5, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8450](https://cve.now/CVE-2024-8450.md): PLANET Technology switch devices - Hard-coded SNMPv1 read-write community string (CVSS 8.6, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8449](https://cve.now/CVE-2024-8449.md): PLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials (CVSS 6.8, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8448](https://cve.now/CVE-2024-8448.md): PLANET Technology switch devices - Remote privilege escalation using hard-coded credentials (CVSS 8.8, PLANET Technology GS-4210-24PL4C hardware · PLANET Technolo…)
- [CVE-2024-8536](https://cve.now/CVE-2024-8536.md): Ultimate Blocks \< 3.2.2 - Contributor+ Stored XSS (CVSS 5.4, Ultimate Blocks)
- [CVE-2024-8379](https://cve.now/CVE-2024-8379.md): Cost Calculator Builder \< 3.2.29 - Admin+ SQL Injection (CVSS 7.2, Cost Calculator Builder)
- [CVE-2024-8283](https://cve.now/CVE-2024-8283.md): Slider by 10Web \< 1.2.59 - Admin+ Stored XSS (CVSS 4.8, Slider by 10Web)
- [CVE-2024-8239](https://cve.now/CVE-2024-8239.md): Starbox \< 3.5.3 - Contributor+ Stored XSS (CVSS 5.4, Starbox)
- [CVE-2024-3635](https://cve.now/CVE-2024-3635.md): The Post Grid \< 7.5.0 - Editor+ Stored XSS via Grid Creation (CVSS 4.8, The Post Grid)
- [CVE-2024-28807](https://cve.now/CVE-2024-28807.md): An issue was discovered in Infinera hiT 7300 5.60.50. (CVSS 6.5)
- [CVE-2024-28808](https://cve.now/CVE-2024-28808.md): An issue was discovered in Infinera hiT 7300 5.60.50. (CVSS 2.7)
- [CVE-2024-28809](https://cve.now/CVE-2024-28809.md): An issue was discovered in Infinera hiT 7300 5.60.50. (CVSS 8.8)
- [CVE-2024-28810](https://cve.now/CVE-2024-28810.md): An issue was discovered in Infinera hiT 7300 5.60.50. (CVSS 6.6)
- [CVE-2024-28811](https://cve.now/CVE-2024-28811.md): An issue was discovered in Infinera hiT 7300 5.60.50. (CVSS 3.3)
- [CVE-2024-28812](https://cve.now/CVE-2024-28812.md): An issue was discovered in Infinera hiT 7300 5.60.50. (CVSS 8.8)
- [CVE-2024-28813](https://cve.now/CVE-2024-28813.md): An issue was discovered in Infinera hiT 7300 5.60.50. (CVSS 8.4)
- [CVE-2024-35495](https://cve.now/CVE-2024-35495.md): An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 Build 220930 Rel.14394 (CVSS 4.3)
- [CVE-2024-42017](https://cve.now/CVE-2024-42017.md): An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. (CVSS 10.0)
- [CVE-2024-45200](https://cve.now/CVE-2024-45200.md): In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based (CVSS 6.3)
- [CVE-2024-45920](https://cve.now/CVE-2024-45920.md): A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application (CVSS 5.4)
- [CVE-2024-45993](https://cve.now/CVE-2024-45993.md): Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb. (CVSS 6.5)
- [CVE-2024-46280](https://cve.now/CVE-2024-46280.md): PIX-LINK LV-WR22 RE3002-P1-01\_V117.0 is vulnerable to Improper Access Control. (CVSS 8.8)
- [CVE-2024-46293](https://cve.now/CVE-2024-46293.md): Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2024-46313](https://cve.now/CVE-2024-46313.md): TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm. (CVSS 8.0)
- [CVE-2024-46475](https://cve.now/CVE-2024-46475.md): A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows attackers to execute a (CVSS 4.8)
- [CVE-2024-46510](https://cve.now/CVE-2024-46510.md): ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface (CVSS 7.6)
- [CVE-2024-46511](https://cve.now/CVE-2024-46511.md): LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitr (CVSS 7.5)
- [CVE-2024-46540](https://cve.now/CVE-2024-46540.md): A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attackers to use remote fil (CVSS 6.3)
- [CVE-2024-46548](https://cve.now/CVE-2024-46548.md): TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communicati (CVSS 6.3)
- [CVE-2024-46549](https://cve.now/CVE-2024-46549.md): An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating (CVSS 7.6)
- [CVE-2024-46635](https://cve.now/CVE-2024-46635.md): An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access sensitive information (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.