CVEs published October 1, 2024
110 CVEs were published on October 1, 2024: 9 critical, 38 high.
- Published
- 110
- Critical
- 9
- High
- 38
- Medium
- 61
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 11
- librenms · librenms/librenms
- 6
- code-projects Restaurant Reservation System
- 2
- elabftw
- 2
- logoninc KB Support – Customer Support Ticket & Helpdesk Pl…
- 2
- Mozilla Firefox
- 2
- xunhuweb Wechat Social login 微信QQ钉钉登录插件
- 2
- 123.chat - Video Chat
- 1
- adreastrian Guten Post Layout – An Advanced Post Grid Colle…
- 1
- automatic-rock SVG Complete
- 1
Critical 9
- CVE-2024-9402Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-9401Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-9392A compromised content process could have allowed for the arbitrary loading of cross-origin pages.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-9289WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege EscalationRedefiningTheWeb WordPress & WooCommerce Affiliate Program
- CVE-2024-9265Echo RSS Feed Post Generator <= 5.4.6 - Unauthenticated Privilege EscalationCodeRevolution Echo RSS Feed Post Generator
- CVE-2024-9106Wechat Social login <= 1.3.0 - Authentication Bypassxunhuweb Wechat Social login 微信QQ钉钉登录插件
- CVE-2024-9108Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Uploadxunhuweb Wechat Social login 微信QQ钉钉登录插件
- CVE-2024-25660The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unautho
- CVE-2024-41276A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism.
High 38
- CVE-2024-47523LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" featurelibrenms · librenms/librenms
- CVE-2024-47524LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Namelibrenms · librenms/librenms
- CVE-2024-47525Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.phplibrenms · librenms/librenms
- CVE-2024-47527LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.phplibrenms · librenms/librenms
- CVE-2024-47604XSS vulnerability in NuGetGallery HTML attributes handlingNuGetGallery
- CVE-2024-47534Incorrect delegation lookups can make go-tuf download the wrong artifacttheupdateframework go-tuf · github.com/theupdateframework/g…
- CVE-2024-9403Memory safety bugs present in Firefox 130.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-9400A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-9399A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service conMozilla Firefox · Mozilla Thunderbird
- CVE-2024-9396It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to mMozilla Firefox · Mozilla Thunderbird
- CVE-2024-9393An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-41673Decidim has a cross-site scripting vulnerability in the version control pagedecidim
- CVE-2024-45408eLabFTW contains a direct and indirect information disclosureelabftw
- CVE-2024-25632Unauthorised granting of administrator privileges over arbitrary teams under certain circumstanceselabftw
- CVE-2024-9018WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameterhahncgdev WP Easy Gallery – WordPress Gallery Plugin
- CVE-2024-7434UltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injectionultrapressorg UltraPress
- CVE-2024-8548KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actionslogoninc KB Support – Customer Support Ticket & Helpdesk Pl…
- CVE-2024-7433Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injectionultrapressorg Empowerment
- CVE-2024-7869123.chat - Video Chat <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting123.chat - Video Chat
- CVE-2024-7432Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injectionultrapressorg Unseen Blog
- CVE-2024-9145Local command injection in Wiz Code Visual Studio Code extensionWiz Code Visual Studio Code extension
- CVE-2024-21489Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the uplot · org.webjars.npm:uplot
- CVE-2024-47295Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary passworSEIKO EPSON Web Config
- CVE-2024-8981Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scriptingwpmudev Broken Link Checker
- CVE-2024-47560RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability.J’s Communication Co. RevoWorks Cloud Client
- CVE-2024-25659In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux serve
- CVE-2024-25661In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop applicat
- CVE-2024-42514A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to
- CVE-2024-46080Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_zip function.
- CVE-2024-46084Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.
- CVE-2024-46258cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_load_png_mem() function at cute_png.h.
- CVE-2024-46259cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_unfilter() function at cute_png.h.
- CVE-2024-46261cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_make32() function at cute_png.h.
- CVE-2024-46263cute_png v1.05 was discovered to contain a stack overflow via the cp_dynamic() function at cute_png.h.
- CVE-2024-46264cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_find() function at cute_png.h.
- CVE-2024-46267cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_block() function at cute_png.h.
- CVE-2024-46274cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_stored() function at cute_png.h.
- CVE-2024-46276cute_png v1.05 was discovered to contain a heap buffer overflow via the cp_chunk() function at cute_png.h.
Medium, low and unrated 63
- CVE-2024-47526LibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.phplibrenms · librenms/librenms
- CVE-2024-47528LibreNMS Contains a Stored XSS via File Uploadlibrenms · librenms/librenms
- CVE-2024-47609Remotely exploitable DoS in Tonic `<=v0.12.2`hyperium tonic · tonic
- CVE-2024-9407Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instructionpodman · buildah +8
- CVE-2024-9411OFCMS add.json add cross site scriptingOFCMS
- CVE-2024-9341Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go librarygithub.com/containers/common · Red Hat Enterprise Linux +1
- CVE-2024-9355Golang-fips: golang fips zeroed buffergithub.com/golang-fips/openssl · Red Hat Enterprise Lin… +20
- CVE-2024-47608Logicytics vulnerable to shell injectionsDefinetlyNotAI Logicytics
- CVE-2024-47071OSS Endpoint Manager allows unauthorized access to read system filesFreePBX endpointman
- CVE-2024-9395A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog.Mozilla Firefox
- CVE-2024-9391A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode.Mozilla Firefox
- CVE-2024-9398By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application whiMozilla Firefox · Mozilla Thunderbird
- CVE-2024-9397A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjackingMozilla Firefox · Mozilla Thunderbird
- CVE-2024-9394An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-7273Cross Site Request Forgery in Kiteworks OwnCloudKiteworks OwnCloud
- CVE-2024-30132Missing default HTTP security headers affect HCL Nomad server on DominoHCL Software Nomad server on Domino
- CVE-2024-9405An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18.Pluck CMS
- CVE-2023-3441Exposure of Sensitive Information Due to Incompatible Policies in GitLabGitLab
- CVE-2024-9060AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadgrandplugins AVIF Uploader
- CVE-2024-9118QS Dark Mode Plugin <= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadquomodosoft QS Dark Mode Plugin
- CVE-2024-8430Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Importspicethemes Spice Starter Sites
- CVE-2024-8324XO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingishitaka XO Slider
- CVE-2024-8786Auto Featured Image from Title <= 2.3 - Reflected Cross-Site Scriptingbrochris Auto Featured Image from Title
- CVE-2024-9220LH Copy Media File <= 1.08 - Reflected Cross-Site Scriptingshawfactor LH Copy Media File
- CVE-2024-8793Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scriptingjkohlbach Store Exporter – Export WooCommerce Products, Ord…
- CVE-2024-8288Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attributeadreastrian Guten Post Layout – An Advanced Post Grid Colle…
- CVE-2024-9228Loggedin – Limit Active Logins <= 1.3.1 - Reflected Cross-Site Scriptingjoelcj91 Loggedin – Limit Concurrent Sessions
- CVE-2024-8799Custom Banners <= 3.3 - Reflected Cross-Site Scriptingghuger Custom Banners
- CVE-2024-9224Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Readkau-boy Hello World
- CVE-2024-9209WP Search Analytics <= 1.4.10 - Reflected Cross-Site Scriptingcornelraiu-1 Search Analytics for WP
- CVE-2024-9241PDF Image Generator <= 1.5.6 - Reflected Cross-Site Scriptingfishpie PDF Image Generator
- CVE-2024-8728Easy Load More <= 1.0.3 - Reflected Cross-Site Scriptingbrianbrey Easy Load More
- CVE-2024-8727DK PDF <= 1.9.6 - Reflected Cross-Site Scriptingtorstenbulk DK PDF – WordPress PDF Generator
- CVE-2024-9267Easy WordPress Subscribe – Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameteroptinhound Easy WordPress Subscribe – Optin Hound
- CVE-2024-8989Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcodepremio Stars Testimonials — Responsive Reviews & Star Ratin…
- CVE-2024-8675Soumettre.fr <= 2.1.3 - Missing AuthorizationSoumettre.fr
- CVE-2024-9304LocateAndFilter <= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploaddgamoni LocateAndFilter
- CVE-2024-8990Geo Mashup <= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcodecyberhobo Geo Mashup
- CVE-2024-8632KB Support – WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposurelogoninc KB Support – Customer Support Ticket & Helpdesk Pl…
- CVE-2024-9272R Animated Icon Plugin <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmascotdevelopers R Animated Icon Plugin
- CVE-2024-8720RumbleTalk Live Group Chat – HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingRumbleTalk Live Group Chat – HTML5
- CVE-2024-8718Gravity Forms Toolbar <= 1.7.0 - Reflected Cross-Site Scriptingdaveshine Gravity Forms Toolbar
- CVE-2024-9274Elastik Page Builder <= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadazexo Elastik Page Builder
- CVE-2024-9269Relogo <= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadcconover Relogo
- CVE-2024-9119SVG Complete <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadautomatic-rock SVG Complete
- CVE-2024-8107Slider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadRevolution Slider Slider Revolution
- CVE-2024-21531All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the progit-shallow-clone
- CVE-2024-0116NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory regiNVIDIA Triton Inference Server
- CVE-2024-9360code-projects Restaurant Reservation System updatebal.php sql injectioncode-projects Restaurant Reservation System
- CVE-2024-9359code-projects Restaurant Reservation System addcompany.php sql injectioncode-projects Restaurant Reservation System
- CVE-2024-47396WordPress Move Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilitymoveaddons Move Addons for Elementor
- CVE-2024-9358ThingsBoard HTTP RPC API resource consumptionThingsBoard
- CVE-2021-37577Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specificatio
- CVE-2024-25658Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the da
- CVE-2024-31835Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload
- CVE-2024-44610PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters i
- CVE-2024-44744An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecifie
- CVE-2024-45967Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.pagekit/pagekit
- CVE-2024-45999A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get_station_info()function located in the file /app
- CVE-2024-46079Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj_new.php via the Descricao parameter.
- CVE-2024-46081Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-46082Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm_cor.php via the form and field parameters.
- CVE-2024-46083Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS).