CVEs published October 2, 2024
91 CVEs were published on October 2, 2024: 9 critical, 21 high. 1 is now in CISA KEV.
- Published
- 91
- Critical
- 9
- High
- 21
- Medium
- 60
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 22
Most affected products
- Cisco Small Business RV Series Router Firmware
- 11
- Cisco Data Center Network Manager
- 7
- Cisco Meraki MX Firmware
- 7
- Canonical Juju · github.com/juju/juju
- 3
- Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- Jenkins Project Jenkins OpenId Connect Authentication Plugi…
- 2
- OpenC3 cosmos · openc3 +1
- 2
- Schneider Elektronik Series
- 2
- tribalsystems/zenario
- 2
- Apple iTunes for Windows
- 1
Critical 9
- CVE-2024-9441Linear eMerge e3-Series Forgot Password Command InjectionLinear eMerge e3-Series
- CVE-2024-20432Cisco Nexus Dashboard Fabric Controller Web UI Command Injection VulnerabilityCisco Data Center Network Manager
- CVE-2024-44097According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping.Google Android
- CVE-2024-35293Schneider Elektronik Series 700 prone to missing authentication for critical reset functionSchneider Elektronik Series
- CVE-2024-24116An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.
- CVE-2024-24117Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via t
- CVE-2024-24122A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp
- CVE-2024-45186FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials.
- CVE-2024-45519The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.
High 21
- CVE-2024-28888A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object.Foxit Reader
- CVE-2024-8733HP One Agent Software – Potential Privilege EscalationHP One Agent Software
- CVE-2024-20501Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could alCisco Meraki MX Firmware
- CVE-2024-20499Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could alCisco Meraki MX Firmware
- CVE-2024-20498Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could alCisco Meraki MX Firmware
- CVE-2024-20449Cisco Nexus Dashboard Fabric Controller Remote Code Execution VulnerabilityCisco Data Center Network Manager
- CVE-2024-20393Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Privilege Escalation VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2024-47807Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `iss` (Issuer) claim of an ID Token, allowiJenkins Project Jenkins OpenId Connect Authentication Plugi…
- CVE-2024-47806Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the `aud` (Audience) claim of an ID Token, alloJenkins Project Jenkins OpenId Connect Authentication Plugi…
- CVE-2024-47805Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentiJenkins Project Jenkins Credentials Plugin · org.jenkins-ci…
- CVE-2024-44193A logic issue was addressed with improved restrictions.Apple iTunes for Windows
- CVE-2024-8885A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writinSophos Intercept X
- CVE-2024-8038Vulnerable juju introspection abstract UNIX domain socket.Canonical Juju · github.com/juju/juju
- CVE-2024-7558JUJU_CONTEXT_ID is a predictable authentication secret.Canonical Juju · github.com/juju/juju
- CVE-2024-44017WordPress MH Board plugin <= 1.3.2.1 - Local File Inclusion vulnerabilityMinHyeong Lim MH Board
- CVE-2024-44030WordPress Checkout Mestres WP plugin <= 8.6 - Local File Inclusion vulnerabilityMestres do WP Checkout Mestres WP
- CVE-2024-7315Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data ExposureMigration, Backup, Staging
- CVE-2024-7855WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Uploadthimpress WP Hotel Booking
- CVE-2024-33662Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function.github.com/portainer/portainer
- CVE-2024-41290FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
- CVE-2024-46626OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.
Medium, low and unrated 61
- CVE-2024-47616Pomerium's service account access token may grant unintended access to databroker APIpomerium · github.com/pomerium/pomerium
- CVE-2024-47529OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)OpenC3 cosmos · openc3 +1
- CVE-2024-46977OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)OpenC3 cosmos · openc3
- CVE-2024-43795OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)OpenC3 cosmos · openc3 +1
- CVE-2024-9440Slim Select 2.0 createOption "text" XSSslim-select
- CVE-2024-20509A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unCisco Meraki MX Firmware
- CVE-2024-20513A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unCisco Meraki MX Firmware
- CVE-2024-20502A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unCisco Meraki MX Firmware
- CVE-2024-20500A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unCisco Meraki MX Firmware
- CVE-2024-20524Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20523Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20522Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20521Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20520Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20519Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20518Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20517Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20516Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service VulnerabilitiesCisco Small Business RV Series Router Firmware
- CVE-2024-20515Cisco Identity Services Engine Information Disclosure VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20492Cisco Expressway Series Privilege Escalation VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2024-20491Cisco Nexus Dashboard Insights Information Disclosure VulnerabilityCisco Nexus Dashboard Insights
- CVE-2024-20490Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure VulnerabilityCisco Data Center Network Manager · Cisco Nexus Dashboard O…
- CVE-2024-20477Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint VulnerabilityCisco Data Center Network Manager
- CVE-2024-20470Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Remote Code Execution VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2024-20448Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure VulnerabilityCisco Data Center Network Manager
- CVE-2024-20444Cisco Nexus Dashboard Fabric Controller REST API Command Injection VulnerabilityCisco Data Center Network Manager
- CVE-2024-20442Cisco Nexus Dashboard Unauthorized API Endpoints VulnerabilityCisco Nexus Dashboard
- CVE-2024-20441Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint VulnerabilityCisco Data Center Network Manager
- CVE-2024-20438Cisco Nexus Dashboard Fabric Controller Unauthorized REST API VulnerabilityCisco Data Center Network Manager
- CVE-2024-20385Cisco Nexus Dashboard Orchestrator SSL Certificate Validation VulnerabilityCisco Nexus Dashboard Orchestrator
- CVE-2024-20365Cisco Integrated Management Controller Redfish Command Injection VulnerabilityCisco Unified Computing System
- CVE-2024-47804If an attempt is made to create an item of a type prohibited by `ACL#hasCreatePermission2` or `TopLevelItemDescriptor#isApplicableIn(ItemGroJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2024-47803Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissionsJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2024-9423Certain HP LaserJet Printers – Potential Denial of ServiceCertain HP LaserJet Printers
- CVE-2024-6360Incorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica.OpenText™ Vertica
- CVE-2024-47612XSS in Special:DataDump when displaying dump statusmiraheze DataDump
- CVE-2024-47611XZ Utils on Microsoft Windows platform are vulnerable to argument injectiontukaani-project xz
- CVE-2024-9429code-projects Restaurant Reservation System filter2.php sql injectioncode-projects Restaurant Reservation System
- CVE-2024-8037Vulnerable juju hook tool abstract UNIX domain socket.Canonical Juju · github.com/juju/juju
- CVE-2024-35294Schneider Elektronik Series 700 prone to missing authentication for traffic capture functionSchneider Elektronik Series
- CVE-2024-8505WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameterdcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…
- CVE-2024-8282Ibtana – WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attributevowelweb Ibtana – WordPress Website Builder
- CVE-2024-9218Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.3.14 - Reflected Cross-Site Scriptingwpblockart Magazine Blocks – Blog Designer, Magazine & News…
- CVE-2024-9378YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scriptingicopydoc YML for Yandex Market
- CVE-2024-9344BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site ScriptingBerqWP – Automated All-In-One Page Speed Optimization for C…
- CVE-2024-8800RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more <= 2.21.0 - Reflected Cross-Site Scriptingsanrl RabbitLoader – AI Speed Optimization, Caching & CDN f…
- CVE-2024-9210MC4WP: Mailchimp Top Bar <= 1.6.0 - Reflected Cross-Site Scriptingdvankooten MC4WP: Mailchimp Top Bar
- CVE-2024-9222Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scriptingcozmoslabs Paid Membership Subscriptions – Effortless Membe…
- CVE-2024-9225SEOPress – On-site SEO <= 8.1.1 - Reflected Cross-Site Scriptingrainbowgeek SEOPress – On-site SEO & Analytics
- CVE-2024-9172Demo Importer Plus <= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadkraftplugins Demo Importer Plus
- CVE-2024-8967PWA — easy way to Progressive Web App <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadiworks PWA — easy way to Progressive Web App
- CVE-2024-8254Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Executionicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2024-9333Permission bypass in M-Files Connector for CopilotM-Files Connector for Copilot
- CVE-2024-9174Stored HTML Injection in Hubshare social moduleM-Files Hubshare
- CVE-2024-21530Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functcocoon
- CVE-2024-33209FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-33210A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.
- CVE-2024-45960Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system.tribalsystems/zenario
- CVE-2024-45962October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system.october/october
- CVE-2024-45964Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.tribalsystems/zenario
- CVE-2024-45965Contao before 5.5.6 allows XSS via an SVG document.Contao