# CVEs published 2024-10-02

91 CVEs were published on October 2, 2024: 9 critical, 21 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-47616](https://cve.now/CVE-2024-47616.md): Pomerium's service account access token may grant unintended access to databroker API (CVSS 6.8, pomerium · github.com/pomerium/pomerium)
- [CVE-2024-28888](https://cve.now/CVE-2024-28888.md): A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. (CVSS 8.8, Foxit Reader)
- [CVE-2024-47529](https://cve.now/CVE-2024-47529.md): OpenC3 COSMOS uses clear text storage of password/token (\`GHSL-2024-129\`) (CVSS 4.8, OpenC3 cosmos · openc3 +1)
- [CVE-2024-46977](https://cve.now/CVE-2024-46977.md): OpenC3 COSMOS allows a path traversal via screen controller (\`GHSL-2024-127\`) (CVSS 5.3, OpenC3 cosmos · openc3)
- [CVE-2024-43795](https://cve.now/CVE-2024-43795.md): OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (\`GHSL-2024-128\`) (CVSS 5.1, OpenC3 cosmos · openc3 +1)
- [CVE-2024-8733](https://cve.now/CVE-2024-8733.md): HP One Agent Software – Potential Privilege Escalation (CVSS 8.0, HP One Agent Software)
- [CVE-2024-9441](https://cve.now/CVE-2024-9441.md): Linear eMerge e3-Series Forgot Password Command Injection (CVSS 9.8, Linear eMerge e3-Series)
- [CVE-2024-9440](https://cve.now/CVE-2024-9440.md): Slim Select 2.0 createOption "text" XSS (CVSS 5.4, slim-select)
- [CVE-2024-20509](https://cve.now/CVE-2024-20509.md): A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un (CVSS 5.8, Cisco Meraki MX Firmware)
- [CVE-2024-20513](https://cve.now/CVE-2024-20513.md): A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un (CVSS 5.8, Cisco Meraki MX Firmware)
- [CVE-2024-20502](https://cve.now/CVE-2024-20502.md): A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un (CVSS 5.8, Cisco Meraki MX Firmware)
- [CVE-2024-20501](https://cve.now/CVE-2024-20501.md): Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could al (CVSS 8.6, Cisco Meraki MX Firmware)
- [CVE-2024-20499](https://cve.now/CVE-2024-20499.md): Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could al (CVSS 8.6, Cisco Meraki MX Firmware)
- [CVE-2024-20500](https://cve.now/CVE-2024-20500.md): A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an un (CVSS 5.8, Cisco Meraki MX Firmware)
- [CVE-2024-20498](https://cve.now/CVE-2024-20498.md): Multiple vulnerabilities in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could al (CVSS 8.6, Cisco Meraki MX Firmware)
- [CVE-2024-20524](https://cve.now/CVE-2024-20524.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities (CVSS 6.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20523](https://cve.now/CVE-2024-20523.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities (CVSS 6.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20522](https://cve.now/CVE-2024-20522.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20521](https://cve.now/CVE-2024-20521.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20520](https://cve.now/CVE-2024-20520.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20519](https://cve.now/CVE-2024-20519.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20518](https://cve.now/CVE-2024-20518.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Remote Command Execution Vulnerabilities (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20517](https://cve.now/CVE-2024-20517.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities (CVSS 6.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20516](https://cve.now/CVE-2024-20516.md): Cisco Small Business RV042, RV042G, RV320, and RV325 Denial of Service Vulnerabilities (CVSS 6.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20515](https://cve.now/CVE-2024-20515.md): Cisco Identity Services Engine Information Disclosure Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2024-20492](https://cve.now/CVE-2024-20492.md): Cisco Expressway Series Privilege Escalation Vulnerability (CVSS 6.0, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2024-20491](https://cve.now/CVE-2024-20491.md): Cisco Nexus Dashboard Insights Information Disclosure Vulnerability (CVSS 6.3, Cisco Nexus Dashboard Insights)
- [CVE-2024-20490](https://cve.now/CVE-2024-20490.md): Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure Vulnerability (CVSS 6.3, Cisco Data Center Network Manager · Cisco Nexus Dashboard O…)
- [CVE-2024-20477](https://cve.now/CVE-2024-20477.md): Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability (CVSS 5.4, Cisco Data Center Network Manager)
- [CVE-2024-20470](https://cve.now/CVE-2024-20470.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Remote Code Execution Vulnerability (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20449](https://cve.now/CVE-2024-20449.md): Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability (CVSS 8.8, Cisco Data Center Network Manager)
- [CVE-2024-20448](https://cve.now/CVE-2024-20448.md): Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability (CVSS 6.3, Cisco Data Center Network Manager)
- [CVE-2024-20444](https://cve.now/CVE-2024-20444.md): Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability (CVSS 5.5, Cisco Data Center Network Manager)
- [CVE-2024-20442](https://cve.now/CVE-2024-20442.md): Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability (CVSS 5.4, Cisco Nexus Dashboard)
- [CVE-2024-20441](https://cve.now/CVE-2024-20441.md): Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability (CVSS 5.7, Cisco Data Center Network Manager)
- [CVE-2024-20438](https://cve.now/CVE-2024-20438.md): Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability (CVSS 6.3, Cisco Data Center Network Manager)
- [CVE-2024-20432](https://cve.now/CVE-2024-20432.md): Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability (CVSS 9.9, Cisco Data Center Network Manager)
- [CVE-2024-20393](https://cve.now/CVE-2024-20393.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Privilege Escalation Vulnerability (CVSS 8.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20385](https://cve.now/CVE-2024-20385.md): Cisco Nexus Dashboard Orchestrator SSL Certificate Validation Vulnerability (CVSS 5.9, Cisco Nexus Dashboard Orchestrator)
- [CVE-2024-20365](https://cve.now/CVE-2024-20365.md): Cisco Integrated Management Controller Redfish Command Injection Vulnerability (CVSS 6.5, Cisco Unified Computing System)
- [CVE-2024-47807](https://cve.now/CVE-2024-47807.md): Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a\_1de8 and earlier does not check the \`iss\` (Issuer) claim of an ID Token, allowi (CVSS 8.1, Jenkins Project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2024-47806](https://cve.now/CVE-2024-47806.md): Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a\_1de8 and earlier does not check the \`aud\` (Audience) claim of an ID Token, allo (CVSS 8.1, Jenkins Project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2024-47805](https://cve.now/CVE-2024-47805.md): Jenkins Credentials Plugin 1380.va\_435002fa\_924 and earlier, except 1371.1373.v4eb\_fa\_b\_7161e9, does not redact encrypted values of credenti (CVSS 7.5, Jenkins Project Jenkins Credentials Plugin · org.jenkins-ci…)
- [CVE-2024-47804](https://cve.now/CVE-2024-47804.md): If an attempt is made to create an item of a type prohibited by \`ACL#hasCreatePermission2\` or \`TopLevelItemDescriptor#isApplicableIn(ItemGro (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2024-47803](https://cve.now/CVE-2024-47803.md): Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions (CVSS 4.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2024-9423](https://cve.now/CVE-2024-9423.md): Certain HP LaserJet Printers – Potential Denial of Service (CVSS 5.3, Certain HP LaserJet Printers)
- [CVE-2024-6360](https://cve.now/CVE-2024-6360.md): Incorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica. (CVSS 6.9, OpenText™ Vertica)
- [CVE-2024-44193](https://cve.now/CVE-2024-44193.md): A logic issue was addressed with improved restrictions. (CVSS 8.4, Apple iTunes for Windows)
- [CVE-2024-47612](https://cve.now/CVE-2024-47612.md): XSS in Special:DataDump when displaying dump status (CVSS 3.5, miraheze DataDump)
- [CVE-2024-47611](https://cve.now/CVE-2024-47611.md): XZ Utils on Microsoft Windows platform are vulnerable to argument injection (CVSS 6.3, tukaani-project xz)
- [CVE-2024-44097](https://cve.now/CVE-2024-44097.md): According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. (CVSS 9.8, Google Android)
- [CVE-2024-9429](https://cve.now/CVE-2024-9429.md): code-projects Restaurant Reservation System filter2.php sql injection (CVSS 5.3, code-projects Restaurant Reservation System)
- [CVE-2024-8885](https://cve.now/CVE-2024-8885.md): A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2024.2.0 and older allows writin (CVSS 8.8, Sophos Intercept X)
- [CVE-2024-8038](https://cve.now/CVE-2024-8038.md): Vulnerable juju introspection abstract UNIX domain socket. (CVSS 7.9, Canonical Juju · github.com/juju/juju)
- [CVE-2024-8037](https://cve.now/CVE-2024-8037.md): Vulnerable juju hook tool abstract UNIX domain socket. (CVSS 6.5, Canonical Juju · github.com/juju/juju)
- [CVE-2024-35294](https://cve.now/CVE-2024-35294.md): Schneider Elektronik Series 700 prone to missing authentication for traffic capture function (CVSS 6.5, Schneider Elektronik Series)
- [CVE-2024-7558](https://cve.now/CVE-2024-7558.md): JUJU\_CONTEXT\_ID is a predictable authentication secret. (CVSS 8.7, Canonical Juju · github.com/juju/juju)
- [CVE-2024-35293](https://cve.now/CVE-2024-35293.md): Schneider Elektronik Series 700 prone to missing authentication for critical reset function (CVSS 9.1, Schneider Elektronik Series)
- [CVE-2024-8505](https://cve.now/CVE-2024-8505.md): WordPress Infinite Scroll - Ajax Load More \<= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button\_label Parameter (CVSS 6.4, dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…)
- [CVE-2024-8282](https://cve.now/CVE-2024-8282.md): Ibtana – WordPress Website Builder \<= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute (CVSS 6.4, vowelweb Ibtana – WordPress Website Builder)
- [CVE-2024-44017](https://cve.now/CVE-2024-44017.md): WordPress MH Board plugin \<= 1.3.2.1 - Local File Inclusion vulnerability (CVSS 7.5, MinHyeong Lim MH Board)
- [CVE-2024-44030](https://cve.now/CVE-2024-44030.md): WordPress Checkout Mestres WP plugin \<= 8.6 - Local File Inclusion vulnerability (CVSS 7.2, Mestres do WP Checkout Mestres WP)
- [CVE-2024-9218](https://cve.now/CVE-2024-9218.md): Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid \<= 1.3.14 - Reflected Cross-Site Scripting (CVSS 6.1, wpblockart Magazine Blocks – Blog Designer, Magazine & News…)
- [CVE-2024-9378](https://cve.now/CVE-2024-9378.md): YML for Yandex Market \<= 4.7.2 - Reflected Cross-Site Scripting (CVSS 6.1, icopydoc YML for Yandex Market)
- [CVE-2024-9344](https://cve.now/CVE-2024-9344.md): BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript \<= 2.1.1 - Reflected Cross-Site Scripting (CVSS 6.1, BerqWP – Automated All-In-One Page Speed Optimization for C…)
- [CVE-2024-8800](https://cve.now/CVE-2024-8800.md): RabbitLoader – Website Speed Optimization for improving Core Web Vital metrics with Cache, Image Optimization, and more \<= 2.21.0 - Reflected Cross-Site Scripting (CVSS 6.1, sanrl RabbitLoader – AI Speed Optimization, Caching & CDN f…)
- [CVE-2024-9210](https://cve.now/CVE-2024-9210.md): MC4WP: Mailchimp Top Bar \<= 1.6.0 - Reflected Cross-Site Scripting (CVSS 6.1, dvankooten MC4WP: Mailchimp Top Bar)
- [CVE-2024-9222](https://cve.now/CVE-2024-9222.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.12.8 - Reflected Cross-Site Scripting (CVSS 6.1, cozmoslabs Paid Membership Subscriptions – Effortless Membe…)
- [CVE-2024-9225](https://cve.now/CVE-2024-9225.md): SEOPress – On-site SEO \<= 8.1.1 - Reflected Cross-Site Scripting (CVSS 6.1, rainbowgeek SEOPress – On-site SEO & Analytics)
- [CVE-2024-9172](https://cve.now/CVE-2024-9172.md): Demo Importer Plus \<= 2.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, kraftplugins Demo Importer Plus)
- [CVE-2024-8967](https://cve.now/CVE-2024-8967.md): PWA — easy way to Progressive Web App \<= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, iworks PWA — easy way to Progressive Web App)
- [CVE-2024-8254](https://cve.now/CVE-2024-8254.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-7315](https://cve.now/CVE-2024-7315.md): Migration, Backup, Staging – WPvivid \< 0.9.106 - Unauthenticated Sensitive Data Exposure (CVSS 7.5, Migration, Backup, Staging)
- [CVE-2024-9333](https://cve.now/CVE-2024-9333.md): Permission bypass in M-Files Connector for Copilot (CVSS 5.3, M-Files Connector for Copilot)
- [CVE-2024-9174](https://cve.now/CVE-2024-9174.md): Stored HTML Injection in Hubshare social module (CVSS 6.9, M-Files Hubshare)
- [CVE-2024-21530](https://cve.now/CVE-2024-21530.md): Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump funct (CVSS 4.5, cocoon)
- [CVE-2024-7855](https://cve.now/CVE-2024-7855.md): WP Hotel Booking \<= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, thimpress WP Hotel Booking)
- [CVE-2024-24116](https://cve.now/CVE-2024-24116.md): An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config\_menu.htm. (CVSS 9.8)
- [CVE-2024-24117](https://cve.now/CVE-2024-24117.md): Insecure Permissions vulnerability in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release (9736) allows a remote attacker to gain privileges via t (CVSS 9.8)
- [CVE-2024-24122](https://cve.now/CVE-2024-24122.md): A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp (CVSS 9.8)
- [CVE-2024-33209](https://cve.now/CVE-2024-33209.md): FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2024-33210](https://cve.now/CVE-2024-33210.md): A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. (CVSS 5.4)
- [CVE-2024-33662](https://cve.now/CVE-2024-33662.md): Portainer before 2.20.2 improperly uses an encryption algorithm in the AesEncrypt function. (CVSS 7.5, github.com/portainer/portainer)
- [CVE-2024-41290](https://cve.now/CVE-2024-41290.md): FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. (CVSS 8.1)
- [CVE-2024-45186](https://cve.now/CVE-2024-45186.md): FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials. (CVSS 9.8)
- [CVE-2024-45519](https://cve.now/CVE-2024-45519.md): The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10. (CVSS 10.0, KEV)
- [CVE-2024-45960](https://cve.now/CVE-2024-45960.md): Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. (CVSS 4.8, tribalsystems/zenario)
- [CVE-2024-45962](https://cve.now/CVE-2024-45962.md): October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. (CVSS 4.7, october/october)
- [CVE-2024-45964](https://cve.now/CVE-2024-45964.md): Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field. (CVSS 4.8, tribalsystems/zenario)
- [CVE-2024-45965](https://cve.now/CVE-2024-45965.md): Contao before 5.5.6 allows XSS via an SVG document. (CVSS 6.4, Contao)
- [CVE-2024-46626](https://cve.now/CVE-2024-46626.md): OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.