CVEs published October 3, 2024
58 CVEs were published on October 3, 2024: 6 critical, 25 high.
- Published
- 58
- Critical
- 6
- High
- 25
- Medium
- 21
- Low
- 3
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- JTEKT ELECTRONICS Kostac PLC Programming Software
- 3
- NVIDIA CUDA Toolkit
- 3
- Veertu Anka Build
- 3
- Webroot SecureAnywhere - Web Shield
- 3
- Apple iOS and iPadOS
- 2
- Delta Electronics DIAEnergie
- 2
- GNOME Project G Structured File Library
- 2
- Optigo Networks ONS-S8 Spectra Aggregation Switch
- 2
- sulu · sulu/sulu
- 2
- TEM Opera Plus FM Family Transmitter
- 2
Critical 6
- CVE-2024-43699Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2024-45367Optigo Networks ONS-S8 Spectra Aggregation Switch Weak AuthenticationOptigo Networks ONS-S8 Spectra Aggregation Switch
- CVE-2024-41925Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File InclusionOptigo Networks ONS-S8 Spectra Aggregation Switch
- CVE-2024-41988Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family TransmitterTEM Opera Plus FM Family Transmitter
- CVE-2024-47561Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)Apache Software Foundation Apache Avro Java SDK · org.apach…
- CVE-2024-41593DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte
High 25
- CVE-2024-42417Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2024-41987Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family TransmitterTEM Opera Plus FM Family Transmitter
- CVE-2024-25590Crafted responses can lead to a denial of service due to cache inefficiencies in the RecursorPowerDNS Recursor
- CVE-2024-42415An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured FiGNOME Project G Structured File Library
- CVE-2024-36474An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library (GNOME Project G Structured File Library
- CVE-2024-41163A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0.Veertu Anka Build
- CVE-2024-39755A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0.Veertu Anka Build
- CVE-2024-41922A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0.Veertu Anka Build
- CVE-2024-47614async-graphql vulnerable to Directive Overloadasync-graphql
- CVE-2024-5803Local privelage escalation via COM hijackingAVG/Avast Antivirus
- CVE-2024-9313Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform anCanonical Authd · github.com/ubuntu/authd
- CVE-2024-8352Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Downloaddejanmarkovic Social Web Suite – Social Media Auto Post, So…
- CVE-2024-47136Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 andJTEKT ELECTRONICS Kostac PLC Programming Software
- CVE-2024-47135Stack-based buffer overflow vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6JTEKT ELECTRONICS Kostac PLC Programming Software
- CVE-2024-47134Out-of-bounds write vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 anJTEKT ELECTRONICS Kostac PLC Programming Software
- CVE-2023-37822The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the
- CVE-2024-41586A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code v
- CVE-2024-41588The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated
- CVE-2024-41589DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests.
- CVE-2024-41590Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed th
- CVE-2024-41592DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extr
- CVE-2024-41594An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigo
- CVE-2024-41595DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of m
- CVE-2024-41596Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval
- CVE-2024-46658Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.
Medium, low and unrated 27
- CVE-2024-44207This issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2024-44204A logic issue was addressed with improved validation.Apple iOS and iPadOS
- CVE-2024-9266Open Redirectexpressjs express · express
- CVE-2024-47762Unexpected visibility of environment variable configurations in @backstage/plugin-app-backendbackstage · @backstage/plugin-app-backend
- CVE-2024-7824Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dumpWebroot SecureAnywhere - Web Shield
- CVE-2024-7825Type confusion that can cause the WRSA.exe service to crash and generate a crash dumpWebroot SecureAnywhere - Web Shield
- CVE-2024-7826Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dumpWebroot SecureAnywhere - Web Shield
- CVE-2024-0125NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause a NULL pointer dNVIDIA CUDA Toolkit
- CVE-2024-0124NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause nvdisasm to readNVIDIA CUDA Toolkit
- CVE-2024-0123NVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker may cause an improperNVIDIA CUDA Toolkit
- CVE-2024-8508Unbounded name compression could lead to Denial of ServiceNLnet Labs Unbound
- CVE-2024-9460Codezips Online Shopping Portal index.php sql injectionCodezips Online Shopping Portal
- CVE-2024-47617Reflected XSS Vulnerability in Sulu Media Bundlesulu · sulu/sulu
- CVE-2024-47618Sulu vulnerable to XSS via uploaded SVGsulu · sulu/sulu
- CVE-2024-9100Local File InclusionManageEngine Analytics Plus
- CVE-2024-47554Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderApache Software Foundation Apache Commons IO · commons-io:c…
- CVE-2024-42504HPE IceWall Agent products, Cross-Site Request Forgery (CSRF)Hewlett Packard Enterprise HPE IceWall Agent products
- CVE-2024-8159Deep Freeze 9.00.020.5760 - Out-of-bounds readFaronics DeepFreeze
- CVE-2024-34535In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.
- CVE-2024-41583DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitizatio
- CVE-2024-41584DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormA
- CVE-2024-41585DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recv
- CVE-2024-41587Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.
- CVE-2024-41591DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS.
- CVE-2024-45870Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.
- CVE-2024-45871Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS).
- CVE-2024-45872Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d.