# CVEs published 2024-10-03

58 CVEs were published on October 3, 2024: 6 critical, 25 high. Days are UTC.

- [CVE-2024-44207](https://cve.now/CVE-2024-44207.md): This issue was addressed with improved checks. (CVSS 4.3, Apple iOS and iPadOS)
- [CVE-2024-44204](https://cve.now/CVE-2024-44204.md): A logic issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2024-42417](https://cve.now/CVE-2024-42417.md): Delta Electronics DIAEnergie SQL Injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-43699](https://cve.now/CVE-2024-43699.md): Delta Electronics DIAEnergie SQL Injection (CVSS 9.8, Delta Electronics DIAEnergie)
- [CVE-2024-45367](https://cve.now/CVE-2024-45367.md): Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication (CVSS 9.1, Optigo Networks ONS-S8 Spectra Aggregation Switch)
- [CVE-2024-41925](https://cve.now/CVE-2024-41925.md): Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion (CVSS 9.8, Optigo Networks ONS-S8 Spectra Aggregation Switch)
- [CVE-2024-9266](https://cve.now/CVE-2024-9266.md): Open Redirect (CVSS 4.7, expressjs express · express)
- [CVE-2024-41988](https://cve.now/CVE-2024-41988.md): Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family Transmitter (CVSS 9.3, TEM Opera Plus FM Family Transmitter)
- [CVE-2024-41987](https://cve.now/CVE-2024-41987.md): Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family Transmitter (CVSS 8.6, TEM Opera Plus FM Family Transmitter)
- [CVE-2024-47762](https://cve.now/CVE-2024-47762.md): Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend (CVSS 5.8, backstage · @backstage/plugin-app-backend)
- [CVE-2024-7824](https://cve.now/CVE-2024-7824.md): Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dump (no CVSS, Webroot SecureAnywhere - Web Shield)
- [CVE-2024-7825](https://cve.now/CVE-2024-7825.md): Type confusion that can cause the WRSA.exe service to crash and generate a crash dump (no CVSS, Webroot SecureAnywhere - Web Shield)
- [CVE-2024-7826](https://cve.now/CVE-2024-7826.md): Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dump (no CVSS, Webroot SecureAnywhere - Web Shield)
- [CVE-2024-0125](https://cve.now/CVE-2024-0125.md): NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause a NULL pointer d (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-0124](https://cve.now/CVE-2024-0124.md): NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can cause nvdisasm to read (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-0123](https://cve.now/CVE-2024-0123.md): NVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker may cause an improper (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2024-8508](https://cve.now/CVE-2024-8508.md): Unbounded name compression could lead to Denial of Service (CVSS 5.3, NLnet Labs Unbound)
- [CVE-2024-25590](https://cve.now/CVE-2024-25590.md): Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor (CVSS 7.5, PowerDNS Recursor)
- [CVE-2024-42415](https://cve.now/CVE-2024-42415.md): An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Project G Structured Fi (CVSS 8.4, GNOME Project G Structured File Library)
- [CVE-2024-36474](https://cve.now/CVE-2024-36474.md): An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library ( (CVSS 8.4, GNOME Project G Structured File Library)
- [CVE-2024-41163](https://cve.now/CVE-2024-41163.md): A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. (CVSS 7.5, Veertu Anka Build)
- [CVE-2024-39755](https://cve.now/CVE-2024-39755.md): A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. (CVSS 7.8, Veertu Anka Build)
- [CVE-2024-41922](https://cve.now/CVE-2024-41922.md): A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. (CVSS 7.5, Veertu Anka Build)
- [CVE-2024-9460](https://cve.now/CVE-2024-9460.md): Codezips Online Shopping Portal index.php sql injection (CVSS 6.9, Codezips Online Shopping Portal)
- [CVE-2024-47614](https://cve.now/CVE-2024-47614.md): async-graphql vulnerable to Directive Overload (CVSS 7.5, async-graphql)
- [CVE-2024-47617](https://cve.now/CVE-2024-47617.md): Reflected XSS Vulnerability in Sulu Media Bundle (CVSS 6.1, sulu · sulu/sulu)
- [CVE-2024-5803](https://cve.now/CVE-2024-5803.md): Local privelage escalation via COM hijacking (CVSS 7.5, AVG/Avast Antivirus)
- [CVE-2024-47618](https://cve.now/CVE-2024-47618.md): Sulu vulnerable to XSS via uploaded SVG (CVSS 5.1, sulu · sulu/sulu)
- [CVE-2024-9100](https://cve.now/CVE-2024-9100.md): Local File Inclusion (CVSS 6.5, ManageEngine Analytics Plus)
- [CVE-2024-47554](https://cve.now/CVE-2024-47554.md): Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader (CVSS 4.3, Apache Software Foundation Apache Commons IO · commons-io:c…)
- [CVE-2024-9313](https://cve.now/CVE-2024-9313.md): Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform an (CVSS 8.8, Canonical Authd · github.com/ubuntu/authd)
- [CVE-2024-47561](https://cve.now/CVE-2024-47561.md): Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK) (CVSS 9.2, Apache Software Foundation Apache Avro Java SDK · org.apach…)
- [CVE-2024-42504](https://cve.now/CVE-2024-42504.md): HPE IceWall Agent products, Cross-Site Request Forgery (CSRF) (CVSS 4.3, Hewlett Packard Enterprise HPE IceWall Agent products)
- [CVE-2024-8159](https://cve.now/CVE-2024-8159.md): Deep Freeze 9.00.020.5760 - Out-of-bounds read (CVSS 6.4, Faronics DeepFreeze)
- [CVE-2024-8352](https://cve.now/CVE-2024-8352.md): Social Web Suite – Social Media Auto Post, Social Media Auto Publish \<= 4.1.11 - Directory Traversal to Arbitrary File Download (CVSS 7.5, dejanmarkovic Social Web Suite – Social Media Auto Post, So…)
- [CVE-2024-47136](https://cve.now/CVE-2024-47136.md): Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 and (CVSS 7.8, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2024-47135](https://cve.now/CVE-2024-47135.md): Stack-based buffer overflow vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6 (CVSS 7.8, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2024-47134](https://cve.now/CVE-2024-47134.md): Out-of-bounds write vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.14.0 an (CVSS 7.8, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2023-37822](https://cve.now/CVE-2023-37822.md): The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the (CVSS 8.2)
- [CVE-2024-34535](https://cve.now/CVE-2024-34535.md): In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header. (CVSS 5.9)
- [CVE-2024-41583](https://cve.now/CVE-2024-41583.md): DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to stored Cross Site Scripting (XSS) by authenticated users due to poor sanitizatio (CVSS 4.7)
- [CVE-2024-41584](https://cve.now/CVE-2024-41584.md): DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to reflected XSS by authenticated users, caused by missing validation of the sFormA (CVSS 4.7)
- [CVE-2024-41585](https://cve.now/CVE-2024-41585.md): DrayTek Vigor3910 devices through 4.3.2.6 are affected by an OS command injection vulnerability that allows an attacker to leverage the recv (CVSS 6.8)
- [CVE-2024-41586](https://cve.now/CVE-2024-41586.md): A stack-based Buffer Overflow vulnerability in DrayTek Vigor310 devices through 4.3.2.6 allows a remote attacker to execute arbitrary code v (CVSS 8.0)
- [CVE-2024-41587](https://cve.now/CVE-2024-41587.md): Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4. (CVSS 5.4)
- [CVE-2024-41588](https://cve.now/CVE-2024-41588.md): The CGI endpoints v2x00.cgi and cgiwcg.cgi of DrayTek Vigor3910 devices through 4.3.2.6 are vulnerable to buffer overflows, by authenticated (CVSS 8.0)
- [CVE-2024-41589](https://cve.now/CVE-2024-41589.md): DrayTek Vigor310 devices through 4.3.2.6 use unencrypted HTTP for authentication requests. (CVSS 8.8)
- [CVE-2024-41590](https://cve.now/CVE-2024-41590.md): Several CGI endpoints are vulnerable to buffer overflows, by authenticated users, because of missing bounds checking on parameters passed th (CVSS 8.0)
- [CVE-2024-41591](https://cve.now/CVE-2024-41591.md): DrayTek Vigor3910 devices through 4.3.2.6 allow unauthenticated DOM-based reflected XSS. (CVSS 6.1)
- [CVE-2024-41592](https://cve.now/CVE-2024-41592.md): DrayTek Vigor3910 devices through 4.3.2.6 have a stack-based overflow when processing query string parameters because GetCGI mishandles extr (CVSS 8.0)
- [CVE-2024-41593](https://cve.now/CVE-2024-41593.md): DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft\_payload\_dns(), because a byte (CVSS 9.8)
- [CVE-2024-41594](https://cve.now/CVE-2024-41594.md): An issue in DrayTek Vigor310 devices through 4.3.2.6 allows an attacker to obtain sensitive information because the httpd server of the Vigo (CVSS 7.5)
- [CVE-2024-41595](https://cve.now/CVE-2024-41595.md): DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to change settings or cause a denial of service via .cgi pages because of m (CVSS 8.0)
- [CVE-2024-41596](https://cve.now/CVE-2024-41596.md): Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 (in the Vigor management UI) because of improper retrieval (CVSS 8.0)
- [CVE-2024-45870](https://cve.now/CVE-2024-45870.md): Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub\_0x3d80fc via a crafted POC file. (CVSS 6.5)
- [CVE-2024-45871](https://cve.now/CVE-2024-45871.md): Bandisoft BandiView 7.05 is Incorrect Access Control via sub\_0x232bd8 resulting in denial of service (DOS). (CVSS 6.3)
- [CVE-2024-45872](https://cve.now/CVE-2024-45872.md): Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub\_0x410d1d. (CVSS 6.3)
- [CVE-2024-46658](https://cve.now/CVE-2024-46658.md): Syrotech SY-GOPON-8OLT-L3 v1.6.0\_240629 was discovered to contain an authenticated command injection vulnerability. (CVSS 8.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.