CVEs published October 4, 2024
89 CVEs were published on October 4, 2024: 2 critical, 26 high.
- Published
- 89
- Critical
- 2
- High
- 26
- Medium
- 60
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Esri Portal for ArcGIS
- 8
- Microchip TimeProvider
- 7
- Shilpi Computers Client Dashboard
- 6
- AVG/Avast Antivirus
- 4
- zephyrproject-rtos Zephyr
- 3
- D-Link DIR-605L
- 2
- D3D Security IP Camera D8801
- 2
- Esri Portal for ArcGIS Enterprise Experience Builder
- 2
- ultimatemember Ultimate Member – User Profile, Registration…
- 2
- acekyd Display Medium Posts
- 1
Critical 2
High 26
- CVE-2024-43683Improper verification of the Host header in TimeProvider 4100Microchip TimeProvider
- CVE-2024-43684Cross-Site Request Forgery vulnerability in TimeProvider 4100Microchip TimeProvider
- CVE-2024-43685Session token fixation in TimeProvider 4100Microchip TimeProvider
- CVE-2024-9054Remote code Execution inTimeProvider® 4100Microchip TimeProvider
- CVE-2024-43687XSS vulnerability in bannerconfig endpoint in TimeProvider 4100Microchip TimeProvider
- CVE-2024-38040BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerabilityEsri Portal for ArcGIS
- CVE-2024-47183Parse Server's custom object ID allows to acquire role privilegesparse-community parse-server · parse-server
- CVE-2024-47769IDURAR has a Path Traversal (unauthenticated user can read sensitive data)idurar-erp-crm
- CVE-2024-9515D-Link DIR-605L formSetQoS buffer overflowD-Link DIR-605L
- CVE-2024-9514D-Link DIR-605L formSetDomainFilter buffer overflowD-Link DIR-605L
- CVE-2024-47790Missing Authorization VulnerabilityD3D Security IP Camera D8801
- CVE-2024-47789Credential Leakage VulnerabilityD3D Security IP Camera D8801
- CVE-2024-47657Improper Access Control VulnerabilityShilpi Computers Net Back Office
- CVE-2024-47655Unrestricted File Upload VulnerabilityShilpi Computers Client Dashboard
- CVE-2024-47654No Rate Limiting vulnerabilityShilpi Computers Client Dashboard
- CVE-2024-47653Missing Authorization VulnerabilityShilpi Computers Client Dashboard
- CVE-2024-47652Insecure Authentication VulnerabilityShilpi Computers Client Dashboard
- CVE-2024-47651Parameter Pollution VulnerabilityShilpi Computers Client Dashboard
- CVE-2024-6400Cleartext Storage of Username and Password in Finrota's NetahsilatFinrota Netahsilat
- CVE-2024-37868File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "
- CVE-2024-37869File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the "
- CVE-2024-41512A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitra
- CVE-2024-46078itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete_category of the file sports_scheduli
- CVE-2024-46486TP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via the httpProcDataSrv function.
- CVE-2024-47850CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet re
- CVE-2024-47910An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5.
Medium, low and unrated 61
- CVE-2024-47848User can review/unreview articles while blockedThe Wikimedia Foundation Mediawiki - PageTriage
- CVE-2024-43686Reflected XSS in TimeProvider 4100 chart componentMicrochip TimeProvider
- CVE-2024-7801SQL injection in get_chart_data in TimeProvider 4100Microchip TimeProvider
- CVE-2024-47764cookie accepts cookie name, path, and domain with out of bounds charactersjshttp cookie · cookie
- CVE-2024-38038BUG-000165732 - Reflected XSS in Portal for ArcGISEsri Portal for ArcGIS
- CVE-2024-25691BUG-000165286 - Reflected XSS in Portal for ArcGISEsri Portal for ArcGIS
- CVE-2024-25694BUG-000163019 - Stored XSS in Portal for ArcGISEsri Enterprise Web App Builder
- CVE-2024-25701BUG-000160765 - Stored XSS in ArcGIS Experience BuilderEsri Portal for ArcGIS Enterprise Experience Builder
- CVE-2024-25702BUG-000160599 - Stored XSS in Portal for ArcGIS Web App BuilderEsri ArcGIS Enterprise Web App Builder
- CVE-2024-25707BUG-000160241 - Reflected XSS in Portal for ArcGISEsri Portal for ArcGIS
- CVE-2024-38036BUG-000154827 - Reflected XSS in ArcGIS Experience BuilderEsri Portal for ArcGIS Enterprise Experience Builder
- CVE-2024-8149BUG-000168624 - Unvalidated redirect in Portal for ArcGIS.Esri Portal for ArcGIS
- CVE-2024-38039BUG-000161683 - HTML injection vulnerability in Portal for ArcGIS.Esri Portal for ArcGIS
- CVE-2024-8148BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1)Esri Portal for ArcGIS
- CVE-2024-38037BUG-000167983 - Unvalidated redirect in Portal for ArcGISEsri Portal for ArcGIS
- CVE-2024-47768Lif Authentication Server Has No Auth Check When Updating Password In Account RecoveryLif-Platforms Lif-Auth-Server
- CVE-2024-47765Minecraft MOTD Parser's HtmlGenerator vulnerable to XSSjgniecki MinecraftMotdParser · dev-lancer/minecraft-motd-pa…
- CVE-2024-9410Ada.cx SSRF via Sentry MisconfigurationAda Support Ada.cx Sentry Component
- CVE-2024-8499Checkout Field Editor (Checkout Manager) for WooCommerce <= 2.0.3 - Reflected Cross-Site Scripting via render_review_request_noticethemehigh Checkout Field Editor (Checkout Manager) for WooC…
- CVE-2024-9484An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature <24092400 released on 24/Sep/2024 on MacOS allows a malformAVG/Avast Antivirus
- CVE-2024-9513Netadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposureNetadmin Software NetAdmin IAM
- CVE-2024-9483Uninitialized variable in digital signiture verification may crash the applicationAVG/Avast Antivirus
- CVE-2024-9482Out of Bounds write on scan of malformed Mach-O file may crash the applicationAVG/Avast Antivirus
- CVE-2024-9481Out of Bounds write on scan of malformed eml file may crash the applicationAVG/Avast Antivirus
- CVE-2024-9271Re:WP <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadremydcf Re:WP
- CVE-2024-9071Easy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadsigmadevs Easy Demo Importer – A Modern One-Click Demo Impo…
- CVE-2024-9435ShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site Scriptingplainware ShiftController Employee Shift Scheduling
- CVE-2024-9306WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scriptingwpdevelop Booking Calendar
- CVE-2024-6444Bluetooth: ots: missing buffer length checkzephyrproject-rtos Zephyr
- CVE-2024-6443zephyr: out-of-bound read in utf8_trunczephyrproject-rtos Zephyr
- CVE-2024-6442Bluetooth: ASCS Unchecked tailroom of the response bufferzephyrproject-rtos Zephyr
- CVE-2024-9242Memberful – Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site ScriptingMemberful – Membership Plugin
- CVE-2024-8804Code Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingdartiss Code Embed
- CVE-2024-9237Fish and Ships <= 1.5.9 - Reflected Cross-Site Scriptingwpcentrics Advanced Shipping Rates for WooCommerce: Flexibl…
- CVE-2024-8519Ultimate Member <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingultimatemember Ultimate Member – User Profile, Registration…
- CVE-2024-8520Ultimate Member <= 2.8.6 - Cross-Site Request Forgery to Membership Status Changeultimatemember Ultimate Member – User Profile, Registration…
- CVE-2024-9384Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scriptingwpcodefactory Price by Quantity & Bulk Quantity Discounts f…
- CVE-2024-9445Display Medium Posts <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcodeacekyd Display Medium Posts
- CVE-2024-9375WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scriptingcontact-banker WordPress Captcha Plugin by Captcha Bank
- CVE-2024-9204Smart Custom 404 Error Page <= 11.4.7 - Reflected Cross-Site Scriptingnerdpressteam Smart Custom 404 Error Page
- CVE-2024-9421Login Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameterprontotools Login Logout Shortcode
- CVE-2024-9368Aggregator Advanced Settings <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmigumello Aggregator Advanced Settings
- CVE-2024-9349Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site Scriptingmiunosoft Auto Amazon Links – Amazon Associates Affiliate P…
- CVE-2024-9372WP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpblockshub WP Blocks Hub
- CVE-2024-9353Popularis Extra <= 1.2.6 - Reflected Cross-Site Scriptingthemes4wp Popularis Extra
- CVE-2024-9345Product Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scriptingtychesoftwares Product Delivery Date for WooCommerce – Lite
- CVE-2024-8802Clio Grow <= 1.0.2 - Reflected Cross-Site Scriptingcliogrow Clio Grow Form
- CVE-2023-26771Taskcafe 0.3.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-41511A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers
- CVE-2024-41513A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbi
- CVE-2024-41514A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject
- CVE-2024-41515A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick <= 1.11.0 allows remote attackers to inject arb
- CVE-2024-41516A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick <= 1.11.0 allows remote attackers to inject arbitrary web
- CVE-2024-44439An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows
- CVE-2024-46077itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-us
- CVE-2024-46409A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting
- CVE-2024-47211In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lacironic
- CVE-2024-47854An XSS vulnerability was discovered in Veritas Data Insight before 7.1.
- CVE-2024-47855util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.org.kordamp.json:json-lib-core · net.sf.json-lib:json-lib
- CVE-2024-47911In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint
- CVE-2024-47913An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2.mediawiki/abuse-filter