# CVEs published 2024-10-04

89 CVEs were published on October 4, 2024: 2 critical, 26 high. Days are UTC.

- [CVE-2024-47848](https://cve.now/CVE-2024-47848.md): User can review/unreview articles while blocked (CVSS 6.9, The Wikimedia Foundation Mediawiki - PageTriage)
- [CVE-2024-43683](https://cve.now/CVE-2024-43683.md): Improper verification of the Host header in TimeProvider 4100 (CVSS 8.7, Microchip TimeProvider)
- [CVE-2024-43684](https://cve.now/CVE-2024-43684.md): Cross-Site Request Forgery vulnerability in TimeProvider 4100 (CVSS 8.7, Microchip TimeProvider)
- [CVE-2024-43685](https://cve.now/CVE-2024-43685.md): Session token fixation in TimeProvider 4100 (CVSS 8.7, Microchip TimeProvider)
- [CVE-2024-43686](https://cve.now/CVE-2024-43686.md): Reflected XSS in TimeProvider 4100 chart component (CVSS 5.4, Microchip TimeProvider)
- [CVE-2024-9054](https://cve.now/CVE-2024-9054.md): Remote code Execution inTimeProvider® 4100 (CVSS 8.5, Microchip TimeProvider)
- [CVE-2024-43687](https://cve.now/CVE-2024-43687.md): XSS vulnerability in bannerconfig endpoint in TimeProvider 4100 (CVSS 7.7, Microchip TimeProvider)
- [CVE-2024-7801](https://cve.now/CVE-2024-7801.md): SQL injection in get\_chart\_data in TimeProvider 4100 (CVSS 6.3, Microchip TimeProvider)
- [CVE-2024-47764](https://cve.now/CVE-2024-47764.md): cookie accepts cookie name, path, and domain with out of bounds characters (CVSS 6.9, jshttp cookie · cookie)
- [CVE-2024-38040](https://cve.now/CVE-2024-38040.md): BUG-000167984 - Portal for ArcGIS has a Local file inclusion (LFI) vulnerability (CVSS 7.5, Esri Portal for ArcGIS)
- [CVE-2024-38038](https://cve.now/CVE-2024-38038.md): BUG-000165732 - Reflected XSS in Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2024-25691](https://cve.now/CVE-2024-25691.md): BUG-000165286 - Reflected XSS in Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2024-25694](https://cve.now/CVE-2024-25694.md): BUG-000163019 - Stored XSS in Portal for ArcGIS (CVSS 4.8, Esri Enterprise Web App Builder)
- [CVE-2024-25701](https://cve.now/CVE-2024-25701.md): BUG-000160765 - Stored XSS in ArcGIS Experience Builder (CVSS 4.8, Esri Portal for ArcGIS Enterprise Experience Builder)
- [CVE-2024-25702](https://cve.now/CVE-2024-25702.md): BUG-000160599 - Stored XSS in Portal for ArcGIS Web App Builder (CVSS 4.8, Esri ArcGIS Enterprise Web App Builder)
- [CVE-2024-25707](https://cve.now/CVE-2024-25707.md): BUG-000160241 - Reflected XSS in Portal for ArcGIS (CVSS 4.8, Esri Portal for ArcGIS)
- [CVE-2024-38036](https://cve.now/CVE-2024-38036.md): BUG-000154827 - Reflected XSS in ArcGIS Experience Builder (CVSS 5.4, Esri Portal for ArcGIS Enterprise Experience Builder)
- [CVE-2024-8149](https://cve.now/CVE-2024-8149.md): BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (CVSS 4.6, Esri Portal for ArcGIS)
- [CVE-2024-38039](https://cve.now/CVE-2024-38039.md): BUG-000161683 - HTML injection vulnerability in Portal for ArcGIS. (CVSS 5.4, Esri Portal for ArcGIS)
- [CVE-2024-8148](https://cve.now/CVE-2024-8148.md): BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1) (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2024-38037](https://cve.now/CVE-2024-38037.md): BUG-000167983 - Unvalidated redirect in Portal for ArcGIS (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2024-47183](https://cve.now/CVE-2024-47183.md): Parse Server's custom object ID allows to acquire role privileges (CVSS 8.1, parse-community parse-server · parse-server)
- [CVE-2024-47769](https://cve.now/CVE-2024-47769.md): IDURAR has a Path Traversal (unauthenticated user can read sensitive data) (CVSS 7.5, idurar-erp-crm)
- [CVE-2024-47768](https://cve.now/CVE-2024-47768.md): Lif Authentication Server Has No Auth Check When Updating Password In Account Recovery (CVSS 6.9, Lif-Platforms Lif-Auth-Server)
- [CVE-2024-47765](https://cve.now/CVE-2024-47765.md): Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS (CVSS 6.9, jgniecki MinecraftMotdParser · dev-lancer/minecraft-motd-pa…)
- [CVE-2024-9515](https://cve.now/CVE-2024-9515.md): D-Link DIR-605L formSetQoS buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9514](https://cve.now/CVE-2024-9514.md): D-Link DIR-605L formSetDomainFilter buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9410](https://cve.now/CVE-2024-9410.md): Ada.cx SSRF via Sentry Misconfiguration (CVSS 5.3, Ada Support Ada.cx Sentry Component)
- [CVE-2024-8499](https://cve.now/CVE-2024-8499.md): Checkout Field Editor (Checkout Manager) for WooCommerce \<= 2.0.3 - Reflected Cross-Site Scripting via render\_review\_request\_notice (CVSS 4.7, themehigh Checkout Field Editor (Checkout Manager) for WooC…)
- [CVE-2024-47790](https://cve.now/CVE-2024-47790.md): Missing Authorization Vulnerability (CVSS 8.7, D3D Security IP Camera D8801)
- [CVE-2024-9484](https://cve.now/CVE-2024-9484.md): An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature \<24092400 released on 24/Sep/2024 on MacOS allows a malform (CVSS 5.1, AVG/Avast Antivirus)
- [CVE-2024-47789](https://cve.now/CVE-2024-47789.md): Credential Leakage Vulnerability (CVSS 8.7, D3D Security IP Camera D8801)
- [CVE-2024-9513](https://cve.now/CVE-2024-9513.md): Netadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposure (CVSS 6.3, Netadmin Software NetAdmin IAM)
- [CVE-2024-47657](https://cve.now/CVE-2024-47657.md): Improper Access Control Vulnerability (CVSS 7.1, Shilpi Computers Net Back Office)
- [CVE-2024-9483](https://cve.now/CVE-2024-9483.md): Uninitialized variable in digital signiture verification may crash the application (CVSS 5.1, AVG/Avast Antivirus)
- [CVE-2024-47656](https://cve.now/CVE-2024-47656.md): User Enumeration vulnerability (CVSS 9.3, Shilpi Computers Client Dashboard)
- [CVE-2024-9482](https://cve.now/CVE-2024-9482.md): Out of Bounds write on scan of malformed Mach-O file may crash the application (CVSS 5.1, AVG/Avast Antivirus)
- [CVE-2024-47655](https://cve.now/CVE-2024-47655.md): Unrestricted File Upload Vulnerability (CVSS 8.6, Shilpi Computers Client Dashboard)
- [CVE-2024-47654](https://cve.now/CVE-2024-47654.md): No Rate Limiting vulnerability (CVSS 7.1, Shilpi Computers Client Dashboard)
- [CVE-2024-47653](https://cve.now/CVE-2024-47653.md): Missing Authorization Vulnerability (CVSS 7.1, Shilpi Computers Client Dashboard)
- [CVE-2024-9481](https://cve.now/CVE-2024-9481.md): Out of Bounds write on scan of malformed eml file may crash the application (CVSS 5.1, AVG/Avast Antivirus)
- [CVE-2024-47652](https://cve.now/CVE-2024-47652.md): Insecure Authentication Vulnerability (CVSS 7.6, Shilpi Computers Client Dashboard)
- [CVE-2024-47651](https://cve.now/CVE-2024-47651.md): Parameter Pollution Vulnerability (CVSS 7.1, Shilpi Computers Client Dashboard)
- [CVE-2024-6400](https://cve.now/CVE-2024-6400.md): Cleartext Storage of Username and Password in Finrota's Netahsilat (CVSS 8.2, Finrota Netahsilat)
- [CVE-2024-9271](https://cve.now/CVE-2024-9271.md): Re:WP \<= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, remydcf Re:WP)
- [CVE-2024-9071](https://cve.now/CVE-2024-9071.md): Easy Demo Importer – A Modern One-Click Demo Import Solution \<= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, sigmadevs Easy Demo Importer – A Modern One-Click Demo Impo…)
- [CVE-2024-9435](https://cve.now/CVE-2024-9435.md): ShiftController Employee Shift Scheduling \<= 4.9.66 - Reflected Cross-Site Scripting (CVSS 6.1, plainware ShiftController Employee Shift Scheduling)
- [CVE-2024-9306](https://cve.now/CVE-2024-9306.md): WP Booking Calendar \<= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, wpdevelop Booking Calendar)
- [CVE-2024-6444](https://cve.now/CVE-2024-6444.md): Bluetooth: ots: missing buffer length check (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2024-6443](https://cve.now/CVE-2024-6443.md): zephyr: out-of-bound read in utf8\_trunc (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2024-6442](https://cve.now/CVE-2024-6442.md): Bluetooth: ASCS Unchecked tailroom of the response buffer (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2024-9242](https://cve.now/CVE-2024-9242.md): Memberful – Membership Plugin \<= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting (CVSS 6.4, Memberful – Membership Plugin)
- [CVE-2024-8804](https://cve.now/CVE-2024-8804.md): Code Embed \<= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dartiss Code Embed)
- [CVE-2024-9237](https://cve.now/CVE-2024-9237.md): Fish and Ships \<= 1.5.9 - Reflected Cross-Site Scripting (CVSS 6.1, wpcentrics Advanced Shipping Rates for WooCommerce: Flexibl…)
- [CVE-2024-8519](https://cve.now/CVE-2024-8519.md): Ultimate Member \<= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-8520](https://cve.now/CVE-2024-8520.md): Ultimate Member \<= 2.8.6 - Cross-Site Request Forgery to Membership Status Change (CVSS 5.3, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2024-9384](https://cve.now/CVE-2024-9384.md): Quantity Dynamic Pricing & Bulk Discounts for WooCommerce \<= 3.8.0 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory Price by Quantity & Bulk Quantity Discounts f…)
- [CVE-2024-9445](https://cve.now/CVE-2024-9445.md): Display Medium Posts \<= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via display\_medium\_posts Shortcode (CVSS 6.4, acekyd Display Medium Posts)
- [CVE-2024-9375](https://cve.now/CVE-2024-9375.md): WordPress Captcha Plugin by Captcha Bank \<= 4.0.36 - Reflected Cross-Site Scripting (CVSS 6.1, contact-banker WordPress Captcha Plugin by Captcha Bank)
- [CVE-2024-9204](https://cve.now/CVE-2024-9204.md): Smart Custom 404 Error Page \<= 11.4.7 - Reflected Cross-Site Scripting (CVSS 6.1, nerdpressteam Smart Custom 404 Error Page)
- [CVE-2024-9421](https://cve.now/CVE-2024-9421.md): Login Logout Shortcode \<= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter (CVSS 6.4, prontotools Login Logout Shortcode)
- [CVE-2024-9368](https://cve.now/CVE-2024-9368.md): Aggregator Advanced Settings \<= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, migumello Aggregator Advanced Settings)
- [CVE-2024-9349](https://cve.now/CVE-2024-9349.md): Auto Amazon Links – Amazon Associates Affiliate Plugin \<= 5.4.2 - Reflected Cross-Site Scripting (CVSS 6.1, miunosoft Auto Amazon Links – Amazon Associates Affiliate P…)
- [CVE-2024-9372](https://cve.now/CVE-2024-9372.md): WP Blocks Hub \<= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wpblockshub WP Blocks Hub)
- [CVE-2024-9353](https://cve.now/CVE-2024-9353.md): Popularis Extra \<= 1.2.6 - Reflected Cross-Site Scripting (CVSS 6.1, themes4wp Popularis Extra)
- [CVE-2024-9345](https://cve.now/CVE-2024-9345.md): Product Delivery Date for WooCommerce – Lite \<= 2.7.3 - Reflected Cross-Site Scripting (CVSS 6.1, tychesoftwares Product Delivery Date for WooCommerce – Lite)
- [CVE-2024-8802](https://cve.now/CVE-2024-8802.md): Clio Grow \<= 1.0.2 - Reflected Cross-Site Scripting (CVSS 6.1, cliogrow Clio Grow Form)
- [CVE-2023-26770](https://cve.now/CVE-2023-26770.md): TaskCafe 0.3.2 lacks validation in the Cookie value. (CVSS 9.8)
- [CVE-2023-26771](https://cve.now/CVE-2023-26771.md): Taskcafe 0.3.2 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.5)
- [CVE-2024-37868](https://cve.now/CVE-2024-37868.md): File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the " (CVSS 8.8)
- [CVE-2024-37869](https://cve.now/CVE-2024-37869.md): File Upload vulnerability in Itsourcecode Online Discussion Forum Project v.1.0 allows a remote attacker to execute arbitrary code via the " (CVSS 8.8)
- [CVE-2024-41511](https://cve.now/CVE-2024-41511.md): A Path Traversal (Local File Inclusion) vulnerability in "BinaryFileRedirector.ashx" in CADClick v1.11.0 and before allows remote attackers (CVSS 3.9)
- [CVE-2024-41512](https://cve.now/CVE-2024-41512.md): A SQL Injection vulnerability in "ccHandler.aspx" in all versions of CADClick v.1.11.0 and before allows remote attackers to execute arbitra (CVSS 8.8)
- [CVE-2024-41513](https://cve.now/CVE-2024-41513.md): A reflected cross-site scripting (XSS) vulnerability in "Artikel.aspx" in CADClick v1.11.0 and before allows remote attackers to inject arbi (CVSS 5.4)
- [CVE-2024-41514](https://cve.now/CVE-2024-41514.md): A reflected cross-site scripting (XSS) vulnerability in "PrevPgGroup.aspx" in CADClick v1.11.0 and before allows remote attackers to inject (CVSS 5.4)
- [CVE-2024-41515](https://cve.now/CVE-2024-41515.md): A reflected cross-site scripting (XSS) vulnerability in "ccHandlerResource.ashx" in CADClick \<= 1.11.0 allows remote attackers to inject arb (CVSS 5.4)
- [CVE-2024-41516](https://cve.now/CVE-2024-41516.md): A Reflected cross-site scripting (XSS) vulnerability in "ccHandler.aspx" CADClick \<= 1.11.0 allows remote attackers to inject arbitrary web (CVSS 5.4)
- [CVE-2024-44439](https://cve.now/CVE-2024-44439.md): An issue in Shanghai Zhouma Network Technology CO., Ltd IMS Intelligent Manufacturing Collaborative Internet of Things System v.1.9.1 allows (CVSS 5.9)
- [CVE-2024-46077](https://cve.now/CVE-2024-46077.md): itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the val-us (CVSS 5.4)
- [CVE-2024-46078](https://cve.now/CVE-2024-46078.md): itsourcecode Sports Management System Project 1.0 is vulnerable to SQL Injection in the function delete\_category of the file sports\_scheduli (CVSS 7.5)
- [CVE-2024-46409](https://cve.now/CVE-2024-46409.md): A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting (CVSS 5.4)
- [CVE-2024-46486](https://cve.now/CVE-2024-46486.md): TP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via the httpProcDataSrv function. (CVSS 8.0)
- [CVE-2024-47211](https://cve.now/CVE-2024-47211.md): In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lac (CVSS 5.3, ironic)
- [CVE-2024-47850](https://cve.now/CVE-2024-47850.md): CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet re (CVSS 7.5)
- [CVE-2024-47854](https://cve.now/CVE-2024-47854.md): An XSS vulnerability was discovered in Veritas Data Insight before 7.1. (CVSS 6.1)
- [CVE-2024-47855](https://cve.now/CVE-2024-47855.md): util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string. (CVSS 5.3, org.kordamp.json:json-lib-core · net.sf.json-lib:json-lib)
- [CVE-2024-47910](https://cve.now/CVE-2024-47910.md): An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. (CVSS 7.2)
- [CVE-2024-47911](https://cve.now/CVE-2024-47911.md): In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint (CVSS 6.7)
- [CVE-2024-47913](https://cve.now/CVE-2024-47913.md): An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. (CVSS 5.3, mediawiki/abuse-filter)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.