CVEs published October 7, 2024
108 CVEs were published on October 7, 2024: 9 critical, 46 high. 1 is now in CISA KEV.
- Published
- 108
- Critical
- 9
- High
- 46
- Medium
- 52
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 29
Most affected products
- Qualcomm Snapdragon
- 20
- D-Link DIR-619L B1
- 5
- PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- 5
- Xerox FreeFlow Core
- 5
- cacti
- 4
- discourse
- 4
- MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…
- 4
- SOPlanning
- 4
- MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT…
- 3
- redis
- 3
Critical 9
- CVE-2024-9574SQL Injection vulnerability in SOPlanningSOPlanning
- CVE-2024-33066Improper Input Validation in WLAN Resource ManagerQualcomm Snapdragon
- CVE-2024-20103In wlan firmware, there is a possible out of bounds write due to improper input validation.MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT…
- CVE-2024-20101In wlan driver, there is a possible out of bounds write due to improper input validation.MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT…
- CVE-2024-20100In wlan driver, there is a possible out of bounds write due to improper input validation.MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT…
- CVE-2024-45873A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a cra
- CVE-2024-45874A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafte
- CVE-2024-46076RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of
- CVE-2024-46446Mecha CMS 3.0.0 is vulnerable to Directory Traversal.
High 46
- CVE-2024-47782Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscovermiraheze WikiDiscover
- CVE-2024-47610Stored Cross-site Scripting Vulnerability in Markdown EditorInvenTree
- CVE-2024-43363Remote code execution via Log Poisoning in Cacticacti
- CVE-2024-43362Stored Cross-site Scripting (XSS) when creating external links in Cacticacti
- CVE-2024-43789Denial of service by the absence of restrictions on replies to posts in Discoursediscourse
- CVE-2024-45051Bypass of email address validation via encoded email addresses in Discoursediscourse
- CVE-2024-45060Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheetPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-45290Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheetPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-45293XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX readerPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-31449Lua library commands may lead to stack overflow and RCE in Redisredis
- CVE-2024-47975Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized Solidigm D7-P5500 · Solidigm D7-P5600 +9
- CVE-2024-47559Authenticated RCE via Path TraversalXerox FreeFlow Core
- CVE-2024-47558Authenticated RCE via Path TraversalXerox FreeFlow Core
- CVE-2024-47557Pre-Auth RCE via Path TraversalXerox FreeFlow Core
- CVE-2024-47556Pre-Auth RCE via Path TraversalXerox FreeFlow Core
- CVE-2024-47555Missing Authentication - User & System ConfigurationXerox FreeFlow Core
- CVE-2024-27458HP Hotkey Support – Escalation of PrivilegeHP Hotkey Support
- CVE-2024-9570D-Link DIR-619L B1 formEasySetTimezone buffer overflowD-Link DIR-619L B1
- CVE-2023-6362A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4.WinHex
- CVE-2023-6361A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4.WinHex
- CVE-2024-9569D-Link DIR-619L B1 formEasySetPassword buffer overflowD-Link DIR-619L B1
- CVE-2024-9568D-Link DIR-619L B1 formAdvNetwork buffer overflowD-Link DIR-619L B1
- CVE-2024-9576Improper access control in Linux Workbooth DistroLinux Workbooth
- CVE-2024-9567D-Link DIR-619L B1 formAdvFirewall buffer overflowD-Link DIR-619L B1
- CVE-2024-9566D-Link DIR-619L B1 formDeviceReboot buffer overflowD-Link DIR-619L B1
- CVE-2024-43047Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2024-38399Use After Free in GraphicsQualcomm Snapdragon
- CVE-2024-38397Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-33073Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-33071Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-33070Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-33069Use After Free in WLAN HostQualcomm Snapdragon
- CVE-2024-33065Improper Input Validation in CameraQualcomm Snapdragon
- CVE-2024-33064Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-33049Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-23369Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOSQualcomm Snapdragon
- CVE-2024-21455Untrusted Pointer Dereference in DSP ServiceQualcomm Snapdragon
- CVE-2024-47335WordPress Bit Form plugin <= 2.13.11 - SQL Injection vulnerabilityBit Apps Bit Form
- CVE-2024-20094In Modem, there is a possible system crash due to a missing bounds check.MediaTek MT2735, MT6833, MT6853, MT6855, MT6873, MT6875, MT…
- CVE-2024-20092In vdec, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…
- CVE-2024-9565D-Link DIR-605L formSetPassword buffer overflowD-Link DIR-605L
- CVE-2024-9564D-Link DIR-605L formWlanWizardSetup buffer overflowD-Link DIR-605L
- CVE-2024-44068An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W92
- CVE-2024-45932Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.krayin/laravel-crm
- CVE-2024-46041IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.
- CVE-2024-46278Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.
Medium, low and unrated 53
- CVE-2024-47969Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service.Solidigm DC P4510 · Solidigm P4511 +12
- CVE-2024-47781Cross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWikimiraheze CreateWiki
- CVE-2024-47817Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeuslara-zeus dynamic-dashboard · lara-zeus/dynamic-dashboard +1
- CVE-2024-47968Improper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potentially enable denial oSolidigm DC P4510 · Solidigm DC P4610 +3
- CVE-2024-47814use-after-free when closing buffers in Vimvim
- CVE-2024-47818Logged-in users with any role can delete arbitrary files in @saltcorn/serversaltcorn · @saltcorn/server
- CVE-2024-47967Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of serSolidigm D7-P5510 · Solidigm D7-P5520 +3
- CVE-2024-47772Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discoursediscourse
- CVE-2024-47974Race condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial of service.Solidigm D7-P5510 · Solidigm D7-P5520 +3
- CVE-2024-47973In some Solidigm DC Products, a defect in device overprovisioning may provide information disclosure to an attacker.Solidigm D7-P5520 · Solidigm D7-P5620 +5
- CVE-2024-43365Stored Cross-site Scripting (XSS) when creating external links in Cacticacti
- CVE-2024-43364Stored Cross-site Scripting (XSS) when creating external links in Cacticacti
- CVE-2024-45297Prevent topic list filtering by hidden tags for unauthorized users in Discoursediscourse
- CVE-2024-45291Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheetPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-45292PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinksPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1
- CVE-2024-47079Unauthorized usage of remote hardware module because of missing channel verificationmeshtastic firmware
- CVE-2024-31228Denial-of-service due to unbounded pattern matching in Redisredis
- CVE-2024-31227Denial-of-service due to malformed ACL selectors in Redisredis
- CVE-2024-47972Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the reSolidigm D7-P5510 · Solidigm D5-P5316 +2
- CVE-2024-47971Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service.Solidigm D5-P5316 · Solidigm D7-P5520 +1
- CVE-2024-47976Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized acSolidigm DC P4510 · Solidigm DC P4610 +10
- CVE-2024-9573SQL Injection vulnerability in SOPlanningSOPlanning
- CVE-2024-9572Cross-Site Scripting vulnerability in SOPlanningSOPlanning
- CVE-2024-9571Cross-Site Scripting vulnerability in SOPlanningSOPlanning
- CVE-2024-38425Improper Authorization in PerformanceQualcomm Snapdragon
- CVE-2024-23379Double Free in DSP ServicesQualcomm Snapdragon
- CVE-2024-23378Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in AudioQualcomm Snapdragon
- CVE-2024-23376Use After Free in ComputerVisionQualcomm Snapdragon
- CVE-2024-23375Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in RILQualcomm Snapdragon
- CVE-2024-23374Stack-based Buffer Overflow in Power Management ICQualcomm Snapdragon
- CVE-2024-23370Use After Free in Automotive MultimediaQualcomm Snapdragon
- CVE-2024-42027The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they havRocket.Chat Mobile
- CVE-2024-45153Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-47344WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerabilityStylemix uListing
- CVE-2024-20102In wlan driver, there is a possible out of bounds read due to improper input validation.MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8678, MT…
- CVE-2024-20099In power, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6768, MT6833, MT6853, MT6877, MT6893, MT8532
- CVE-2024-20098In power, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6768, MT6779, MT6781, MT6785, MT6833, MT6853, MT…
- CVE-2024-20097In vdec, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6785, MT6789, MT6853, MT…
- CVE-2024-20096In m4u, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-20095In m4u, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-20093In vdec, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…
- CVE-2024-20091In vdec, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…
- CVE-2024-20090In vdec, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…
- CVE-2024-28709Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted scriplimesurvey/limesurvey
- CVE-2024-28710Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input limesurvey/limesurvey
- CVE-2024-42831A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary Java
- CVE-2024-44674D-Link COVR-2600R FW101b05 is vulnerable to Buffer Overflow.
- CVE-2024-45894BlueCMS 1.6 suffers from Arbitrary File Deletion via the file_name parameter in an /admin/database.php?act=del request.
- CVE-2024-45919A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges.
- CVE-2024-45933OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary f
- CVE-2024-46040IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration.
- CVE-2024-46300itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.
- CVE-2024-46325TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url.