# CVEs published 2024-10-07

108 CVEs were published on October 7, 2024: 9 critical, 46 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-47969](https://cve.now/CVE-2024-47969.md): Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of service. (CVSS 6.2, Solidigm DC P4510 · Solidigm P4511 +12)
- [CVE-2024-47781](https://cve.now/CVE-2024-47781.md): Cross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWiki (CVSS 5.3, miraheze CreateWiki)
- [CVE-2024-47782](https://cve.now/CVE-2024-47782.md): Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover (CVSS 7.6, miraheze WikiDiscover)
- [CVE-2024-47817](https://cve.now/CVE-2024-47817.md): Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus (CVSS 5.3, lara-zeus dynamic-dashboard · lara-zeus/dynamic-dashboard +1)
- [CVE-2024-47968](https://cve.now/CVE-2024-47968.md): Improper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potentially enable denial o (CVSS 4.4, Solidigm DC P4510 · Solidigm DC P4610 +3)
- [CVE-2024-47814](https://cve.now/CVE-2024-47814.md): use-after-free when closing buffers in Vim (CVSS 3.9, vim)
- [CVE-2024-47818](https://cve.now/CVE-2024-47818.md): Logged-in users with any role can delete arbitrary files in @saltcorn/server (CVSS 6.5, saltcorn · @saltcorn/server)
- [CVE-2024-47967](https://cve.now/CVE-2024-47967.md): Improper resource initialization handling in firmware of some Solidigm DC Products may allow an attacker to potentially enable denial of ser (CVSS 4.4, Solidigm D7-P5510 · Solidigm D7-P5520 +3)
- [CVE-2024-47772](https://cve.now/CVE-2024-47772.md): Cross-site Scripting (XSS) via chat excerpts when content security policy (CSP) disabled in Discourse (CVSS 6.5, discourse)
- [CVE-2024-47974](https://cve.now/CVE-2024-47974.md): Race condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial of service. (CVSS 4.4, Solidigm D7-P5510 · Solidigm D7-P5520 +3)
- [CVE-2024-47610](https://cve.now/CVE-2024-47610.md): Stored Cross-site Scripting Vulnerability in Markdown Editor (CVSS 7.3, InvenTree)
- [CVE-2024-47973](https://cve.now/CVE-2024-47973.md): In some Solidigm DC Products, a defect in device overprovisioning may provide information disclosure to an attacker. (CVSS 5.1, Solidigm D7-P5520 · Solidigm D7-P5620 +5)
- [CVE-2024-43363](https://cve.now/CVE-2024-43363.md): Remote code execution via Log Poisoning in Cacti (CVSS 7.2, cacti)
- [CVE-2024-43365](https://cve.now/CVE-2024-43365.md): Stored Cross-site Scripting (XSS) when creating external links in Cacti (CVSS 5.7, cacti)
- [CVE-2024-43364](https://cve.now/CVE-2024-43364.md): Stored Cross-site Scripting (XSS) when creating external links in Cacti (CVSS 5.7, cacti)
- [CVE-2024-43362](https://cve.now/CVE-2024-43362.md): Stored Cross-site Scripting (XSS) when creating external links in Cacti (CVSS 7.3, cacti)
- [CVE-2024-43789](https://cve.now/CVE-2024-43789.md): Denial of service by the absence of restrictions on replies to posts in Discourse (CVSS 7.5, discourse)
- [CVE-2024-45297](https://cve.now/CVE-2024-45297.md): Prevent topic list filtering by hidden tags for unauthorized users in Discourse (CVSS 5.3, discourse)
- [CVE-2024-45051](https://cve.now/CVE-2024-45051.md): Bypass of email address validation via encoded email addresses in Discourse (CVSS 8.2, discourse)
- [CVE-2024-45060](https://cve.now/CVE-2024-45060.md): Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet (CVSS 7.1, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-45290](https://cve.now/CVE-2024-45290.md): Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet (CVSS 7.7, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-45291](https://cve.now/CVE-2024-45291.md): Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet (CVSS 6.3, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-45292](https://cve.now/CVE-2024-45292.md): PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks (CVSS 5.4, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-45293](https://cve.now/CVE-2024-45293.md): XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader (CVSS 7.5, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-47079](https://cve.now/CVE-2024-47079.md): Unauthorized usage of remote hardware module because of missing channel verification (CVSS 6.4, meshtastic firmware)
- [CVE-2024-31449](https://cve.now/CVE-2024-31449.md): Lua library commands may lead to stack overflow and RCE in Redis (CVSS 7.0, redis)
- [CVE-2024-31228](https://cve.now/CVE-2024-31228.md): Denial-of-service due to unbounded pattern matching in Redis (CVSS 5.5, redis)
- [CVE-2024-31227](https://cve.now/CVE-2024-31227.md): Denial-of-service due to malformed ACL selectors in Redis (CVSS 4.4, redis)
- [CVE-2024-47972](https://cve.now/CVE-2024-47972.md): Improper resource management in firmware of some Solidigm DC Products may allow an attacker to potentially control the performance of the re (CVSS 4.0, Solidigm D7-P5510 · Solidigm D5-P5316 +2)
- [CVE-2024-47971](https://cve.now/CVE-2024-47971.md): Improper error handling in firmware of some SSD DC Products may allow an attacker to enable denial of service. (CVSS 6.5, Solidigm D5-P5316 · Solidigm D7-P5520 +1)
- [CVE-2024-47976](https://cve.now/CVE-2024-47976.md): Improper access removal handling in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized ac (CVSS 6.7, Solidigm DC P4510 · Solidigm DC P4610 +10)
- [CVE-2024-47975](https://cve.now/CVE-2024-47975.md): Improper access control validation in firmware of some Solidigm DC Products may allow an attacker with physical access to gain unauthorized (CVSS 7.0, Solidigm D7-P5500 · Solidigm D7-P5600 +9)
- [CVE-2024-47559](https://cve.now/CVE-2024-47559.md): Authenticated RCE via Path Traversal (CVSS 7.6, Xerox FreeFlow Core)
- [CVE-2024-47558](https://cve.now/CVE-2024-47558.md): Authenticated RCE via Path Traversal (CVSS 7.6, Xerox FreeFlow Core)
- [CVE-2024-47557](https://cve.now/CVE-2024-47557.md): Pre-Auth RCE via Path Traversal (CVSS 8.3, Xerox FreeFlow Core)
- [CVE-2024-47556](https://cve.now/CVE-2024-47556.md): Pre-Auth RCE via Path Traversal (CVSS 8.3, Xerox FreeFlow Core)
- [CVE-2024-47555](https://cve.now/CVE-2024-47555.md): Missing Authentication - User & System Configuration (CVSS 8.3, Xerox FreeFlow Core)
- [CVE-2024-27458](https://cve.now/CVE-2024-27458.md): HP Hotkey Support – Escalation of Privilege (CVSS 8.8, HP Hotkey Support)
- [CVE-2024-9570](https://cve.now/CVE-2024-9570.md): D-Link DIR-619L B1 formEasySetTimezone buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2023-6362](https://cve.now/CVE-2023-6362.md): A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. (CVSS 7.3, WinHex)
- [CVE-2023-6361](https://cve.now/CVE-2023-6361.md): A vulnerability has been discovered in Winhex affecting version 16.1 SR-1 and 20.4. (CVSS 7.3, WinHex)
- [CVE-2024-9569](https://cve.now/CVE-2024-9569.md): D-Link DIR-619L B1 formEasySetPassword buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9574](https://cve.now/CVE-2024-9574.md): SQL Injection vulnerability in SOPlanning (CVSS 9.8, SOPlanning)
- [CVE-2024-9573](https://cve.now/CVE-2024-9573.md): SQL Injection vulnerability in SOPlanning (CVSS 6.3, SOPlanning)
- [CVE-2024-9572](https://cve.now/CVE-2024-9572.md): Cross-Site Scripting vulnerability in SOPlanning (CVSS 6.3, SOPlanning)
- [CVE-2024-9571](https://cve.now/CVE-2024-9571.md): Cross-Site Scripting vulnerability in SOPlanning (CVSS 6.3, SOPlanning)
- [CVE-2024-9568](https://cve.now/CVE-2024-9568.md): D-Link DIR-619L B1 formAdvNetwork buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9576](https://cve.now/CVE-2024-9576.md): Improper access control in Linux Workbooth Distro (CVSS 7.0, Linux Workbooth)
- [CVE-2024-9567](https://cve.now/CVE-2024-9567.md): D-Link DIR-619L B1 formAdvFirewall buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9566](https://cve.now/CVE-2024-9566.md): D-Link DIR-619L B1 formDeviceReboot buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-43047](https://cve.now/CVE-2024-43047.md): Use After Free in DSP Service (CVSS 7.8, KEV, Qualcomm Snapdragon)
- [CVE-2024-38425](https://cve.now/CVE-2024-38425.md): Improper Authorization in Performance (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2024-38399](https://cve.now/CVE-2024-38399.md): Use After Free in Graphics (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-38397](https://cve.now/CVE-2024-38397.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33073](https://cve.now/CVE-2024-33073.md): Buffer Over-read in WLAN Host Communication (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-33071](https://cve.now/CVE-2024-33071.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33070](https://cve.now/CVE-2024-33070.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33069](https://cve.now/CVE-2024-33069.md): Use After Free in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33066](https://cve.now/CVE-2024-33066.md): Improper Input Validation in WLAN Resource Manager (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2024-33065](https://cve.now/CVE-2024-33065.md): Improper Input Validation in Camera (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33064](https://cve.now/CVE-2024-33064.md): Buffer Over-read in WLAN Host Communication (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-33049](https://cve.now/CVE-2024-33049.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-23379](https://cve.now/CVE-2024-23379.md): Double Free in DSP Services (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23378](https://cve.now/CVE-2024-23378.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23376](https://cve.now/CVE-2024-23376.md): Use After Free in ComputerVision (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23375](https://cve.now/CVE-2024-23375.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in RIL (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23374](https://cve.now/CVE-2024-23374.md): Stack-based Buffer Overflow in Power Management IC (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23370](https://cve.now/CVE-2024-23370.md): Use After Free in Automotive Multimedia (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2024-23369](https://cve.now/CVE-2024-23369.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-21455](https://cve.now/CVE-2024-21455.md): Untrusted Pointer Dereference in DSP Service (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-42027](https://cve.now/CVE-2024-42027.md): The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they hav (CVSS 6.7, Rocket.Chat Mobile)
- [CVE-2024-45153](https://cve.now/CVE-2024-45153.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-47344](https://cve.now/CVE-2024-47344.md): WordPress uListing plugin \<= 2.1.5 - Sensitive Data Exposure vulnerability (CVSS 5.3, Stylemix uListing)
- [CVE-2024-47335](https://cve.now/CVE-2024-47335.md): WordPress Bit Form plugin \<= 2.13.11 - SQL Injection vulnerability (CVSS 7.6, Bit Apps Bit Form)
- [CVE-2024-20102](https://cve.now/CVE-2024-20102.md): In wlan driver, there is a possible out of bounds read due to improper input validation. (CVSS 4.9, MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8678, MT…)
- [CVE-2024-20099](https://cve.now/CVE-2024-20099.md): In power, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6768, MT6833, MT6853, MT6877, MT6893, MT8532)
- [CVE-2024-20098](https://cve.now/CVE-2024-20098.md): In power, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6768, MT6779, MT6781, MT6785, MT6833, MT6853, MT…)
- [CVE-2024-20097](https://cve.now/CVE-2024-20097.md): In vdec, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6761, MT6765, MT6768, MT6785, MT6789, MT6853, MT…)
- [CVE-2024-20096](https://cve.now/CVE-2024-20096.md): In m4u, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20095](https://cve.now/CVE-2024-20095.md): In m4u, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20094](https://cve.now/CVE-2024-20094.md): In Modem, there is a possible system crash due to a missing bounds check. (CVSS 7.5, MediaTek MT2735, MT6833, MT6853, MT6855, MT6873, MT6875, MT…)
- [CVE-2024-20103](https://cve.now/CVE-2024-20103.md): In wlan firmware, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT…)
- [CVE-2024-20101](https://cve.now/CVE-2024-20101.md): In wlan driver, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT…)
- [CVE-2024-20100](https://cve.now/CVE-2024-20100.md): In wlan driver, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT3605, MT6985, MT6989, MT6990, MT7927, MT8183, MT…)
- [CVE-2024-20093](https://cve.now/CVE-2024-20093.md): In vdec, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…)
- [CVE-2024-20092](https://cve.now/CVE-2024-20092.md): In vdec, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…)
- [CVE-2024-20091](https://cve.now/CVE-2024-20091.md): In vdec, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…)
- [CVE-2024-20090](https://cve.now/CVE-2024-20090.md): In vdec, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT…)
- [CVE-2024-9565](https://cve.now/CVE-2024-9565.md): D-Link DIR-605L formSetPassword buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-9564](https://cve.now/CVE-2024-9564.md): D-Link DIR-605L formWlanWizardSetup buffer overflow (CVSS 8.7, D-Link DIR-605L)
- [CVE-2024-28709](https://cve.now/CVE-2024-28709.md): Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted scrip (CVSS 6.1, limesurvey/limesurvey)
- [CVE-2024-28710](https://cve.now/CVE-2024-28710.md): Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input (CVSS 6.1, limesurvey/limesurvey)
- [CVE-2024-42831](https://cve.now/CVE-2024-42831.md): A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary Java (CVSS 6.1)
- [CVE-2024-44068](https://cve.now/CVE-2024-44068.md): An issue was discovered in the m2m scaler driver in Samsung Mobile Processor and Wearable Processor Exynos 9820, 9825, 980, 990, 850,and W92 (CVSS 8.1)
- [CVE-2024-44674](https://cve.now/CVE-2024-44674.md): D-Link COVR-2600R FW101b05 is vulnerable to Buffer Overflow. (CVSS 5.7)
- [CVE-2024-45873](https://cve.now/CVE-2024-45873.md): A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a cra (CVSS 9.8)
- [CVE-2024-45874](https://cve.now/CVE-2024-45874.md): A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafte (CVSS 9.8)
- [CVE-2024-45894](https://cve.now/CVE-2024-45894.md): BlueCMS 1.6 suffers from Arbitrary File Deletion via the file\_name parameter in an /admin/database.php?act=del request. (CVSS 4.9)
- [CVE-2024-45919](https://cve.now/CVE-2024-45919.md): A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. (CVSS 6.5)
- [CVE-2024-45932](https://cve.now/CVE-2024-45932.md): Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. (CVSS 7.1, krayin/laravel-crm)
- [CVE-2024-45933](https://cve.now/CVE-2024-45933.md): OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary f (CVSS 6.6)
- [CVE-2024-46040](https://cve.now/CVE-2024-46040.md): IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. (CVSS 6.5)
- [CVE-2024-46041](https://cve.now/CVE-2024-46041.md): IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay. (CVSS 8.8)
- [CVE-2024-46076](https://cve.now/CVE-2024-46076.md): RuoYi v4.7.9 and before has a security flaw that allows escaping from comments within the code generation feature, enabling the injection of (CVSS 9.8)
- [CVE-2024-46278](https://cve.now/CVE-2024-46278.md): Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console. (CVSS 8.4)
- [CVE-2024-46300](https://cve.now/CVE-2024-46300.md): itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php. (CVSS 6.1)
- [CVE-2024-46325](https://cve.now/CVE-2024-46325.md): TP-Link WR740N V6 has a stack overflow vulnerability via the ssid parameter in /userRpm/popupSiteSurveyRpm.htm url. (CVSS 5.5)
- [CVE-2024-46446](https://cve.now/CVE-2024-46446.md): Mecha CMS 3.0.0 is vulnerable to Directory Traversal. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.