CVEs published October 9, 2024
124 CVEs were published on October 9, 2024: 14 critical, 59 high. 3 are now in CISA KEV.
- Published
- 124
- Critical
- 14
- High
- 59
- Medium
- 37
- Low
- 4
- Unrated
- 10
- Now in CISA KEV
- 3
- Fix available
- 38
Most affected products
- Linux
- 17
- Adobe Animate
- 11
- Adobe Substance3D - Stager
- 8
- Adobe Framemaker
- 5
- Palo Alto Networks Expedition
- 5
- Progress Software Telerik Reporting
- 4
- Juniper Networks Junos OS
- 3
- Progress Software Telerik Report Server
- 3
- Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- 3
- VMware NSX, VMware Cloud Foundation
- 3
Critical 14
- CVE-2024-47832XML Signature Bypass via differential XML parsing in ssoreadyssoready · github.com/ssoready/ssoready
- CVE-2024-9465Expedition: SQL Injection Leads to Firewall Admin Credential DisclosurePalo Alto Networks Expedition
- CVE-2024-9464Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential DisclosurePalo Alto Networks Expedition
- CVE-2024-9463Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential DisclosurePalo Alto Networks Expedition
- CVE-2024-8015Telerik Report Server Insecure Type ResolutionProgress Software Telerik Reporting
- CVE-2024-47659smack: tcp: ipv4, fix incorrect labelingLinux
- CVE-2024-9680An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-46586cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.
- CVE-2024-25825FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the
- CVE-2024-32608HDF5 library through 1.14.3 has memory corruption in H5A__close resulting in the corruption of the instruction pointer and causing denial of
- CVE-2024-45160Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via
- CVE-2024-45746An issue was discovered in Trusted Firmware-M through 2.1.0.
- CVE-2024-48941The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to bypass 2FA by interacti
- CVE-2024-48942The Syracom Secure Login (2FA) plugin for Jira, Confluence, and Bitbucket through 3.1.4.5 allows remote attackers to easily brute-force the
High 59
- CVE-2024-39525Junos OS and Junos OS Evolved: When BGP traceoptions is enabled, receipt of specially crafted BGP packet causes RPD crashJuniper Networks Junos OS
- CVE-2024-39516Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crashJuniper Networks Junos OS
- CVE-2024-39515Junos OS and Junos OS Evolved: With BGP traceoptions enabled, receipt of specifically malformed BGP update causes RPD crashJuniper Networks Junos OS
- CVE-2024-3656Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitieskeycloak · Red Hat Build of Keycloak +3
- CVE-2024-9468PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted PacketPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1
- CVE-2024-9467Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session DisclosurePalo Alto Networks Expedition
- CVE-2024-9466Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential DisclosurePalo Alto Networks Expedition
- CVE-2024-43610Copilot Studio Information Disclosure VulnerabilityMicrosoft Copilot Studio
- CVE-2024-47670ocfs2: add bounds checking to ocfs2_xattr_find_entry()Linux
- CVE-2024-7292Account Controller allows high count of login attemptsProgress Software Telerik Report Server
- CVE-2024-7294Uncontrolled resource consumption of anonymous endpointsProgress Software Telerik Report Server
- CVE-2024-7293Password policy for new users is not strong enoughProgress Software Telerik Report Server
- CVE-2024-7840Improper neutralization special element in hyperlinksProgress Software Telerik Reporting
- CVE-2024-9675Buildah: buildah allows arbitrary directory mountbuildah · Red Hat Enterprise Linux +4
- CVE-2024-47425Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe Framemaker
- CVE-2024-47423Adobe Framemaker | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe Framemaker
- CVE-2024-47421Adobe Framemaker | Out-of-bounds Read (CWE-125)Adobe Framemaker
- CVE-2024-47424Adobe Framemaker | Integer Overflow or Wraparound (CWE-190)Adobe Framemaker
- CVE-2024-47422Adobe Framemaker | Untrusted Search Path (CWE-426)Adobe Framemaker
- CVE-2024-8048Telerik Reporting Insecure Expression EvaluationProgress Software Telerik Reporting
- CVE-2024-45137InDesign Desktop | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe InDesign Desktop
- CVE-2024-8014Telerik Reporting EntityDataSource Insecure Type ResolutionProgress Software Telerik Reporting
- CVE-2024-47669nilfs2: fix state management in error path of log writing functionLinux
- CVE-2024-47668lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()Linux
- CVE-2024-47667PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)Linux
- CVE-2024-45136InCopy | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe InCopy
- CVE-2024-47658crypto: stm32/cryp - call finalize with bh disabledLinux
- CVE-2024-45138Substance3D - Stager | Use After Free (CWE-416)Adobe Substance3D - Stager
- CVE-2024-45142Substance3D - Stager | Write-what-where Condition (CWE-123)Adobe Substance3D - Stager
- CVE-2024-45143Substance3D - Stager | Heap-based Buffer Overflow (CWE-122)Adobe Substance3D - Stager
- CVE-2024-45141Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2024-45152Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2024-45139Substance3D - Stager | Heap-based Buffer Overflow (CWE-122)Adobe Substance3D - Stager
- CVE-2024-45140Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2024-45144Substance3D - Stager | Out-of-bounds Write (CWE-787)Adobe Substance3D - Stager
- CVE-2024-9286SQLi in TRtek Software's Distant Education PlatformTRtek Software Distant Education Platform
- CVE-2024-45720Apache Subversion: Command line argument injection on Windows platformsApache Software Foundation Apache Subversion
- CVE-2024-28168Apache XML Graphics FOP: XML External Entity (XXE) ProcessingApache Software Foundation Apache XML Graphics FOP · org.ap…
- CVE-2024-47334WordPress Zoho Flow for WordPress plugin <= 2.7.1 - SQL Injection vulnerabilityZoho Flow
- CVE-2024-9575Local File Inclusion in pretix-widget WordPress pluginrami.io pretix Widget WordPress plugin
- CVE-2024-47410Animate | Stack-based Buffer Overflow (CWE-121)Adobe Animate
- CVE-2024-47415Animate | Use After Free (CWE-416)Adobe Animate
- CVE-2024-47417Animate | Heap-based Buffer Overflow (CWE-122)Adobe Animate
- CVE-2024-47416Animate | Integer Overflow or Wraparound (CWE-190)Adobe Animate
- CVE-2024-47413Animate | Use After Free (CWE-416)Adobe Animate
- CVE-2024-47414Animate | Use After Free (CWE-416)Adobe Animate
- CVE-2024-47418Animate | Use After Free (CWE-416)Adobe Animate
- CVE-2024-47411Animate | Access of Uninitialized Pointer (CWE-824)Adobe Animate
- CVE-2024-47412Animate | Use After Free (CWE-416)Adobe Animate
- CVE-2024-45146Dimension | Use After Free (CWE-416)Adobe Dimension
- CVE-2024-45150Dimension | Out-of-bounds Write (CWE-787)Adobe Dimension
- CVE-2023-37154check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with \
- CVE-2024-35288Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occu
- CVE-2024-45179An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.
- CVE-2024-46292A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name para
- CVE-2024-46304A NULL pointer dereference in libcoap v4.3.5-rc2 and below allows a remote attacker to cause a denial of service via the coap_handle_request
- CVE-2024-46307A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.
- CVE-2024-46316DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 function at /cgi-bin/mainfunction.c
- CVE-2024-47191pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running
Medium, low and unrated 51
- CVE-2024-8264Sensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05Fortra Robot Schedule Enterprise
- CVE-2024-30118HCL Connections is susceptible to a sensitive information disclosure vulnerabilityHCL Software Connections
- CVE-2024-7041IDOR in open-webui/open-webuiopen-webui/open-webui · open-webui
- CVE-2024-38815VMware NSX contains a content spoofing vulnerability.VMware NSX, VMware Cloud Foundation
- CVE-2024-38818VMware NSX contains a local privilege escalation vulnerability.VMware NSX, VMware Cloud Foundation
- CVE-2024-38817VMware NSX contains a command injection vulnerability.VMware NSX, VMware Cloud Foundation
- CVE-2024-47828Cross-Site Request Forgery in ampacheampache
- CVE-2024-47833Session Cookie without Secure and HTTPOnly flags in taipyAvaiga taipy · taipy
- CVE-2024-47815Cross-site Scripting in IncidentReportingmiraheze IncidentReporting
- CVE-2024-47816Users can impersonate import requesters if their actor IDs coincide in ImportDumpmiraheze ImportDump
- CVE-2024-47812Cross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDumpmiraheze ImportDump
- CVE-2024-47813Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violationsbytecodealliance wasmtime · wasmtime
- CVE-2024-47763Wasmtime runtime crash when combining tail calls with trapping importsbytecodealliance wasmtime · wasmtime-bin +1
- CVE-2024-9473GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks GlobalProtect App
- CVE-2024-9471PAN-OS: Privilege Escalation (PE) Vulnerability in XML APIPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-9470Cortex XSOAR: Information Disclosure VulnerabilityPalo Alto Networks Cortex XSOAR
- CVE-2024-9469Cortex XDR Agent: Local Windows User Can Disable the AgentPalo Alto Networks Cortex XDR Agent
- CVE-2024-47673wifi: iwlwifi: mvm: pause TCM when the firmware is stoppedLinux
- CVE-2024-47671USB: usbtmc: prevent kernel-usb-infoleakLinux
- CVE-2024-9671System: pdf invoices of the developer users can be seen if the url is known3scale · Red Hat 3scale API Management Platform
- CVE-2024-47666scsi: pm80xx: Set phy->enable_completion only when we wait for itLinux
- CVE-2024-47665i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setupLinux
- CVE-2024-47664spi: hisi-kunpeng: Add verification for the max_frequency provided by the firmwareLinux
- CVE-2024-47663staging: iio: frequency: ad9834: Validate frequency parameter valueLinux
- CVE-2024-47662drm/amd/display: Remove register from DCN35 DMCUB diagnostic collectionLinux
- CVE-2024-47661drm/amd/display: Avoid overflow from uint32_t to uint8_tLinux
- CVE-2024-47660fsnotify: clear PARENT_WATCHED flags lazilyLinux
- CVE-2024-46871drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAXLinux
- CVE-2024-46870drm/amd/display: Disable DMCUB timeout for DCN35Linux
- CVE-2024-45145Lightroom Desktop | Out-of-bounds Read (CWE-125)Adobe Lightroom Desktop
- CVE-2024-47419Animate | Out-of-bounds Read (CWE-125)Adobe Animate
- CVE-2024-47420Animate | Out-of-bounds Read (CWE-125)Adobe Animate
- CVE-2024-20787Substance3D - Painter | Out-of-bounds Read (CWE-125)Adobe Substance3D - Painter
- CVE-2024-9451Embed PDF Viewer <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via height and width Parametersafragen Embed PDF Viewer
- CVE-2024-39586Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability.Dell AppSync
- CVE-2024-9449Auto iFrame <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parametergregross Auto iFrame
- CVE-2024-39440In DRM service, there is a possible system crash due to null pointer dereference.Unisoc (Shanghai) Technologies Co. T606/T612/T616/T610/T618…
- CVE-2024-39439In DRM service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. T606/T612/T616/T610/T618…
- CVE-2024-39438In linkturbonative service, there is a possible command injection due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2024-39437In linkturbonative service, there is a possible command injection due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2024-39436In linkturbonative service, there is a possible command injection due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2024-5968Photo Gallery by 10Web <= 1.8.27 - Admin+ Stored XSSPhoto Gallery by 10Web
- CVE-2024-7963CMSMasters Content Composer <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCMSMasters Content Composer
- CVE-2023-36325i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation att
- CVE-2023-45359An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1.
- CVE-2023-45361An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1.
- CVE-2023-45872An issue was discovered in Qt before 6.2.11 and 6.3.x through 6.6.x before 6.6.1.
- CVE-2024-42934OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service
- CVE-2024-42988Lack of access control in ChallengeSolves (/api/v1/challenges/<challenge id>/solves) of CTFd v2.0.0 - v3.7.2 allows authenticated users to r
- CVE-2024-46237PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) via the patname, pataddress, and medhis parameters in
- CVE-2024-48933A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.19.3 allows remote attackers to inject arbitrary web script or HTML int