CVEs published October 10, 2024
118 CVEs were published on October 10, 2024: 7 critical, 28 high.
- Published
- 118
- Critical
- 7
- High
- 28
- Medium
- 72
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 49
Most affected products
- Adobe Commerce · magento/community-edition
- 20
- gradio-app gradio · gradio
- 12
- D-Link DIR-619L B1
- 5
- Delta Electronics CNCSoft-G2
- 5
- code-projects Blood Bank System
- 4
- GitLab
- 4
- LyLme_spage
- 3
- User registration & user profile – UserPlus
- 3
- Adobe Commerce
- 2
- Codezips Pharmacy Management System
- 2
Critical 7
- CVE-2024-9487An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabledGitHub Enterprise Server
- CVE-2024-47636WordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerabilityeyecix JobSearch
- CVE-2023-25581Deserialization of untrusted data in InternalAttributeHandler in pac4jpac4j · org.pac4j:pac4j-core
- CVE-2024-9201SQL injection vulnerability in SEUR pluginSEUR plugin
- CVE-2024-45115Adobe Commerce | Improper Authentication (CWE-287)Adobe Commerce
- CVE-2024-9518UserPlus <= 2.0 - Unauthenticated Privilege EscalationUser registration & user profile – UserPlus
- CVE-2024-48949The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) ||elliptic
High 28
- CVE-2024-47870Race condition in update_root_in_config may redirect user traffic in Gradiogradio-app gradio · gradio
- CVE-2024-47871Insecure communication between the FRP client and server in Gradiogradio-app gradio · gradio
- CVE-2024-9180Vault Operators in Root Namespace May Elevate Their PrivilegesHashiCorp Vault · github.com/hashicorp/vault +1
- CVE-2024-47966Use of Uninitialized Variable vulnerability in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-47965Out-of-bounds Read vulnerability in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-47964Heap-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-47963Out-of-bounds Write vulnerability in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-47962Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-9312Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions.Canonical Authd · github.com/ubuntu/authd
- CVE-2024-9786D-Link DIR-619L B1 formSetLog buffer overflowD-Link DIR-619L B1
- CVE-2024-9785D-Link DIR-619L B1 formSetDDNS buffer overflowD-Link DIR-619L B1
- CVE-2024-6530Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-9784D-Link DIR-619L B1 formResetStatistic buffer overflowD-Link DIR-619L B1
- CVE-2024-9783D-Link DIR-619L B1 formLogDnsquery buffer overflowD-Link DIR-619L B1
- CVE-2024-9782D-Link DIR-619L B1 formEasySetupWWConfig buffer overflowD-Link DIR-619L B1
- CVE-2024-8977Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2024-45117Adobe Commerce | Improper Input Validation (CWE-20)Adobe Commerce · magento/community-edition
- CVE-2024-45116Adobe Commerce | Cross-site Scripting (XSS) (CWE-79)Adobe Commerce · magento/community-edition
- CVE-2024-45148Adobe Commerce | Improper Authentication (CWE-287)Adobe Commerce
- CVE-2024-9781Improper Handling of Missing Values in WiresharkWireshark Foundation Wireshark
- CVE-2024-9780Missing Initialization of a Variable in WiresharkWireshark Foundation Wireshark
- CVE-2024-9022TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parametertotalsoft TS Poll – Survey, Versus Poll, Image Poll, Video…
- CVE-2024-9581Shortcodes AnyWhere <= 1.0.1 - Unauthenticated Arbitrary Shortcode Executionhappyplugins Shortcodes AnyWhere
- CVE-2024-9522WP Users Masquerade <= 2.0.0 - Authenticated (Subscriber+) Authentication Bypasslagunaisw WP Users Masquerade
- CVE-2024-9519UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege EscalationUser registration & user profile – UserPlus
- CVE-2024-35202Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by includi
- CVE-2024-48957execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file
- CVE-2024-48958execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file
Medium, low and unrated 83
- CVE-2024-9818SourceCodester Online Veterinary Appointment System manage_category.php sql injectionSourceCodester Online Veterinary Appointment System
- CVE-2024-9817code-projects Blood Bank System update.php sql injectioncode-projects Blood Bank System
- CVE-2024-47867Lack of integrity check on the downloaded FRP client in Gradiogradio-app gradio · gradio
- CVE-2024-47868Several components’ post-process steps may allow arbitrary file leaks in Gradiogradio-app gradio · gradio
- CVE-2024-47869Non-constant-time comparison when comparing hashes in Gradiogradio-app gradio · gradio
- CVE-2024-47872Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG filesgradio-app gradio · gradio
- CVE-2024-9816Codezips Tourist Management System change-image.php unrestricted uploadCodezips Tourist Management System
- CVE-2024-47084CORS origin validation is not performed when the request has a cookie in Gradiogradio-app gradio · gradio
- CVE-2024-47164The `is_in_or_equal` function may be bypassed in Gradiogradio-app gradio · gradio
- CVE-2024-47165CORS origin validation accepts the null origin in Gradiogradio-app gradio · gradio
- CVE-2024-47166One-level read path traversal in `/custom_component` in Gradiogradio-app gradio · gradio
- CVE-2024-47167SSRF in the path parameter of /queue/join in Gradiogradio-app gradio · gradio
- CVE-2024-47168The `enable_monitoring` flag set to `False` does not disable monitoring in Gradiogradio-app gradio · gradio
- CVE-2024-9815Codezips Tourist Management System create-package.php unrestricted uploadCodezips Tourist Management System
- CVE-2024-9814Codezips Pharmacy Management System update.php sql injectionCodezips Pharmacy Management System
- CVE-2024-9813Codezips Pharmacy Management System register.php sql injectionCodezips Pharmacy Management System
- CVE-2024-9812code-projects Crud Operation System delete.php sql injectioncode-projects Crud Operation System
- CVE-2024-9811code-projects Restaurant Reservation System filter3.php sql injectioncode-projects Restaurant Reservation System
- CVE-2024-9810SourceCodester Record Management System sort2_user.php cross site scriptingSourceCodester Record Management System
- CVE-2024-9809SourceCodester Online Eyewear Shop Master.php delete_product sql injectionSourceCodester Online Eyewear Shop
- CVE-2024-9808SourceCodester Online Eyewear Shop sql injectionSourceCodester Online Eyewear Shop
- CVE-2024-9807Craig Rodway Classroombookings Session Page sessions cross site scriptingCraig Rodway Classroombookings
- CVE-2024-9806Craig Rodway Classroombookings Room Page fields cross site scriptingCraig Rodway Classroombookings
- CVE-2024-47354WordPress Simple Membership After Login Redirection plugin <= 1.6 - Open Redirection vulnerabilitywp.insider Simple Membership After Login Redirection
- CVE-2024-47648WordPress EventPrime plugin <= 4.0.4.5 - Open Redirection vulnerabilityMetagauss EventPrime
- CVE-2024-9805code-projects Blood Bank System campsdetails.php cross site scriptingcode-projects Blood Bank System
- CVE-2024-9804code-projects Blood Bank System campsdetails.php sql injectioncode-projects Blood Bank System
- CVE-2024-9803code-projects Blood Bank Management System blooddetails.php cross site scriptingcode-projects Blood Bank Management System
- CVE-2024-9799SourceCodester Profile Registration without Reload Refresh add.php cross site scriptingSourceCodester Profile Registration without Reload Refresh
- CVE-2024-9797code-projects Blood Bank System register.php sql injectioncode-projects Blood Bank System
- CVE-2024-9794Codezips Online Shopping Portal update-image1.php unrestricted uploadCodezips Online Shopping Portal
- CVE-2024-9793Tenda AC1206 ate ate_ifconfig_set command injectionTenda AC1206
- CVE-2024-9792D-Link DSL-2750U Port Forwarding Page cross site scriptingD-Link DSL-2750U
- CVE-2024-9790LyLme_spage sou.php sql injectionLyLme_spage
- CVE-2024-9789LyLme_spage apply.php sql injectionLyLme_spage
- CVE-2024-9788LyLme_spage tag.php sql injectionLyLme_spage
- CVE-2024-4658SQLi in TE Informatics' Nova CMSTE Informatics Nova CMS
- CVE-2024-9787Contemporary Control System BASrouter BACnet BASRT-B UDP Packet denial of serviceContemporary Control System BASrouter BACnet BASRT-B
- CVE-2024-6157An attacker who successfully exploited these vulnerabilities could cause the robot to stop.ABB RobotWare
- CVE-2024-48902In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via APJetBrains YouTrack
- CVE-2024-9596Inclusion of Sensitive Information in Source Code in GitLabGitLab
- CVE-2024-45127Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Commerce · magento/community-edition
- CVE-2024-45128Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition
- CVE-2024-45133Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45124Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45123Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Commerce · magento/community-edition
- CVE-2024-45121Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45119Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Commerce · magento/community-edition
- CVE-2024-45122Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45135Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45120Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)Adobe Commerce · magento/community-edition
- CVE-2024-45130Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45132Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition
- CVE-2024-45131Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition
- CVE-2024-45134Adobe Commerce | Information Exposure (CWE-200)Adobe Commerce · magento/community-edition
- CVE-2024-45129Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45118Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45149Adobe Commerce | Improper Access Control (CWE-284)Adobe Commerce · magento/community-edition
- CVE-2024-45125Adobe Commerce | Incorrect Authorization (CWE-863)Adobe Commerce · magento/community-edition
- CVE-2024-9623Incorrect Authorization in GitLabGitLab
- CVE-2024-22068Weak Password Vulnerability in ZTE ZSR V2 Intelligent Multi Service RouterZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 1…
- CVE-2024-6747Information leak in mknotifydCheckmk
- CVE-2024-9802Conformance validation endpoint discloses detail about service to unauthenticated usersOpen Mainframe Project Zowe
- CVE-2024-9796WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL InjectionWP-Advanced-Search
- CVE-2024-9798Health endpoint offers list of onboarded services to unauthenticated usersOpen Mainframe Project Zowe
- CVE-2024-9156TI WooCommerce Wishlist <= 2.8.2 - Unauthenticated SQL Injection via lang parametersTI WooCommerce Wishlist
- CVE-2024-9074Advanced Blocks Pro <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadessamamdani Advanced Blocks Pro
- CVE-2024-9520UserPlus <= 2.0 - Missing Authorization via Multiple FunctionsUser registration & user profile – UserPlus
- CVE-2024-9067Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment DeletionYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2024-8477Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.87 - Cross-Site Request Forgeryneeraj_slit Brevo – Email, SMS, Web Push, Chat, and more.
- CVE-2024-8729Easy Social Share Buttons <= 1.4.5 - Reflected Cross-Site Scriptingbrianbrey Easy Social Share Buttons
- CVE-2024-9685Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Messagerainafarai Notification for Telegram
- CVE-2024-9057Curator.io: Show all your social media posts in a beautiful feed. <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via feed_id Attributecuratorio Curator.io
- CVE-2024-9377Products, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site Scriptingwpcodefactory Export Products, Orders & Customers for WooCo…
- CVE-2024-9065WP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_testmatbao WP Helper Premium
- CVE-2024-9064Elementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadnamogo Elementor Inline SVG
- CVE-2024-9066Marketing and SEO Booster <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploaddale668 Marketing and SEO Booster
- CVE-2024-8987Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media ShortcodeYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2024-8513QA Analytics <= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Updatequarka QA Assistants – Driven by data
- CVE-2024-9205Maximum Products per User for WooCommerce <= 4.2.8 - Reflected Cross-Site Scriptingwpcodefactory Maximum Products per User for WooCommerce
- CVE-2024-9072GDPR-Extensions-com – Consent Manager <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadgdprextensionscom GDPR-Extensions-com – Consent Manager
- CVE-2024-9457WP Builder <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadcssjockey WP Builder
- CVE-2024-7048IDOR in open-webui/open-webuiopen-webui/open-webui