# CVEs published 2024-10-11

132 CVEs were published on October 11, 2024: 20 critical, 52 high. Days are UTC.

- [CVE-2024-38365](https://cve.now/CVE-2024-38365.md): btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality (CVSS 7.4, btcsuite btcd · github.com/btcsuite/btcd)
- [CVE-2024-47884](https://cve.now/CVE-2024-47884.md): Insecure Temporary File in \`foxmarks\` (CVSS 2.4, zefr0x foxmarks)
- [CVE-2024-48041](https://cve.now/CVE-2024-48041.md): WordPress CM Tooltip Glossary plugin \<= 4.3.9 - Stored Cross-Site Scripting vulnerability (CVSS 6.5, CreativeMindsSolutions CM Tooltip Glossary)
- [CVE-2024-48040](https://cve.now/CVE-2024-48040.md): WordPress Tainacan plugin \<= 0.21.8 - SQL Injection vulnerability (CVSS 8.5, Tainacan)
- [CVE-2024-8912](https://cve.now/CVE-2024-8912.md): HTTP Request Smuggling in Looker (CVSS 8.9, Google Looker)
- [CVE-2024-48033](https://cve.now/CVE-2024-48033.md): WordPress Talkback plugin \<= 1.0 - PHP Object Injection vulnerability (CVSS 9.8, baptiste.gourdin Talkback)
- [CVE-2024-47331](https://cve.now/CVE-2024-47331.md): WordPress Multi Step for Contact Form plugin \<= 2.7.7 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, Ninja Team Multi Step for Contact Form)
- [CVE-2024-48020](https://cve.now/CVE-2024-48020.md): WordPress Backup and Staging by WP Time Capsule plugin \<= 1.22.21 - SQL Injection vulnerability (CVSS 8.5, revmakx Backup and Staging by WP Time Capsule)
- [CVE-2024-47353](https://cve.now/CVE-2024-47353.md): WordPress ElementsReady Addons for Elementor plugin \<= 6.4.2 - Open Redirection vulnerability (CVSS 4.7, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2024-9539](https://cve.now/CVE-2024-9539.md): An information disclosure vulnerability was identified in GitHub Enterprise Server via attacker uploaded asset URL allowing the attacker to (CVSS 5.7, GitHub Enterprise Server)
- [CVE-2024-44157](https://cve.now/CVE-2024-44157.md): A stack buffer overflow was addressed through improved input validation. (CVSS 5.5, Apple TV · Apple iTunes for Windows)
- [CVE-2024-47877](https://cve.now/CVE-2024-47877.md): Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory. (CVSS 6.9, codeclysm extract · github.com/codeclysm/extract +2)
- [CVE-2024-9859](https://cve.now/CVE-2024-9859.md): Type confusion in WebAssembly in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to execute arbitrary code via a crafted HTM (CVSS 8.8, Google Chrome)
- [CVE-2024-47507](https://cve.now/CVE-2024-47507.md): Junos OS and Junos OS Evolved: BGP update message containing aggregator attribute with an ASN value of zero (0) is accepted (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2024-6985](https://cve.now/CVE-2024-6985.md): Path Traversal in api open\_personality\_folder in parisneo/lollms-webui (CVSS 4.4, parisneo/lollms · lollms)
- [CVE-2024-47506](https://cve.now/CVE-2024-47506.md): Junos OS: SRX Series: A large amount of traffic being processed by ATP Cloud can lead to a PFE crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2024-47509](https://cve.now/CVE-2024-47509.md): Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #3 (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-47508](https://cve.now/CVE-2024-47508.md): Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #2 (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-47505](https://cve.now/CVE-2024-47505.md): Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #1 (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-47504](https://cve.now/CVE-2024-47504.md): Junos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-47503](https://cve.now/CVE-2024-47503.md): Junos OS: SRX4600 and SRX5000 Series: Sequence of specific PIM packets causes a flowd crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-47502](https://cve.now/CVE-2024-47502.md): Junos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-47501](https://cve.now/CVE-2024-47501.md): Junos OS: MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C: In a VPLS or Junos Fusion scenario specific show commands cause FPCs to crash (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2024-47499](https://cve.now/CVE-2024-47499.md): Junos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-47498](https://cve.now/CVE-2024-47498.md): Junos OS Evolved: QFX5000 Series: Configured MAC learning and move limits are not in effect (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-47497](https://cve.now/CVE-2024-47497.md): Junos OS: SRX Series, QFX Series, MX Series and EX Series: Receiving specific HTTPS traffic causes resource exhaustion (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-47496](https://cve.now/CVE-2024-47496.md): Junos OS: MX Series: The PFE will crash on running specific command (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2024-47495](https://cve.now/CVE-2024-47495.md): Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device. (CVSS 6.7, Juniper Networks Junos OS Evolved)
- [CVE-2024-47494](https://cve.now/CVE-2024-47494.md): Junos OS: Due to a race condition AgentD process causes a memory corruption and FPC reset (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2024-47493](https://cve.now/CVE-2024-47493.md): Junos OS: MX Series: Trio-based FPCs: Continuous physical Interface flaps causes local FPC to crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-47491](https://cve.now/CVE-2024-47491.md): Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP path attribute leads to an RPD crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2024-47490](https://cve.now/CVE-2024-47490.md): Junos OS Evolved: ACX 7000 Series: Receipt of specific transit MPLS packets causes resources to be exhausted (CVSS 8.2, Juniper Networks Junos OS Evolved)
- [CVE-2024-47489](https://cve.now/CVE-2024-47489.md): Junos OS Evolved: ACX Series: Receipt of specific transit protocol packets is incorrectly processed by the RE (CVSS 5.8, Juniper Networks Junos OS Evolved)
- [CVE-2024-39563](https://cve.now/CVE-2024-39563.md): Junos Space: Remote Command Execution (RCE) vulnerability in web application (CVSS 7.3, Juniper Networks Junos Space)
- [CVE-2024-39547](https://cve.now/CVE-2024-39547.md): Junos OS and Junos OS Evolved: cRPD: Receipt of crafted TCP traffic can trigger high CPU utilization (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-8376](https://cve.now/CVE-2024-8376.md): Memory leak (CVSS 7.2, Eclipse Foundation Mosquitto)
- [CVE-2024-39544](https://cve.now/CVE-2024-39544.md): Junos OS Evolved: Low privileged local user able to view NETCONF traceoptions files (CVSS 5.0, Juniper Networks Junos OS Evolved)
- [CVE-2024-39534](https://cve.now/CVE-2024-39534.md): Junos OS Evolved: Connections to the network and broadcast address accepted (CVSS 5.4, Juniper Networks Junos OS Evolved)
- [CVE-2024-33582](https://cve.now/CVE-2024-33582.md): A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileg (CVSS 7.8, Lenovo Service Framework)
- [CVE-2024-33581](https://cve.now/CVE-2024-33581.md): A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with (CVSS 7.8, Lenovo PC Manager AI intelligent scenario)
- [CVE-2024-39527](https://cve.now/CVE-2024-39527.md): Junos OS: SRX Series: Low privileged user able to access sensitive information on file system (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2024-33580](https://cve.now/CVE-2024-33580.md): A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo Personal Cloud)
- [CVE-2024-33579](https://cve.now/CVE-2024-33579.md): A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo Baiying)
- [CVE-2024-39526](https://cve.now/CVE-2024-39526.md): Junos OS and Junos OS Evolved: MX Series with MPC10/MPC11/LC9600, MX304, EX9200, PTX Series: Receipt of malformed DHCP packets causes interfaces to stop processing packets (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-33578](https://cve.now/CVE-2024-33578.md): A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo Leyun)
- [CVE-2024-9046](https://cve.now/CVE-2024-9046.md): A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo stARstudio)
- [CVE-2024-4132](https://cve.now/CVE-2024-4132.md): A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo Lock Screen)
- [CVE-2024-4131](https://cve.now/CVE-2024-4131.md): A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo Emulator)
- [CVE-2024-4130](https://cve.now/CVE-2024-4130.md): A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo App Store)
- [CVE-2024-4089](https://cve.now/CVE-2024-4089.md): A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8, Lenovo SuperFile)
- [CVE-2024-5474](https://cve.now/CVE-2024-5474.md): A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2 (CVSS 5.5, Lenovo Dolby Vision Provisioning software)
- [CVE-2024-47875](https://cve.now/CVE-2024-47875.md): DOMPurify nesting-based mXSS (CVSS 10.0, cure53 DOMPurify · dompurify)
- [CVE-2024-47830](https://cve.now/CVE-2024-47830.md): Plane allows server side request forgery via /\_next/image endpoint (CVSS 9.3, makeplane plane)
- [CVE-2024-47074](https://cve.now/CVE-2024-47074.md): Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability (CVSS 9.3, dataease)
- [CVE-2024-45402](https://cve.now/CVE-2024-45402.md): Picotls double free (CVSS 8.6, h2o picotls)
- [CVE-2024-45396](https://cve.now/CVE-2024-45396.md): Quicly assertion failures (CVSS 7.5, h2o quicly)
- [CVE-2024-45403](https://cve.now/CVE-2024-45403.md): H2O assertion failure when HTTP/3 requests are cancelled (CVSS 3.7, h2o)
- [CVE-2024-45397](https://cve.now/CVE-2024-45397.md): H2O alllows bypassing address-based access control with 0-RTT (CVSS 5.9, h2o)
- [CVE-2024-25622](https://cve.now/CVE-2024-25622.md): H2O ignores headers configuration directives (CVSS 3.1, h2o)
- [CVE-2024-8755](https://cve.now/CVE-2024-8755.md): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (CVSS 8.4, Progress LoadMaster)
- [CVE-2024-8530](https://cve.now/CVE-2024-8530.md): CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause exposure of private data when an already generat (CVSS 5.9, Schneider Electric Data Center Expert)
- [CVE-2024-6657](https://cve.now/CVE-2024-6657.md): BLE peripheral DoS after few cycles of connect/disconnects (CVSS 6.5, silabs.com EFR32 BLE SDK)
- [CVE-2024-8531](https://cve.now/CVE-2024-8531.md): CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could compromise the Data Center Expert software when an (CVSS 7.2, Schneider Electric Data Center Expert)
- [CVE-2024-9002](https://cve.now/CVE-2024-9002.md): CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized access, loss of confidentiality, integrity, and av (CVSS 7.8, Schneider Electric Easergy Studio)
- [CVE-2024-9856](https://cve.now/CVE-2024-9856.md): 07FLYCMS/07FLY-CMS/07FlyCRM System Settings Page cross site scripting (CVSS 5.1, 07FLYCMS · 07FLY-CMS +1)
- [CVE-2024-9855](https://cve.now/CVE-2024-9855.md): 07FLYCMS/07FLY-CMS/07FlyCRM Module Plug-In sysmodule\_1 uploadFile unrestricted upload (CVSS 5.1, 07FLYCMS · 07FLY-CMS +1)
- [CVE-2024-8970](https://cve.now/CVE-2024-8970.md): Incorrect Authorization in GitLab (CVSS 8.2, GitLab)
- [CVE-2024-6971](https://cve.now/CVE-2024-6971.md): Path Traversal in parisneo/lollms-webui (CVSS 3.4, parisneo/lollms · lollms)
- [CVE-2023-42133](https://cve.now/CVE-2023-42133.md): PAX Android based POS devices allow for escalation of privilege via improperly configured scripts. (CVSS 6.7, PAX POS terminals)
- [CVE-2024-5005](https://cve.now/CVE-2024-5005.md): Incorrect Provision of Specified Functionality in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-9164](https://cve.now/CVE-2024-9164.md): Missing Authentication for Critical Function in GitLab (CVSS 9.6, GitLab)
- [CVE-2024-9538](https://cve.now/CVE-2024-9538.md): ShopLentor \<= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template (CVSS 4.3, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-8913](https://cve.now/CVE-2024-8913.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content\_template (CVSS 4.3, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-7514](https://cve.now/CVE-2024-7514.md): WordPress Comments Import & Export \<= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal (CVSS 6.5, webtoffee Comments Import & Export)
- [CVE-2024-45317](https://cve.now/CVE-2024-45317.md): A Server-Side Request Forgery (SSRF) vulnerability in SMA1000 appliance firmware versions 12.4.3-02676 and earlier allows a remote, unauthen (CVSS 7.5, SonicWall SMA1000)
- [CVE-2024-45316](https://cve.now/CVE-2024-45316.md): The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier (CVSS 7.8, SonicWall Connect Tunnel)
- [CVE-2024-45315](https://cve.now/CVE-2024-45315.md): The Improper link resolution before file access ('Link Following') vulnerability in SonicWall Connect Tunnel (version 12.4.3.271 and earlier (CVSS 5.5, SonicWall Connect Tunnel)
- [CVE-2024-9051](https://cve.now/CVE-2024-9051.md): WP Ultimate Post Grid \<= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode (CVSS 6.4, brechtvds WP Ultimate Post Grid)
- [CVE-2024-9507](https://cve.now/CVE-2024-9507.md): Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder \<= 2.15.2 - Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read (CVSS 4.9, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2024-9211](https://cve.now/CVE-2024-9211.md): FULL – Cliente \<= 3.1.22 - Reflected Cross-Site Scripting (CVSS 6.1, fullservices FULL – Cliente)
- [CVE-2024-9610](https://cve.now/CVE-2024-9610.md): Language Switcher \<= 3.7.13 - Reflected Cross-Site Scripting (CVSS 6.1, rafasashi Language Switcher)
- [CVE-2024-9234](https://cve.now/CVE-2024-9234.md): GutenKit \<= 2.1.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, ataurr GutenKit – Page Builder Blocks, Patterns, and Templa…)
- [CVE-2024-9232](https://cve.now/CVE-2024-9232.md): Download Plugins and Themes in ZIP from Dashboard \<= 1.9.1 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory Download Plugins and Themes in ZIP from Dashb…)
- [CVE-2024-9707](https://cve.now/CVE-2024-9707.md): Hunk Companion \<= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation (CVSS 9.8, themehunk Hunk Companion)
- [CVE-2024-9436](https://cve.now/CVE-2024-9436.md): PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes \<= 3.5.14 - Reflected Cross-Site Scripting (CVSS 6.1, PublishPress Revisions: Duplicate Posts, Submit, Approve an…)
- [CVE-2024-9221](https://cve.now/CVE-2024-9221.md): Tainacan \<= 0.21.10 - Reflected Cross-Site Scripting (CVSS 6.1, Tainacan)
- [CVE-2024-9616](https://cve.now/CVE-2024-9616.md): BlockMeister – Block Pattern Builder \<= 3.1.10 - Reflected Cross-Site Scripting (CVSS 6.1, BlockMeister – Block Pattern Builder)
- [CVE-2024-9346](https://cve.now/CVE-2024-9346.md): Embed videos and respect privacy \<= 1.2 - Reflected Cross-Site Scripting (CVSS 6.1, michaelzangl Embed videos and respect privacy)
- [CVE-2024-9611](https://cve.now/CVE-2024-9611.md): Increase upload file size & Maximum Execution Time limit \<= 2.0 - Reflected Cross-Site Scripting (CVSS 6.1, ttodua Increase upload file size & Maximum Execution Time l…)
- [CVE-2024-9586](https://cve.now/CVE-2024-9586.md): Linkz.ai \<= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update (CVSS 6.5, vittor1o Linkz.ai – Automatic link previews on hover)
- [CVE-2024-9587](https://cve.now/CVE-2024-9587.md): Linkz.ai \<= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX (CVSS 5.4, vittor1o Linkz.ai – Automatic link previews on hover)
- [CVE-2024-9543](https://cve.now/CVE-2024-9543.md): Powerpress \<= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode (CVSS 6.4, PowerPress Podcasting plugin by Blubrry)
- [CVE-2024-21534](https://cve.now/CVE-2024-21534.md): All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. (CVSS 9.8, jsonpath-plus · org.webjars.npm:jsonpath-plus)
- [CVE-2024-9822](https://cve.now/CVE-2024-9822.md): Pedalo Connector \<= 2.0.5 - Authentication Bypass to Administrator (CVSS 9.8, pedaloagency Pedalo Connector)
- [CVE-2024-35517](https://cve.now/CVE-2024-35517.md): Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb\_remote\_smb\_conf.cgi via the share\_name parameter. (CVSS 8.4)
- [CVE-2024-35522](https://cve.now/CVE-2024-35522.md): Netgear EX3700 ' AC750 WiFi Range Extender Essentials Edition before 1.0.0.98 contains an authenticated command injection in operating\_mode. (CVSS 8.4)
- [CVE-2024-42018](https://cve.now/CVE-2024-42018.md): An issue was discovered in Atos Eviden SMC xScale before 1.6.6. (CVSS 7.7)
- [CVE-2024-42640](https://cve.now/CVE-2024-42640.md): angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. (CVSS 9.8, angular-base64-upload)
- [CVE-2024-44413](https://cve.now/CVE-2024-44413.md): A vulnerability was discovered in DI\_8200-16.07.26A1, which has been classified as critical. (CVSS 8.8)
- [CVE-2024-44414](https://cve.now/CVE-2024-44414.md): A vulnerability was discovered in FBM\_292W-21.03.10V, which has been classified as critical. (CVSS 8.8)
- [CVE-2024-44415](https://cve.now/CVE-2024-44415.md): A vulnerability was discovered in DI\_8200-16.07.26A1, There is a buffer overflow in the dbsrv\_asp function; The strcpy function is executed (CVSS 6.5)
- [CVE-2024-44729](https://cve.now/CVE-2024-44729.md): Incorrect access control in the component app/src/server.js of Mirotalk before commit 9de226 allows unauthenticated attackers without presen (CVSS 7.5)
- [CVE-2024-44730](https://cve.now/CVE-2024-44730.md): Incorrect access control in the function handleDataChannelChat(dataMessage) of Mirotalk before commit c21d58 allows attackers to forge chat (CVSS 9.1)
- [CVE-2024-44731](https://cve.now/CVE-2024-44731.md): Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to execu (CVSS 4.7)
- [CVE-2024-44734](https://cve.now/CVE-2024-44734.md): Incorrect access control in Mirotalk before commit 9de226 allows attackers to arbitrarily change usernames via sending a crafted roomAction (CVSS 7.5)
- [CVE-2024-44807](https://cve.now/CVE-2024-44807.md): A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. (CVSS 5.3)
- [CVE-2024-45184](https://cve.now/CVE-2024-45184.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with chipset Exynos 9820, 9825, 980, 990, 850, 1080, 210 (CVSS 6.2)
- [CVE-2024-45754](https://cve.now/CVE-2024-45754.md): An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x be (CVSS 7.2)
- [CVE-2024-46088](https://cve.now/CVE-2024-46088.md): An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management (CVSS 9.8)
- [CVE-2024-46215](https://cve.now/CVE-2024-46215.md): A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub\_445BDC() function within the /usr/sbin/goahead progr (CVSS 6.5)
- [CVE-2024-46468](https://cve.now/CVE-2024-46468.md): A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress \<= v5.1.1, which can be exploited by an attacker to obtain sensitive (CVSS 7.5)
- [CVE-2024-46532](https://cve.now/CVE-2024-46532.md): SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class (CVSS 9.8)
- [CVE-2024-48768](https://cve.now/CVE-2024-48768.md): An issue in almaodo GmbH appinventor.ai\_google.almando\_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmwa (CVSS 7.5)
- [CVE-2024-48769](https://cve.now/CVE-2024-48769.md): An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update p (CVSS 9.1)
- [CVE-2024-48770](https://cve.now/CVE-2024-48770.md): An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update p (CVSS 8.2)
- [CVE-2024-48771](https://cve.now/CVE-2024-48771.md): An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware (CVSS 7.5)
- [CVE-2024-48772](https://cve.now/CVE-2024-48772.md): An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process. (CVSS 9.1)
- [CVE-2024-48773](https://cve.now/CVE-2024-48773.md): An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process (CVSS 7.5)
- [CVE-2024-48774](https://cve.now/CVE-2024-48774.md): An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware updat (CVSS 7.5)
- [CVE-2024-48775](https://cve.now/CVE-2024-48775.md): An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update proc (CVSS 7.5)
- [CVE-2024-48776](https://cve.now/CVE-2024-48776.md): An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process (CVSS 7.5)
- [CVE-2024-48777](https://cve.now/CVE-2024-48777.md): LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process. (CVSS 7.5)
- [CVE-2024-48778](https://cve.now/CVE-2024-48778.md): An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the (CVSS 9.1)
- [CVE-2024-48784](https://cve.now/CVE-2024-48784.md): An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the fi (CVSS 9.8)
- [CVE-2024-48786](https://cve.now/CVE-2024-48786.md): An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firm (CVSS 9.1)
- [CVE-2024-48787](https://cve.now/CVE-2024-48787.md): An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware upda (CVSS 9.1)
- [CVE-2024-48788](https://cve.now/CVE-2024-48788.md): An issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive information via the firmware update process. (CVSS 7.5)
- [CVE-2024-48813](https://cve.now/CVE-2024-48813.md): SQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html taskmatic 1.0 allows a remote attacker to execute (CVSS 8.8)
- [CVE-2024-48827](https://cve.now/CVE-2024-48827.md): An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password fun (CVSS 8.8)
- [CVE-2024-48937](https://cve.now/CVE-2024-48937.md): Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. (CVSS 6.1)
- [CVE-2024-48938](https://cve.now/CVE-2024-48938.md): Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows DoS/ReDos via email. (CVSS 7.5)
- [CVE-2024-48987](https://cve.now/CVE-2024-48987.md): Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP\_KEY. (CVSS 6.6, snipe/snipe-it)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.