CVEs published October 14, 2024
76 CVEs were published on October 14, 2024: 8 critical, 29 high.
- Published
- 76
- Critical
- 8
- High
- 29
- Medium
- 33
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Splunk Enterprise
- 5
- Splunk Enterprise · Splunk Cloud Platform
- 5
- Enalean tuleap
- 4
- teamplus technology team+
- 3
- Checkmk
- 2
- Apache Software Foundation Apache ActiveMQ Artemis · org.ap…
- 1
- Apache Software Foundation Apache Roller
- 1
- authzed spicedb · github.com/authzed/spicedb
- 1
- CERT/CC VINCE - Vulnerability Information and Coordination…
- 1
- Eclipse Foundation Jetty · Eclipse Jetty Jetty +4
- 1
Critical 8
- CVE-2024-9924Hgiga OAKlouds - Arbitrary File Read And DeleteHgiga OAKlouds
- CVE-2024-9921TEAMPLUS TECHNOLOGY Team+ - SQL Injectionteamplus technology team+
- CVE-2023-48082Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generat
- CVE-2024-46535Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUserMsg.
- CVE-2024-48150D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.
- CVE-2024-48153DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the
- CVE-2024-48168A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execut
- CVE-2024-48823Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to es
High 29
- CVE-2024-9548Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scriptingveronalabs SlimStat Analytics
- CVE-2024-6207CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted Rockwell Automation ControlLogix® · Rockwell Automation… +3
- CVE-2024-45733Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on WindowsSplunk Enterprise
- CVE-2024-45732Low-privileged user could run search as nobody in SplunkDeploymentServerConfig appSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-45731Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate diskSplunk Enterprise
- CVE-2023-50780Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansApache Software Foundation Apache ActiveMQ Artemis · org.ap…
- CVE-2024-7847RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded ScriptRockwell Automation RSLogix 500® · Rockwell Automation R… +1
- CVE-2024-9139OS Command Injection in Restricted CommandMoxa EDR-8010 Series · Moxa EDR-G9004 Series +6
- CVE-2024-43701GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devicesImagination Technologies Graphics DDK
- CVE-2024-9137Moxa Service Missing Authentication for Critical FunctionMoxa EDR-8010 Series · Moxa EDR-G9004 Series +58
- CVE-2024-9922TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversalteamplus technology team+
- CVE-2024-35518Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie_fix2.cgi via the wan_dns1_pri parameter.
- CVE-2024-35519Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi v
- CVE-2024-35520Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.
- CVE-2024-48249Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
- CVE-2024-48251Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.
- CVE-2024-48253Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.
- CVE-2024-48255Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.
- CVE-2024-48257Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.
- CVE-2024-48259Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.
- CVE-2024-48789An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update pr
- CVE-2024-48791An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware
- CVE-2024-48792An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process.
- CVE-2024-48796An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process.
- CVE-2024-48797An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the fi
- CVE-2024-48798An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmwa
- CVE-2024-48799An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware up
- CVE-2024-48822Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to es
- CVE-2024-48824An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensiti
Medium, low and unrated 39
- CVE-2024-9546WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosurexplodedthemes WPIDE – File Manager & Code Editor
- CVE-2024-30117HCL BigFix Platform is affected by a DLL Hijack vulnerabilityHCL Software BigFix Platform
- CVE-2024-9953Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8CERT/CC VINCE - Vulnerability Information and Coordination…
- CVE-2024-48911OpenCanary Executes Commands From Potentially Writable Config Filethinkst opencanary · opencanary
- CVE-2024-48909SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is notauthzed spicedb · github.com/authzed/spicedb
- CVE-2024-47885astro's client-side router has DOM Clobbering Gadget that leads to XSSwithastro astro · astro
- CVE-2024-47831Next.js image optimization has Denial of Service conditionvercel next.js · next
- CVE-2024-47826eLabFTW vulnerable to HTML Injection in extended search error messageelabftw
- CVE-2024-47767Tuleap lists trackers in the quick add actions of the backlog without any permissions checkEnalean tuleap
- CVE-2024-47766Permissions are incorrectly verified for project administrators in the cross tracker search widgetEnalean tuleap
- CVE-2024-46988Tuleap does not properly check permissions for email notifications in trackersEnalean tuleap
- CVE-2024-46980Tuleap vulnerable to XSS in the HTML mail content of the cross reference fieldEnalean tuleap
- CVE-2024-45739Sensitive information disclosure in AdminManager logging channelSplunk Enterprise
- CVE-2024-45738Sensitive information disclosure in REST_Calls logging channelSplunk Enterprise
- CVE-2024-45737Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF)Splunk Enterprise · Splunk Cloud Platform
- CVE-2024-45736Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk DaemonSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-45741Persistent Cross-Site Scripting (XSS) via props.conf on Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-45734Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic DashboardSplunk Enterprise
- CVE-2024-45740Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-45735Improper Access Control for low-privileged user in Splunk Secure Gateway AppSplunk Enterprise · Splunk Secure Gateway
- CVE-2024-8184Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacksEclipse Foundation Jetty · org.eclipse.jetty:jetty-server
- CVE-2024-6762Jetty PushSessionCacheFilter can cause remote DoS attacksEclipse Foundation Jetty · org.eclipse.jetty:jetty-servlets
- CVE-2024-6763Jetty URI parsing of invalid authorityEclipse Foundation Jetty · org.eclipse.jetty:jetty-http
- CVE-2024-9823Jetty DOS vulnerability on DosFilterEclipse Foundation Jetty · Eclipse Jetty Jetty +4
- CVE-2024-9936When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitabMozilla Firefox
- CVE-2024-8602XML Eternal Entity Attack in the Software Library taxstatement.jarSchweizerische Steuerkonferenz Library taxstatement.jar
- CVE-2024-46911Apache Roller: Weakness in CSRF protection allows privilege escalationApache Software Foundation Apache Roller
- CVE-2024-38863CSRF token leaked in URL parametersCheckmk
- CVE-2024-38862SNMP and IMPI secrets written to audit logCheckmk
- CVE-2024-9923TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path Traversalteamplus technology team+
- CVE-2024-41997An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02).
- CVE-2024-46528An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x github.com/kubesphere/kubesphere
- CVE-2024-48119Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter.
- CVE-2024-48120X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module.
- CVE-2024-48790An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process.
- CVE-2024-48793An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process.
- CVE-2024-48795An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firm
- CVE-2024-48821Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote
- CVE-2024-49214QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address.