# CVEs published 2024-10-14

76 CVEs were published on October 14, 2024: 8 critical, 29 high. Days are UTC.

- [CVE-2024-9548](https://cve.now/CVE-2024-9548.md): Slimstat Analytics \<= 5.2.6 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, veronalabs SlimStat Analytics)
- [CVE-2024-9546](https://cve.now/CVE-2024-9546.md): WPIDE \<= 3.4.9 - Unauthenticated Full Path Dislcosure (CVSS 5.3, xplodedthemes WPIDE – File Manager & Code Editor)
- [CVE-2024-30117](https://cve.now/CVE-2024-30117.md): HCL BigFix Platform is affected by a DLL Hijack vulnerability (CVSS 2.5, HCL Software BigFix Platform)
- [CVE-2024-9953](https://cve.now/CVE-2024-9953.md): Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8 (CVSS 4.9, CERT/CC VINCE - Vulnerability Information and Coordination…)
- [CVE-2024-6207](https://cve.now/CVE-2024-6207.md): CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted (CVSS 8.7, Rockwell Automation ControlLogix® · Rockwell Automation… +3)
- [CVE-2024-48911](https://cve.now/CVE-2024-48911.md): OpenCanary Executes Commands From Potentially Writable Config File (CVSS 5.8, thinkst opencanary · opencanary)
- [CVE-2024-48909](https://cve.now/CVE-2024-48909.md): SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not (CVSS 2.0, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2024-47885](https://cve.now/CVE-2024-47885.md): astro's client-side router has DOM Clobbering Gadget that leads to XSS (CVSS 5.9, withastro astro · astro)
- [CVE-2024-47831](https://cve.now/CVE-2024-47831.md): Next.js image optimization has Denial of Service condition (CVSS 5.9, vercel next.js · next)
- [CVE-2024-47826](https://cve.now/CVE-2024-47826.md): eLabFTW vulnerable to HTML Injection in extended search error message (CVSS 3.5, elabftw)
- [CVE-2024-47767](https://cve.now/CVE-2024-47767.md): Tuleap lists trackers in the quick add actions of the backlog without any permissions check (CVSS 4.3, Enalean tuleap)
- [CVE-2024-47766](https://cve.now/CVE-2024-47766.md): Permissions are incorrectly verified for project administrators in the cross tracker search widget (CVSS 4.9, Enalean tuleap)
- [CVE-2024-46988](https://cve.now/CVE-2024-46988.md): Tuleap does not properly check permissions for email notifications in trackers (CVSS 4.8, Enalean tuleap)
- [CVE-2024-46980](https://cve.now/CVE-2024-46980.md): Tuleap vulnerable to XSS in the HTML mail content of the cross reference field (CVSS 4.8, Enalean tuleap)
- [CVE-2024-45739](https://cve.now/CVE-2024-45739.md): Sensitive information disclosure in AdminManager logging channel (CVSS 4.9, Splunk Enterprise)
- [CVE-2024-45738](https://cve.now/CVE-2024-45738.md): Sensitive information disclosure in REST\_Calls logging channel (CVSS 4.9, Splunk Enterprise)
- [CVE-2024-45737](https://cve.now/CVE-2024-45737.md): Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF) (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-45733](https://cve.now/CVE-2024-45733.md): Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows (CVSS 8.8, Splunk Enterprise)
- [CVE-2024-45732](https://cve.now/CVE-2024-45732.md): Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app (CVSS 7.1, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-45736](https://cve.now/CVE-2024-45736.md): Improperly Formatted ‘INGEST\_EVAL’ Parameter Crashes Splunk Daemon (CVSS 6.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-45741](https://cve.now/CVE-2024-45741.md): Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise (CVSS 5.4, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-45734](https://cve.now/CVE-2024-45734.md): Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard (CVSS 4.3, Splunk Enterprise)
- [CVE-2024-45740](https://cve.now/CVE-2024-45740.md): Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise (CVSS 5.4, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-45731](https://cve.now/CVE-2024-45731.md): Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk (CVSS 8.0, Splunk Enterprise)
- [CVE-2024-45735](https://cve.now/CVE-2024-45735.md): Improper Access Control for low-privileged user in Splunk Secure Gateway App (CVSS 4.3, Splunk Enterprise · Splunk Secure Gateway)
- [CVE-2023-50780](https://cve.now/CVE-2023-50780.md): Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans (CVSS 8.8, Apache Software Foundation Apache ActiveMQ Artemis · org.ap…)
- [CVE-2024-8184](https://cve.now/CVE-2024-8184.md): Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks (CVSS 5.9, Eclipse Foundation Jetty · org.eclipse.jetty:jetty-server)
- [CVE-2024-6762](https://cve.now/CVE-2024-6762.md): Jetty PushSessionCacheFilter can cause remote DoS attacks (CVSS 3.1, Eclipse Foundation Jetty · org.eclipse.jetty:jetty-servlets)
- [CVE-2024-6763](https://cve.now/CVE-2024-6763.md): Jetty URI parsing of invalid authority (CVSS 3.7, Eclipse Foundation Jetty · org.eclipse.jetty:jetty-http)
- [CVE-2024-9823](https://cve.now/CVE-2024-9823.md): Jetty DOS vulnerability on DosFilter (CVSS 5.3, Eclipse Foundation Jetty · Eclipse Jetty Jetty +4)
- [CVE-2024-7847](https://cve.now/CVE-2024-7847.md): RSLogix™ 5 and RSLogix 500® Remote Code Execution Via VBA Embedded Script (CVSS 8.8, Rockwell Automation RSLogix 500® · Rockwell Automation R… +1)
- [CVE-2024-9936](https://cve.now/CVE-2024-9936.md): When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitab (CVSS 6.5, Mozilla Firefox)
- [CVE-2024-8602](https://cve.now/CVE-2024-8602.md): XML Eternal Entity Attack in the Software Library taxstatement.jar (CVSS 6.3, Schweizerische Steuerkonferenz Library taxstatement.jar)
- [CVE-2024-9139](https://cve.now/CVE-2024-9139.md): OS Command Injection in Restricted Command (CVSS 8.6, Moxa EDR-8010 Series · Moxa EDR-G9004 Series +6)
- [CVE-2024-43701](https://cve.now/CVE-2024-43701.md): GPU DDK - PowerVR: TLB invalidate UAF of dma\_buf imported into multiple GPU devices (CVSS 7.8, Imagination Technologies Graphics DDK)
- [CVE-2024-46911](https://cve.now/CVE-2024-46911.md): Apache Roller: Weakness in CSRF protection allows privilege escalation (CVSS 4.7, Apache Software Foundation Apache Roller)
- [CVE-2024-9137](https://cve.now/CVE-2024-9137.md): Moxa Service Missing Authentication for Critical Function (CVSS 8.8, Moxa EDR-8010 Series · Moxa EDR-G9004 Series +58)
- [CVE-2024-38863](https://cve.now/CVE-2024-38863.md): CSRF token leaked in URL parameters (CVSS 2.0, Checkmk)
- [CVE-2024-38862](https://cve.now/CVE-2024-38862.md): SNMP and IMPI secrets written to audit log (CVSS 5.1, Checkmk)
- [CVE-2024-9924](https://cve.now/CVE-2024-9924.md): Hgiga OAKlouds - Arbitrary File Read And Delete (CVSS 9.8, Hgiga OAKlouds)
- [CVE-2024-9923](https://cve.now/CVE-2024-9923.md): TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Move through Path Traversal (CVSS 4.9, teamplus technology team+)
- [CVE-2024-9922](https://cve.now/CVE-2024-9922.md): TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal (CVSS 7.5, teamplus technology team+)
- [CVE-2024-9921](https://cve.now/CVE-2024-9921.md): TEAMPLUS TECHNOLOGY Team+ - SQL Injection (CVSS 9.8, teamplus technology team+)
- [CVE-2023-48082](https://cve.now/CVE-2023-48082.md): Nagios XI before 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generat (CVSS 9.1)
- [CVE-2024-35518](https://cve.now/CVE-2024-35518.md): Netgear EX6120 v1.0.0.68 is vulnerable to Command Injection in genie\_fix2.cgi via the wan\_dns1\_pri parameter. (CVSS 8.4)
- [CVE-2024-35519](https://cve.now/CVE-2024-35519.md): Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating\_mode.cgi v (CVSS 8.4)
- [CVE-2024-35520](https://cve.now/CVE-2024-35520.md): Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT\_invite.cgi via device\_name2 parameter. (CVSS 8.4)
- [CVE-2024-41997](https://cve.now/CVE-2024-41997.md): An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). (CVSS 6.6)
- [CVE-2024-46528](https://cve.now/CVE-2024-46528.md): An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x (CVSS 4.3, github.com/kubesphere/kubesphere)
- [CVE-2024-46535](https://cve.now/CVE-2024-46535.md): Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUserMsg. (CVSS 9.8)
- [CVE-2024-48119](https://cve.now/CVE-2024-48119.md): Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. (CVSS 5.4)
- [CVE-2024-48120](https://cve.now/CVE-2024-48120.md): X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. (CVSS 6.5)
- [CVE-2024-48150](https://cve.now/CVE-2024-48150.md): D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub\_451208 function. (CVSS 9.8)
- [CVE-2024-48153](https://cve.now/CVE-2024-48153.md): DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the (CVSS 9.8)
- [CVE-2024-48168](https://cve.now/CVE-2024-48168.md): A stack overflow vulnerability exists in the sub\_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execut (CVSS 9.8)
- [CVE-2024-48249](https://cve.now/CVE-2024-48249.md): Wavelog 1.8.5 allows Gridmap\_model.php get\_band\_confirmed SQL injection via band, sat, propagation, or mode. (CVSS 7.3)
- [CVE-2024-48251](https://cve.now/CVE-2024-48251.md): Wavelog 1.8.5 allows Activated\_gridmap\_model.php get\_band\_confirmed SQL injection via band, sat, propagation, or mode. (CVSS 7.3)
- [CVE-2024-48253](https://cve.now/CVE-2024-48253.md): Cloudlog 2.6.15 allows Oqrs.php delete\_oqrs\_line id SQL injection. (CVSS 7.3)
- [CVE-2024-48255](https://cve.now/CVE-2024-48255.md): Cloudlog 2.6.15 allows Oqrs.php get\_station\_info station\_id SQL injection. (CVSS 7.3)
- [CVE-2024-48257](https://cve.now/CVE-2024-48257.md): Wavelog 1.8.5 allows Oqrs\_model.php get\_worked\_modes station\_id SQL injectioin. (CVSS 7.3)
- [CVE-2024-48259](https://cve.now/CVE-2024-48259.md): Cloudlog 2.6.15 allows Oqrs.php request\_form SQL injection via station\_id or callsign. (CVSS 7.3)
- [CVE-2024-48789](https://cve.now/CVE-2024-48789.md): An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update pr (CVSS 7.5)
- [CVE-2024-48790](https://cve.now/CVE-2024-48790.md): An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process. (CVSS 5.3)
- [CVE-2024-48791](https://cve.now/CVE-2024-48791.md): An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware (CVSS 7.5)
- [CVE-2024-48792](https://cve.now/CVE-2024-48792.md): An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process. (CVSS 7.5)
- [CVE-2024-48793](https://cve.now/CVE-2024-48793.md): An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process. (CVSS 5.9)
- [CVE-2024-48795](https://cve.now/CVE-2024-48795.md): An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firm (CVSS 5.3)
- [CVE-2024-48796](https://cve.now/CVE-2024-48796.md): An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process. (CVSS 7.5)
- [CVE-2024-48797](https://cve.now/CVE-2024-48797.md): An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the fi (CVSS 7.5)
- [CVE-2024-48798](https://cve.now/CVE-2024-48798.md): An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmwa (CVSS 7.5)
- [CVE-2024-48799](https://cve.now/CVE-2024-48799.md): An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware up (CVSS 7.5)
- [CVE-2024-48821](https://cve.now/CVE-2024-48821.md): Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565\_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote (CVSS 6.1)
- [CVE-2024-48822](https://cve.now/CVE-2024-48822.md): Privilege escalation in Automatic Systems Maintenance SlimLane 29565\_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to es (CVSS 8.8)
- [CVE-2024-48823](https://cve.now/CVE-2024-48823.md): Local file inclusion in Automatic Systems Maintenance SlimLane 29565\_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to es (CVSS 9.8)
- [CVE-2024-48824](https://cve.now/CVE-2024-48824.md): An issue in Automatic Systems Maintenance SlimLane 29565\_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensiti (CVSS 7.5)
- [CVE-2024-49214](https://cve.now/CVE-2024-49214.md): QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.