# CVEs published 2024-10-15

188 CVEs were published on October 15, 2024: 20 critical, 72 high. Days are UTC.

- [CVE-2024-49340](https://cve.now/CVE-2024-49340.md): IBM Watson Studio Local cross-site request forgery (CVSS 4.3, IBM Watson Studio Local)
- [CVE-2024-38190](https://cve.now/CVE-2024-38190.md): Power Platform Information Disclosure Vulnerability (CVSS 8.6, Microsoft Power Platform)
- [CVE-2024-38204](https://cve.now/CVE-2024-38204.md): Imagine Cup site Information Disclosure Vulnerability (CVSS 7.5, Microsoft Azure Functions)
- [CVE-2024-38139](https://cve.now/CVE-2024-38139.md): Microsoft Dataverse Elevation of Privilege Vulnerability (CVSS 8.7, Microsoft Dataverse)
- [CVE-2024-10004](https://cve.now/CVE-2024-10004.md): Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in t (CVSS 9.1, Mozilla Firefox for iOS)
- [CVE-2024-45085](https://cve.now/CVE-2024-45085.md): IBM WebSphere Application Server denial of service (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2024-9594](https://cve.now/CVE-2024-9594.md): VM images built with Image Builder with some providers use default credentials during builds (CVSS 6.3, Kubernetes Image Builder · github.com/kubernetes-sigs/image…)
- [CVE-2024-9486](https://cve.now/CVE-2024-9486.md): VM images built with Image Builder and Proxmox provider use default credentials (CVSS 9.8, Kubernetes Image Builder · github.com/kubernetes-sigs/image…)
- [CVE-2024-9966](https://cve.now/CVE-2024-9966.md): Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security pol (CVSS 5.3, Google Chrome)
- [CVE-2024-9965](https://cve.now/CVE-2024-9965.md): Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user t (CVSS 8.8, Google Chrome)
- [CVE-2024-9964](https://cve.now/CVE-2024-9964.md): Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in (CVSS 4.3, Google Chrome)
- [CVE-2024-9963](https://cve.now/CVE-2024-9963.md): Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage i (CVSS 4.3, Google Chrome)
- [CVE-2024-9962](https://cve.now/CVE-2024-9962.md): Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage (CVSS 4.3, Google Chrome)
- [CVE-2024-9961](https://cve.now/CVE-2024-9961.md): Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2024-9960](https://cve.now/CVE-2024-9960.md): Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-9959](https://cve.now/CVE-2024-9959.md): Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.8, Google Chrome)
- [CVE-2024-9958](https://cve.now/CVE-2024-9958.md): Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing vi (CVSS 4.3, Google Chrome)
- [CVE-2024-9957](https://cve.now/CVE-2024-9957.md): Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 8.8, Google Chrome)
- [CVE-2024-9956](https://cve.now/CVE-2024-9956.md): Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform pri (CVSS 7.8, Google Chrome)
- [CVE-2024-9955](https://cve.now/CVE-2024-9955.md): Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2024-9954](https://cve.now/CVE-2024-9954.md): Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-21286](https://cve.now/CVE-2024-21286.md): Vulnerability in the PeopleSoft Enterprise ELM Enterprise Learning Management product of Oracle PeopleSoft (component: Enterprise Learning M (CVSS 5.4, Oracle PeopleSoft Enterprise ELM Enterprise Learning Manage…)
- [CVE-2024-21285](https://cve.now/CVE-2024-21285.md): Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). (CVSS 7.1, Oracle Banking Liquidity Management)
- [CVE-2024-21284](https://cve.now/CVE-2024-21284.md): Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Reports). (CVSS 7.1, Oracle Banking Liquidity Management)
- [CVE-2024-21283](https://cve.now/CVE-2024-21283.md): Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Core product of Oracle PeopleSoft (component: Global Payroll for Core). (CVSS 8.1, Oracle PeopleSoft Enterprise HCM Global Payroll Core)
- [CVE-2024-21282](https://cve.now/CVE-2024-21282.md): Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). (CVSS 8.1, Oracle Financials)
- [CVE-2024-21281](https://cve.now/CVE-2024-21281.md): Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.3, Oracle Banking Liquidity Management)
- [CVE-2024-21280](https://cve.now/CVE-2024-21280.md): Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). (CVSS 8.1, Oracle Service Contracts)
- [CVE-2024-21279](https://cve.now/CVE-2024-21279.md): Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). (CVSS 8.1, Oracle Sourcing)
- [CVE-2024-21278](https://cve.now/CVE-2024-21278.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes). (CVSS 8.1, Oracle Contract Lifecycle Management for Public Sector)
- [CVE-2024-21277](https://cve.now/CVE-2024-21277.md): Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). (CVSS 8.1, Oracle MES for Process Manufacturing)
- [CVE-2024-21276](https://cve.now/CVE-2024-21276.md): Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages). (CVSS 8.1, Oracle Work in Process)
- [CVE-2024-21275](https://cve.now/CVE-2024-21275.md): Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface). (CVSS 8.1, Oracle Quoting)
- [CVE-2024-21274](https://cve.now/CVE-2024-21274.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21273](https://cve.now/CVE-2024-21273.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2024-21272](https://cve.now/CVE-2024-21272.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). (CVSS 7.5, Oracle MySQL Connectors · mysql-connector-python)
- [CVE-2024-21271](https://cve.now/CVE-2024-21271.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal). (CVSS 8.1, Oracle Field Service)
- [CVE-2024-21270](https://cve.now/CVE-2024-21270.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). (CVSS 8.1, Oracle Common Applications Calendar)
- [CVE-2024-21269](https://cve.now/CVE-2024-21269.md): Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan). (CVSS 8.1, Oracle Incentive Compensation)
- [CVE-2024-21268](https://cve.now/CVE-2024-21268.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). (CVSS 8.1, Oracle Applications Manager)
- [CVE-2024-21267](https://cve.now/CVE-2024-21267.md): Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). (CVSS 8.1, Oracle Cost Management)
- [CVE-2024-21266](https://cve.now/CVE-2024-21266.md): Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). (CVSS 8.1, Oracle Advanced Pricing)
- [CVE-2024-21265](https://cve.now/CVE-2024-21265.md): Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). (CVSS 8.1, Oracle Site Hub)
- [CVE-2024-21264](https://cve.now/CVE-2024-21264.md): Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Activity Guide Composer). (CVSS 5.4, Oracle PeopleSoft Enterprise CC Common Application Objects)
- [CVE-2024-21263](https://cve.now/CVE-2024-21263.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.1, Oracle VM VirtualBox)
- [CVE-2024-21262](https://cve.now/CVE-2024-21262.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC). (CVSS 6.5, Oracle MySQL Connectors)
- [CVE-2024-21261](https://cve.now/CVE-2024-21261.md): Vulnerability in Oracle Application Express (component: General). (CVSS 4.9, Oracle Application Express)
- [CVE-2024-21260](https://cve.now/CVE-2024-21260.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21259](https://cve.now/CVE-2024-21259.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2024-21258](https://cve.now/CVE-2024-21258.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). (CVSS 5.3, Oracle Installed Base)
- [CVE-2024-21257](https://cve.now/CVE-2024-21257.md): Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization). (CVSS 3.0, Oracle Hyperion BI+)
- [CVE-2024-21255](https://cve.now/CVE-2024-21255.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). (CVSS 8.8, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2024-21254](https://cve.now/CVE-2024-21254.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 8.8, Oracle BI Publisher)
- [CVE-2024-21253](https://cve.now/CVE-2024-21253.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 2.3, Oracle VM VirtualBox)
- [CVE-2024-21252](https://cve.now/CVE-2024-21252.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 8.1, Oracle Product Hub)
- [CVE-2024-21251](https://cve.now/CVE-2024-21251.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 3.1, Oracle Database Server)
- [CVE-2024-21250](https://cve.now/CVE-2024-21250.md): Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Manager Specifi (CVSS 8.1, Oracle Process Manufacturing Product Development)
- [CVE-2024-21249](https://cve.now/CVE-2024-21249.md): Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Expenses). (CVSS 4.3, Oracle PeopleSoft Enterprise FIN Expenses)
- [CVE-2024-21248](https://cve.now/CVE-2024-21248.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.3, Oracle VM VirtualBox)
- [CVE-2024-21247](https://cve.now/CVE-2024-21247.md): Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). (CVSS 3.8, Oracle MySQL Cluster · Oracle MySQL Client)
- [CVE-2024-21246](https://cve.now/CVE-2024-21246.md): Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). (CVSS 7.5, Oracle Service Bus)
- [CVE-2024-21244](https://cve.now/CVE-2024-21244.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21243](https://cve.now/CVE-2024-21243.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Telemetry). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21242](https://cve.now/CVE-2024-21242.md): Vulnerability in the XML Database component of Oracle Database Server. (CVSS 3.5, Oracle Database Server)
- [CVE-2024-21241](https://cve.now/CVE-2024-21241.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21239](https://cve.now/CVE-2024-21239.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21238](https://cve.now/CVE-2024-21238.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). (CVSS 5.3, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21237](https://cve.now/CVE-2024-21237.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication GCS). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21236](https://cve.now/CVE-2024-21236.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21235](https://cve.now/CVE-2024-21235.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 4.8, Oracle Java SE)
- [CVE-2024-21234](https://cve.now/CVE-2024-21234.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21233](https://cve.now/CVE-2024-21233.md): Vulnerability in the Oracle Database Core component of Oracle Database Server. (CVSS 4.3, Oracle Database Server)
- [CVE-2024-21232](https://cve.now/CVE-2024-21232.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 2.2, Oracle MySQL Server)
- [CVE-2024-21231](https://cve.now/CVE-2024-21231.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). (CVSS 3.1, Oracle MySQL Server)
- [CVE-2024-21230](https://cve.now/CVE-2024-21230.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21219](https://cve.now/CVE-2024-21219.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21218](https://cve.now/CVE-2024-21218.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21217](https://cve.now/CVE-2024-21217.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Seriali (CVSS 3.7, Oracle Java SE)
- [CVE-2024-21216](https://cve.now/CVE-2024-21216.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2024-21215](https://cve.now/CVE-2024-21215.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21214](https://cve.now/CVE-2024-21214.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2024-21213](https://cve.now/CVE-2024-21213.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.2, Oracle MySQL Server)
- [CVE-2024-21212](https://cve.now/CVE-2024-21212.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Health Monitor). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2024-21211](https://cve.now/CVE-2024-21211.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compile (CVSS 3.7, Oracle GraalVM · Oracle Java SE)
- [CVE-2024-21210](https://cve.now/CVE-2024-21210.md): Vulnerability in Oracle Java SE (component: Hotspot). (CVSS 3.7, Oracle Java SE)
- [CVE-2024-21209](https://cve.now/CVE-2024-21209.md): Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). (CVSS 2.0, Oracle MySQL Client)
- [CVE-2024-21208](https://cve.now/CVE-2024-21208.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Network (CVSS 3.7, Oracle Java SE)
- [CVE-2024-21207](https://cve.now/CVE-2024-21207.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21206](https://cve.now/CVE-2024-21206.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics). (CVSS 4.3, Oracle Enterprise Command Center Framework)
- [CVE-2024-21205](https://cve.now/CVE-2024-21205.md): Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: OSB Core Functionality). (CVSS 6.5, Oracle Service Bus)
- [CVE-2024-21204](https://cve.now/CVE-2024-21204.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21203](https://cve.now/CVE-2024-21203.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). (CVSS 4.9, Oracle MySQL Cluster · Oracle MySQL Server)
- [CVE-2024-21202](https://cve.now/CVE-2024-21202.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 6.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2024-21201](https://cve.now/CVE-2024-21201.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21200](https://cve.now/CVE-2024-21200.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21199](https://cve.now/CVE-2024-21199.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21198](https://cve.now/CVE-2024-21198.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21197](https://cve.now/CVE-2024-21197.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21196](https://cve.now/CVE-2024-21196.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: X Plugin). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-21195](https://cve.now/CVE-2024-21195.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Layout Templates). (CVSS 7.6, Oracle BI Publisher)
- [CVE-2024-21194](https://cve.now/CVE-2024-21194.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21193](https://cve.now/CVE-2024-21193.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21192](https://cve.now/CVE-2024-21192.md): Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Fusion Middleware (component: WebLogic Mgmt). (CVSS 4.4, Oracle Enterprise Manager for Fusion Middleware)
- [CVE-2024-21191](https://cve.now/CVE-2024-21191.md): Vulnerability in the Oracle Enterprise Manager Fusion Middleware Control product of Oracle Fusion Middleware (component: FMW Control Plugin) (CVSS 7.6, Oracle Enterprise Manager Fusion Middleware Control)
- [CVE-2024-21190](https://cve.now/CVE-2024-21190.md): Vulnerability in the Oracle Global Lifecycle Management FMW Installer product of Oracle Fusion Middleware (component: Cloning). (CVSS 7.5, Oracle Global Lifecycle Management FMW Installer)
- [CVE-2024-21172](https://cve.now/CVE-2024-21172.md): Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications (component: Opera Servlet). (CVSS 9.0, Oracle Hospitality OPERA)
- [CVE-2024-5749](https://cve.now/CVE-2024-5749.md): Certain HP DesignJet products – Credential reflection (CVSS 7.5, Certain HP DesignJet products)
- [CVE-2024-48915](https://cve.now/CVE-2024-48915.md): Agent Dart missing certificate verification checks (CVSS 8.7, AstroxNetwork agent\_dart)
- [CVE-2024-48914](https://cve.now/CVE-2024-48914.md): Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy (CVSS 9.1, vendure-ecommerce vendure · @vendure/asset-server-plugin)
- [CVE-2024-48913](https://cve.now/CVE-2024-48913.md): Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. (CVSS 5.9, honojs hono · hono)
- [CVE-2024-47876](https://cve.now/CVE-2024-47876.md): Sakai: Kernel users created with type roleview can login as a normal user (CVSS 8.7, sakaiproject sakai · org.sakaiproject.kernel:sakai-kernel-i…)
- [CVE-2024-47874](https://cve.now/CVE-2024-47874.md): Starlette Denial of service (DoS) via multipart/form-data (CVSS 8.7, encode starlette · starlette)
- [CVE-2024-47824](https://cve.now/CVE-2024-47824.md): Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room (CVSS 8.7, matrix-org matrix-react-sdk · matrix-react-sdk)
- [CVE-2024-9506](https://cve.now/CVE-2024-9506.md): Regular Expression Denial of Service (ReDoS) (CVSS 3.7, vue)
- [CVE-2024-47779](https://cve.now/CVE-2024-47779.md): Element Web vulnerable to potential exposure of access token via authenticated media (CVSS 7.0, element-hq element-web)
- [CVE-2024-9676](https://cve.now/CVE-2024-9676.md): Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos) (CVSS 6.5, containers/storage · Red Hat Enterprise Linux +3)
- [CVE-2024-47771](https://cve.now/CVE-2024-47771.md): Element Desktop vulnerable to potential exposure of access token via authenticated media (CVSS 7.0, element-hq element-desktop)
- [CVE-2024-47080](https://cve.now/CVE-2024-47080.md): matrix-js-sdk keys sent via \`sendSharedHistoryKeys\` vulnerable to interception by malicious homeserver (CVSS 8.7, matrix-org matrix-js-sdk · matrix-js-sdk)
- [CVE-2024-9979](https://cve.now/CVE-2024-9979.md): Pyo3: risk of use-after-free in \`borrowed\` reads from python weak references (CVSS 5.3, pyo3 · Red Hat Ansible Automation Platform +1)
- [CVE-2024-9986](https://cve.now/CVE-2024-9986.md): code-projects Blood Bank Management System member\_register.php sql injection (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2024-9977](https://cve.now/CVE-2024-9977.md): MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection (CVSS 5.1, MitraStar GPT-2541GNAC)
- [CVE-2024-9976](https://cve.now/CVE-2024-9976.md): code-projects Pharmacy Management System manage\_customer.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-9975](https://cve.now/CVE-2024-9975.md): SourceCodester Drag and Drop Image Upload upload.php unrestricted upload (CVSS 5.3, SourceCodester Drag and Drop Image Upload)
- [CVE-2024-47674](https://cve.now/CVE-2024-47674.md): mm: avoid leaving partial pfn mappings around in error case (CVSS 7.8, Linux)
- [CVE-2024-49388](https://cve.now/CVE-2024-49388.md): Sensitive information manipulation due to improper authorization. (CVSS 3.1, Acronis Cyber Protect)
- [CVE-2024-49387](https://cve.now/CVE-2024-49387.md): Cleartext transmission of sensitive information in acep-collector service. (CVSS 5.4, Acronis Cyber Protect)
- [CVE-2024-49384](https://cve.now/CVE-2024-49384.md): Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. (CVSS 3.5, Acronis Cyber Protect)
- [CVE-2024-49383](https://cve.now/CVE-2024-49383.md): Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. (CVSS 3.5, Acronis Cyber Protect)
- [CVE-2024-49382](https://cve.now/CVE-2024-49382.md): Excessive attack surface in archive-server service due to binding to an unrestricted IP address. (CVSS 3.5, Acronis Cyber Protect)
- [CVE-2024-45276](https://cve.now/CVE-2024-45276.md): MB connect line/Helmholz: tmp directory exposed via webservice (CVSS 7.5, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-45275](https://cve.now/CVE-2024-45275.md): MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords (CVSS 9.8, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-45274](https://cve.now/CVE-2024-45274.md): MB connect line/Helmholz: Remote code execution via confnet service (CVSS 9.8, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-45273](https://cve.now/CVE-2024-45273.md): MB connect line/Helmholz: Weak encryption of configuration file (CVSS 8.4, MB connect line mbNET.mini · MB connect line mbNET/mbNET… +9)
- [CVE-2024-45272](https://cve.now/CVE-2024-45272.md): MB connect line/Helmholz: Generation of weak passwords vulnerability (CVSS 7.5, MB connect line mbCONNECT24 · MB connect line mymbCONNEC… +2)
- [CVE-2024-45271](https://cve.now/CVE-2024-45271.md): MB connect line/Helmholz: Remote code execution due to improper input validation (CVSS 8.4, MB connect line mbNET.mini · Helmholz REX100)
- [CVE-2024-47945](https://cve.now/CVE-2024-47945.md): Predictable Session ID (CVSS 9.1, RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit)
- [CVE-2024-9974](https://cve.now/CVE-2024-9974.md): SourceCodester Online Eyewear Shop POST Request Master.php sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9973](https://cve.now/CVE-2024-9973.md): SourceCodester Online Eyewear Shop Report Viewing Page page sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-47944](https://cve.now/CVE-2024-47944.md): Missing Protection Mechanism for Alternate Hardware Interface (CVSS 6.8, RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit)
- [CVE-2024-47943](https://cve.now/CVE-2024-47943.md): Improper signature verification of firmware upgrade files (CVSS 9.8, RITTAL GmbH & Co. KG IoT Interface & CMC III Processing Unit)
- [CVE-2024-9925](https://cve.now/CVE-2024-9925.md): SQL injection in QPLANT by TAI Smart Factory (CVSS 9.8, TAI Smart Factory QPLANT SF)
- [CVE-2024-9895](https://cve.now/CVE-2024-9895.md): Smart Online Order for Clover \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via moo\_receipt\_link Shortcode (CVSS 6.4, elbanyaoui Smart Online Order for Clover)
- [CVE-2024-9985](https://cve.now/CVE-2024-9985.md): Ragic Enterprise Cloud Database - Arbitrary File Upload (CVSS 10.0, Ragic Enterprise Cloud Database)
- [CVE-2024-9984](https://cve.now/CVE-2024-9984.md): Ragic Enterprise Cloud Database - Missing Authentication (CVSS 9.8, Ragic Enterprise Cloud Database)
- [CVE-2024-9983](https://cve.now/CVE-2024-9983.md): Ragic Enterprise Cloud Database - Arbitrary File Read through Path Traversal (CVSS 7.5, Ragic Enterprise Cloud Database)
- [CVE-2024-9982](https://cve.now/CVE-2024-9982.md): ESi Technology AIM LINE Marketing Platform - SQL Injection (CVSS 9.8, ESi Technology AIM LINE Marketing Platform)
- [CVE-2024-9981](https://cve.now/CVE-2024-9981.md): FormosaSoft ee-class - Local File Inclusion (CVSS 8.8, FormosaSoft ee-class)
- [CVE-2024-9980](https://cve.now/CVE-2024-9980.md): FormosaSoft ee-class - SQL Injection (CVSS 8.8, FormosaSoft ee-class)
- [CVE-2024-9837](https://cve.now/CVE-2024-9837.md): AADMY – Add Auto Date Month Year Into Posts \<= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, numanrki AADMY – Add Auto Date Month Year Into Posts)
- [CVE-2024-9972](https://cve.now/CVE-2024-9972.md): ChanGate Property Management System - SQL Injection (CVSS 9.8, ChanGate Property Management System)
- [CVE-2024-46898](https://cve.now/CVE-2024-46898.md): SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. (CVSS 8.6, SHIRASAGI Project SHIRASAGI)
- [CVE-2024-0129](https://cve.now/CVE-2024-0129.md): NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extractio (CVSS 6.3, NVIDIA NeMo)
- [CVE-2024-9944](https://cve.now/CVE-2024-9944.md): WooCommerce \<= 9.0.2 - Unauthenticated HTML Injection (CVSS 5.3, automattic WooCommerce)
- [CVE-2024-21535](https://cve.now/CVE-2024-21535.md): Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper input (CVSS 6.1, markdown-to-jsx)
- [CVE-2024-9971](https://cve.now/CVE-2024-9971.md): NewType FlowMaster BPM Plus - SQL Injection (CVSS 8.8, NewType FlowMaster BPM Plus)
- [CVE-2024-9970](https://cve.now/CVE-2024-9970.md): NewType FlowMaster BPM Plus - Privilege Escalation (CVSS 8.8, NewType FlowMaster BPM Plus)
- [CVE-2024-9969](https://cve.now/CVE-2024-9969.md): NewType WebEIP v3.0 - Reflected XSS (CVSS 5.4, NewType WebEIP)
- [CVE-2024-9968](https://cve.now/CVE-2024-9968.md): NewType WebEIP v3.0 - SQL injection (CVSS 8.8, NewType WebEIP)
- [CVE-2024-9820](https://cve.now/CVE-2024-9820.md): WP 2FA with Telegram \<= 3.0 - Two-Factor Authentication Bypass (CVSS 6.5, dueclic AuthPress)
- [CVE-2024-6757](https://cve.now/CVE-2024-6757.md): Elementor \<= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get\_image\_alt Function (CVSS 4.3, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2024-9687](https://cve.now/CVE-2024-9687.md): WP 2FA with Telegram \<= 3.0 - Authenticated (Subscriber+) Authentication Bypass (CVSS 8.8, dueclic AuthPress)
- [CVE-2024-9952](https://cve.now/CVE-2024-9952.md): SourceCodester Online Eyewear Shop Contact Information Page contact\_info cross site scripting (CVSS 5.1, SourceCodester Online Eyewear Shop)
- [CVE-2023-31493](https://cve.now/CVE-2023-31493.md): RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in language folder, while exe (CVSS 6.6)
- [CVE-2024-31955](https://cve.now/CVE-2024-31955.md): An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. (CVSS 4.9)
- [CVE-2024-35584](https://cve.now/CVE-2024-35584.md): SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis (CVSS 8.8)
- [CVE-2024-41311](https://cve.now/CVE-2024-41311.md): In Libheif 1.17.6, insufficient checks in ImageOverlay::parse() decoding a heif file containing an overlay image with forged offsets can lea (CVSS 8.1)
- [CVE-2024-41344](https://cve.now/CVE-2024-41344.md): A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate pri (CVSS 7.5)
- [CVE-2024-44337](https://cve.now/CVE-2024-44337.md): The package \`github.com/gomarkdown/markdown\` is a Go library for parsing Markdown text and rendering as HTML. (CVSS 5.1, github.com/gomarkdown/markdown)
- [CVE-2024-44775](https://cve.now/CVE-2024-44775.md): kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. (CVSS 7.5)
- [CVE-2024-48278](https://cve.now/CVE-2024-48278.md): Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) via /edit-profile.php (CVSS 5.5)
- [CVE-2024-48279](https://cve.now/CVE-2024-48279.md): A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. (CVSS 7.6)
- [CVE-2024-48280](https://cve.now/CVE-2024-48280.md): A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2, which (CVSS 7.6)
- [CVE-2024-48282](https://cve.now/CVE-2024-48282.md): A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Management System 3.2, wh (CVSS 7.6)
- [CVE-2024-48283](https://cve.now/CVE-2024-48283.md): Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-result.php via the sear (CVSS 9.8)
- [CVE-2024-48411](https://cve.now/CVE-2024-48411.md): itsourcecode Online Tours and Travels Management System v1.0 is vulnerable to SQL Injection (SQLI) via a crafted payload to the val-email pa (CVSS 9.8)
- [CVE-2024-48622](https://cve.now/CVE-2024-48622.md): A cross-site scripting (XSS) issue in DomainMOD below v4.12.0 allows remote attackers to inject JavaScript code via admin/domain-fields/edit (CVSS 6.6)
- [CVE-2024-48623](https://cve.now/CVE-2024-48623.md): In queue\\index.php of DomainMOD below v4.12.0, the list\_id and domain\_id parameters in the GET request can be exploited to cause a reflected (CVSS 5.3)
- [CVE-2024-48624](https://cve.now/CVE-2024-48624.md): In segments\\edit.php of DomainMOD below v4.12.0, the segid parameter in the GET request can be exploited to cause a reflected Cross Site Scr (CVSS 5.3)
- [CVE-2024-48710](https://cve.now/CVE-2024-48710.md): In TP-Link TL-WDR7660 1.0, the wlanTimerRuleJsonToBin function handles the parameter string name without checking it, which can lead to stac (CVSS 6.5)
- [CVE-2024-48712](https://cve.now/CVE-2024-48712.md): In TP-Link TL-WDR7660 1.0, the rtRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack overf (CVSS 6.5)
- [CVE-2024-48713](https://cve.now/CVE-2024-48713.md): In TP-Link TL-WDR7660 1.0, the wacWhitelistJsonToBin function handles the parameter string name without checking it, which can lead to stack (CVSS 6.5)
- [CVE-2024-48714](https://cve.now/CVE-2024-48714.md): In TP-Link TL-WDR7660 v1.0, the guestRuleJsonToBin function handles the parameter string name without checking it, which can lead to stack o (CVSS 6.5)
- [CVE-2024-48779](https://cve.now/CVE-2024-48779.md): An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformp (CVSS 9.8)
- [CVE-2024-48781](https://cve.now/CVE-2024-48781.md): An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a speciall (CVSS 9.8)
- [CVE-2024-48782](https://cve.now/CVE-2024-48782.md): File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application only (CVSS 9.8)
- [CVE-2024-48783](https://cve.now/CVE-2024-48783.md): An issue in Ruijie NBR3000D-E Gateway allows a remote attacker to obtain sensitive information via the /tool/shell/postgresql.conf component (CVSS 4.3)
- [CVE-2024-48948](https://cve.now/CVE-2024-48948.md): The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at (CVSS 4.8, elliptic)
- [CVE-2024-49195](https://cve.now/CVE-2024-49195.md): Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.