CVEs published October 18, 2024
77 CVEs were published on October 18, 2024: 6 critical, 20 high. 1 is now in CISA KEV.
- Published
- 77
- Critical
- 6
- High
- 20
- Medium
- 48
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 16
Most affected products
- Bitdefender Total Security
- 5
- chertz WP Easy Post Types
- 3
- Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- 3
- Hikvision HikCentral Master Lite
- 2
- Ivanti DSM
- 2
- Kajitori Co. Exment
- 2
- Moxa MXsecurity Series
- 2
- Tenda AC8
- 2
- Topdata Inner Rep Plus WebServer
- 2
- wfh45678 Radar
- 2
Critical 6
- CVE-2024-37404Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1Ivanti Connect Secure · Ivanti Policy Secure
- CVE-2024-9537ScienceLogic SL1 unspecified vulnerabilityScienceLogic SL1
- CVE-2024-10119SECOM WRTM326 - OS Command InjectionSECOM WRTM326
- CVE-2024-10118SECOM WRTR-304GN-304TW-UPSC - OS Command InjectionSECOM WRTR-304GN-304TW-UPSC
- CVE-2024-9264Grafana SQL Expressions allow for remote code executionGrafana · github.com/grafana/grafana
- CVE-2024-45944In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in a
High 20
- CVE-2024-29213Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unsIvanti DSM
- CVE-2024-29821Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unsIvanti DSM
- CVE-2024-10130Tenda AC8 SetSysAutoRebbotCfg formSetRebootTimer stack-based overflowTenda AC8
- CVE-2024-10123Tenda AC8 saveParentControlInfo compare_parentcontrol_time stack-based overflowTenda AC8
- CVE-2024-49361Potential Vulnerability in ACON Library: Improper Input Validation Leading to Malicious Code Executiontorinriley ACON
- CVE-2024-9593Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code ExecutionScott Paterson Time Clock Pro · scottpaterson Time Clock –…
- CVE-2023-6080Privilege Escalation to SYSTEM in Lakeside Software InstallerLakeside Software SysTrack LsiAgent Installer
- CVE-2024-49224WordPress Mitm Bug Tracker plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymahesh_9696 Mitm Bug Tracker
- CVE-2024-49238WordPress ADIF Log Search Widget plugin <= 1.0f - Reflected Cross Site Scripting (XSS) vulnerabilityemka73 ADIF Log Search Widget
- CVE-2024-49239WordPress Add Categories Post Footer plugin <= 2.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilitynikhilvaghela Add Categories Post Footer
- CVE-2024-49240WordPress AB Categories Search Widget plugin <= 0.2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityajberasategui AB Categories Search Widget
- CVE-2024-49243WordPress Dynamic Elementor Addons plugin <= 1.0.0 - Local File Inclusion vulnerabilityramjon27 Dynamic Elementor Addons
- CVE-2024-47487There is a SQL injection vulnerability in some HikCentral Professional versions.Hikvision HikCentral Professional
- CVE-2023-49570Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210)Bitdefender Total Security
- CVE-2023-49567Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)Bitdefender Total Security
- CVE-2023-6058HTTPS Certificate Validation Issue in Bitdefender Safepay (VA-11167)Bitdefender Total Security
- CVE-2023-6057Insecure Trust of DSA-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11166)Bitdefender Total Security
- CVE-2024-10079WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injectionchertz WP Easy Post Types
- CVE-2023-6056Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164)BItdefender Total Security
- CVE-2023-6055Improper Certificate Validation in Bitdefender Total Security HTTPS Scanning (VA-11158)Bitdefender Total Security
Medium, low and unrated 51
- CVE-2024-43577Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-10129HFO4 shudong-share Share create_share.php sql injectionHFO4 shudong-share
- CVE-2024-10128Topdata Inner Rep Plus WebServer td.js.gz risky encryptionTopdata Inner Rep Plus WebServer
- CVE-2024-10122Topdata Inner Rep Plus WebServer Operator Details Form InnerRepPlus.html missing password field maskingTopdata Inner Rep Plus WebServer
- CVE-2024-10121wfh45678 Radar Interface authorizationwfh45678 Radar
- CVE-2024-10120wfh45678 Radar upload unrestricted uploadwfh45678 Radar
- CVE-2024-48016Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerabDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2024-47241Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability.Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2024-42508This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users.Hewlett Packard Enterprise (HPE) HPE OneView
- CVE-2024-47240Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability.Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2024-9674Debrandify · Remove or Replace WordPress Branding <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmorceaudebois Debrandify · Remove or Replace WordPress Bran…
- CVE-2024-43300WordPress Movie Database plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityBert Movie Database
- CVE-2024-49225WordPress wpPricing Builder plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityswebdeveloper wpPricing Builder
- CVE-2024-49228WordPress bVerse Convert plugin <= 1.3.7.1 - Cross Site Scripting (XSS) vulnerabilityEdwin Rivera bVerse Convert
- CVE-2024-49230WordPress Ajax Custom CSS/JS plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityharry005 Ajax Custom CSS/JS
- CVE-2024-49231WordPress WordPress Video plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitycyclop WordPress Video
- CVE-2024-49232WordPress El mejor Cluster plugin <= 1.1.15 - Cross Site Scripting (XSS) vulnerabilityderethor El mejor Cluster
- CVE-2024-49233WordPress MAS Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityMadrasThemes MAS Elementor
- CVE-2024-49234WordPress Plexx Elementor Extension plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilitythemeworm Plexx Elementor Extension
- CVE-2024-49236WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityHafiz Uddin Ahmed Crazy Call To Action Box
- CVE-2024-49241WordPress Tito plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilitytady Tito
- CVE-2024-9425Advanced Category and Custom Taxonomy Image <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcodesajjad67 Advanced Category and Custom Taxonomy Image
- CVE-2024-10057RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcodefahadmahmood RSS Feed Widget
- CVE-2024-47486There is an XSS vulnerability in some HikCentral Master Lite versions.Hikvision HikCentral Master Lite
- CVE-2024-47485There is a CSV injection vulnerability in some HikCentral Master Lite versions.Hikvision HikCentral Master Lite
- CVE-2024-4740MXsecurity Use of Hard-coded CredentialsMoxa MXsecurity Series
- CVE-2024-4739MXsecurity License Generation Function DisclosureMoxa MXsecurity Series
- CVE-2024-10078WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functionschertz WP Easy Post Types
- CVE-2024-10055Click to Chat – WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcodeninjateam WP Click to Chat – Email, Live Chat, Call & Book…
- CVE-2024-10080WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Metachertz WP Easy Post Types
- CVE-2024-9703Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetychesoftwares Arconix Shortcodes
- CVE-2024-9206MAS Companies For WP Job Manager <= 1.0.13 - Reflected Cross-Site Scriptingmadrasthemes MAS Companies For WP Job Manager
- CVE-2024-47793Stored cross-site scripting vulnerability exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier.Kajitori Co. Exment
- CVE-2024-46897Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier.Kajitori Co. Exment
- CVE-2024-38820CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match ExceptionVMware Spring · org.springframework:spring-context +1
- CVE-2024-9366Easy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEasy Menu Manager | WPZest
- CVE-2024-10014Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcodetiandi Flat UI Button
- CVE-2024-9892Add Widget After Content <= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingapintop Add Widget After Content
- CVE-2024-9382Gantry 4 Framework <= 4.1.21 - Reflected Cross-Site ScriptingGantry 4 Framework
- CVE-2024-9364SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletionsmackcoders SendGrid for WordPress
- CVE-2024-9361Bulk images optimizer: Resize, optimize, convert to webp, rename ... <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Updategiuliopanda Bulk images optimizer: Resize, optimize, conver…
- CVE-2024-9383Parcel Pro <= 1.8.4 - Reflected Cross-Site Scriptingparcelpro Parcel Pro
- CVE-2024-9452Branding <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadlolitaframework Branding
- CVE-2024-9350DPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site Scriptingdpdbaltics DPD Baltic Shipping
- CVE-2024-8740GetResponse Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scriptingfatcatapps GetResponse Forms by Optin Cat
- CVE-2024-9373Elemenda <= 0.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadthemeid Elemenda
- CVE-2024-10040Infinite-Scroll <= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Updatepaulirish-1 Infinite-Scroll
- CVE-2024-10049Edit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via pageioannup Edit WooCommerce Templates
- CVE-2024-8790Social Share With Floating Bar <= 1.0.3 - Reflected Cross-Site Scriptingthemeinwp Social Share With Floating Bar
- CVE-2024-8916Suki Sites Import <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadsukiwp Suki Sites Import
- CVE-2024-9848Product Customizer Light <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadk2servicecom Product Customizer Light