# CVEs published 2024-10-18

77 CVEs were published on October 18, 2024: 6 critical, 20 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-29213](https://cve.now/CVE-2024-29213.md): Ivanti DSM \< version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via uns (CVSS 7.8, Ivanti DSM)
- [CVE-2024-29821](https://cve.now/CVE-2024-29821.md): Ivanti DSM \< version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via uns (CVSS 7.8, Ivanti DSM)
- [CVE-2024-37404](https://cve.now/CVE-2024-37404.md): Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 (CVSS 9.1, Ivanti Connect Secure · Ivanti Policy Secure)
- [CVE-2024-43577](https://cve.now/CVE-2024-43577.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2024-10130](https://cve.now/CVE-2024-10130.md): Tenda AC8 SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow (CVSS 8.7, Tenda AC8)
- [CVE-2024-10129](https://cve.now/CVE-2024-10129.md): HFO4 shudong-share Share create\_share.php sql injection (CVSS 5.3, HFO4 shudong-share)
- [CVE-2024-10128](https://cve.now/CVE-2024-10128.md): Topdata Inner Rep Plus WebServer td.js.gz risky encryption (CVSS 5.1, Topdata Inner Rep Plus WebServer)
- [CVE-2024-10123](https://cve.now/CVE-2024-10123.md): Tenda AC8 saveParentControlInfo compare\_parentcontrol\_time stack-based overflow (CVSS 8.7, Tenda AC8)
- [CVE-2024-10122](https://cve.now/CVE-2024-10122.md): Topdata Inner Rep Plus WebServer Operator Details Form InnerRepPlus.html missing password field masking (CVSS 5.1, Topdata Inner Rep Plus WebServer)
- [CVE-2024-49361](https://cve.now/CVE-2024-49361.md): Potential Vulnerability in ACON Library: Improper Input Validation Leading to Malicious Code Execution (CVSS 8.1, torinriley ACON)
- [CVE-2024-10121](https://cve.now/CVE-2024-10121.md): wfh45678 Radar Interface authorization (CVSS 6.9, wfh45678 Radar)
- [CVE-2024-9593](https://cve.now/CVE-2024-9593.md): Time Clock \<= 1.2.2 & Time Clock Pro \<= 1.1.4 - Unauthenticated (Limited) Remote Code Execution (CVSS 8.3, Scott Paterson Time Clock Pro · scottpaterson Time Clock –…)
- [CVE-2024-10120](https://cve.now/CVE-2024-10120.md): wfh45678 Radar upload unrestricted upload (CVSS 6.9, wfh45678 Radar)
- [CVE-2024-48016](https://cve.now/CVE-2024-48016.md): Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerab (CVSS 4.6, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2024-47241](https://cve.now/CVE-2024-47241.md): Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.24, contains an Improper Certificate Validation vulnerability. (CVSS 5.5, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2023-6080](https://cve.now/CVE-2023-6080.md): Privilege Escalation to SYSTEM in Lakeside Software Installer (CVSS 7.8, Lakeside Software SysTrack LsiAgent Installer)
- [CVE-2024-42508](https://cve.now/CVE-2024-42508.md): This vulnerability could be exploited, leading to unauthorized disclosure of information to authenticated users. (CVSS 5.5, Hewlett Packard Enterprise (HPE) HPE OneView)
- [CVE-2024-9537](https://cve.now/CVE-2024-9537.md): ScienceLogic SL1 unspecified vulnerability (CVSS 9.8, KEV, ScienceLogic SL1)
- [CVE-2024-47240](https://cve.now/CVE-2024-47240.md): Dell Secure Connect Gateway (SCG) 5.24 contains an Incorrect Default Permissions vulnerability. (CVSS 5.5, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2024-9674](https://cve.now/CVE-2024-9674.md): Debrandify · Remove or Replace WordPress Branding \<= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, morceaudebois Debrandify · Remove or Replace WordPress Bran…)
- [CVE-2024-43300](https://cve.now/CVE-2024-43300.md): WordPress Movie Database plugin \<= 1.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Bert Movie Database)
- [CVE-2024-49224](https://cve.now/CVE-2024-49224.md): WordPress Mitm Bug Tracker plugin \<= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mahesh\_9696 Mitm Bug Tracker)
- [CVE-2024-49225](https://cve.now/CVE-2024-49225.md): WordPress wpPricing Builder plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, swebdeveloper wpPricing Builder)
- [CVE-2024-49228](https://cve.now/CVE-2024-49228.md): WordPress bVerse Convert plugin \<= 1.3.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Edwin Rivera bVerse Convert)
- [CVE-2024-49230](https://cve.now/CVE-2024-49230.md): WordPress Ajax Custom CSS/JS plugin \<= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.5, harry005 Ajax Custom CSS/JS)
- [CVE-2024-49231](https://cve.now/CVE-2024-49231.md): WordPress WordPress Video plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cyclop WordPress Video)
- [CVE-2024-49232](https://cve.now/CVE-2024-49232.md): WordPress El mejor Cluster plugin \<= 1.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, derethor El mejor Cluster)
- [CVE-2024-49233](https://cve.now/CVE-2024-49233.md): WordPress MAS Elementor plugin \<= 1.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MadrasThemes MAS Elementor)
- [CVE-2024-49234](https://cve.now/CVE-2024-49234.md): WordPress Plexx Elementor Extension plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themeworm Plexx Elementor Extension)
- [CVE-2024-49236](https://cve.now/CVE-2024-49236.md): WordPress Crazy Call To Action Box plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hafiz Uddin Ahmed Crazy Call To Action Box)
- [CVE-2024-49238](https://cve.now/CVE-2024-49238.md): WordPress ADIF Log Search Widget plugin \<= 1.0f - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, emka73 ADIF Log Search Widget)
- [CVE-2024-49239](https://cve.now/CVE-2024-49239.md): WordPress Add Categories Post Footer plugin \<= 2.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, nikhilvaghela Add Categories Post Footer)
- [CVE-2024-49240](https://cve.now/CVE-2024-49240.md): WordPress AB Categories Search Widget plugin \<= 0.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ajberasategui AB Categories Search Widget)
- [CVE-2024-49241](https://cve.now/CVE-2024-49241.md): WordPress Tito plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tady Tito)
- [CVE-2024-49243](https://cve.now/CVE-2024-49243.md): WordPress Dynamic Elementor Addons plugin \<= 1.0.0 - Local File Inclusion vulnerability (CVSS 7.5, ramjon27 Dynamic Elementor Addons)
- [CVE-2024-9425](https://cve.now/CVE-2024-9425.md): Advanced Category and Custom Taxonomy Image \<= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad\_tax\_image Shortcode (CVSS 6.4, sajjad67 Advanced Category and Custom Taxonomy Image)
- [CVE-2024-10057](https://cve.now/CVE-2024-10057.md): RSS Feed Widget \<= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode (CVSS 6.4, fahadmahmood RSS Feed Widget)
- [CVE-2024-47486](https://cve.now/CVE-2024-47486.md): There is an XSS vulnerability in some HikCentral Master Lite versions. (CVSS 2.1, Hikvision HikCentral Master Lite)
- [CVE-2024-47487](https://cve.now/CVE-2024-47487.md): There is a SQL injection vulnerability in some HikCentral Professional versions. (CVSS 7.2, Hikvision HikCentral Professional)
- [CVE-2024-47485](https://cve.now/CVE-2024-47485.md): There is a CSV injection vulnerability in some HikCentral Master Lite versions. (CVSS 5.5, Hikvision HikCentral Master Lite)
- [CVE-2024-4740](https://cve.now/CVE-2024-4740.md): MXsecurity Use of Hard-coded Credentials (CVSS 5.3, Moxa MXsecurity Series)
- [CVE-2024-4739](https://cve.now/CVE-2024-4739.md): MXsecurity License Generation Function Disclosure (CVSS 5.3, Moxa MXsecurity Series)
- [CVE-2023-49570](https://cve.now/CVE-2023-49570.md): Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210) (CVSS 8.6, Bitdefender Total Security)
- [CVE-2023-49567](https://cve.now/CVE-2023-49567.md): Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239) (CVSS 8.6, Bitdefender Total Security)
- [CVE-2023-6058](https://cve.now/CVE-2023-6058.md): HTTPS Certificate Validation Issue in Bitdefender Safepay (VA-11167) (CVSS 8.6, Bitdefender Total Security)
- [CVE-2023-6057](https://cve.now/CVE-2023-6057.md): Insecure Trust of DSA-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11166) (CVSS 8.6, Bitdefender Total Security)
- [CVE-2024-10078](https://cve.now/CVE-2024-10078.md): WP Easy Post Types \<= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions (CVSS 6.3, chertz WP Easy Post Types)
- [CVE-2024-10079](https://cve.now/CVE-2024-10079.md): WP Easy Post Types \<= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, chertz WP Easy Post Types)
- [CVE-2024-10055](https://cve.now/CVE-2024-10055.md): Click to Chat – WP Support All-in-One Floating Widget \<= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio\_snapchat Shortcode (CVSS 6.4, ninjateam WP Click to Chat – Email, Live Chat, Call & Book…)
- [CVE-2024-10080](https://cve.now/CVE-2024-10080.md): WP Easy Post Types \<= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (CVSS 6.4, chertz WP Easy Post Types)
- [CVE-2023-6056](https://cve.now/CVE-2023-6056.md): Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164) (CVSS 8.6, BItdefender Total Security)
- [CVE-2023-6055](https://cve.now/CVE-2023-6055.md): Improper Certificate Validation in Bitdefender Total Security HTTPS Scanning (VA-11158) (CVSS 8.6, Bitdefender Total Security)
- [CVE-2024-9703](https://cve.now/CVE-2024-9703.md): Arconix Shortcodes \<= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, tychesoftwares Arconix Shortcodes)
- [CVE-2024-9206](https://cve.now/CVE-2024-9206.md): MAS Companies For WP Job Manager \<= 1.0.13 - Reflected Cross-Site Scripting (CVSS 6.1, madrasthemes MAS Companies For WP Job Manager)
- [CVE-2024-47793](https://cve.now/CVE-2024-47793.md): Stored cross-site scripting vulnerability exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. (CVSS 5.4, Kajitori Co. Exment)
- [CVE-2024-46897](https://cve.now/CVE-2024-46897.md): Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. (CVSS 3.8, Kajitori Co. Exment)
- [CVE-2024-38820](https://cve.now/CVE-2024-38820.md): CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception (CVSS 3.1, VMware Spring · org.springframework:spring-context +1)
- [CVE-2024-9366](https://cve.now/CVE-2024-9366.md): Easy Menu Manager | WPZest \<= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, Easy Menu Manager | WPZest)
- [CVE-2024-10014](https://cve.now/CVE-2024-10014.md): Flat UI Button \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode (CVSS 6.4, tiandi Flat UI Button)
- [CVE-2024-9892](https://cve.now/CVE-2024-9892.md): Add Widget After Content \<= 2.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, apintop Add Widget After Content)
- [CVE-2024-9382](https://cve.now/CVE-2024-9382.md): Gantry 4 Framework \<= 4.1.21 - Reflected Cross-Site Scripting (CVSS 6.1, Gantry 4 Framework)
- [CVE-2024-9364](https://cve.now/CVE-2024-9364.md): SendGrid for WordPress \<= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion (CVSS 4.3, smackcoders SendGrid for WordPress)
- [CVE-2024-9361](https://cve.now/CVE-2024-9361.md): Bulk images optimizer: Resize, optimize, convert to webp, rename ... \<= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update (CVSS 4.3, giuliopanda Bulk images optimizer: Resize, optimize, conver…)
- [CVE-2024-9383](https://cve.now/CVE-2024-9383.md): Parcel Pro \<= 1.8.4 - Reflected Cross-Site Scripting (CVSS 6.1, parcelpro Parcel Pro)
- [CVE-2024-9452](https://cve.now/CVE-2024-9452.md): Branding \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, lolitaframework Branding)
- [CVE-2024-9350](https://cve.now/CVE-2024-9350.md): DPD Baltic Shipping \<= 1.2.83 - Reflected Cross-Site Scripting (CVSS 6.1, dpdbaltics DPD Baltic Shipping)
- [CVE-2024-8740](https://cve.now/CVE-2024-8740.md): GetResponse Forms by Optin Cat \<= 2.5.7 - Reflected Cross-Site Scripting (CVSS 6.1, fatcatapps GetResponse Forms by Optin Cat)
- [CVE-2024-9373](https://cve.now/CVE-2024-9373.md): Elemenda \<= 0.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, themeid Elemenda)
- [CVE-2024-10040](https://cve.now/CVE-2024-10040.md): Infinite-Scroll \<= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 5.3, paulirish-1 Infinite-Scroll)
- [CVE-2024-10049](https://cve.now/CVE-2024-10049.md): Edit WooCommerce Templates \<= 1.1.2 - Reflected Cross-Site Scripting via page (CVSS 6.1, ioannup Edit WooCommerce Templates)
- [CVE-2024-8790](https://cve.now/CVE-2024-8790.md): Social Share With Floating Bar \<= 1.0.3 - Reflected Cross-Site Scripting (CVSS 6.1, themeinwp Social Share With Floating Bar)
- [CVE-2024-8916](https://cve.now/CVE-2024-8916.md): Suki Sites Import \<= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, sukiwp Suki Sites Import)
- [CVE-2024-9848](https://cve.now/CVE-2024-9848.md): Product Customizer Light \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, k2servicecom Product Customizer Light)
- [CVE-2024-10119](https://cve.now/CVE-2024-10119.md): SECOM WRTM326 - OS Command Injection (CVSS 9.8, SECOM WRTM326)
- [CVE-2024-10118](https://cve.now/CVE-2024-10118.md): SECOM WRTR-304GN-304TW-UPSC - OS Command Injection (CVSS 9.8, SECOM WRTR-304GN-304TW-UPSC)
- [CVE-2024-9264](https://cve.now/CVE-2024-9264.md): Grafana SQL Expressions allow for remote code execution (CVSS 9.4, Grafana · github.com/grafana/grafana)
- [CVE-2024-45944](https://cve.now/CVE-2024-45944.md): In J2eeFAST \<=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in a (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.