CVEs published October 22, 2024
81 CVEs were published on October 22, 2024: 12 critical, 27 high.
- Published
- 81
- Critical
- 12
- High
- 27
- Medium
- 38
- Low
- 2
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Liferay Portal · Liferay DXP +2
- 5
- amu02aftab Category and Taxonomy Meta Fields
- 3
- Google Chrome
- 3
- IBM Concert
- 2
- Kieback&Peter DDC4040e · Kieback&Peter DDC4020e +8
- 2
- Linux
- 2
- Pandora FMS
- 2
- stevemullen Rover IDX
- 2
- Trend Micro Antivirus One
- 2
- Trend Micro Deep Discovery Inspector
- 2
Critical 12
- CVE-2024-43698Kieback&Peter DDC4000 Series Use of Weak CredentialsKieback&Peter DDC4040e · Kieback&Peter DDC4020e +8
- CVE-2024-41717Kieback&Peter DDC4000 Series Path TraversalKieback & Peter DDC4040e · Kieback&Peter DDC4020e +8
- CVE-2024-48919RCE via Prompt Injection Into Cursor's Terminal Cmd-Kgetcursor cursor
- CVE-2024-48904An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.Trend Micro Cloud Edge
- CVE-2024-9129Format String Injection in Zend ServerZend Server
- CVE-2024-38002The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, Liferay Portal · Liferay DXP +2
- CVE-2024-8980The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA Liferay Portal · Liferay DXP +2
- CVE-2024-26519An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the
- CVE-2024-40494Buffer Overflow in coap_msg.c in FreeCoAP allows remote attackers to execute arbitrary code or cause a denial of service (stack buffer overf
- CVE-2024-44812SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password par
- CVE-2024-46483Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap ov
- CVE-2024-46538A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
High 27
- CVE-2024-7587Information Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32Mitsubishi Electric GENESIS64 · Mitsubishi Electric MC W… +5
- CVE-2024-10231Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-10230Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-10229Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a Google Chrome
- CVE-2024-43812Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected CredentialsKieback&Peter DDC4040e · Kieback&Peter DDC4020e +8
- CVE-2024-48903An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affectTrend Micro Deep Security Agent
- CVE-2024-45335Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted viruTrend Micro Antivirus One
- CVE-2024-45334Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthoriTrend Micro Antivirus One
- CVE-2024-41183Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevatioTrend Micro VPN
- CVE-2024-39753An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installatTrend Micro Apex One
- CVE-2024-26273Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.QLiferay Portal · Liferay DXP +2
- CVE-2024-26272Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.QLiferay Portal · Liferay DXP +2
- CVE-2024-26271Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Liferay Portal · Liferay DXP +2
- CVE-2024-9050Networkmanager-libreswan: local privilege escalation via leftupdownNetworkManager-libreswan · Red Hat Enterprise Linux 7.7… +2
- CVE-2024-35308Post-auth Arbitrary File Read in the Server Plugins SectionPandora FMS
- CVE-2024-9987SQL Injection in CSV Module Data CollectionPandora FMS
- CVE-2024-9627TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosuregsuvorov TeploBot – Telegram Bot for WP
- CVE-2024-10002Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administratorstevemullen Rover IDX
- CVE-2022-23862A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53.
- CVE-2024-31029An issue in the server_handle_regular function of the test_coap_server.c file within the FreeCoAP project allows remote attackers to cause a
- CVE-2024-42643Integer Overflow in fast_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access.
- CVE-2024-44331Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cause a denial of servic
- CVE-2024-45518An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before P
- CVE-2024-46482An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to
- CVE-2024-48570Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdat
- CVE-2024-48605An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow
- CVE-2024-48657SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code
Medium, low and unrated 42
- CVE-2024-46903A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive informatiTrend Micro Deep Discovery Inspector
- CVE-2024-46902A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive informatiTrend Micro Deep Discovery Inspector
- CVE-2024-10183Arbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege EscalationJamf Pro
- CVE-2024-9287Virtual environment (venv) activation scripts don't quote pathsPython Software Foundation CPython · libpython +2
- CVE-2024-49373Centurion ERP user can view projects from organizations they're not apart ofnofusscomputing centurion_erp
- CVE-2024-48929Umbraco CMS Has Incomplete Server Termination During Explicit Sign-OutUmbraco-CMS · Umbraco.CMS
- CVE-2024-48927Potential Code Execution Risk When Viewing SVG Files in Full Screen in BackofficeUmbraco-CMS · UmbracoCms +1
- CVE-2024-48926Umbraco CMS logout page displayed before session expirationUmbraco-CMS · Umbraco.CMS +1
- CVE-2024-48925Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook APIUmbraco-CMS · Umbraco.CMS
- CVE-2024-47819Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary sectionUmbraco-CMS · Umbraco.Cms.StaticAssets +1
- CVE-2024-43177IBM Concert improper certificate validationIBM Concert
- CVE-2024-43173IBM Concert information disclosureIBM Concert
- CVE-2024-50312Graphql: information disclosure via graphql introspection in openshiftRed Hat OpenShift Container Platform · github.com/openshift…
- CVE-2024-50311Graphql: denial of service (dos) vulnerability via graphql batchingRed Hat OpenShift Container Platform
- CVE-2024-10234Wildfly: wildfly vulnerable to cross-site scripting (xss)wildfly · Red Hat JBoss Enterprise Application Platform +5
- CVE-2024-10189Anchor Episodes Index (Spotify for Podcasters) <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcodejeswd Anchor Episodes Index
- CVE-2024-9231WP-Members Membership Plugin <= 3.4.9.5 - Reflected Cross-Site Scriptingcbutlerjr WP-Members Membership Plugin
- CVE-2023-52919nfc: nci: fix possible NULL pointer dereference in send_acknowledge()Linux
- CVE-2023-52918media: pci: cx23885: check cx23885_vdev_init() returnLinux
- CVE-2024-9541News Kit Elementor Addons <= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Templateblazethemes News Kit Addons For Elementor
- CVE-2024-9589Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scriptingamu02aftab Category and Taxonomy Meta Fields
- CVE-2024-9591Category and Taxonomy Image <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scriptingamu02aftab Category and Taxonomy Image
- CVE-2024-9590Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scriptingamu02aftab Category and Taxonomy Meta Fields
- CVE-2024-9588Category and Taxonomy Meta Fields <= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Deleteamu02aftab Category and Taxonomy Meta Fields
- CVE-2024-8852All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logsservmask All-in-One WP Migration and Backup
- CVE-2024-10003Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functionsstevemullen Rover IDX
- CVE-2024-9677The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier veZyxel USG FLEX H series uOS firmware
- CVE-2022-23861Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53.
- CVE-2024-40493Null Pointer Dereference in `coap_client_exchange_blockwise2` function in Keith Cullen FreeCoAP 1.0 allows remote attackers to cause a denia
- CVE-2024-45526An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78.OPCFoundation.NetStandard.Opc.Ua · OPCFoundation.NetStandar…
- CVE-2024-46240Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under action=system and the company/contact parameters und
- CVE-2024-48415itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middl
- CVE-2024-48644Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote
- CVE-2024-48652Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name fieldcamaleon_cms
- CVE-2024-48656Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrar
- CVE-2024-48706Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform within the (a) managem
- CVE-2024-48707Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone
- CVE-2024-48708Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b
- CVE-2024-49208Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files.
- CVE-2024-49209Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application fi
- CVE-2024-49210Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09.
- CVE-2024-49211Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08.