# CVEs published 2024-10-22

81 CVEs were published on October 22, 2024: 12 critical, 27 high. Days are UTC.

- [CVE-2024-7587](https://cve.now/CVE-2024-7587.md): Information Disclosure, Information Tampering and Denial of Service (DoS) Vulnerability in GENESIS64, ICONICS Suite, MC Works64, and GENESIS32 (CVSS 7.8, Mitsubishi Electric GENESIS64 · Mitsubishi Electric MC W… +5)
- [CVE-2024-10231](https://cve.now/CVE-2024-10231.md): Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-10230](https://cve.now/CVE-2024-10230.md): Type Confusion in V8 in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-10229](https://cve.now/CVE-2024-10229.md): Inappropriate implementation in Extensions in Google Chrome prior to 130.0.6723.69 allowed a remote attacker to bypass site isolation via a (CVSS 8.1, Google Chrome)
- [CVE-2024-43698](https://cve.now/CVE-2024-43698.md): Kieback&Peter DDC4000 Series Use of Weak Credentials (CVSS 9.3, Kieback&Peter DDC4040e · Kieback&Peter DDC4020e +8)
- [CVE-2024-43812](https://cve.now/CVE-2024-43812.md): Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials (CVSS 8.6, Kieback&Peter DDC4040e · Kieback&Peter DDC4020e +8)
- [CVE-2024-41717](https://cve.now/CVE-2024-41717.md): Kieback&Peter DDC4000 Series Path Traversal (CVSS 9.3, Kieback & Peter DDC4040e · Kieback&Peter DDC4020e +8)
- [CVE-2024-48919](https://cve.now/CVE-2024-48919.md): RCE via Prompt Injection Into Cursor's Terminal Cmd-K (CVSS 9.2, getcursor cursor)
- [CVE-2024-48904](https://cve.now/CVE-2024-48904.md): An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. (CVSS 9.8, Trend Micro Cloud Edge)
- [CVE-2024-48903](https://cve.now/CVE-2024-48903.md): An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affect (CVSS 7.8, Trend Micro Deep Security Agent)
- [CVE-2024-46903](https://cve.now/CVE-2024-46903.md): A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive informati (CVSS 6.5, Trend Micro Deep Discovery Inspector)
- [CVE-2024-46902](https://cve.now/CVE-2024-46902.md): A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive informati (CVSS 4.9, Trend Micro Deep Discovery Inspector)
- [CVE-2024-45335](https://cve.now/CVE-2024-45335.md): Trend Micro Antivirus One, version 3.10.4 and below contains a vulnerability that could allow an attacker to use a specifically crafted viru (CVSS 8.4, Trend Micro Antivirus One)
- [CVE-2024-45334](https://cve.now/CVE-2024-45334.md): Trend Micro Antivirus One versions 3.10.4 and below (Consumer) is vulnerable to an Arbitrary Configuration Update that could allow unauthori (CVSS 7.8, Trend Micro Antivirus One)
- [CVE-2024-41183](https://cve.now/CVE-2024-41183.md): Trend Micro VPN, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite under specific conditions that can lead to elevatio (CVSS 7.8, Trend Micro VPN)
- [CVE-2024-39753](https://cve.now/CVE-2024-39753.md): An modOSCE SQL Injection vulnerability in Trend Micro Apex One could allow a remote attacker to execute arbitrary code on affected installat (CVSS 7.5, Trend Micro Apex One)
- [CVE-2024-10183](https://cve.now/CVE-2024-10183.md): Arbitrary File Write Vulnerability in Jamf Remote Assist Leading to Privilege Escalation (CVSS 5.2, Jamf Pro)
- [CVE-2024-9129](https://cve.now/CVE-2024-9129.md): Format String Injection in Zend Server (CVSS 9.3, Zend Server)
- [CVE-2024-9287](https://cve.now/CVE-2024-9287.md): Virtual environment (venv) activation scripts don't quote paths (CVSS 5.3, Python Software Foundation CPython · libpython +2)
- [CVE-2024-49373](https://cve.now/CVE-2024-49373.md): Centurion ERP user can view projects from organizations they're not apart of (CVSS 4.1, nofusscomputing centurion\_erp)
- [CVE-2024-48929](https://cve.now/CVE-2024-48929.md): Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out (CVSS 4.2, Umbraco-CMS · Umbraco.CMS)
- [CVE-2024-48927](https://cve.now/CVE-2024-48927.md): Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice (CVSS 4.6, Umbraco-CMS · UmbracoCms +1)
- [CVE-2024-48926](https://cve.now/CVE-2024-48926.md): Umbraco CMS logout page displayed before session expiration (CVSS 4.2, Umbraco-CMS · Umbraco.CMS +1)
- [CVE-2024-48925](https://cve.now/CVE-2024-48925.md): Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API (CVSS 0.0, Umbraco-CMS · Umbraco.CMS)
- [CVE-2024-47819](https://cve.now/CVE-2024-47819.md): Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section (CVSS 4.2, Umbraco-CMS · Umbraco.Cms.StaticAssets +1)
- [CVE-2024-38002](https://cve.now/CVE-2024-38002.md): The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2024-26273](https://cve.now/CVE-2024-26273.md): Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.4.0 through 7.4.3.103, and Liferay DXP 2023.Q (CVSS 8.8, Liferay Portal · Liferay DXP +2)
- [CVE-2024-43177](https://cve.now/CVE-2024-43177.md): IBM Concert improper certificate validation (CVSS 5.9, IBM Concert)
- [CVE-2024-26272](https://cve.now/CVE-2024-26272.md): Cross-site request forgery (CSRF) vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q (CVSS 8.8, Liferay Portal · Liferay DXP +2)
- [CVE-2024-43173](https://cve.now/CVE-2024-43173.md): IBM Concert information disclosure (CVSS 3.7, IBM Concert)
- [CVE-2024-8980](https://cve.now/CVE-2024-8980.md): The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA (CVSS 9.6, Liferay Portal · Liferay DXP +2)
- [CVE-2024-26271](https://cve.now/CVE-2024-26271.md): Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023. (CVSS 8.8, Liferay Portal · Liferay DXP +2)
- [CVE-2024-50312](https://cve.now/CVE-2024-50312.md): Graphql: information disclosure via graphql introspection in openshift (CVSS 5.3, Red Hat OpenShift Container Platform · github.com/openshift…)
- [CVE-2024-50311](https://cve.now/CVE-2024-50311.md): Graphql: denial of service (dos) vulnerability via graphql batching (CVSS 6.5, Red Hat OpenShift Container Platform)
- [CVE-2024-10234](https://cve.now/CVE-2024-10234.md): Wildfly: wildfly vulnerable to cross-site scripting (xss) (CVSS 6.1, wildfly · Red Hat JBoss Enterprise Application Platform +5)
- [CVE-2024-9050](https://cve.now/CVE-2024-9050.md): Networkmanager-libreswan: local privilege escalation via leftupdown (CVSS 7.8, NetworkManager-libreswan · Red Hat Enterprise Linux 7.7… +2)
- [CVE-2024-10189](https://cve.now/CVE-2024-10189.md): Anchor Episodes Index (Spotify for Podcasters) \<= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor\_episodes Shortcode (CVSS 6.4, jeswd Anchor Episodes Index)
- [CVE-2024-9231](https://cve.now/CVE-2024-9231.md): WP-Members Membership Plugin \<= 3.4.9.5 - Reflected Cross-Site Scripting (CVSS 6.1, cbutlerjr WP-Members Membership Plugin)
- [CVE-2024-35308](https://cve.now/CVE-2024-35308.md): Post-auth Arbitrary File Read in the Server Plugins Section (CVSS 8.3, Pandora FMS)
- [CVE-2024-9987](https://cve.now/CVE-2024-9987.md): SQL Injection in CSV Module Data Collection (CVSS 8.6, Pandora FMS)
- [CVE-2023-52919](https://cve.now/CVE-2023-52919.md): nfc: nci: fix possible NULL pointer dereference in send\_acknowledge() (no CVSS, Linux)
- [CVE-2023-52918](https://cve.now/CVE-2023-52918.md): media: pci: cx23885: check cx23885\_vdev\_init() return (no CVSS, Linux)
- [CVE-2024-9541](https://cve.now/CVE-2024-9541.md): News Kit Elementor Addons \<= 1.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template (CVSS 4.3, blazethemes News Kit Addons For Elementor)
- [CVE-2024-9589](https://cve.now/CVE-2024-9589.md): Category and Taxonomy Meta Fields \<= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, amu02aftab Category and Taxonomy Meta Fields)
- [CVE-2024-9591](https://cve.now/CVE-2024-9591.md): Category and Taxonomy Image \<= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 5.5, amu02aftab Category and Taxonomy Image)
- [CVE-2024-9590](https://cve.now/CVE-2024-9590.md): Category and Taxonomy Meta Fields \<= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 5.5, amu02aftab Category and Taxonomy Meta Fields)
- [CVE-2024-9588](https://cve.now/CVE-2024-9588.md): Category and Taxonomy Meta Fields \<= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete (CVSS 5.4, amu02aftab Category and Taxonomy Meta Fields)
- [CVE-2024-9627](https://cve.now/CVE-2024-9627.md): TeploBot - Telegram Bot for WP \<= 1.3 - Telegram Bot Token Disclosure (CVSS 8.6, gsuvorov TeploBot – Telegram Bot for WP)
- [CVE-2024-8852](https://cve.now/CVE-2024-8852.md): All-in-One WP Migration and Backup \<= 7.86 - Unauthenticated Information Disclosure via Error Logs (CVSS 5.3, servmask All-in-One WP Migration and Backup)
- [CVE-2024-10003](https://cve.now/CVE-2024-10003.md): Rover IDX \<= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions (CVSS 6.3, stevemullen Rover IDX)
- [CVE-2024-10002](https://cve.now/CVE-2024-10002.md): Rover IDX \<= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator (CVSS 8.8, stevemullen Rover IDX)
- [CVE-2024-9677](https://cve.now/CVE-2024-9677.md): The insufficiently protected credentials vulnerability in the CLI command of the USG FLEX H series uOS firmware version V1.21 and earlier ve (CVSS 5.5, Zyxel USG FLEX H series uOS firmware)
- [CVE-2022-23861](https://cve.now/CVE-2022-23861.md): Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. (CVSS 6.1)
- [CVE-2022-23862](https://cve.now/CVE-2022-23862.md): A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. (CVSS 8.4)
- [CVE-2024-26519](https://cve.now/CVE-2024-26519.md): An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the (CVSS 9.0)
- [CVE-2024-31029](https://cve.now/CVE-2024-31029.md): An issue in the server\_handle\_regular function of the test\_coap\_server.c file within the FreeCoAP project allows remote attackers to cause a (CVSS 8.2)
- [CVE-2024-40493](https://cve.now/CVE-2024-40493.md): Null Pointer Dereference in \`coap\_client\_exchange\_blockwise2\` function in Keith Cullen FreeCoAP 1.0 allows remote attackers to cause a denia (CVSS 5.3)
- [CVE-2024-40494](https://cve.now/CVE-2024-40494.md): Buffer Overflow in coap\_msg.c in FreeCoAP allows remote attackers to execute arbitrary code or cause a denial of service (stack buffer overf (CVSS 9.8)
- [CVE-2024-42643](https://cve.now/CVE-2024-42643.md): Integer Overflow in fast\_ping.c in SmartDNS Release46 allows remote attackers to cause a Denial of Service via misaligned memory access. (CVSS 7.5)
- [CVE-2024-44331](https://cve.now/CVE-2024-44331.md): Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cause a denial of servic (CVSS 7.5)
- [CVE-2024-44812](https://cve.now/CVE-2024-44812.md): SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password par (CVSS 9.8)
- [CVE-2024-45518](https://cve.now/CVE-2024-45518.md): An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before P (CVSS 7.5)
- [CVE-2024-45526](https://cve.now/CVE-2024-45526.md): An issue was discovered in OPC Foundation OPCFoundation/UA-.NETStandard through 1.5.374.78. (CVSS 5.3, OPCFoundation.NetStandard.Opc.Ua · OPCFoundation.NetStandar…)
- [CVE-2024-46240](https://cve.now/CVE-2024-46240.md): Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under action=system and the company/contact parameters und (CVSS 4.8)
- [CVE-2024-46482](https://cve.now/CVE-2024-46482.md): An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to (CVSS 8.2)
- [CVE-2024-46483](https://cve.now/CVE-2024-46483.md): Xlight FTP Server \<3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap ov (CVSS 9.8)
- [CVE-2024-46538](https://cve.now/CVE-2024-46538.md): A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 9.3)
- [CVE-2024-48415](https://cve.now/CVE-2024-48415.md): itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middl (CVSS 4.6)
- [CVE-2024-48570](https://cve.now/CVE-2024-48570.md): Client Management System 1.0 was discovered to contain a SQL injection vulnerability via the Between Dates Reports parameter at /admin/bwdat (CVSS 7.5)
- [CVE-2024-48605](https://cve.now/CVE-2024-48605.md): An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow (CVSS 7.8)
- [CVE-2024-48644](https://cve.now/CVE-2024-48644.md): Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889\_23031701) allows remote (CVSS 5.3)
- [CVE-2024-48652](https://cve.now/CVE-2024-48652.md): Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field (CVSS 4.8, camaleon\_cms)
- [CVE-2024-48656](https://cve.now/CVE-2024-48656.md): Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrar (CVSS 5.4)
- [CVE-2024-48657](https://cve.now/CVE-2024-48657.md): SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code (CVSS 8.1)
- [CVE-2024-48706](https://cve.now/CVE-2024-48706.md): Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the title parameter with action=add or action=editform within the (a) managem (CVSS 5.4)
- [CVE-2024-48707](https://cve.now/CVE-2024-48707.md): Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone (CVSS 5.4)
- [CVE-2024-48708](https://cve.now/CVE-2024-48708.md): Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b (CVSS 5.4)
- [CVE-2024-49208](https://cve.now/CVE-2024-49208.md): Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. (CVSS 5.9)
- [CVE-2024-49209](https://cve.now/CVE-2024-49209.md): Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application fi (CVSS 6.5)
- [CVE-2024-49210](https://cve.now/CVE-2024-49210.md): Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. (CVSS 5.2)
- [CVE-2024-49211](https://cve.now/CVE-2024-49211.md): Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. (CVSS 5.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.