CVEs published October 23, 2024
120 CVEs were published on October 23, 2024: 11 critical, 28 high. 2 are now in CISA KEV.
- Published
- 120
- Critical
- 11
- High
- 28
- Medium
- 79
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 9
Most affected products
- Cisco Firepower Management Center
- 23
- Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- 16
- Cisco Firepower Threat Defense Software
- 7
- PHPGurukul Medical Card Generation System
- 6
- LocalServer
- 4
- Siemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…
- 4
- ZZCMS
- 4
- ESAFENET CDG
- 3
- HCL Software Sametime
- 3
- Tenda RX9
- 3
Critical 11
- CVE-2024-20424A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower ManagemeCisco Firepower Management Center
- CVE-2024-20412A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthCisco Firepower Threat Defense Software
- CVE-2024-20329Cisco Adaptive Security Appliance Software Remote Command Injection VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2024-49652WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Upload vulnerabilityRenata Bracichowicz 3D Work In Progress
- CVE-2024-49653WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerabilityjames-eggers Portfolleo
- CVE-2024-49658WordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerabilityecomerciar Woocommerce Custom Profile Picture
- CVE-2024-49668WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerabilitychristopherdewese1099 Verbalize WP
- CVE-2024-49669WordPress INK Official plugin <= 4.1.2 - Arbitrary File Upload vulnerabilityAlexander De Ridder INK Official
- CVE-2024-49671WordPress AI Postpix plugin <= 1.1.8 - Arbitrary File Upload vulnerabilityDogu Pekgoz AI Image Generator for Your Content & Featured…
- CVE-2024-47575A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FoFortinet FortiManager
- CVE-2024-47901A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All veSiemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…
High 28
- CVE-2024-48963The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project.Snyk Cli · Snyk PHP Plugin +1
- CVE-2024-48964The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project.Snyk Cli · Snyk Gradle Plugin +1
- CVE-2024-20495A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTDCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20494A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefenseCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20426A vulnerability in the Internet Key Exchange version 2 (IKEv2) protocol for VPN termination of Cisco Adaptive Security Appliance (ASA) SoftwCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20408A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20402A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) SoftwarCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20351Cisco Firepower Threat Defense Software Snort Firewall Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2024-20339Cisco Firepower Threat Defense Software for Firepower 2100 Series TLS Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2024-20330Cisco Firepower Threat Defense Software for Cisco Firepower 2100 Series TCP UDP Snort 2 and Snort 2 Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2024-20260Cisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service VulnerabilityCisco Secure Firewall Adaptive Security Appliance (ASA) Sof…
- CVE-2024-20268Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-49690WordPress Qi Blocks plugin <= 1.3.2 - Local File Inclusion vulnerabilityQode Qi Blocks
- CVE-2024-49701WordPress Mags theme <= 1.1.6 - Local File Inclusion vulnerabilitythemehorse Mags
- CVE-2024-49684WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - PHP Object Injection vulnerabilityrevmakx Backup and Staging by WP Time Capsule
- CVE-2024-49657WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Deletion vulnerabilityRenata Bracichowicz 3D Work In Progress
- CVE-2024-49675WordPress iBryl Switch User plugin <= 1.0.1 - Account Takeover vulnerabilityVitalii iBryl Switch User
- CVE-2024-49370Change-Password via Portal-Profile sets PimcoreBackendUser password without hashingpimcore
- CVE-2024-10283Tenda RX9/RX9 Pro SetNetControlList sub_4337EC stack-based overflowTenda RX9
- CVE-2024-10282Tenda RX9/RX9 Pro SetVirtualServerCfg sub_42EA38 stack-based overflowTenda RX9
- CVE-2024-47904A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All veSiemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…
- CVE-2024-47902A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All veSiemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…
- CVE-2024-10281Tenda RX9/RX9 Pro SetStaticRouteCfg sub_42EEE0 stack-based overflowTenda RX9
- CVE-2024-10280Tenda AC6/AC7/AC8/AC9/AC10/AC10U/AC15/AC18/AC500/AC1206 GetIPTV websReadEvent null pointer dereferenceTenda AC6 · Tenda AC7 +8
- CVE-2024-9947ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth providerProfilePress Team ProfilePress Pro
- CVE-2024-50066mm/mremap: fix move_normal_pmd/retract_page_tables raceLinux
- CVE-2024-9927WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order ProposalWP Overnight BV WooCommerce Order Proposal
- CVE-2024-40431A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUG
Medium, low and unrated 81
- CVE-2023-50355HCL Sametime is impacted by generation of error messages containing sensitive informationHCL Software Sametime
- CVE-2024-10301PHPGurukul Medical Card Generation System Search search-medicalcard.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2024-10300PHPGurukul Medical Card Generation System View Enquiry Page view-enquiry.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2024-10299PHPGurukul Medical Card Generation System Managecard View Detail Page view-card-detail.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2024-10298PHPGurukul Medical Card Generation System Managecard Edit Card Detail Page edit-card-detail.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2024-20526A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cauCisco Adaptive Security Appliance (ASA) Software
- CVE-2024-20493A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) SoCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20485A vulnerability in the VPN web server of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20482A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower ManagemeCisco Firepower Management Center
- CVE-2024-20481A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefeCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20473A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticatedCisco Firepower Management Center
- CVE-2024-20472A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticatedCisco Firepower Management Center
- CVE-2024-20474A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remoteCisco Secure Client
- CVE-2024-20471A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticatedCisco Firepower Management Center
- CVE-2024-20431A vulnerability in the geolocation access control feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, rCisco Firepower Threat Defense Software
- CVE-2024-20415A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reCisco Firepower Management Center
- CVE-2024-20410A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reCisco Firepower Management Center
- CVE-2024-20409A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reCisco Firepower Management Center
- CVE-2024-9949Denial of Service in Forescout SecureConnectorForescout SecureConnector
- CVE-2024-20407A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTDCisco Firepower Threat Defense Software
- CVE-2024-20403A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoCisco Firepower Management Center
- CVE-2024-20388A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote atCisco Firepower Management Center · Cisco Firepower Threat…
- CVE-2024-20387A vulnerability in the web-based management interface of Cisco FMC Software could allow an authenticated, remote attacker to store maliciousCisco Firepower Management Center
- CVE-2024-20386A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reCisco Firepower Management Center
- CVE-2024-20384A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DeCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20382A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefensCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-10297PHPGurukul Medical Card Generation System Managecard Edit Image Page changeimage.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2024-20379A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower ManagemeCisco Firepower Management Center
- CVE-2024-20377A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attackCisco Firepower Management Center
- CVE-2024-20374A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower ManagemeCisco Firepower Management Center
- CVE-2024-20372A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, reCisco Firepower Management Center
- CVE-2024-20370A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance (ASA) Software and Cisco Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20364A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoCisco Firepower Management Center
- CVE-2024-20342Cisco Firepower Threat Defense Software Rate Filter Bypass VulnerabilityCisco Firepower Threat Defense Software
- CVE-2024-20341Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting VulnerabilityCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20340A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower ManagemeCisco Secure Firewall Management Center
- CVE-2024-20331Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Authentication DoS VulnerabilityCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20300Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2024-20299Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass VulnerabilityCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20298Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2024-20297Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass VulnerabilityCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20275Cisco Secure Firewall Management Center Software Backup Cluster Command Injection VulnerabilityCisco Firepower Management Center
- CVE-2024-20274Cisco Secure Firewall Management Center HTML Injection VulnerabilityCisco Firepower Management Center
- CVE-2024-20273Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2024-20269Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2024-20264Cisco Firepower Management Center Software Cross-Site Scripting VulnerabilityCisco Firepower Management Center
- CVE-2024-49756AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.ash-project ash_postgres
- CVE-2024-10296PHPGurukul Medical Card Generation System Report of Medical Card Page card-bwdates-reports-details.php sql injectionPHPGurukul Medical Card Generation System
- CVE-2024-10293ZZCMS functions.php Ebak_SetGotoPak unrestricted uploadZZCMS
- CVE-2024-49751Frappe Press possible HTML injection through SaaS Signup inputsfrappe press
- CVE-2024-49676WordPress Custom Icons for Elementor plugin <= 0.3.3 - Arbitrary File Upload vulnerabilityMichael Bourne Custom Icons for Elementor
- CVE-2024-10292ZZCMS ChangeTable.php unrestricted uploadZZCMS
- CVE-2024-10291ZZCMS phome.php Ebak_DotranExecutSQL sql injectionZZCMS
- CVE-2024-30124HCL Sametime is impacted by insecure servicesHCL Software Sametime
- CVE-2024-10290ZZCMS inc.php information disclosureZZCMS
- CVE-2024-30122HCL Sametime is impacted by misconfigured security related HTTP headersHCL Software Sametime
- CVE-2024-5764Nexus Repository 3 - Static hard-coded encryption passphrase used by defaultSonatype Nexus Repository
- CVE-2024-47903A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All veSiemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…
- CVE-2024-10250Nioland <= 1.2.6 - Reflected Cross-Site Scripting via sSteelThemes Nioland - SaaS & Software Startup Tech WordPres…
- CVE-2024-10041Pam: libpam: libpam vulnerable to read hashed passwordpam · Red Hat Enterprise Linux
- CVE-2024-50050Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potenMeta Platforms Llama Stack
- CVE-2024-10279ESAFENET CDG PrintPolicyService.java sql injectionESAFENET CDG
- CVE-2024-10278ESAFENET CDG ReUserOrganiseService.java sql injectionESAFENET CDG
- CVE-2024-10289Cross-Site Scripting (XSS) vulnerability in LocalServerLocalServer
- CVE-2024-10288Cross-Site Scripting (XSS) vulnerability in LocalServerLocalServer
- CVE-2024-10287Cross-Site Scripting (XSS) vulnerability in LocalServerLocalServer
- CVE-2024-10286Cross-Site Scripting (XSS) vulnerability in LocalServerLocalServer
- CVE-2024-10277ESAFENET CDG UsbKeyAjax.java sql injectionESAFENET CDG
- CVE-2024-8500WP Shortcodes Plugin — Shortcodes Ultimate <= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptinggn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-10276Telestream Sentry Reports Page page cross site scriptingTelestream Sentry
- CVE-2023-50310IBM CICS Transaction Gateway for Multiplatforms information disclosureIBM CICS Transaction Gateway for Multiplatforms
- CVE-2024-9530Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposureqodeinteractive Qi Addons For Elementor
- CVE-2024-10045Transients Manager <= 2.0.6 - Cross-Site Request Forgerysmub Transients Manager
- CVE-2024-43924WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Broken Access Control vulnerabilitydFactory Responsive Lightbox
- CVE-2024-9583RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorizationrebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…
- CVE-2024-9829Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Downloadmetagauss Download Plugin
- CVE-2024-31880IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2024-40432A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_C
- CVE-2024-48213RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php.
- CVE-2024-50382Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in
- CVE-2024-50383Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna12