# CVEs published 2024-10-23

120 CVEs were published on October 23, 2024: 11 critical, 28 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-50355](https://cve.now/CVE-2023-50355.md): HCL Sametime is impacted by generation of error messages containing sensitive information (CVSS 3.6, HCL Software Sametime)
- [CVE-2024-10301](https://cve.now/CVE-2024-10301.md): PHPGurukul Medical Card Generation System Search search-medicalcard.php sql injection (CVSS 5.1, PHPGurukul Medical Card Generation System)
- [CVE-2024-10300](https://cve.now/CVE-2024-10300.md): PHPGurukul Medical Card Generation System View Enquiry Page view-enquiry.php sql injection (CVSS 5.1, PHPGurukul Medical Card Generation System)
- [CVE-2024-10299](https://cve.now/CVE-2024-10299.md): PHPGurukul Medical Card Generation System Managecard View Detail Page view-card-detail.php sql injection (CVSS 5.1, PHPGurukul Medical Card Generation System)
- [CVE-2024-10298](https://cve.now/CVE-2024-10298.md): PHPGurukul Medical Card Generation System Managecard Edit Card Detail Page edit-card-detail.php sql injection (CVSS 5.1, PHPGurukul Medical Card Generation System)
- [CVE-2024-48963](https://cve.now/CVE-2024-48963.md): The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. (CVSS 7.5, Snyk Cli · Snyk PHP Plugin +1)
- [CVE-2024-48964](https://cve.now/CVE-2024-48964.md): The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. (CVSS 7.5, Snyk Cli · Snyk Gradle Plugin +1)
- [CVE-2024-20526](https://cve.now/CVE-2024-20526.md): A vulnerability in the SSH server of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cau (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2024-20495](https://cve.now/CVE-2024-20495.md): A vulnerability in the Remote Access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20494](https://cve.now/CVE-2024-20494.md): A vulnerability in the TLS cryptography functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20493](https://cve.now/CVE-2024-20493.md): A vulnerability in the login authentication functionality of the Remote Access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) So (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20485](https://cve.now/CVE-2024-20485.md): A vulnerability in the VPN web server of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software (CVSS 6.0, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20482](https://cve.now/CVE-2024-20482.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Manageme (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2024-20481](https://cve.now/CVE-2024-20481.md): A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defe (CVSS 5.8, KEV, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20473](https://cve.now/CVE-2024-20473.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2024-20472](https://cve.now/CVE-2024-20472.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2024-20474](https://cve.now/CVE-2024-20474.md): A vulnerability in Internet Key Exchange version 2 (IKEv2) processing of Cisco Secure Client Software could allow an unauthenticated, remote (CVSS 4.3, Cisco Secure Client)
- [CVE-2024-20471](https://cve.now/CVE-2024-20471.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2024-20431](https://cve.now/CVE-2024-20431.md): A vulnerability in the geolocation access control feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, r (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2024-20426](https://cve.now/CVE-2024-20426.md): A vulnerability in the Internet Key Exchange version 2 (IKEv2) protocol for VPN termination of Cisco Adaptive Security Appliance (ASA) Softw (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20424](https://cve.now/CVE-2024-20424.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Manageme (CVSS 9.9, Cisco Firepower Management Center)
- [CVE-2024-20415](https://cve.now/CVE-2024-20415.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-20412](https://cve.now/CVE-2024-20412.md): A vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauth (CVSS 9.3, Cisco Firepower Threat Defense Software)
- [CVE-2024-20410](https://cve.now/CVE-2024-20410.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re (CVSS 5.4, Cisco Firepower Management Center)
- [CVE-2024-20409](https://cve.now/CVE-2024-20409.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-9949](https://cve.now/CVE-2024-9949.md): Denial of Service in Forescout SecureConnector (CVSS 5.8, Forescout SecureConnector)
- [CVE-2024-20408](https://cve.now/CVE-2024-20408.md): A vulnerability in the Dynamic Access Policies (DAP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20407](https://cve.now/CVE-2024-20407.md): A vulnerability in the interaction between the TCP Intercept feature and the Snort 3 detection engine on Cisco Firepower Threat Defense (FTD (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2024-20403](https://cve.now/CVE-2024-20403.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remo (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-20402](https://cve.now/CVE-2024-20402.md): A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwar (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20388](https://cve.now/CVE-2024-20388.md): A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote at (CVSS 5.3, Cisco Firepower Management Center · Cisco Firepower Threat…)
- [CVE-2024-20387](https://cve.now/CVE-2024-20387.md): A vulnerability in the web-based management interface of Cisco FMC Software could allow an authenticated, remote attacker to store malicious (CVSS 5.4, Cisco Firepower Management Center)
- [CVE-2024-20386](https://cve.now/CVE-2024-20386.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-20384](https://cve.now/CVE-2024-20384.md): A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat De (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20382](https://cve.now/CVE-2024-20382.md): A vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defens (CVSS 6.1, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-10297](https://cve.now/CVE-2024-10297.md): PHPGurukul Medical Card Generation System Managecard Edit Image Page changeimage.php sql injection (CVSS 5.1, PHPGurukul Medical Card Generation System)
- [CVE-2024-20379](https://cve.now/CVE-2024-20379.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Manageme (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2024-20377](https://cve.now/CVE-2024-20377.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attack (CVSS 5.4, Cisco Firepower Management Center)
- [CVE-2024-20374](https://cve.now/CVE-2024-20374.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Manageme (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2024-20372](https://cve.now/CVE-2024-20372.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, re (CVSS 6.1, Cisco Firepower Management Center)
- [CVE-2024-20370](https://cve.now/CVE-2024-20370.md): A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance (ASA) Software and Cisco (CVSS 6.0, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20364](https://cve.now/CVE-2024-20364.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remo (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-20351](https://cve.now/CVE-2024-20351.md): Cisco Firepower Threat Defense Software Snort Firewall Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2024-20342](https://cve.now/CVE-2024-20342.md): Cisco Firepower Threat Defense Software Rate Filter Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2024-20341](https://cve.now/CVE-2024-20341.md): Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20340](https://cve.now/CVE-2024-20340.md): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Manageme (CVSS 6.5, Cisco Secure Firewall Management Center)
- [CVE-2024-20339](https://cve.now/CVE-2024-20339.md): Cisco Firepower Threat Defense Software for Firepower 2100 Series TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2024-20331](https://cve.now/CVE-2024-20331.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software VPN Authentication DoS Vulnerability (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20330](https://cve.now/CVE-2024-20330.md): Cisco Firepower Threat Defense Software for Cisco Firepower 2100 Series TCP UDP Snort 2 and Snort 2 Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2024-20329](https://cve.now/CVE-2024-20329.md): Cisco Adaptive Security Appliance Software Remote Command Injection Vulnerability (CVSS 9.9, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2024-20300](https://cve.now/CVE-2024-20300.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-20299](https://cve.now/CVE-2024-20299.md): Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass Vulnerability (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20298](https://cve.now/CVE-2024-20298.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-20297](https://cve.now/CVE-2024-20297.md): Cisco Adaptive Security Appliance and Firepower Threat Defense AnyConnect Access Control List Bypass Vulnerability (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20275](https://cve.now/CVE-2024-20275.md): Cisco Secure Firewall Management Center Software Backup Cluster Command Injection Vulnerability (CVSS 6.8, Cisco Firepower Management Center)
- [CVE-2024-20274](https://cve.now/CVE-2024-20274.md): Cisco Secure Firewall Management Center HTML Injection Vulnerability (CVSS 5.5, Cisco Firepower Management Center)
- [CVE-2024-20273](https://cve.now/CVE-2024-20273.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Firepower Management Center)
- [CVE-2024-20260](https://cve.now/CVE-2024-20260.md): Cisco Adaptive Security Virtual Appliance and Secure Firewall Threat Defense Virtual SSL VPN Denial of Service Vulnerability (CVSS 8.6, Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…)
- [CVE-2024-20269](https://cve.now/CVE-2024-20269.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-20268](https://cve.now/CVE-2024-20268.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Denial of Service Vulnerability (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20264](https://cve.now/CVE-2024-20264.md): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2024-49756](https://cve.now/CVE-2024-49756.md): AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. (CVSS 5.3, ash-project ash\_postgres)
- [CVE-2024-10296](https://cve.now/CVE-2024-10296.md): PHPGurukul Medical Card Generation System Report of Medical Card Page card-bwdates-reports-details.php sql injection (CVSS 5.1, PHPGurukul Medical Card Generation System)
- [CVE-2024-10293](https://cve.now/CVE-2024-10293.md): ZZCMS functions.php Ebak\_SetGotoPak unrestricted upload (CVSS 5.3, ZZCMS)
- [CVE-2024-49751](https://cve.now/CVE-2024-49751.md): Frappe Press possible HTML injection through SaaS Signup inputs (CVSS 1.2, frappe press)
- [CVE-2024-49652](https://cve.now/CVE-2024-49652.md): WordPress 3D Work In Progress plugin \<= 1.0.3 - Arbitrary File Upload vulnerability (CVSS 9.9, Renata Bracichowicz 3D Work In Progress)
- [CVE-2024-49653](https://cve.now/CVE-2024-49653.md): WordPress Portfolleo plugin \<= 1.2 - Arbitrary File Upload vulnerability (CVSS 9.9, james-eggers Portfolleo)
- [CVE-2024-49658](https://cve.now/CVE-2024-49658.md): WordPress Woocommerce Custom Profile Picture plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 9.9, ecomerciar Woocommerce Custom Profile Picture)
- [CVE-2024-49668](https://cve.now/CVE-2024-49668.md): WordPress Verbalize WP plugin \<= 1.0 - Arbitrary File Upload vulnerability (CVSS 10.0, christopherdewese1099 Verbalize WP)
- [CVE-2024-49669](https://cve.now/CVE-2024-49669.md): WordPress INK Official plugin \<= 4.1.2 - Arbitrary File Upload vulnerability (CVSS 9.9, Alexander De Ridder INK Official)
- [CVE-2024-49671](https://cve.now/CVE-2024-49671.md): WordPress AI Postpix plugin \<= 1.1.8 - Arbitrary File Upload vulnerability (CVSS 9.9, Dogu Pekgoz AI Image Generator for Your Content & Featured…)
- [CVE-2024-49676](https://cve.now/CVE-2024-49676.md): WordPress Custom Icons for Elementor plugin \<= 0.3.3 - Arbitrary File Upload vulnerability (CVSS 6.6, Michael Bourne Custom Icons for Elementor)
- [CVE-2024-10292](https://cve.now/CVE-2024-10292.md): ZZCMS ChangeTable.php unrestricted upload (CVSS 5.3, ZZCMS)
- [CVE-2024-10291](https://cve.now/CVE-2024-10291.md): ZZCMS phome.php Ebak\_DotranExecutSQL sql injection (CVSS 5.3, ZZCMS)
- [CVE-2024-30124](https://cve.now/CVE-2024-30124.md): HCL Sametime is impacted by insecure services (CVSS 4.0, HCL Software Sametime)
- [CVE-2024-49690](https://cve.now/CVE-2024-49690.md): WordPress Qi Blocks plugin \<= 1.3.2 - Local File Inclusion vulnerability (CVSS 7.5, Qode Qi Blocks)
- [CVE-2024-49701](https://cve.now/CVE-2024-49701.md): WordPress Mags theme \<= 1.1.6 - Local File Inclusion vulnerability (CVSS 7.5, themehorse Mags)
- [CVE-2024-49684](https://cve.now/CVE-2024-49684.md): WordPress Backup and Staging by WP Time Capsule plugin \<= 1.22.21 - PHP Object Injection vulnerability (CVSS 7.2, revmakx Backup and Staging by WP Time Capsule)
- [CVE-2024-49657](https://cve.now/CVE-2024-49657.md): WordPress 3D Work In Progress plugin \<= 1.0.3 - Arbitrary File Deletion vulnerability (CVSS 7.7, Renata Bracichowicz 3D Work In Progress)
- [CVE-2024-49675](https://cve.now/CVE-2024-49675.md): WordPress iBryl Switch User plugin \<= 1.0.1 - Account Takeover vulnerability (CVSS 8.8, Vitalii iBryl Switch User)
- [CVE-2024-49370](https://cve.now/CVE-2024-49370.md): Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing (CVSS 8.7, pimcore)
- [CVE-2024-47575](https://cve.now/CVE-2024-47575.md): A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fo (CVSS 9.8, KEV, Fortinet FortiManager)
- [CVE-2024-10290](https://cve.now/CVE-2024-10290.md): ZZCMS inc.php information disclosure (CVSS 6.9, ZZCMS)
- [CVE-2024-10283](https://cve.now/CVE-2024-10283.md): Tenda RX9/RX9 Pro SetNetControlList sub\_4337EC stack-based overflow (CVSS 8.7, Tenda RX9)
- [CVE-2024-30122](https://cve.now/CVE-2024-30122.md): HCL Sametime is impacted by misconfigured security related HTTP headers (CVSS 5.8, HCL Software Sametime)
- [CVE-2024-5764](https://cve.now/CVE-2024-5764.md): Nexus Repository 3 - Static hard-coded encryption passphrase used by default (CVSS 5.9, Sonatype Nexus Repository)
- [CVE-2024-10282](https://cve.now/CVE-2024-10282.md): Tenda RX9/RX9 Pro SetVirtualServerCfg sub\_42EA38 stack-based overflow (CVSS 8.7, Tenda RX9)
- [CVE-2024-47904](https://cve.now/CVE-2024-47904.md): A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions \< V8.2.12), InterMesh 7707 Fire Subscriber (All ve (CVSS 7.8, Siemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…)
- [CVE-2024-47903](https://cve.now/CVE-2024-47903.md): A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions \< V8.2.12), InterMesh 7707 Fire Subscriber (All ve (CVSS 5.8, Siemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…)
- [CVE-2024-47902](https://cve.now/CVE-2024-47902.md): A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions \< V8.2.12), InterMesh 7707 Fire Subscriber (All ve (CVSS 7.2, Siemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…)
- [CVE-2024-47901](https://cve.now/CVE-2024-47901.md): A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions \< V8.2.12), InterMesh 7707 Fire Subscriber (All ve (CVSS 10.0, Siemens InterMesh 7177 Hybrid 2.0 Subscriber · Siemens Inte…)
- [CVE-2024-10281](https://cve.now/CVE-2024-10281.md): Tenda RX9/RX9 Pro SetStaticRouteCfg sub\_42EEE0 stack-based overflow (CVSS 8.7, Tenda RX9)
- [CVE-2024-10250](https://cve.now/CVE-2024-10250.md): Nioland \<= 1.2.6 - Reflected Cross-Site Scripting via s (CVSS 6.1, SteelThemes Nioland - SaaS & Software Startup Tech WordPres…)
- [CVE-2024-10041](https://cve.now/CVE-2024-10041.md): Pam: libpam: libpam vulnerable to read hashed password (CVSS 4.7, pam · Red Hat Enterprise Linux)
- [CVE-2024-50050](https://cve.now/CVE-2024-50050.md): Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, poten (CVSS 6.3, Meta Platforms Llama Stack)
- [CVE-2024-10280](https://cve.now/CVE-2024-10280.md): Tenda AC6/AC7/AC8/AC9/AC10/AC10U/AC15/AC18/AC500/AC1206 GetIPTV websReadEvent null pointer dereference (CVSS 7.1, Tenda AC6 · Tenda AC7 +8)
- [CVE-2024-10279](https://cve.now/CVE-2024-10279.md): ESAFENET CDG PrintPolicyService.java sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10278](https://cve.now/CVE-2024-10278.md): ESAFENET CDG ReUserOrganiseService.java sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10289](https://cve.now/CVE-2024-10289.md): Cross-Site Scripting (XSS) vulnerability in LocalServer (CVSS 6.1, LocalServer)
- [CVE-2024-10288](https://cve.now/CVE-2024-10288.md): Cross-Site Scripting (XSS) vulnerability in LocalServer (CVSS 6.1, LocalServer)
- [CVE-2024-10287](https://cve.now/CVE-2024-10287.md): Cross-Site Scripting (XSS) vulnerability in LocalServer (CVSS 6.1, LocalServer)
- [CVE-2024-10286](https://cve.now/CVE-2024-10286.md): Cross-Site Scripting (XSS) vulnerability in LocalServer (CVSS 6.1, LocalServer)
- [CVE-2024-10277](https://cve.now/CVE-2024-10277.md): ESAFENET CDG UsbKeyAjax.java sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-8500](https://cve.now/CVE-2024-8500.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 5.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-10276](https://cve.now/CVE-2024-10276.md): Telestream Sentry Reports Page page cross site scripting (CVSS 5.3, Telestream Sentry)
- [CVE-2023-50310](https://cve.now/CVE-2023-50310.md): IBM CICS Transaction Gateway for Multiplatforms information disclosure (CVSS 4.9, IBM CICS Transaction Gateway for Multiplatforms)
- [CVE-2024-9530](https://cve.now/CVE-2024-9530.md): Qi Addons For Elementor \<= 1.8.0 - Sensitive Information Exposure (CVSS 4.3, qodeinteractive Qi Addons For Elementor)
- [CVE-2024-10045](https://cve.now/CVE-2024-10045.md): Transients Manager \<= 2.0.6 - Cross-Site Request Forgery (CVSS 4.3, smub Transients Manager)
- [CVE-2024-43924](https://cve.now/CVE-2024-43924.md): WordPress Responsive Lightbox & Gallery plugin \<= 2.4.7 - Broken Access Control vulnerability (CVSS 5.3, dFactory Responsive Lightbox)
- [CVE-2024-9947](https://cve.now/CVE-2024-9947.md): ProfilePress - Pro \<= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider (CVSS 8.1, ProfilePress Team ProfilePress Pro)
- [CVE-2024-9583](https://cve.now/CVE-2024-9583.md): RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging \<= 4.23.12 - Missing Authorization (CVSS 4.3, rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…)
- [CVE-2024-9829](https://cve.now/CVE-2024-9829.md): Download Plugin \<= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download (CVSS 6.5, metagauss Download Plugin)
- [CVE-2024-50066](https://cve.now/CVE-2024-50066.md): mm/mremap: fix move\_normal\_pmd/retract\_page\_tables race (CVSS 7.8, Linux)
- [CVE-2024-9927](https://cve.now/CVE-2024-9927.md): WooCommerce Order Proposal \<= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal (CVSS 7.2, WP Overnight BV WooCommerce Order Proposal)
- [CVE-2024-31880](https://cve.now/CVE-2024-31880.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-40431](https://cve.now/CVE-2024-40431.md): A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL\_SCSI\_PASS\_THROUG (CVSS 8.8)
- [CVE-2024-40432](https://cve.now/CVE-2024-40432.md): A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL\_SFFDISK\_DEVICE\_C (CVSS 6.5)
- [CVE-2024-48213](https://cve.now/CVE-2024-48213.md): RockOA v2.6.5 is vulnerable to Directory Traversal in webmain/system/beifen/beifenAction.php. (CVSS 4.3)
- [CVE-2024-50382](https://cve.now/CVE-2024-50382.md): Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in (CVSS 5.9)
- [CVE-2024-50383](https://cve.now/CVE-2024-50383.md): Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna12 (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.