CVEs published October 24, 2024
106 CVEs were published on October 24, 2024: 13 critical, 38 high.
- Published
- 106
- Critical
- 13
- High
- 38
- Medium
- 55
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- IceWhaleTech ZimaOS
- 5
- baserproject basercms · baserproject/basercms
- 4
- pyassimp
- 4
- OpenRefine · org.openrefine:openrefine
- 3
- SourceCodeHero Clothes Recommendation System
- 3
- Apple macOS
- 2
- Apple Safari · Apple iOS and iPadOS +4
- 2
- GitLab
- 2
- metagauss EventPrime – Events Calendar, Bookings and Tickets
- 2
- SourceCodester Best House Rental Management System
- 2
Critical 13
- CVE-2024-47883Butterfly has path/URL confusion in resource handling leading to multiple weaknessesOpenRefine simile-butterfly · org.openrefine.dependencies:b…
- CVE-2024-7763WhatsUp Gold getReport Missing Authentication Authentication Bypass VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-49681WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerabilityactivity-log.com WP Sessions Time Monitoring Full Automatic
- CVE-2024-41617Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control.
- CVE-2024-41618Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function.
- CVE-2024-46478HTMLDOC v1.9.18 contains a buffer overflow in parse_pre function,ps-pdf.cxx:5681.
- CVE-2024-48143A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the
- CVE-2024-48144A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exf
- CVE-2024-48145A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate
- CVE-2024-48514php-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6).maestroerror/php-heic-to-jpg
- CVE-2024-48538Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information b
- CVE-2024-48539Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism.
- CVE-2024-48548The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices.
High 38
- CVE-2024-10351Tenda RX9 Pro POST Request setMacFilterCfg sub_424CE0 stack-based overflowTenda RX9 Pro
- CVE-2024-49760OpenRefine has a path traversal in LoadLanguageCommandOpenRefine · org.openrefine:openrefine
- CVE-2024-49359ZimaOS vulnerable to Directory Listing via Parameter ManipulationIceWhaleTech ZimaOS
- CVE-2024-49357ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data LeakIceWhaleTech ZimaOS
- CVE-2024-48931ZimaOS Arbitrary File Read via Parameter ManipulationIceWhaleTech ZimaOS
- CVE-2024-47881OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)OpenRefine · org.openrefine:database
- CVE-2024-47880OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommandOpenRefine · org.openrefine:openrefine
- CVE-2024-10327A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOSOkta Verify for iOS
- CVE-2024-47879OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)OpenRefine · org.openrefine:main
- CVE-2024-47878Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)OpenRefine · org.openrefine:extensions
- CVE-2024-46998baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Featurebaserproject basercms · baserproject/basercms
- CVE-2024-10295Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a requestgateway · Red Hat 3scale API Management Platform
- CVE-2024-10313iniNet Solutions SpiderControl SCADA PC HMI Editor Path TraversaliniNet Solutions SpiderControl SCADA PC HMI Editor
- CVE-2024-49691WordPress Product Filter by WBW plugin <= 2.7.0 - SQL Injection vulnerabilityWBW Plugins Product Filter by WBW
- CVE-2024-5608SQL InjectionManageEngine ADAudit Plus
- CVE-2024-8312Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-6049Unauthenticated Path TraversalLawo AG vsm LTC Time Sync
- CVE-2024-45242EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping o
- CVE-2024-45260An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2.
- CVE-2024-45261An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2.
- CVE-2024-45262An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2.
- CVE-2024-45263An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2.
- CVE-2024-48139A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent
- CVE-2024-48140A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attacke
- CVE-2024-48141A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subs
- CVE-2024-48142A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access an
- CVE-2024-48208pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow.
- CVE-2024-48423An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp librpyassimp
- CVE-2024-48427A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbit
- CVE-2024-48440Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command
- CVE-2024-48441Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection
- CVE-2024-48454An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user
- CVE-2024-48541Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive informat
- CVE-2024-48542Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sen
- CVE-2024-48544Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive in
- CVE-2024-48545Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information
- CVE-2024-48546Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information
- CVE-2024-48547Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive info
Medium, low and unrated 55
- CVE-2024-10353SourceCodester Online Exam System admin-dashboard access controlSourceCodester Online Exam System
- CVE-2024-10350code-projects Hospital Management System add-doctor.php sql injectioncode-projects Hospital Management System
- CVE-2024-49750Snowflake Connector for Python has sensitive data in logssnowflakedb snowflake-connector-python · snowflake-connecto…
- CVE-2024-10349SourceCodester Best House Rental Management System ajax.php delete_tenant sql injectionSourceCodester Best House Rental Management System
- CVE-2024-10348SourceCodester Best House Rental Management System Manage Tenant Details index.php cross site scriptingSourceCodester Best House Rental Management System
- CVE-2024-49762Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabledpterodactyl panel · pterodactyl/panel
- CVE-2024-49358ZimaOS vulnerable to Username Enumeration via API ResponsesIceWhaleTech ZimaOS
- CVE-2024-48932ZimaOS Unauthenticated API Discloses UsernamesIceWhaleTech ZimaOS
- CVE-2024-47882OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious projectOpenRefine · org.openrefine:openrefine
- CVE-2024-47173Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setupsaimeos ai-admin-graphql · aimeos/ai-admin-graphql
- CVE-2024-46996baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Featurebaserproject basercms · baserproject/basercms
- CVE-2024-46995baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Requestbaserproject basercms · baserproject/basercms
- CVE-2024-46994baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Featurebaserproject basercms · baserproject/basercms
- CVE-2024-10338SourceCodeHero Clothes Recommendation System home.php sql injectionSourceCodeHero Clothes Recommendation System
- CVE-2024-10337SourceCodeHero Clothes Recommendation System home.php sql injectionSourceCodeHero Clothes Recommendation System
- CVE-2024-38314IBM Maximo Application Suite - Monitor Component information disclosureIBM Maximo Application Suite - Monitor Component
- CVE-2024-44206An issue in the handling of URL protocols was addressed with improved logic.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-44205A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS
- CVE-2024-44141The issue was addressed with improved checks.Apple macOS
- CVE-2024-40810An out-of-bounds write issue was addressed with improved input validation.Apple macOS
- CVE-2024-44185The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-10336SourceCodeHero Clothes Recommendation System Admin Login Page index.php sql injectionSourceCodeHero Clothes Recommendation System
- CVE-2024-10335SourceCodester Garbage Collection Management System login.php sql injectionSourceCodester Garbage Collection Management System
- CVE-2024-9692Improper Access Control in Input in VIMESA VHF/FM Transmitter Blue PlusVIMESA VHF/FM Transmitter Blue Plus
- CVE-2024-45031Apache Syncope: Stored XSS in Console and EnduserApache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2024-49693WordPress Mega Elements – Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilityKraft Plugins Mega Elements
- CVE-2024-49695WordPress WP Flow Plus plugin <= 5.2.3 - Cross Site Scripting (XSS) vulnerabilitySpiffy Plugins WP Flow Plus
- CVE-2024-10180Contact Form 7 - Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcodefelipeelia Contact Form 7 – Repeatable Fields
- CVE-2024-49696WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.21 - Cross Site Scripting (XSS) vulnerabilityrobosoft Robo Gallery
- CVE-2024-49702WordPress myCred Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal myCred Elementor
- CVE-2024-10332A Cross-Site Scripting vulnerability has been found in Janto v4.3r11 from Impronta.Janto
- CVE-2024-49703WordPress WpEvently plugin <= 4.2.5 - Cross Site Scripting (XSS) vulnerabilitymagepeopleteam WpEvently
- CVE-2024-49683WordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerabilityMagazine3 Schema & Structured Data for WP & AMP
- CVE-2024-49682WordPress Simple Membership plugin <= 4.5.3 - Open Redirection vulnerabilitywp.insider Simple Membership
- CVE-2024-8959WP Adminify – Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadlitonice13 WP Adminify – White Label WordPress, Admin Menu…
- CVE-2024-10176Compact WP Audio Player <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcodemra13 Compact WP Audio Player
- CVE-2024-9214Extra Product Options Builder for WooCommerce <= 1.2.133 - Unauthenticated Stored Cross-Site Scriptingedgarrojas Extra Product Options Builder for WooCommerce
- CVE-2024-9650WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'brechtvds WP Recipe Maker
- CVE-2024-10331PHPGurukul Vehicle Record System search-vehicle.php sql injectionPHPGurukul Vehicle Record System
- CVE-2024-6826Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-8717PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip <= 2.3.32 - Reflected Cross-Site Scriptingdearhive Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF emb…
- CVE-2024-10050Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcodebrainstormforce Ultimate Addons for Elementor
- CVE-2024-9943MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updateswcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…
- CVE-2024-8667HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publicationnlemsieh HurryTimer – An Scarcity and Urgency Countdown Tim…
- CVE-2024-9531MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sendingwcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…
- CVE-2024-9864EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scriptingmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-9865EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Logmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-9374Terms descriptions <= 3.4.6 - Reflected Cross-Site Scriptingvladimirs Terms descriptions
- CVE-2024-40595An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS
- CVE-2024-45259An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2.
- CVE-2024-48424A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specificalpyassimp
- CVE-2024-48425A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library duripyassimp
- CVE-2024-48426A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSpyassimp
- CVE-2024-48442Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows a
- CVE-2024-48540Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the A