# CVEs published 2024-10-24

106 CVEs were published on October 24, 2024: 13 critical, 38 high. Days are UTC.

- [CVE-2024-10353](https://cve.now/CVE-2024-10353.md): SourceCodester Online Exam System admin-dashboard access control (CVSS 5.3, SourceCodester Online Exam System)
- [CVE-2024-10351](https://cve.now/CVE-2024-10351.md): Tenda RX9 Pro POST Request setMacFilterCfg sub\_424CE0 stack-based overflow (CVSS 8.7, Tenda RX9 Pro)
- [CVE-2024-10350](https://cve.now/CVE-2024-10350.md): code-projects Hospital Management System add-doctor.php sql injection (CVSS 5.1, code-projects Hospital Management System)
- [CVE-2024-49750](https://cve.now/CVE-2024-49750.md): Snowflake Connector for Python has sensitive data in logs (CVSS 5.5, snowflakedb snowflake-connector-python · snowflake-connecto…)
- [CVE-2024-10349](https://cve.now/CVE-2024-10349.md): SourceCodester Best House Rental Management System ajax.php delete\_tenant sql injection (CVSS 5.3, SourceCodester Best House Rental Management System)
- [CVE-2024-10348](https://cve.now/CVE-2024-10348.md): SourceCodester Best House Rental Management System Manage Tenant Details index.php cross site scripting (CVSS 5.3, SourceCodester Best House Rental Management System)
- [CVE-2024-49762](https://cve.now/CVE-2024-49762.md): Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled (CVSS 4.6, pterodactyl panel · pterodactyl/panel)
- [CVE-2024-49760](https://cve.now/CVE-2024-49760.md): OpenRefine has a path traversal in LoadLanguageCommand (CVSS 7.1, OpenRefine · org.openrefine:openrefine)
- [CVE-2024-49359](https://cve.now/CVE-2024-49359.md): ZimaOS vulnerable to Directory Listing via Parameter Manipulation (CVSS 7.5, IceWhaleTech ZimaOS)
- [CVE-2024-49358](https://cve.now/CVE-2024-49358.md): ZimaOS vulnerable to Username Enumeration via API Responses (CVSS 5.3, IceWhaleTech ZimaOS)
- [CVE-2024-49357](https://cve.now/CVE-2024-49357.md): ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak (CVSS 7.5, IceWhaleTech ZimaOS)
- [CVE-2024-48932](https://cve.now/CVE-2024-48932.md): ZimaOS Unauthenticated API Discloses Usernames (CVSS 5.3, IceWhaleTech ZimaOS)
- [CVE-2024-48931](https://cve.now/CVE-2024-48931.md): ZimaOS Arbitrary File Read via Parameter Manipulation (CVSS 7.5, IceWhaleTech ZimaOS)
- [CVE-2024-47883](https://cve.now/CVE-2024-47883.md): Butterfly has path/URL confusion in resource handling leading to multiple weaknesses (CVSS 9.1, OpenRefine simile-butterfly · org.openrefine.dependencies:b…)
- [CVE-2024-47882](https://cve.now/CVE-2024-47882.md): OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project (CVSS 5.9, OpenRefine · org.openrefine:openrefine)
- [CVE-2024-47881](https://cve.now/CVE-2024-47881.md): OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) (CVSS 8.1, OpenRefine · org.openrefine:database)
- [CVE-2024-47880](https://cve.now/CVE-2024-47880.md): OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand (CVSS 8.1, OpenRefine · org.openrefine:openrefine)
- [CVE-2024-10327](https://cve.now/CVE-2024-10327.md): A vulnerability in Okta Verify for iOS versions 9.25.1 (beta) and 9.27.0 (including beta) allows push notification responses through the iOS (CVSS 8.1, Okta Verify for iOS)
- [CVE-2024-47879](https://cve.now/CVE-2024-47879.md): OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF) (CVSS 7.6, OpenRefine · org.openrefine:main)
- [CVE-2024-7763](https://cve.now/CVE-2024-7763.md): WhatsUp Gold getReport Missing Authentication Authentication Bypass Vulnerability (CVSS 9.8, Progress Software WhatsUp Gold)
- [CVE-2024-47878](https://cve.now/CVE-2024-47878.md): Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) (CVSS 8.1, OpenRefine · org.openrefine:extensions)
- [CVE-2024-47173](https://cve.now/CVE-2024-47173.md): Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups (CVSS 5.5, aimeos ai-admin-graphql · aimeos/ai-admin-graphql)
- [CVE-2024-46998](https://cve.now/CVE-2024-46998.md): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature (CVSS 7.1, baserproject basercms · baserproject/basercms)
- [CVE-2024-46996](https://cve.now/CVE-2024-46996.md): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature (CVSS 6.3, baserproject basercms · baserproject/basercms)
- [CVE-2024-46995](https://cve.now/CVE-2024-46995.md): baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request (CVSS 6.1, baserproject basercms · baserproject/basercms)
- [CVE-2024-46994](https://cve.now/CVE-2024-46994.md): baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature (CVSS 5.4, baserproject basercms · baserproject/basercms)
- [CVE-2024-10338](https://cve.now/CVE-2024-10338.md): SourceCodeHero Clothes Recommendation System home.php sql injection (CVSS 5.1, SourceCodeHero Clothes Recommendation System)
- [CVE-2024-10337](https://cve.now/CVE-2024-10337.md): SourceCodeHero Clothes Recommendation System home.php sql injection (CVSS 5.1, SourceCodeHero Clothes Recommendation System)
- [CVE-2024-10295](https://cve.now/CVE-2024-10295.md): Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request (CVSS 7.5, gateway · Red Hat 3scale API Management Platform)
- [CVE-2024-10313](https://cve.now/CVE-2024-10313.md): iniNet Solutions SpiderControl SCADA PC HMI Editor Path Traversal (CVSS 8.0, iniNet Solutions SpiderControl SCADA PC HMI Editor)
- [CVE-2024-38314](https://cve.now/CVE-2024-38314.md): IBM Maximo Application Suite - Monitor Component information disclosure (CVSS 5.9, IBM Maximo Application Suite - Monitor Component)
- [CVE-2024-44206](https://cve.now/CVE-2024-44206.md): An issue in the handling of URL protocols was addressed with improved logic. (CVSS 5.4, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-44205](https://cve.now/CVE-2024-44205.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-44141](https://cve.now/CVE-2024-44141.md): The issue was addressed with improved checks. (CVSS 6.6, Apple macOS)
- [CVE-2024-40810](https://cve.now/CVE-2024-40810.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2024-44185](https://cve.now/CVE-2024-44185.md): The issue was addressed with improved checks. (CVSS 5.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-10336](https://cve.now/CVE-2024-10336.md): SourceCodeHero Clothes Recommendation System Admin Login Page index.php sql injection (CVSS 6.9, SourceCodeHero Clothes Recommendation System)
- [CVE-2024-10335](https://cve.now/CVE-2024-10335.md): SourceCodester Garbage Collection Management System login.php sql injection (CVSS 6.9, SourceCodester Garbage Collection Management System)
- [CVE-2024-9692](https://cve.now/CVE-2024-9692.md): Improper Access Control in Input in VIMESA VHF/FM Transmitter Blue Plus (CVSS 6.9, VIMESA VHF/FM Transmitter Blue Plus)
- [CVE-2024-45031](https://cve.now/CVE-2024-45031.md): Apache Syncope: Stored XSS in Console and Enduser (CVSS 6.1, Apache Software Foundation Apache Syncope · org.apache.sync…)
- [CVE-2024-49693](https://cve.now/CVE-2024-49693.md): WordPress Mega Elements – Addons for Elementor plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kraft Plugins Mega Elements)
- [CVE-2024-49695](https://cve.now/CVE-2024-49695.md): WordPress WP Flow Plus plugin \<= 5.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Spiffy Plugins WP Flow Plus)
- [CVE-2024-10180](https://cve.now/CVE-2024-10180.md): Contact Form 7 - Repeatable Fields \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field\_group Shortcode (CVSS 6.4, felipeelia Contact Form 7 – Repeatable Fields)
- [CVE-2024-49696](https://cve.now/CVE-2024-49696.md): WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin \<= 3.2.21 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, robosoft Robo Gallery)
- [CVE-2024-49702](https://cve.now/CVE-2024-49702.md): WordPress myCred Elementor plugin \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saad Iqbal myCred Elementor)
- [CVE-2024-10332](https://cve.now/CVE-2024-10332.md): A Cross-Site Scripting vulnerability has been found in Janto v4.3r11 from Impronta. (CVSS 6.1, Janto)
- [CVE-2024-49703](https://cve.now/CVE-2024-49703.md): WordPress WpEvently plugin \<= 4.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, magepeopleteam WpEvently)
- [CVE-2024-49681](https://cve.now/CVE-2024-49681.md): WordPress WP Sessions Time Monitoring Full Automatic plugin \<= 1.0.9 - SQL Injection vulnerability (CVSS 9.3, activity-log.com WP Sessions Time Monitoring Full Automatic)
- [CVE-2024-49691](https://cve.now/CVE-2024-49691.md): WordPress Product Filter by WBW plugin \<= 2.7.0 - SQL Injection vulnerability (CVSS 7.6, WBW Plugins Product Filter by WBW)
- [CVE-2024-5608](https://cve.now/CVE-2024-5608.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-49683](https://cve.now/CVE-2024-49683.md): WordPress Schema & Structured Data for WP & AMP plugin \<= 1.3.5 - Sensitive Data Exposure vulnerability (CVSS 5.3, Magazine3 Schema & Structured Data for WP & AMP)
- [CVE-2024-49682](https://cve.now/CVE-2024-49682.md): WordPress Simple Membership plugin \<= 4.5.3 - Open Redirection vulnerability (CVSS 4.7, wp.insider Simple Membership)
- [CVE-2024-8959](https://cve.now/CVE-2024-8959.md): WP Adminify – Best WordPress Custom Dashboard Plugin \<= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, litonice13 WP Adminify – White Label WordPress, Admin Menu…)
- [CVE-2024-10176](https://cve.now/CVE-2024-10176.md): Compact WP Audio Player \<= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc\_embed\_player Shortcode (CVSS 6.4, mra13 Compact WP Audio Player)
- [CVE-2024-9214](https://cve.now/CVE-2024-9214.md): Extra Product Options Builder for WooCommerce \<= 1.2.133 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, edgarrojas Extra Product Options Builder for WooCommerce)
- [CVE-2024-9650](https://cve.now/CVE-2024-9650.md): WP Recipe Maker \<= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' (CVSS 6.5, brechtvds WP Recipe Maker)
- [CVE-2024-10331](https://cve.now/CVE-2024-10331.md): PHPGurukul Vehicle Record System search-vehicle.php sql injection (CVSS 5.3, PHPGurukul Vehicle Record System)
- [CVE-2024-6826](https://cve.now/CVE-2024-6826.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-8312](https://cve.now/CVE-2024-8312.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2024-8717](https://cve.now/CVE-2024-8717.md): PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip \<= 2.3.32 - Reflected Cross-Site Scripting (CVSS 6.1, dearhive Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF emb…)
- [CVE-2024-10050](https://cve.now/CVE-2024-10050.md): Elementor Header & Footer Builder \<= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode (CVSS 4.3, brainstormforce Ultimate Addons for Elementor)
- [CVE-2024-6049](https://cve.now/CVE-2024-6049.md): Unauthenticated Path Traversal (CVSS 7.5, Lawo AG vsm LTC Time Sync)
- [CVE-2024-9943](https://cve.now/CVE-2024-9943.md): MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \<= 4.2.4 - Cross-Site Request Forgery to Vendor Updates (CVSS 6.3, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2024-8667](https://cve.now/CVE-2024-8667.md): HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce \<= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication (CVSS 4.3, nlemsieh HurryTimer – An Scarcity and Urgency Countdown Tim…)
- [CVE-2024-9531](https://cve.now/CVE-2024-9531.md): MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \<= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending (CVSS 4.3, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2024-9864](https://cve.now/CVE-2024-9864.md): EventPrime – Modern Events Calendar, Bookings and Tickets \<= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-9865](https://cve.now/CVE-2024-9865.md): EventPrime – Modern Events Calendar, Bookings and Tickets \<= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log (CVSS 6.1, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-9374](https://cve.now/CVE-2024-9374.md): Terms descriptions \<= 3.4.6 - Reflected Cross-Site Scripting (CVSS 6.1, vladimirs Terms descriptions)
- [CVE-2024-40595](https://cve.now/CVE-2024-40595.md): An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise before 7.5.1 (and LTS (CVSS 5.3)
- [CVE-2024-41617](https://cve.now/CVE-2024-41617.md): Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2024-41618](https://cve.now/CVE-2024-41618.md): Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the \`transaction\_delete\_group\` function. (CVSS 9.8)
- [CVE-2024-45242](https://cve.now/CVE-2024-45242.md): EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2\_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping o (CVSS 7.8)
- [CVE-2024-45259](https://cve.now/CVE-2024-45259.md): An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. (CVSS 6.5)
- [CVE-2024-45260](https://cve.now/CVE-2024-45260.md): An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. (CVSS 8.0)
- [CVE-2024-45261](https://cve.now/CVE-2024-45261.md): An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. (CVSS 8.0)
- [CVE-2024-45262](https://cve.now/CVE-2024-45262.md): An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. (CVSS 8.8)
- [CVE-2024-45263](https://cve.now/CVE-2024-45263.md): An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. (CVSS 8.8)
- [CVE-2024-46478](https://cve.now/CVE-2024-46478.md): HTMLDOC v1.9.18 contains a buffer overflow in parse\_pre function,ps-pdf.cxx:5681. (CVSS 9.8)
- [CVE-2024-48139](https://cve.now/CVE-2024-48139.md): A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent (CVSS 7.5)
- [CVE-2024-48140](https://cve.now/CVE-2024-48140.md): A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attacke (CVSS 7.5)
- [CVE-2024-48141](https://cve.now/CVE-2024-48141.md): A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subs (CVSS 7.5)
- [CVE-2024-48142](https://cve.now/CVE-2024-48142.md): A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access an (CVSS 7.5)
- [CVE-2024-48143](https://cve.now/CVE-2024-48143.md): A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the (CVSS 9.1)
- [CVE-2024-48144](https://cve.now/CVE-2024-48144.md): A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exf (CVSS 9.1)
- [CVE-2024-48145](https://cve.now/CVE-2024-48145.md): A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate (CVSS 9.1)
- [CVE-2024-48208](https://cve.now/CVE-2024-48208.md): pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow. (CVSS 8.6)
- [CVE-2024-48423](https://cve.now/CVE-2024-48423.md): An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp libr (CVSS 8.4, pyassimp)
- [CVE-2024-48424](https://cve.now/CVE-2024-48424.md): A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specifical (CVSS 5.5, pyassimp)
- [CVE-2024-48425](https://cve.now/CVE-2024-48425.md): A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess\_Triangle::UpdateNode function within the Assimp library duri (CVSS 5.5, pyassimp)
- [CVE-2024-48426](https://cve.now/CVE-2024-48426.md): A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressS (CVSS 6.2, pyassimp)
- [CVE-2024-48427](https://cve.now/CVE-2024-48427.md): A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbit (CVSS 8.1)
- [CVE-2024-48440](https://cve.now/CVE-2024-48440.md): Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command (CVSS 8.8)
- [CVE-2024-48441](https://cve.now/CVE-2024-48441.md): Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS\_v3.2.468.11.04\_P4 was discovered to contain a command injection (CVSS 8.8)
- [CVE-2024-48442](https://cve.now/CVE-2024-48442.md): Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows a (CVSS 6.5)
- [CVE-2024-48454](https://cve.now/CVE-2024-48454.md): An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user (CVSS 7.2)
- [CVE-2024-48514](https://cve.now/CVE-2024-48514.md): php-heic-to-jpg \<= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). (CVSS 9.8, maestroerror/php-heic-to-jpg)
- [CVE-2024-48538](https://cve.now/CVE-2024-48538.md): Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information b (CVSS 9.8)
- [CVE-2024-48539](https://cve.now/CVE-2024-48539.md): Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism. (CVSS 9.8)
- [CVE-2024-48540](https://cve.now/CVE-2024-48540.md): Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the A (CVSS 6.2)
- [CVE-2024-48541](https://cve.now/CVE-2024-48541.md): Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive informat (CVSS 8.4)
- [CVE-2024-48542](https://cve.now/CVE-2024-48542.md): Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sen (CVSS 8.4)
- [CVE-2024-48544](https://cve.now/CVE-2024-48544.md): Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive in (CVSS 8.4)
- [CVE-2024-48545](https://cve.now/CVE-2024-48545.md): Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information (CVSS 8.4)
- [CVE-2024-48546](https://cve.now/CVE-2024-48546.md): Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information (CVSS 8.4)
- [CVE-2024-48547](https://cve.now/CVE-2024-48547.md): Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive info (CVSS 8.4)
- [CVE-2024-48548](https://cve.now/CVE-2024-48548.md): The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. (CVSS 9.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.