# CVEs published 2024-10-28

193 CVEs were published on October 28, 2024: 19 critical, 53 high. Days are UTC.

- [CVE-2024-30106](https://cve.now/CVE-2024-30106.md): HCL Connections is vulnerable to an information disclosure vulnerability (CVSS 3.5, HCL Software Connections)
- [CVE-2024-44260](https://cve.now/CVE-2024-44260.md): This issue was addressed by removing the vulnerable code. (CVSS 6.7, Apple macOS)
- [CVE-2024-44237](https://cve.now/CVE-2024-44237.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2024-44295](https://cve.now/CVE-2024-44295.md): This issue was addressed with additional entitlement checks. (CVSS 7.7, Apple macOS)
- [CVE-2024-44283](https://cve.now/CVE-2024-44283.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2024-44145](https://cve.now/CVE-2024-44145.md): This issue was addressed through improved state management. (CVSS 5.7, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-44240](https://cve.now/CVE-2024-44240.md): The issue was addressed with improved checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44217](https://cve.now/CVE-2024-44217.md): A permissions issue was addressed by removing vulnerable code and adding additional checks. (CVSS 9.1, Apple iOS and iPadOS)
- [CVE-2024-44256](https://cve.now/CVE-2024-44256.md): The issue was addressed with improved input sanitization. (CVSS 9.3, Apple macOS)
- [CVE-2024-44257](https://cve.now/CVE-2024-44257.md): This issue was addressed with improved redaction of sensitive information. (CVSS 6.2, Apple macOS)
- [CVE-2024-44216](https://cve.now/CVE-2024-44216.md): An access issue was addressed with additional sandbox restrictions. (CVSS 6.2, Apple macOS)
- [CVE-2024-40853](https://cve.now/CVE-2024-40853.md): This issue was addressed by restricting options offered on a locked device. (CVSS 5.9, Apple iOS and iPadOS)
- [CVE-2024-44144](https://cve.now/CVE-2024-44144.md): A buffer overflow was addressed with improved size validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44282](https://cve.now/CVE-2024-44282.md): An out-of-bounds read was addressed with improved input validation. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44294](https://cve.now/CVE-2024-44294.md): A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. (CVSS 6.5, Apple macOS)
- [CVE-2024-44236](https://cve.now/CVE-2024-44236.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 6.5, Apple macOS)
- [CVE-2024-44261](https://cve.now/CVE-2024-44261.md): This issue was addressed by restricting options offered on a locked device. (CVSS 6.2, Apple iOS and iPadOS)
- [CVE-2024-44277](https://cve.now/CVE-2024-44277.md): The issue was addressed with improved memory handling. (CVSS 7.7, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-40792](https://cve.now/CVE-2024-40792.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2024-44155](https://cve.now/CVE-2024-44155.md): A custom URL scheme handling issue was addressed with improved input validation. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2024-44285](https://cve.now/CVE-2024-44285.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44196](https://cve.now/CVE-2024-44196.md): A permissions issue was addressed with additional restrictions. (CVSS 7.5, Apple macOS)
- [CVE-2024-44159](https://cve.now/CVE-2024-44159.md): A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. (CVSS 7.1, Apple macOS)
- [CVE-2024-44270](https://cve.now/CVE-2024-44270.md): A logic issue was addressed with improved validation. (CVSS 7.5, Apple macOS)
- [CVE-2024-44289](https://cve.now/CVE-2024-44289.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 7.5, Apple macOS)
- [CVE-2024-44122](https://cve.now/CVE-2024-44122.md): A logic issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-44175](https://cve.now/CVE-2024-44175.md): This issue was addressed with improved validation of symlinks. (CVSS 7.5, Apple macOS)
- [CVE-2024-44174](https://cve.now/CVE-2024-44174.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-44123](https://cve.now/CVE-2024-44123.md): A permissions issue was addressed with additional restrictions. (CVSS 2.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-44267](https://cve.now/CVE-2024-44267.md): The issue was addressed with improved checks. (CVSS 2.7, Apple macOS)
- [CVE-2024-44197](https://cve.now/CVE-2024-44197.md): The issue was addressed with improved memory handling. (CVSS 2.7, Apple macOS)
- [CVE-2024-44251](https://cve.now/CVE-2024-44251.md): This issue was addressed through improved state management. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-44247](https://cve.now/CVE-2024-44247.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-44302](https://cve.now/CVE-2024-44302.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40855](https://cve.now/CVE-2024-40855.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS · Apple visionOS)
- [CVE-2024-44284](https://cve.now/CVE-2024-44284.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2024-44194](https://cve.now/CVE-2024-44194.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-44252](https://cve.now/CVE-2024-44252.md): A logic issue was addressed with improved file handling. (CVSS 7.1, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2024-44213](https://cve.now/CVE-2024-44213.md): An issue existed in the parsing of URLs. (CVSS 7.5, Apple macOS)
- [CVE-2024-44301](https://cve.now/CVE-2024-44301.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-44244](https://cve.now/CVE-2024-44244.md): A memory corruption issue was addressed with improved input validation. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-44287](https://cve.now/CVE-2024-44287.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-44229](https://cve.now/CVE-2024-44229.md): An information leakage was addressed with additional validation. (CVSS 5.3, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2024-44264](https://cve.now/CVE-2024-44264.md): This issue was addressed with improved validation of symlinks. (CVSS 7.5, Apple macOS)
- [CVE-2024-44273](https://cve.now/CVE-2024-44273.md): This issue was addressed with improved handling of symlinks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44265](https://cve.now/CVE-2024-44265.md): The issue was addressed by restricting options offered on a locked device. (CVSS 7.5, Apple macOS)
- [CVE-2024-44137](https://cve.now/CVE-2024-44137.md): The issue was addressed with improved checks. (CVSS 4.6, Apple macOS)
- [CVE-2024-44208](https://cve.now/CVE-2024-44208.md): This issue was addressed through improved state management. (CVSS 7.5, Apple macOS)
- [CVE-2024-44228](https://cve.now/CVE-2024-44228.md): This issue was addressed with improved permissions checking. (CVSS 7.5, Apple Xcode)
- [CVE-2024-44156](https://cve.now/CVE-2024-44156.md): A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. (CVSS 7.1, Apple macOS)
- [CVE-2024-44269](https://cve.now/CVE-2024-44269.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-44253](https://cve.now/CVE-2024-44253.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-44258](https://cve.now/CVE-2024-44258.md): This issue was addressed with improved handling of symlinks. (CVSS 7.1, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2024-27849](https://cve.now/CVE-2024-27849.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS)
- [CVE-2024-44126](https://cve.now/CVE-2024-44126.md): The issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-44235](https://cve.now/CVE-2024-44235.md): The issue was addressed with improved checks. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2024-44262](https://cve.now/CVE-2024-44262.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple visionOS)
- [CVE-2024-44274](https://cve.now/CVE-2024-44274.md): The issue was addressed with improved authentication. (CVSS 4.6, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2024-44254](https://cve.now/CVE-2024-44254.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-44203](https://cve.now/CVE-2024-44203.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2024-44215](https://cve.now/CVE-2024-44215.md): This issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44239](https://cve.now/CVE-2024-44239.md): An information disclosure issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44281](https://cve.now/CVE-2024-44281.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2024-44278](https://cve.now/CVE-2024-44278.md): An information disclosure issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-44297](https://cve.now/CVE-2024-44297.md): The issue was addressed with improved bounds checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44279](https://cve.now/CVE-2024-44279.md): An out-of-bounds read was addressed with improved input validation. (CVSS 6.5, Apple macOS)
- [CVE-2024-44296](https://cve.now/CVE-2024-44296.md): The issue was addressed with improved checks. (CVSS 5.4, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-44280](https://cve.now/CVE-2024-44280.md): A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. (CVSS 7.7, Apple macOS)
- [CVE-2024-40851](https://cve.now/CVE-2024-40851.md): This issue was addressed by restricting options offered on a locked device. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-44255](https://cve.now/CVE-2024-44255.md): A path handling issue was addressed with improved logic. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-44222](https://cve.now/CVE-2024-44222.md): This issue was addressed with improved redaction of sensitive information. (CVSS 3.3, Apple macOS)
- [CVE-2024-44275](https://cve.now/CVE-2024-44275.md): The issue was addressed with improved checks. (CVSS 3.3, Apple macOS)
- [CVE-2024-44263](https://cve.now/CVE-2024-44263.md): A logic issue was addressed with improved state management. (CVSS 4.0, Apple iOS and iPadOS)
- [CVE-2024-44218](https://cve.now/CVE-2024-44218.md): This issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-40867](https://cve.now/CVE-2024-40867.md): A custom URL scheme handling issue was addressed with improved input validation. (CVSS 8.8, Apple iOS and iPadOS)
- [CVE-2024-44259](https://cve.now/CVE-2024-44259.md): This issue was addressed through improved state management. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2024-50495](https://cve.now/CVE-2024-50495.md): WordPress Plugin Propagator plugin \<= 0.1 - Arbitrary File Upload vulnerability (CVSS 10.0, nunomorgadinho Plugin Propagator)
- [CVE-2024-50496](https://cve.now/CVE-2024-50496.md): WordPress AR For WordPress plugin \<= 6.6 - Arbitrary File Upload vulnerability (CVSS 10.0, webandprint AR For WordPress)
- [CVE-2024-50434](https://cve.now/CVE-2024-50434.md): WordPress NewsCard theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 7.5, themehorse NewsCard)
- [CVE-2024-50435](https://cve.now/CVE-2024-50435.md): WordPress Meta News theme \<= 1.1.7 - Local File Inclusion vulnerability (CVSS 7.5, themehorse Meta News)
- [CVE-2024-50436](https://cve.now/CVE-2024-50436.md): WordPress Clean Retina theme \<= 3.0.6 - Local File Inclusion vulnerability (CVSS 7.5, themehorse Clean Retina)
- [CVE-2024-50453](https://cve.now/CVE-2024-50453.md): WordPress The Pack Elementor addons plugin \<= 2.0.9 - Local File Inclusion vulnerability (CVSS 7.5, webangon The Pack Elementor addons)
- [CVE-2024-50457](https://cve.now/CVE-2024-50457.md): WordPress Qode Essential Addons plugin \<= 1.6.3 - Local File Inclusion vulnerability (CVSS 7.5, Qode Essential Addons)
- [CVE-2024-49755](https://cve.now/CVE-2024-49755.md): Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs (CVSS 3.1, DuendeSoftware IdentityServer · Duende.IdentityServer)
- [CVE-2024-5532](https://cve.now/CVE-2024-5532.md): A stored XSS vulnerability has been discovered on OpenText™ Operations Agent (OA). (CVSS 1.8, OpenText™ Operations Agent)
- [CVE-2024-9825](https://cve.now/CVE-2024-9825.md): The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token (CVSS 5.4, Progress Software Chef Habitat Builder)
- [CVE-2024-50429](https://cve.now/CVE-2024-50429.md): WordPress Magazine Blocks plugin \<= 1.3.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BlockArt Magazine Blocks)
- [CVE-2024-50431](https://cve.now/CVE-2024-50431.md): WordPress Breeze plugin \<= 2.1.14 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Cloudways Breeze)
- [CVE-2024-50432](https://cve.now/CVE-2024-50432.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.2.93 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins Post Grid and Gutenberg Blocks)
- [CVE-2024-50433](https://cve.now/CVE-2024-50433.md): WordPress Sky Addons for Elementor plugin \<= 2.5.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wowDevs Sky Addons for Elementor)
- [CVE-2024-50437](https://cve.now/CVE-2024-50437.md): WordPress GeoDirectory plugin \<= 2.3.80 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Paolo GeoDirectory)
- [CVE-2024-50438](https://cve.now/CVE-2024-50438.md): WordPress Church Admin plugin \< 5.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, andy\_moyle Church Admin)
- [CVE-2024-50439](https://cve.now/CVE-2024-50439.md): WordPress Astra Widgets plugin \<= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Astra Widgets)
- [CVE-2024-50440](https://cve.now/CVE-2024-50440.md): WordPress CodePen Embedded Pens Shortcode plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Chris Coyier CodePen Embedded Pens Shortcode)
- [CVE-2024-50441](https://cve.now/CVE-2024-50441.md): WordPress Cozy Blocks plugin \<= 2.0.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CozyThemes Cozy Blocks)
- [CVE-2024-50445](https://cve.now/CVE-2024-50445.md): WordPress Selection Lite plugin \<= 1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, merkulove Selection Lite)
- [CVE-2024-50446](https://cve.now/CVE-2024-50446.md): WordPress Futurio Extra plugin \<= 2.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FuturioWP Futurio Extra)
- [CVE-2024-50447](https://cve.now/CVE-2024-50447.md): WordPress Envo's Elementor Templates & Widgets for WooCommerce plugin \<= 1.4.19 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, EnvoThemes Envo's Elementor Templates & Widgets for WooComm…)
- [CVE-2024-50448](https://cve.now/CVE-2024-50448.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.14.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, YITHEMES YITH WooCommerce Product Add-Ons)
- [CVE-2024-50449](https://cve.now/CVE-2024-50449.md): WordPress PDF Generator Addon for Elementor Page Builder plugin \<= 1.7.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RedefiningTheWeb PDF Generator Addon for Elementor Page Bui…)
- [CVE-2024-50451](https://cve.now/CVE-2024-50451.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RealMag777 MDTF)
- [CVE-2024-50458](https://cve.now/CVE-2024-50458.md): WordPress Advanced Sermons plugin \<= 3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP CodeUs Advanced Sermons)
- [CVE-2024-50460](https://cve.now/CVE-2024-50460.md): WordPress Firelight Lightbox plugin \<= 2.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Firelight Lightbox)
- [CVE-2024-50461](https://cve.now/CVE-2024-50461.md): WordPress EmbedPress plugin \<= 4.0.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper EmbedPress)
- [CVE-2024-50462](https://cve.now/CVE-2024-50462.md): WordPress Interactive World Map plugin \<= 3.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, html5maps Interactive World Map)
- [CVE-2024-50464](https://cve.now/CVE-2024-50464.md): WordPress Kodex Posts likes plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pierre Lebedel Kodex Posts likes)
- [CVE-2024-50467](https://cve.now/CVE-2024-50467.md): WordPress Scrollbar by webxapp plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, siteengineai Scrollbar by webxapp – Best vertical/horizonta…)
- [CVE-2024-50468](https://cve.now/CVE-2024-50468.md): WordPress Raptor Editor plugin \<= 1.0.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, faceleg Raptor Editor)
- [CVE-2024-50469](https://cve.now/CVE-2024-50469.md): WordPress Textboxes plugin \<= 0.1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, brightvesseldev Textboxes)
- [CVE-2024-9629](https://cve.now/CVE-2024-9629.md): Contact Form 7 + Telegram \<= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse (CVSS 5.4, hokku Message Bridge for Contact Form 7 and Telegram)
- [CVE-2024-49771](https://cve.now/CVE-2024-49771.md): MPXJ has a Potential Path Traversal Vulnerability (CVSS 5.3, joniles mpxj · mpxj +5)
- [CVE-2024-6245](https://cve.now/CVE-2024-6245.md): Default Credentials in ssh service for SmartPlay in Maruti Suzuki (CVSS 7.4, Faurecia Clarion Electronics Co. SmartPlay)
- [CVE-2024-42028](https://cve.now/CVE-2024-42028.md): A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and ea (CVSS 8.8, Ubiquiti UniFi Network Application)
- [CVE-2024-10469](https://cve.now/CVE-2024-10469.md): CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view. (CVSS 4.4, CERT/CC VINCE)
- [CVE-2024-47827](https://cve.now/CVE-2024-47827.md): Argo Workflows Controller: Denial of Service via malicious daemon Workflows (CVSS 5.7, argoproj argo-workflows · github.com/argoproj/argo-workf… +2)
- [CVE-2024-10450](https://cve.now/CVE-2024-10450.md): SourceCodester Kortex Lite Advocate Office Management System POST Parameter edit\_profile.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-45802](https://cve.now/CVE-2024-45802.md): Squid Denial of Service (CVSS 7.5, squid-cache squid)
- [CVE-2024-10449](https://cve.now/CVE-2024-10449.md): Codezips Hospital Appointment System loginAction.php sql injection (CVSS 6.9, Codezips Hospital Appointment System)
- [CVE-2024-10214](https://cve.now/CVE-2024-10214.md): Incorrect Session Creation with Desktop SSO (CVSS 3.5, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-49761](https://cve.now/CVE-2024-49761.md): REXML ReDoS vulnerability (CVSS 6.6, ruby rexml · rexml)
- [CVE-2024-10448](https://cve.now/CVE-2024-10448.md): code-projects Blood Bank Management System delete.php cross-site request forgery (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2024-10455](https://cve.now/CVE-2024-10455.md): Reachable Assertion in µD3TN (CVSS 7.5, µD3TN · pyd3tn)
- [CVE-2024-50443](https://cve.now/CVE-2024-50443.md): WordPress PostX plugin \<= 4.1.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPXPO PostX)
- [CVE-2024-10447](https://cve.now/CVE-2024-10447.md): Project Worlds Online Time Table Generator staffdashboard.php sql injection (CVSS 5.3, Project Worlds Online Time Table Generator)
- [CVE-2024-8013](https://cve.now/CVE-2024-8013.md): CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines (CVSS 2.2, MongoDB mongocryptd · MongoDB Mongo\_crypt\_v1.so)
- [CVE-2024-50582](https://cve.now/CVE-2024-50582.md): In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50581](https://cve.now/CVE-2024-50581.md): In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50580](https://cve.now/CVE-2024-50580.md): In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50579](https://cve.now/CVE-2024-50579.md): In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50578](https://cve.now/CVE-2024-50578.md): In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50577](https://cve.now/CVE-2024-50577.md): In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50576](https://cve.now/CVE-2024-50576.md): In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50575](https://cve.now/CVE-2024-50575.md): In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API (CVSS 4.6, JetBrains YouTrack)
- [CVE-2024-50574](https://cve.now/CVE-2024-50574.md): In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality (CVSS 5.3, JetBrains YouTrack)
- [CVE-2024-50573](https://cve.now/CVE-2024-50573.md): In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services (CVSS 4.3, JetBrains Hub)
- [CVE-2024-50470](https://cve.now/CVE-2024-50470.md): WordPress Themes4WP YouTube External Subtitles plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themes4WP YouTube External Subtitles)
- [CVE-2024-50471](https://cve.now/CVE-2024-50471.md): WordPress Trip Plan plugin \<= 1.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, checklistcom Trip Plan)
- [CVE-2024-50472](https://cve.now/CVE-2024-50472.md): WordPress Amilia Store plugin \<= 2.9.8 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, martindrapeau Amilia Store)
- [CVE-2024-50501](https://cve.now/CVE-2024-50501.md): WordPress Kata Plus plugin \<= 1.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Climax Themes Kata Plus)
- [CVE-2024-50502](https://cve.now/CVE-2024-50502.md): WordPress Cozy Blocks plugin \<= 2.0.18 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CozyThemes Cozy Blocks)
- [CVE-2024-50465](https://cve.now/CVE-2024-50465.md): WordPress Premium SEO Pack plugin \<= 1.6.001 - SQL Injection vulnerability (CVSS 8.5, WP SEO – Calin Vingan Premium SEO Pack)
- [CVE-2024-50479](https://cve.now/CVE-2024-50479.md): WordPress Woocommerce Quote Calculator plugin \<= 1.1 - SQL Injection vulnerability (CVSS 9.3, chenyenming Woocommerce Quote Calculator)
- [CVE-2024-50491](https://cve.now/CVE-2024-50491.md): WordPress RSVP ME plugin \<= 1.9.9 - SQL Injection vulnerability (CVSS 9.3, MicahBlu RSVP ME)
- [CVE-2024-50497](https://cve.now/CVE-2024-50497.md): WordPress Advanced Online Ordering and Delivery Platform plugin \<= 2.0.0 - Local File Inclusion vulnerability (CVSS 8.1, wdesco Advanced Online Ordering and Delivery Platform)
- [CVE-2024-50463](https://cve.now/CVE-2024-50463.md): WordPress Sunshine Photo Cart plugin \<= 3.2.9 - Open Redirection vulnerability (CVSS 4.7, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-50478](https://cve.now/CVE-2024-50478.md): WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability (CVSS 9.8, Swoop 1-Click Login: Passwordless Authentication)
- [CVE-2024-50483](https://cve.now/CVE-2024-50483.md): WordPress Meetup plugin \<= 0.1 - Broken Authentication vulnerability (CVSS 9.8, Tareq Hasan Meetup)
- [CVE-2024-50488](https://cve.now/CVE-2024-50488.md): WordPress Token Login plugin \<= 1.0.3 - Broken Authentication vulnerability (CVSS 8.8, yespbs Token Login)
- [CVE-2024-50408](https://cve.now/CVE-2024-50408.md): WordPress Namaste! LMS plugin \<= 2.6.3 - PHP Object Injection vulnerability (CVSS 8.8, Bob Namaste! LMS)
- [CVE-2024-10446](https://cve.now/CVE-2024-10446.md): Project Worlds Online Time Table Generator admindashboard.php sql injection (CVSS 5.3, Project Worlds Online Time Table Generator)
- [CVE-2024-50416](https://cve.now/CVE-2024-50416.md): WordPress WPC Shop as a Customer for WooCommerce plugin \<= 1.2.6 - PHP Object Injection vulnerability (CVSS 8.8, WPClever WPC Shop as a Customer for WooCommerce)
- [CVE-2024-50450](https://cve.now/CVE-2024-50450.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.3.4 - Bypass Vulnerability vulnerability (CVSS 7.3, RealMag777 MDTF)
- [CVE-2024-50492](https://cve.now/CVE-2024-50492.md): WordPress ScottCart plugin \<= 1.1 - Remote Code Execution (RCE) vulnerability (CVSS 8.3, Scott Paterson ScottCart)
- [CVE-2024-50498](https://cve.now/CVE-2024-50498.md): WordPress WP Query Console plugin \<= 1.0 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, Ajit Bohra WP Query Console)
- [CVE-2024-50477](https://cve.now/CVE-2024-50477.md): WordPress Stacks Mobile App Builder plugin \<= 5.2.3 - Account Takeover vulnerability (CVSS 9.8, Stacks Mobile App Builder)
- [CVE-2024-50486](https://cve.now/CVE-2024-50486.md): WordPress Acnoo Flutter API plugin \<= 1.0.5 - Account Takeover vulnerability (CVSS 9.8, Acnoo Flutter API)
- [CVE-2024-50487](https://cve.now/CVE-2024-50487.md): WordPress MaanStore API plugin \<= 1.0.1 - Account Takeover vulnerability (CVSS 9.8, Acnoo MaanStore API)
- [CVE-2024-50489](https://cve.now/CVE-2024-50489.md): WordPress Realty Workstation plugin \<= 1.0.45 - Account Takeover vulnerability (CVSS 9.8, realtyworkstation Realty Workstation)
- [CVE-2024-50442](https://cve.now/CVE-2024-50442.md): WordPress Royal Elementor Addons and Templates plugin \<= 1.3.980 - XML External Entity (XXE) vulnerability (CVSS 6.5, WP Royal Royal Elementor Addons)
- [CVE-2024-38821](https://cve.now/CVE-2024-38821.md): Authorization Bypass of Static Resources in WebFlux Applications (CVSS 9.1, Spring · org.springframework.security:spring-security-web)
- [CVE-2024-9162](https://cve.now/CVE-2024-9162.md): All-in-One WP Migration and Backup \<= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection (CVSS 7.2, servmask All-in-One WP Migration and Backup)
- [CVE-2024-50307](https://cve.now/CVE-2024-50307.md): Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. (CVSS 5.5, kubell Co. Chatwork Desktop Application)
- [CVE-2024-10440](https://cve.now/CVE-2024-10440.md): Sunnet eHRD CTMS - SQL Injection (CVSS 9.8, Sunnet eHRD CTMS)
- [CVE-2024-10439](https://cve.now/CVE-2024-10439.md): Sunnet eHRD CTMS - Insecure Direct Object Reference (CVSS 5.3, Sunnet eHRD CTMS)
- [CVE-2024-10438](https://cve.now/CVE-2024-10438.md): Sunnet eHRD CTMS - Authentication Bypass (CVSS 7.5, Sunnet eHRD CTMS)
- [CVE-2024-23843](https://cve.now/CVE-2024-23843.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Genians Genian NAC V5.0, Genians Genia (CVSS 2.2, Genians Genian NAC)
- [CVE-2024-50067](https://cve.now/CVE-2024-50067.md): uprobe: avoid out-of-bounds memory access of fetching args (CVSS 7.8, Linux)
- [CVE-2024-10435](https://cve.now/CVE-2024-10435.md): didi Super-Jacoco triggerEnvCov command injection (CVSS 5.3, didi Super-Jacoco)
- [CVE-2024-10434](https://cve.now/CVE-2024-10434.md): Tenda AC1206 ate ate\_Tenda\_mfg\_check\_usb3 stack-based overflow (CVSS 8.7, Tenda AC1206)
- [CVE-2024-10433](https://cve.now/CVE-2024-10433.md): Project Worlds Simple Web-Based Chat Application index.php cross site scripting (CVSS 5.3, Project Worlds Simple Web-Based Chat Application)
- [CVE-2024-34537](https://cve.now/CVE-2024-34537.md): TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level (CVSS 4.9, typo3/cms-backend)
- [CVE-2024-39205](https://cve.now/CVE-2024-39205.md): An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request (CVSS 9.8, pyload-ng)
- [CVE-2024-42011](https://cve.now/CVE-2024-42011.md): The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat. (CVSS 7.5)
- [CVE-2024-42930](https://cve.now/CVE-2024-42930.md): PbootCMS 3.2.8 is vulnerable to URL Redirect. (CVSS 6.1)
- [CVE-2024-48074](https://cve.now/CVE-2024-48074.md): An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into t (CVSS 8.0)
- [CVE-2024-48107](https://cve.now/CVE-2024-48107.md): SparkShop \<=1.1.7 is vulnerable to server-side request forgery (SSRF). (CVSS 6.5)
- [CVE-2024-48177](https://cve.now/CVE-2024-48177.md): MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do. (CVSS 8.8)
- [CVE-2024-48178](https://cve.now/CVE-2024-48178.md): newbee-mall v1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the goodsCoverImg parameter. (CVSS 8.1)
- [CVE-2024-48191](https://cve.now/CVE-2024-48191.md): dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=delAdmin&id=1 (CVSS 6.3)
- [CVE-2024-48195](https://cve.now/CVE-2024-48195.md): Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the p (CVSS 6.1)
- [CVE-2024-48196](https://cve.now/CVE-2024-48196.md): An issue in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a crafted script to the post parameter. (CVSS 7.5)
- [CVE-2024-48291](https://cve.now/CVE-2024-48291.md): dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17 (CVSS 6.3)
- [CVE-2024-48356](https://cve.now/CVE-2024-48356.md): LyLme Spage \<=1.6.0 is vulnerable to SQL Injection via /admin/group.php. (CVSS 9.8)
- [CVE-2024-48357](https://cve.now/CVE-2024-48357.md): LyLme Spage 1.2.0 through 1.6.0 is vulnerable to SQL Injection via /admin/apply.php. (CVSS 9.8)
- [CVE-2024-48465](https://cve.now/CVE-2024-48465.md): The MRBS version 1.5.0 has an SQL injection vulnerability in the edit\_entry\_handler.php file, specifically in the rooms%5B%5D parameter (CVSS 9.8)
- [CVE-2024-48594](https://cve.now/CVE-2024-48594.md): File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component (CVSS 8.8)
- [CVE-2024-48825](https://cve.now/CVE-2024-48825.md): Tenda AC7 v.15.03.06.44 ate\_ifconfig\_set has pre-authentication command injection allowing remote attackers to execute arbitrary code. (CVSS 8.0)
- [CVE-2024-48826](https://cve.now/CVE-2024-48826.md): Tenda AC7 v.15.03.06.44 ate\_iwpriv\_set has pre-authentication command injection allowing remote attackers to execute arbitrary code. (CVSS 8.0)
- [CVE-2024-48936](https://cve.now/CVE-2024-48936.md): SchedMD Slurm before 24.05.4 has Incorrect Authorization. (CVSS 5.0)
- [CVE-2024-51506](https://cve.now/CVE-2024-51506.md): Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description. (CVSS 4.8)
- [CVE-2024-51507](https://cve.now/CVE-2024-51507.md): Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name. (CVSS 4.8)
- [CVE-2024-51508](https://cve.now/CVE-2024-51508.md): Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index. (CVSS 4.8)
- [CVE-2024-51509](https://cve.now/CVE-2024-51509.md): Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin\_modules.php) stored XSS payload in the Nam (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.