CVEs published October 30, 2024
96 CVEs were published on October 30, 2024: 13 critical, 37 high.
- Published
- 96
- Critical
- 13
- High
- 37
- Medium
- 45
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- LevelOne WBR-6012
- 12
- ESAFENET CDG
- 3
- HashiCorp Consul · github.com/hashicorp/consul
- 3
- Chetan Khandla Woocommerce Product Design
- 2
- Eclipse Foundation mosquitto
- 2
- amu02aftab Enable Shortcodes inside Widgets,Comments and Ex…
- 1
- BeyondTrust Privileged Identity
- 1
- code-projects Blood Bank System
- 1
- Codezips Free Exam Hall Seating Management System
- 1
- Codezips Online Institute Management System
- 1
Critical 13
- CVE-2024-10456Delta Electronics InfraSuite Device Master Deserialization of Untrusted DataDelta Electronics InfraSuite Device Master
- CVE-2024-33699The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the adminisLevelOne WBR-6012
- CVE-2024-23309The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on clieLevelOne WBR-6012
- CVE-2024-8512W3SPEEDSTER <= 7.26 - Authenticated (Administrator+) Remote Code ExecutionW3SPEEDSTER
- CVE-2024-50510WordPress AR For Woocommerce plugin <= 6.3 - Arbitrary File Upload vulnerabilitywebandprint AR For Woocommerce
- CVE-2024-50511WordPress WP donimedia carousel plugin <= 1.0.1 - Arbitrary File Upload vulnerabilityWP donimedia carousel
- CVE-2024-50507WordPress DS.DownloadList plugin <= 1.3 - PHP Object Injection vulnerabilityDaschmi DS.DownloadList
- CVE-2024-50503WordPress User Toolkit plugin <= 1.2.3 - Account Takeover vulnerabilityDeryck User Toolkit
- CVE-2024-48112A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary cotopthink/thinkphp
- CVE-2024-48202icecms <=3.4.7 has a File Upload vulnerability in FileUtils.java,uploadFile.
- CVE-2024-51298In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the do
- CVE-2024-51424An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact
- CVE-2024-51427An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact
High 37
- CVE-2024-10006Consul L7 Intentions Vulnerable To Headers BypassHashiCorp Consul · github.com/hashicorp/consul
- CVE-2024-10005Consul L7 Intentions Vulnerable To URL Path BypassHashiCorp Consul · github.com/hashicorp/consul
- CVE-2024-9419Certain HP Print Products–Potential Remote Code Execution and/or Elevation of Privilege with the HP Smart Universal Printing DriverHP Smart Universal Printing Driver
- CVE-2024-31151A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during theLevelOne WBR-6012
- CVE-2024-28875A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during theLevelOne WBR-6012
- CVE-2024-24777A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6.LevelOne WBR-6012
- CVE-2024-33700The LevelOne WBR-6012 router firmware R0.40e6 suffers from an input validation vulnerability within its FTP functionality, enabling attackerLevelOne WBR-6012
- CVE-2024-10525Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callbackEclipse Foundation mosquitto
- CVE-2024-50504WordPress Bulk Change Role plugin <= 1.1 - Privilege Escalation vulnerabilitywebxmedia Bulk Change Role
- CVE-2024-50506WordPress Marketing Automation by AZEXO plugin <= 1.27.80 - Privilege Escalation vulnerabilityMarketing Automation by AZEXO
- CVE-2024-50508WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerabilityChetan Khandla Woocommerce Product Design
- CVE-2024-9632Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerabilityxorg-server · Red Hat Enterprise Linux
- CVE-2024-50509WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Deletion vulnerabilityChetan Khandla Woocommerce Product Design
- CVE-2024-10108WPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcodegwin WPAdverts – Classifieds Plugin
- CVE-2024-9846Enable Shortcodes inside Widgets,Comments and Experts <= 1.0.0 - Unauthenticated Arbitrary Shortcode Executionamu02aftab Enable Shortcodes inside Widgets,Comments and Ex…
- CVE-2023-52066http.zig commit 76cf5 was discovered to contain a CRLF injection vulnerability via the url parameter.
- CVE-2024-36060EnGenius EnStation5-AC A8J-ENS500AC 1.0.0 devices allow blind OS command injection via shell metacharacters in the Ping and Speed Test param
- CVE-2024-37573The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone cal
- CVE-2024-42041The com.videodownload.browser.videodownloader (aka AppTool-Browser-Video All Video Downloader) application 20-30.05.24 for Android allows an
- CVE-2024-48093Unrestricted File Upload in the Discussions tab in Operately v.0.1.0 allows a privileged user to achieve Remote Code Execution via uploading
- CVE-2024-48214KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code.
- CVE-2024-48271D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers t
- CVE-2024-48646An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validatio
- CVE-2024-48647A file disclosure vulnerability exists in Sage 1000 v7.0.0.
- CVE-2024-48733SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL
- CVE-2024-48734Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malic
- CVE-2024-48735Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access i
- CVE-2024-51243The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this
- CVE-2024-51257DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the
- CVE-2024-51258DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the
- CVE-2024-51296In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pi
- CVE-2024-51299In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the du
- CVE-2024-51300In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ge
- CVE-2024-51301In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pa
- CVE-2024-51304In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ld
- CVE-2024-51425An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impac
- CVE-2024-51426An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact
Medium, low and unrated 46
- CVE-2024-10086Consul Vulnerable To Reflected XSS On Content-Type Error ManipulationHashiCorp Consul · github.com/hashicorp/consul
- CVE-2024-10546open-scratch Teaching 在线教学平台 URL getDictItemsByTable sql injectionopen-scratch Teaching 在线教学平台
- CVE-2024-9110Cross-Site Scripting In Privileged IdentityBeyondTrust Privileged Identity
- CVE-2024-50344I, Librarian has a Stored XSS vulnerability in Supplemental Filesmkucej i-librarian-free
- CVE-2024-50419WordPress Greenshift plugin <=9.7 - Broken Access Control vulnerabilitywpsoul Greenshift
- CVE-2024-50353ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than ExpectedIowaComputerGurus aspnetcore.utilities.cloudstorage · ICG.A…
- CVE-2024-31152The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series LevelOne WBR-6012
- CVE-2024-32946A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via WLevelOne WBR-6012
- CVE-2024-33603The LevelOne WBR-6012 router has an information disclosure vulnerability in its web application, which allows unauthenticated users to accesLevelOne WBR-6012
- CVE-2024-33626The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive informaLevelOne WBR-6012
- CVE-2024-28052The WBR-6012 is a wireless SOHO router.LevelOne WBR-6012
- CVE-2024-33623A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6.LevelOne WBR-6012
- CVE-2024-3935Eclipse Mosquito: Double free vulnerabilityEclipse Foundation mosquitto
- CVE-2024-9388Black Widgets For Elementor <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmodernaweb Black Widgets For Elementor
- CVE-2024-50512WordPress Posti Shipping plugin <= 3.10.2 - Full Path Disclosure (FPD) vulnerabilityPosti Shipping
- CVE-2024-10223HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcodehtplugins WP Team – WordPress Team Member Plugin
- CVE-2024-8444Download Manager < 3.3.00 - Contributor+ Stored XSSDownload Manager
- CVE-2024-8871Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site Scriptingfatcatapps Pricing Table WordPress Plugin – Easy Pricing Ta…
- CVE-2024-10399Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposurewpchill Download Monitor
- CVE-2024-8792Subscribe to Comments <= 2.3 - Reflected Cross-Site Scriptingmarkjaquith Subscribe to Comments
- CVE-2024-8627Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingjosh401 Ultimate TinyMCE
- CVE-2024-9885Widget or Sidebar Shortcode <= 0.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodefstaude Widget or Sidebar Shortcode
- CVE-2024-10509Codezips Online Institute Management System login.php sql injectionCodezips Online Institute Management System
- CVE-2024-10507Codezips Free Exam Hall Seating Management System login.php sql injectionCodezips Free Exam Hall Seating Management System
- CVE-2024-9886WP Baidu Map <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesuifengtec WP Baidu Map
- CVE-2023-5816Code Explorer <= 1.4.5 - Authenticated (Admin+) External File Readingqriouslad Code Explorer
- CVE-2024-9884T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetwinpictures T(-) Countdown
- CVE-2024-10506code-projects Blood Bank System B-.php sql injectioncode-projects Blood Bank System
- CVE-2024-10505wuzhicms block.php edit code injectionwuzhicms
- CVE-2024-10503Klokan MapTiler tileserver-gl URL cross site scriptingKlokan MapTiler tileserver-gl
- CVE-2024-10502ESAFENET CDG FileDirectoryService.java getOneFileDirectory sql injectionESAFENET CDG
- CVE-2024-10501ESAFENET CDG ExamCDGDocService.java findById sql injectionESAFENET CDG
- CVE-2024-10500ESAFENET CDG HookWhiteListService.java sql injectionESAFENET CDG
- CVE-2024-31972EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execu
- CVE-2024-31973Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Ne
- CVE-2024-31975EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters.
- CVE-2024-43382Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypnet.snowflake:snowflake-jdbc
- CVE-2024-46531phpgurukul Vehicle Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchinputdata parameter a
- CVE-2024-48241An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to cause a denial of service via the __bf_div function.
- CVE-2024-48272D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the dev
- CVE-2024-48346xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path.
- CVE-2024-48569Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at th
- CVE-2024-48648A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0.
- CVE-2024-48807Cross Site Scripting vulnerability in PHPGurukul Doctor Appointment Management System v.1.0 allows a local attacker to execute arbitrary cod
- CVE-2024-51242A Server-Side Request Forgery (SSRF) vulnerability has been identified in eladmin 2.7 and earlier in ServerDeployController.java.
- CVE-2024-51419Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a