CVEs published October 31, 2024
71 CVEs were published on October 31, 2024: 20 critical, 12 high.
- Published
- 71
- Critical
- 20
- High
- 12
- Medium
- 36
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Tongda OA
- 5
- ESAFENET CDG
- 4
- code-projects Blood Bank Management System
- 2
- Codezips Pet Shop Management System
- 2
- shopitpress SIP Reviews Shortcode for WooCommerce
- 2
- alexgff WPGlobus Translate Options
- 1
- Amauri WPMobile.App
- 1
- Apache Software Foundation Apache Lucene.Net.Replicator · L…
- 1
- Arm Compiler for Embedded · Arm Compiler for Functional… +1
- 1
- Beckhoff TwinCAT Package Manager
- 1
Critical 20
- CVE-2024-51482Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64zoneminder
- CVE-2024-51478Use of a Broken or Risky Cryptographic Algorithm in YesWikiyeswiki · yeswiki/yeswiki
- CVE-2024-48910DOMPurify vulnerable to tampering by prototype polutioncure53 DOMPurify · dompurify
- CVE-2024-43984WordPress Podlove Podcast Publisher plugin <= 4.1.13 - CSRF to Remote Code Execution (RCE) vulnerabilityPodlove Podcast Publisher
- CVE-2024-49674WordPress EKC Tournament Manager plugin <= 2.2.1 - CSRF to Arbitrary File Upload vulnerabilitylukashuser EKC Tournament Manager
- CVE-2024-10392AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Uploadsenols AI Puffer – Your AI engine for WordPress
- CVE-2024-21537Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval ililconfig · org.webjars.npm:lilconfig
- CVE-2023-52044Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extensi
- CVE-2024-39332Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execu
- CVE-2024-42515Glossarizer through 1.5.2 improperly tries to convert text into HTML.glossarizer
- CVE-2024-42835langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.langflow
- CVE-2024-48307JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.org.jeecgframework.boot:jeecg-boot-parent
- CVE-2024-48359Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.
- CVE-2024-51060Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter.
- CVE-2024-51063Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter
- CVE-2024-51064Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php.
- CVE-2024-51065Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter.
- CVE-2024-51255DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the
- CVE-2024-51259DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the
- CVE-2024-51260DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the
High 12
- CVE-2024-8185Vault Vulnerable to Denial of Service When Processing Raft Join RequestsHashiCorp Vault · github.com/hashicorp/vault +1
- CVE-2024-43933WordPress WPMobile.App plugin <= 11.48 - CSRF to Stored XSS vulnerabilityAmauri WPMobile.App
- CVE-2024-43383Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.ReplicatorApache Software Foundation Apache Lucene.Net.Replicator · L…
- CVE-2024-39719An issue was discovered in Ollama through 0.3.14.
- CVE-2024-39720An issue was discovered in Ollama before 0.1.46.github.com/ollama/ollama
- CVE-2024-39721An issue was discovered in Ollama before 0.1.34.
- CVE-2024-39722An issue was discovered in Ollama before 0.1.46.
- CVE-2024-48200An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXte
- CVE-2024-48311Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.
- CVE-2024-48360Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.
- CVE-2024-51066An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Management System v1.1 all
- CVE-2024-51254DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the
Medium, low and unrated 39
- CVE-2024-10605code-projects Blood Bank Management System request.php cross-site request forgerycode-projects Blood Bank Management System
- CVE-2024-10602Tongda OA 2017 data_picker_link.php sql injectionTongda OA
- CVE-2024-10601Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2024-10600Tongda OA 2017 submenu.php sql injectionTongda OA
- CVE-2024-10599Tongda OA 2017 package_static_resources.php resource consumptionTongda OA
- CVE-2024-10598Tongda OA Annual Leave data.php improper authorizationTongda OA
- CVE-2024-6479SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) SQL Injectionshopitpress SIP Reviews Shortcode for WooCommerce
- CVE-2024-6480SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site Scriptingshopitpress SIP Reviews Shortcode for WooCommerce
- CVE-2024-10597ESAFENET CDG PolicyActionService.java delPolicyAction sql injectionESAFENET CDG
- CVE-2024-10596ESAFENET CDG EncryptPolicyTypeService.java delEntryptPolicySort sql injectionESAFENET CDG
- CVE-2024-10595ESAFENET CDG PublicDocInfoAjax.java delDifferCourseList sql injectionESAFENET CDG
- CVE-2024-10594ESAFENET CDG FileDirectoryService.java docHistory sql injectionESAFENET CDG
- CVE-2024-10573Mpg123: buffer overflow when writing decoded pcm samplesmpg123 · Red Hat Enterprise Linux
- CVE-2024-50356Press has a potential 2FA bypassfrappe press
- CVE-2024-50347Laravel Reverb has Missing API Signature Verificationlaravel reverb · laravel/reverb
- CVE-2024-7883CMSE secure state may leak from stack to floating-point registersArm Compiler for Embedded · Arm Compiler for Functional… +1
- CVE-2024-51481Nix allows macOS sandbox escape via built-in buildersNixOS nix
- CVE-2024-50354Out-of-memory during deserialization with crafted inputsConsensys gnark · github.com/consensys/gnark
- CVE-2024-8553Foreman: read-only access to entire db from templatesforeman · Red Hat Satellite 6.13 for RHEL +3
- CVE-2024-10454Clickjacking vulnerability in Clibo ManagerClibo Manager
- CVE-2024-8934Beckhoff: Local command injection via TwinCAT Package ManagerBeckhoff TwinCAT Package Manager
- CVE-2024-43930WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - Broken Access Control vulnerabilityeyecix JobSearch
- CVE-2024-49685WordPress Custom Twitter Feeds plugin <= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerabilitySyed Balkhi Custom Twitter Feeds
- CVE-2024-30149HCL AppScan Source is affected by an expired TLS/SSL certificateHCL Software AppScan Source
- CVE-2024-9434WPGlobus Translate Options <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingalexgff WPGlobus Translate Options
- CVE-2024-9446WP Simple Anchors Links <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcodekilukrumedia WP Simple Anchors Links
- CVE-2024-9430Get Quote For Woocommerce – Request A Quote For Woocommerce <= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Downloadwpcloudtechnologies Get Quote For Woocommerce – Request A Q…
- CVE-2024-9165Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadcodemenschen Gift Cards (Gift Vouchers and Packages)
- CVE-2024-9700Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulationwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-9708Easy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpdelower Easy SVG Upload
- CVE-2024-10544Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Filesprasidhda Woo Manage Fraud Orders
- CVE-2024-10561Codezips Pet Shop Management System birdsupdate.php sql injectionCodezips Pet Shop Management System
- CVE-2024-10559SourceCodester Airport Booking Management System details buffer overflowSourceCodester Airport Booking Management System
- CVE-2024-10557code-projects Blood Bank Management System updateprofile.php cross-site request forgerycode-projects Blood Bank Management System
- CVE-2024-10556Codezips Pet Shop Management System birdsadd.php sql injectionCodezips Pet Shop Management System
- CVE-2023-52045Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability.
- CVE-2024-50801A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_
- CVE-2024-50802A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_
- CVE-2024-51430Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary