# CVEs published 2024-10-31

71 CVEs were published on October 31, 2024: 20 critical, 12 high. Days are UTC.

- [CVE-2024-10605](https://cve.now/CVE-2024-10605.md): code-projects Blood Bank Management System request.php cross-site request forgery (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2024-10602](https://cve.now/CVE-2024-10602.md): Tongda OA 2017 data\_picker\_link.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10601](https://cve.now/CVE-2024-10601.md): Tongda OA 2017 delete.php sql injection (CVSS 5.3, Tongda OA)
- [CVE-2024-10600](https://cve.now/CVE-2024-10600.md): Tongda OA 2017 submenu.php sql injection (CVSS 6.9, Tongda OA)
- [CVE-2024-10599](https://cve.now/CVE-2024-10599.md): Tongda OA 2017 package\_static\_resources.php resource consumption (CVSS 6.9, Tongda OA)
- [CVE-2024-10598](https://cve.now/CVE-2024-10598.md): Tongda OA Annual Leave data.php improper authorization (CVSS 6.9, Tongda OA)
- [CVE-2024-6479](https://cve.now/CVE-2024-6479.md): SIP Reviews Shortcode for WooCommerce \<= 1.2.3 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, shopitpress SIP Reviews Shortcode for WooCommerce)
- [CVE-2024-6480](https://cve.now/CVE-2024-6480.md): SIP Reviews Shortcode for WooCommerce \<= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4, shopitpress SIP Reviews Shortcode for WooCommerce)
- [CVE-2024-10597](https://cve.now/CVE-2024-10597.md): ESAFENET CDG PolicyActionService.java delPolicyAction sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10596](https://cve.now/CVE-2024-10596.md): ESAFENET CDG EncryptPolicyTypeService.java delEntryptPolicySort sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10595](https://cve.now/CVE-2024-10595.md): ESAFENET CDG PublicDocInfoAjax.java delDifferCourseList sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10594](https://cve.now/CVE-2024-10594.md): ESAFENET CDG FileDirectoryService.java docHistory sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2024-10573](https://cve.now/CVE-2024-10573.md): Mpg123: buffer overflow when writing decoded pcm samples (CVSS 6.7, mpg123 · Red Hat Enterprise Linux)
- [CVE-2024-51482](https://cve.now/CVE-2024-51482.md): Boolean-based SQL Injection in ZoneMinder v1.37.\* \<= 1.37.64 (CVSS 10.0, zoneminder)
- [CVE-2024-50356](https://cve.now/CVE-2024-50356.md): Press has a potential 2FA bypass (CVSS 0.0, frappe press)
- [CVE-2024-50347](https://cve.now/CVE-2024-50347.md): Laravel Reverb has Missing API Signature Verification (CVSS 6.3, laravel reverb · laravel/reverb)
- [CVE-2024-7883](https://cve.now/CVE-2024-7883.md): CMSE secure state may leak from stack to floating-point registers (CVSS 3.7, Arm Compiler for Embedded · Arm Compiler for Functional… +1)
- [CVE-2024-51478](https://cve.now/CVE-2024-51478.md): Use of a Broken or Risky Cryptographic Algorithm in YesWiki (CVSS 9.9, yeswiki · yeswiki/yeswiki)
- [CVE-2024-51481](https://cve.now/CVE-2024-51481.md): Nix allows macOS sandbox escape via built-in builders (CVSS 1.0, NixOS nix)
- [CVE-2024-50354](https://cve.now/CVE-2024-50354.md): Out-of-memory during deserialization with crafted inputs (CVSS 5.5, Consensys gnark · github.com/consensys/gnark)
- [CVE-2024-8185](https://cve.now/CVE-2024-8185.md): Vault Vulnerable to Denial of Service When Processing Raft Join Requests (CVSS 7.5, HashiCorp Vault · github.com/hashicorp/vault +1)
- [CVE-2024-8553](https://cve.now/CVE-2024-8553.md): Foreman: read-only access to entire db from templates (CVSS 6.3, foreman · Red Hat Satellite 6.13 for RHEL +3)
- [CVE-2024-48910](https://cve.now/CVE-2024-48910.md): DOMPurify vulnerable to tampering by prototype polution (CVSS 9.1, cure53 DOMPurify · dompurify)
- [CVE-2024-10454](https://cve.now/CVE-2024-10454.md): Clickjacking vulnerability in Clibo Manager (CVSS 6.1, Clibo Manager)
- [CVE-2024-8934](https://cve.now/CVE-2024-8934.md): Beckhoff: Local command injection via TwinCAT Package Manager (CVSS 6.5, Beckhoff TwinCAT Package Manager)
- [CVE-2024-43930](https://cve.now/CVE-2024-43930.md): WordPress JobSearch WP Job Board WordPress Plugin plugin \<= 2.5.3 - Broken Access Control vulnerability (CVSS 4.3, eyecix JobSearch)
- [CVE-2024-43933](https://cve.now/CVE-2024-43933.md): WordPress WPMobile.App plugin \<= 11.48 - CSRF to Stored XSS vulnerability (CVSS 7.1, Amauri WPMobile.App)
- [CVE-2024-43984](https://cve.now/CVE-2024-43984.md): WordPress Podlove Podcast Publisher plugin \<= 4.1.13 - CSRF to Remote Code Execution (RCE) vulnerability (CVSS 9.6, Podlove Podcast Publisher)
- [CVE-2024-49674](https://cve.now/CVE-2024-49674.md): WordPress EKC Tournament Manager plugin \<= 2.2.1 - CSRF to Arbitrary File Upload vulnerability (CVSS 9.6, lukashuser EKC Tournament Manager)
- [CVE-2024-49685](https://cve.now/CVE-2024-49685.md): WordPress Custom Twitter Feeds plugin \<= 2.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Syed Balkhi Custom Twitter Feeds)
- [CVE-2024-43383](https://cve.now/CVE-2024-43383.md): Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator (CVSS 8.0, Apache Software Foundation Apache Lucene.Net.Replicator · L…)
- [CVE-2024-30149](https://cve.now/CVE-2024-30149.md): HCL AppScan Source is affected by an expired TLS/SSL certificate (CVSS 4.8, HCL Software AppScan Source)
- [CVE-2024-9434](https://cve.now/CVE-2024-9434.md): WPGlobus Translate Options \<= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, alexgff WPGlobus Translate Options)
- [CVE-2024-9446](https://cve.now/CVE-2024-9446.md): WP Simple Anchors Links \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode (CVSS 6.4, kilukrumedia WP Simple Anchors Links)
- [CVE-2024-9430](https://cve.now/CVE-2024-9430.md): Get Quote For Woocommerce – Request A Quote For Woocommerce \<= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download (CVSS 5.3, wpcloudtechnologies Get Quote For Woocommerce – Request A Q…)
- [CVE-2024-9165](https://cve.now/CVE-2024-9165.md): Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) \<= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, codemenschen Gift Cards (Gift Vouchers and Packages))
- [CVE-2024-9700](https://cve.now/CVE-2024-9700.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation (CVSS 5.3, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-10392](https://cve.now/CVE-2024-10392.md): AI Power: Complete AI Pack \<= 1.8.89 - Unauthenticated Arbitrary File Upload (CVSS 9.8, senols AI Puffer – Your AI engine for WordPress)
- [CVE-2024-21537](https://cve.now/CVE-2024-21537.md): Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval i (CVSS 9.3, lilconfig · org.webjars.npm:lilconfig)
- [CVE-2024-9708](https://cve.now/CVE-2024-9708.md): Easy SVG Upload \<= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wpdelower Easy SVG Upload)
- [CVE-2024-10544](https://cve.now/CVE-2024-10544.md): Woo Manage Fraud Orders \<= 2.6.1 - Unauthenticated Information Exposure via Log Files (CVSS 5.3, prasidhda Woo Manage Fraud Orders)
- [CVE-2024-10561](https://cve.now/CVE-2024-10561.md): Codezips Pet Shop Management System birdsupdate.php sql injection (CVSS 6.9, Codezips Pet Shop Management System)
- [CVE-2024-10559](https://cve.now/CVE-2024-10559.md): SourceCodester Airport Booking Management System details buffer overflow (CVSS 4.8, SourceCodester Airport Booking Management System)
- [CVE-2024-10557](https://cve.now/CVE-2024-10557.md): code-projects Blood Bank Management System updateprofile.php cross-site request forgery (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2024-10556](https://cve.now/CVE-2024-10556.md): Codezips Pet Shop Management System birdsadd.php sql injection (CVSS 6.9, Codezips Pet Shop Management System)
- [CVE-2023-52044](https://cve.now/CVE-2023-52044.md): Studio-42 eLfinder 2.1.62 is vulnerable to Remote Code Execution (RCE) as there is no restriction for uploading files with the .php8 extensi (CVSS 9.8)
- [CVE-2023-52045](https://cve.now/CVE-2023-52045.md): Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting (XSS) vulnerability. (CVSS 6.1)
- [CVE-2024-39332](https://cve.now/CVE-2024-39332.md): Webswing 23.2.2 allows remote attackers to modify client-side JavaScript code to achieve path traversal, likely leading to remote code execu (CVSS 9.8)
- [CVE-2024-39719](https://cve.now/CVE-2024-39719.md): An issue was discovered in Ollama through 0.3.14. (CVSS 7.5)
- [CVE-2024-39720](https://cve.now/CVE-2024-39720.md): An issue was discovered in Ollama before 0.1.46. (CVSS 8.2, github.com/ollama/ollama)
- [CVE-2024-39721](https://cve.now/CVE-2024-39721.md): An issue was discovered in Ollama before 0.1.34. (CVSS 7.5)
- [CVE-2024-39722](https://cve.now/CVE-2024-39722.md): An issue was discovered in Ollama before 0.1.46. (CVSS 7.5)
- [CVE-2024-42515](https://cve.now/CVE-2024-42515.md): Glossarizer through 1.5.2 improperly tries to convert text into HTML. (CVSS 9.9, glossarizer)
- [CVE-2024-42835](https://cve.now/CVE-2024-42835.md): langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. (CVSS 9.8, langflow)
- [CVE-2024-48200](https://cve.now/CVE-2024-48200.md): An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXte (CVSS 8.4)
- [CVE-2024-48307](https://cve.now/CVE-2024-48307.md): JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. (CVSS 9.8, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2024-48311](https://cve.now/CVE-2024-48311.md): Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function. (CVSS 8.8)
- [CVE-2024-48359](https://cve.now/CVE-2024-48359.md): Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter. (CVSS 9.8)
- [CVE-2024-48360](https://cve.now/CVE-2024-48360.md): Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php. (CVSS 7.5)
- [CVE-2024-50801](https://cve.now/CVE-2024-50801.md): A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public\_html/admin/controller/responses/listing\_ (CVSS 6.0)
- [CVE-2024-50802](https://cve.now/CVE-2024-50802.md): A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public\_html/admin/controller/responses/listing\_ (CVSS 6.0)
- [CVE-2024-51060](https://cve.now/CVE-2024-51060.md): Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a\_id' parameter. (CVSS 9.1)
- [CVE-2024-51063](https://cve.now/CVE-2024-51063.md): Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection in add-teacher.php via the mobile number or email parameter (CVSS 9.1)
- [CVE-2024-51064](https://cve.now/CVE-2024-51064.md): Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php. (CVSS 9.8)
- [CVE-2024-51065](https://cve.now/CVE-2024-51065.md): Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter. (CVSS 9.8)
- [CVE-2024-51066](https://cve.now/CVE-2024-51066.md): An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Management System v1.1 all (CVSS 7.5)
- [CVE-2024-51254](https://cve.now/CVE-2024-51254.md): DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the (CVSS 8.8)
- [CVE-2024-51255](https://cve.now/CVE-2024-51255.md): DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the (CVSS 9.8)
- [CVE-2024-51259](https://cve.now/CVE-2024-51259.md): DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the (CVSS 9.8)
- [CVE-2024-51260](https://cve.now/CVE-2024-51260.md): DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the (CVSS 9.8)
- [CVE-2024-51430](https://cve.now/CVE-2024-51430.md): Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary (CVSS 6.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.