CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- progress openedgeClient connections using default TLS certificates from OpenEdge may bypass TLS host name validation7.2 High
- progress openedgeDirect local client connections to MS Agents can bypass authentication8.3 High
- progress openedgeUnauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service8.3 High
- sambas akos, sampaş holding akos (akoscepvatandasservice), akos (tahsilatservice) +2 moreSensetive Data Exposure in SAMPAS's AKOS6.9 Medium
- mozilla firefoxMemory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory...9.8 Critical
- mozilla firefoxMultiple prompts and panels from both Firefox and the Android OS could be used to obscure the...5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreIf a site had been granted the permission to open popup windows, it could cause Select elements...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreThe JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were...9.8 Critical
- mozilla firefox, firefox esr +1 moreFirefox normally asks for confirmation before asking the operating system to find an application...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreInternal browser event interfaces were exposed to web content when privileged EventHandler...8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA potentially exploitable type confusion could be triggered when looking up a property name on an...9.8 Critical
- python cpython, python +1 moreRegular-expression DoS when parsing TarFile headers7.5 High
- lenovo browserDLL Hijacking in Yandex Browser8.4 High
- symphony fintech xts web trader, symphonyfintech xts mobile trader +1 moreInformation Disclosure Vulnerability9.1 Critical
- symphony fintech xts web trader, symphonyfintech xts mobile trader +1 moreUnauthorized Modification Vulnerability9.1 Critical
- symphony fintech xts mobile trader, xts web trader +1 moreAccount Take Over Vulnerability9.2 Critical
- ultimaker curaArbitrary Code Injection in Cura7.8 High
- vmware fusionCode-execution vulnerability8.8 High
- opensc project opensc, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLibopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc3.9 Low
- opensc project opensc, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLibopensc: incorrect handling of the length of buffers or files in pkcs15init3.9 Low
- opensc project opensc, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLibopensc: incorrect handling length of buffers or files in libopensc4.3 Medium
- opensc project opensc, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLibopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init3.9 Low
- opensc project opensc, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLibopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc3.9 Low
- opensc project opensc, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLibopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init3.9 Low
- dell path to power, path to powerprotect +1 moreDell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal...6.8 Medium
- zyxel nwa1123acv3 firmware, usg lite 60ax firmware, wac500 firmware +26 more +28 moreThe improper neutralization of special elements in the parameter "host" in the CGI program of...9.8 Critical
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +2 more +4 moreA reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of...6.1 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +5 more +7 moreA post-authentication command injection vulnerability in Zyxel ATP series firmware versions from...7.2 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +5 more +7 moreA post-authentication command injection vulnerability in Zyxel ATP series firmware versions from...7.2 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +5 more +7 moreA null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through...7.5 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +5 more +7 moreA command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions...8.1 High
- zyxel atp series firmware, usg flex series firmware, atp800 firmware +2 more +4 moreA post-authentication command injection vulnerability in Zyxel ATP series firmware versions from...7.2 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +2 more +4 moreA buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4...4.9 Medium
- zyxel vmg8825-t50k firmware, ax7501-b0 firmware, ax7501-b1 firmware +47 more +49 moreA buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware...7.5 High
- remyandrade contact manager with export to vcf, sourcecodester contact manager +1 moreSourceCodester Contact Manager with Export to VCF Delete Contact delete-account.php sql injection5.3 Medium
- netapp 500f firmware, a250 firmware, active iq unified manager +22 more +24 morePossible denial of service in X.509 name checks7.5 High
- yubico security key c nfc by yubico firmware, security key nfc by yubico firmware, yubihsm 2 fips firmware +15 more +17 moreYubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware...4.2 Medium
- djangoproject djangoDjango allows enumeration of user e-mail addresses5.3 Medium
- djangoproject djangoDjango vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters7.5 High
- squaredup ds for scomSquaredUp DS for SCOM 6.2.1.11104 allows XSS.5.4 Medium
- trustedfirmware mbed tlsAn issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user...5.1 Medium
- seacmsSeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at ...9.8 Critical
- seacmsA cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12...6.1 Medium
- recantha pi camera projectA remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0,...9.8 Critical
- mingsoft mcmsMCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.8.1 High
- syspassA cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary...6.1 Medium
- limesurveyA Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806...6.5 Medium
- limesurveyAn issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to...8.8 High
- Show moreLoading…