CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- alf, alfio-event alf.io +1 morealf.io's preloaded data as json is not escaped correctly6.5 Medium
- consensys gnark, gnark-crypto +1 moregnark's Groth16 commitment extension unsound for more than one commitment6.2 Medium
- consensys gnark, gnark-crypto +1 moregnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge property5.9 Medium
- accordors accord orsIDOR in Ariva Computer's Accord ORS9.2 Critical
webpcrates.iowebp crate may expose memory contents when encoding an image4.6 Medium- byron gitoxidegix-path improperly resolves configuration path reported by Git6.0 Medium
- linux, linux kernel +1 moremedia: aspeed: Fix memory overwrite if timing is 1600x9007.8 High
- linux, linux kernel +1 moremedia: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer5.5 Medium
- wpshuffle frontend post submission manager lite – frontend posting wordpress plugin, frontend post submission manager +1 moreFrontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update4.3 Medium
- wpeka wp adcenter, wpeka-club wp adcenter – ad manager & adsense ads +1 moreWP AdCenter – Ad Manager & Adsense Ads <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_alignment Attribute6.4 Medium
- plechevandrey wp-recall, wppost wp-recall – registration, profile, commerce & more +1 moreWP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update9.8 Critical
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzes, lifterlms +1 moreLifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection7.2 High
- alimir wp ulikeWP ULike < 4.7.2.1 - Subscriber+ Stored-XSS3.5 Low
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an...7.9 High
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s)...7.5 High
- sirv image optimizer, resizer and cdn – sirv, sirv +1 moreImage Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload8.8 High
- contrid newslettersNewsletters <= 4.9.9.2 - Authenticated Privilege Escalation8.8 High
- coffee2code remember me controlsRemember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure5.3 Medium
- apple visionosThe issue was addressed by suspending Persona when the virtual keyboard is active. This issue is...5.3 Medium
- openrapid rapidcmsRapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password...9.8 Critical
- h2o, h2oai h2o-3 +1 moreH2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL9.1 Critical
tgtDebian,iscsitargetUbuntu,scsi-target-utilsopenEuler +2 moretgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand...5.9 Medium- draytek vigor3900 firmwareDrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection...8.8 High
- draytek vigor3900 firmwareDrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection...8.8 High
- openrapid rapidcmsRapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid...9.8 Critical
- openrapid rapidcmsRapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username...9.8 Critical
- deathbreak drugA cross-site scripting (XSS) vulnerability in the component \bean\Manager.java of Drug v1.0...5.4 Medium
- oretnom23 simple forum websiteSourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/...8.8 High
- d-link dir-823g, dlink dir-823g firmware +1 moreD-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows...7.5 High
- d-link di-8100g, dlink di-8100g firmware +1 moreD-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.9.8 Critical
- d-link di-8100, dlink di-8100g firmware +1 moreD-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the...9.8 Critical
- go standard library go/build/constraint, go build constraint standard library +1 moreStack exhaustion in Parse in go/build/constraint7.5 High
- go standard library encoding/gob, encoding\/gob +1 moreStack exhaustion in Decoder.Decode in encoding/gob7.5 High
- go standard library go/parserStack exhaustion in all Parse functions in go/parser4.3 Medium
- mlewand ckeditor-plugin-openlink, open link +1 moreCKEditor Open Link plugin vulnerable to Cross-site Scripting6.1 Medium
- echostar fusion, hughes network systems wl3000 fusion software +1 moreHughes Network Systems WL3000 Missing Encryption of Sensitive Data7.1 High
- echostar fusion, hughes network systems wl3000 fusion software +1 moreHughes Network Systems Insufficiently Protected Credentials4.1 Medium
github.com/cosmos/interchain-securityGo,github.com/cosmos/interchain-security/v2Go,github.com/cosmos/interchain-security/v3Go +2 more +4 moreInterchain Security: The signers of ICS messages do not need to match the provider addressNo score- flycass cockpit access security system (cass), flycass, flycass known crewmember (kcm) +2 moreFlyCASS Cockpit Access Security System (CASS) SQL Injection9.3 Critical
- asterisk, sangoma certified asterisk +1 moreA malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used5.7 Medium
- kemptechnologies loadmaster, loadmaster mt, multi-tenant hypervisor firmware +2 moreImproper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection10.0 Critical
- stripe stripe-cli, cli +1 morestripe-cli Path Traversal vulnerability7.6 High
- salesagility suitecrmSuiteCRM has wrong deletion permission checks on API delete call7.7 High
- mindsdbMindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding9.3 Critical
- ibm aspera faspexIBM Aspera Faspex bypass security5.9 Medium
- ibm aspera faspexIBM Aspera Faspex information disclosure6.5 Medium
- ibm aspera faspexIBM Aspera Faspex bypass security6.8 Medium
- red hat directory server 11, directory server 12, enterprise linux 10 +4 more +6 more389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)5.7 Medium
- phpgurukul job portalSQL injection vulnerability in Job Portal6.3 Medium
- phpgurukul job portalSQL injection vulnerability in Job Portal6.3 Medium
- Show moreLoading…