CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- stylemixthemes cost calculator builder pro, cost calculator builder +1 moreCost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation5.3 Medium
- beaverbuilder customizer export/import, fastlinemedia customizer export\/import, the beaver builder team cutomizer export\/import +2 moreCustomizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import6.6 Medium
- pinpoint booking system, dotonpaper pinpoint booking system – version 2 +1 morePinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection8.8 High
- ninjaforms ninja forms file uploads, saturday drive ninja forms, saturdaydrive ninja forms - file uploads +2 moreNinja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload7.2 High
- lmxcmslmxcms SQL Command Execution Module admin.php formatData code injection5.1 Medium
- maxsdesign preloader plus – wordpress loading screen plugin, wp-brandtheme preloader plus +1 morePreloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- bww big file uploads – increase maximum file upload size, infiniteuploads big file uploads +1 moreBig File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosure4.3 Medium
- wavelogWavelog Live QSO qso index cross site scripting6.9 Medium
- apache airflowApache Airflow: Authenticated DAG authors could execute code on scheduler nodes8.8 High
- apache airflowApache Airflow: Command Injection in an example DAG8.8 High
- opensc project opensc, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreLibopensc: heap buffer overflow in openpgp driver when generating key2.9 Low
jupyterlite-corePyPIHTML injection in JupyterLite leading to DOM Clobbering6.3 Medium- qnap download stationDownload Station7.0 High
- qnap qumagieQuMagie1.0 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero7.3 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.3 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.7 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero6.6 Medium
- qnap qts, quts hero, qnap systems inc. qes +2 more +4 moreQTS, QuTS hero, QuTScloud, QVR, QES8.8 High
- qnap qulog centerQuLog Center8.2 High
- gfi software helpdeskHelpdesk3.5 Low
- qnap qts, quts hero, qnap systems inc. qutscloud +2 moreQTS, QuTS hero2.6 Low
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero7.8 High
- qnap qts, qnap systems inc. quts hero, qutscloud +2 moreQTS7.2 High
- qnap music stationMusic Station4.3 Medium
- qnap video stationVideo Station8.8 High
- qnap video stationVideo Station7.4 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.9 Medium
- qnap qvr smart clientQVR Smart Client6.7 Medium
- qnap notes station 3Notes Station 36.3 Medium
- qnap notes station 3Notes Station 36.3 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero6.6 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero8.8 High
- qnap qts, quts hero +1 moreQTS, QuTS hero8.9 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.4 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero5.4 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero8.7 High
- qnap qts, quts hero +1 moreQTS, QuTS hero4.3 Medium
- mozilla thunderbirdWhen aborting the verification of an OTR chat session, an attacker could have caused a use-after...6.5 Medium
- spipSPIP Bigup Multipart File Upload OS Command Injection9.8 Critical
- hapifhir org.hl7.fhir.core`org.hl7.fhir.core` XXE vulnerability in XSLT transforms8.6 High
- red hat migration toolkit for virtualization 2.6Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication7.5 High
- open-xchange gmbh ox dovecot proDovecot accepts dot LF DOT LF symbol as end of DATA command. RFC requires that it should always...5.3 Medium
- themelooks enter addons – ultimate template builder for elementor, enter addons +1 moreEnter Addons – Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget6.4 Medium
- whyun wpcom member, wpcom member, wpcom-member +2 moreWPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta9.8 Critical
- forumwp, ultimatemember forumwp – forum & discussion board +1 moreForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover8.8 High
- wp codeus advanced sermonsAdvanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jetplugs revision manager tmcRevision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending4.3 Medium
- dataflowx datadiodexAuthenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX10.0 Critical
- alf, alfio-event alf.io +1 moreBypassing promo code limitations with race conditions7.5 High
- Show moreLoading…