CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- haloHalo's editor has a stored XSS vulnerability6.3 Medium
- simple online planning so planning, soplanning +1 moreRemote Code Execution through File Upload in SOPlanning before 1.52.0210.0 Critical
- simple online planning so planning, soplanning, so planning simple online planning +2 moreRemote Code Execution through File Upload in SOPlanning before 1.52.028.9 High
- simple online planning so planning, soplanning +1 moreInsecure Direct Object Reference to export Database in SOPlanning before 1.52.029.3 Critical
- simple online planning so planning, soplanning +1 moreSQL Injection in SOPlanning before 1.52.029.3 Critical
- eclipse dataspace components, eclipse foundation edc, edc connector +2 moreEclipse EDC: Consumer pull transfer token validation checks not applied5.0 Medium
- eclipse glassfishEclipse Glassfish: URL redirection vulnerability to untrusted sites6.1 Medium
- significant-gravitas autogpt, significant-gravitas/autogpt, agpt autogpt classic +2 moreShell Command Denylist Bypass in significant-gravitas/autogpt9.8 Critical
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreUser Enumeration vulnerability9.3 Critical
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreParameter Tampering Vulnerability6.9 Medium
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreNo Rate Limiting Vulnerability8.7 High
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreInformation Disclosure Vulnerability8.7 High
- reedos aim-star, reedos software solutions mutual fund distribution product (aim-star) +1 moreImproper Authorization Vulnerability8.7 High
- vidco voc testerDirectory Traversal in Vidco Software's VOC TESTER9.2 Critical
- elementor website builder, elemntor elementor website builder – more than just a page builder +1 moreElementor Website Builder – More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets5.4 Medium
- fortinet fortisoarAn improper authorization vulnerability [CWE-285] in FortiSOAR version 7.4.0 through 7.4.3, 7.3.0...7.1 High
- villatheme woocommerce photo reviews premium, woocommerce photo reviews +1 moreWooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation9.8 Critical
- i13websolution video carousel slider with lightboxvideo carousel slider with lightbox <= 1.0.6 - Authenticated (Admin+) SQL Injection4.9 Medium
- nko advanced wordpress backgroundsAdvanced WordPress Backgrounds <= 1.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via imageTag Parameter6.4 Medium
- wpdelicious wp delicious – recipe plugin for food bloggers (formerly delicious recipes), wp delicious, wpdelicious +2 moreWP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) <= 1.6.9 - Improper Path Validation to Authenticated (Subscriber+) Arbitrary File Move and Read8.1 High
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget6.4 Medium
- gsplugins gs logo slider, logichunt logo slider +1 moreGS Logo Slider Lite < 3.6.9 - Admin+ Stored XSS4.8 Medium
- enviragallery envira gallery, unknown gallery plugin for wordpress +1 moreEnvira Gallery < 1.8.15 - Author+ Stored XSS4.8 Medium
- dset project dsetdset Prototype Pollution vulnerability8.8 High
- bplugins html5 video player, html5 video player – embed and play videos in custom player +1 moreHTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.32 - Missing Authorization in multiple functions via h5vp_ajax_handler5.3 Medium
- bplugins html5 video player, html5 video player – embed and play videos in custom player +1 moreHTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update4.3 Medium
- octopus serverAffected versions of Octopus Server had a weak content security policy.2.6 Low
- gallagher command centre server, command centre +1 moreInclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server...8.0 High
- gallagher controller 6000 and controller 7000Incorrect Calculation of Buffer Size (CWE-131) in the Controller 6000 and Controller 7000 OSDP...4.6 Medium
- gallagher controller 6000 and controller 7000Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000...6.5 Medium
- gallagher controller 6000 and controller 7000Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and...6.1 Medium
- pickplugins post grid and gutenberg blocks, post grid +1 morePost Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation8.8 High
- google chromeUse after free in Autofill in Google Chrome on Android prior to 128.0.6613.137 allowed a remote...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to...8.8 High
- google chromeUse after free in Media Router in Google Chrome on Android prior to 128.0.6613.137 allowed a...8.8 High
- google chromeHeap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker...8.8 High
- curl, debian linux, netapp active iq unified manager +26 more +28 moreOCSP stapling bypass with GnuTLS6.5 Medium
- perfexcrm perfex crmA stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0...5.4 Medium
- relyum rely-pcie firmwareRELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the...8.8 High
- relyum rely-pcie firmwareRELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS...3.7 Low
- relyum rely-pcie firmwareRELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the...8.8 High
- relyum rely-pcie firmwareA stored cross-site scripting (XSS) vulnerability in the VLAN configuration of RELY-PCIe v22.2.1...4.7 Medium
- relyum rely-pcie firmwareRELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a command injection vulnerability via the...8.8 High
- relyum rely-pcie firmwareRELY-PCIe v22.2.1 to v23.1.0 was discovered to contain incorrect access control in the mService...8.8 High
- relyum rely-pcie firmwareRELY-PCIe v22.2.1 to v23.1.0 was discovered to contain a code injection vulnerability via the...8.8 High
- evilnapsis inventio-liteevilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username"...9.8 Critical
- comfast cf-xr11 firmwareCOMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers...9.8 Critical
- ellevoSQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive...7.5 High
- plutoPluto's http.request allows CR and LF in header values5.3 Medium
- ivanti endpoint managerAn uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September...6.7 Medium
- Show moreLoading…