CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- totolink a720r, a720r firmware +1 moreTOTOLINK A720R exportOvpn os command injection2.3 Low
- mohammad arif opor ayamWordPress Opor Ayam theme <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cryoutcreations fluidaWordPress Fluida theme <= 1.8.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cryoutcreations mantraWordPress Mantra theme <= 3.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- axiomthemes nirvanaWordPress Nirvana theme <= 1.6.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cryoutcreations parabolaWordPress Parabola theme <= 2.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mediaron custom query blocksWordPress Custom Query Blocks plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jennifer hall filmixWordPress filmix theme <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hiroaki miyashita custom field templateWordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- happyformsWordPress Happyforms plugin <= 1.26.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- joomunited wp meta seoWordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- joomunited wp meta seoWordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- spiffy plugins calendar, spiffyplugins spiffy calendar +1 moreWordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- spiffy plugins calendar, spiffyplugins spiffy calendar +1 moreWordPress Spiffy Calendar plugin <= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pickplugins product slider for woocommerceWordPress Product Slider for WooCommerce by PickPlugins plugin <= 1.13.50 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- info-d-74 flipping cardsWordPress Flipping Cards plugin <= 1.30 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- code-projects crud operation systemcode-projects Crud Operation System savedata.php sql injection6.9 Medium
- churchcrm crm, perfexcrm perfex crm +1 morePerfex CRM Parameter Clients.php cross site scripting5.3 Medium
- autocmsAutoCMS robot.php cross site scripting6.9 Medium
- composiocomposiohq composio api.py path path traversal5.1 Medium
- composiocomposiohq composio calculator.py Calculator code injection5.1 Medium
pocoOSS-FuzzUse-of-uninitialized-value in Poco::Dynamic::Var::~VarNo score- opendaylight aaa, authentication\, authorization and accounting +1 moreOpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability7.5 High
- opendaylight md-sal, model-driven service abstraction layer +1 moreOpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries6.5 Medium
- sitecore experience commerce, experience manager, experience platform +2 moreAn issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and...7.5 High
- mispapp/Controller/UserLoginProfilesController.php in MISP before 2.4.198 does not prevent an org...4.9 Medium
- aimhubio aimaimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scripting5.3 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization6.9 Medium
- hamid-alinia-idehweb login with phone number, glboy otp login with phone number, otp verification +1 moreLogin with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation8.8 High
httpdTuxCare,httpd-develTuxCare,httpd-manualTuxCare +5 more +7 moreUpdate of httpdNo score- bricks builder bricksBricks <= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting5.4 Medium
- murgroland wp booking system – booking calendar, wpbookingsystem wp booking system +1 moreWP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting6.1 Medium
- softaculous backuply, backuply – backup, restore, migrate and clone +1 moreBackuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection9.1 Critical
- tecno com.afmobi.boomplayerImproper permission configurationDomain configuration vulnerability of the mobile application ...9.8 Critical
- xootix waitlist woocommerce ( back in stock notifier ), waitlist woocommerce +1 moreWaitlist Woocommerce ( Back in stock notifier ) <= 2.7.5 - Reflected Cross-Site Scripting6.1 Medium
- webliberty simple spoilerSimple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft buddyforms, post form registration form profile form for user profiles and content forms +2 morePost Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation8.8 High
- linuxx86/sev: Make enc_dec_hypercall() accept a size instead of npages9.3 Critical
- linux, linux kernel +1 moresctp: fix a potential overflow in sctp_ifwdtsn_skip8.2 High
- linux, linux kernel +1 moresctp: check send stream number after wait_for_sndbuf5.5 Medium
- linux, linux kernel +1 morexfrm: add NULL check in xfrm_update_ae_params5.5 Medium
- linux, linux kernel +1 morescsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress7.8 High
- linux, linux kernel +1 morescsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress7.8 High
- linux, linux kernel +1 morevc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF7.8 High
- linux, linux kernel +1 morewriteback: avoid use-after-free after removing device7.8 High
- red hat ansible automation platform execution environments, discovery 1 for rhel 9, ansible automation platform 2.4 for rhel 8 +7 more +9 moreAnsible-core: exposure of sensitive information in ansible vault files due to improper logging5.5 Medium
- realmag777 fox – currency switcher professional for woocommerce, pluginus fox - currency switcher professional for woocommerce, realmag777 fox-currency switcher professional +2 moreFOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- ankitpokhrel woocommerce multiple free giftWooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding5.3 Medium
- linuxnvmet-tcp: add bounds check on Transfer Tag9.8 Critical
- linux, linux kernel +1 moretty: n_gsm: fix deadlock and link starvation in outgoing data path5.5 Medium
- Show moreLoading…