CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page4.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore...4.3 Medium
- ivanti cloud services appliance (csa), csa (cloud services appliance), endpoint manager cloud services appliance +2 morePath Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to...9.4 Critical
- microsoft office, visio, 365 apps +5 more +7 moreMicrosoft Office Visio Remote Code Execution Vulnerability7.8 High
- netcat cms, content management system +1 moreNetcat CMS: multiple reflected cross-site scripting vulnerabilities in netshop module5.9 Medium
- netcat cms, content management system +1 moreNetcat CMS: reflected cross-site scripting in openstat module5.9 Medium
- netcat, netcat cms, content management system +2 moreNetcat CMS: user enumeration6.9 Medium
- zitadelUnauthorized Access After Organization or Project Deactivation in Zitadel4.3 Medium
- zitadelService Users Deactivation not Working in Zitadel8.1 High
- zitadelUser Grant Deactivation not Working in Zitadel7.3 High
- kastle systems access control system, kastle access control system firmware +1 moreCleartext Storage of Sensitive Information in Kastle Systems Access Control System8.7 High
- kastle systems access control system, kastle access control system firmware +1 moreUse of Hard-coded Credentials in Kastle Systems Access Control System9.2 Critical
- google reverbObject deserialization in Reverb leading to RCE5.7 Medium
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +13 more +15 moreKeycloak: vulnerable redirect uri validation results in open redirec6.1 Medium
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +8 more +10 moreKeycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak7.7 High
- dassault systèmes 3dswymer, dassault 3dswymer 3dexperience 2022, 3dswymer 3dexperience 2023 +1 more +3 moreStored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x8.7 High
- dassault systèmes enovia collaborative industry innovator, 3ds 3dexperience enovia +1 moreReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x8.7 High
- gematik app-referencevalidator, reference validator +1 moreXML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidator8.6 High
- antfin sofa-hessianRemote Command Execution(RCE) Vulnerbility in sofa-hessian9.8 Critical
- traefikHTTP client can remove the X-Forwarded headers in Traefik9.8 Critical
- dragonflyoss dragonfly2, linuxfoundation dragonfly +1 moreDragonfly2 vulnerable to hard coded cyptographic key9.8 Critical
kernel-livepatch-SLE15-SP6-RT_Update_3SUSE,kernel-rtopenSUSE,kernel-rt_debugopenSUSE +2 more +4 moreSecurity update for the Linux KernelNo scorekernel-livepatch-SLE15-SP5-RT_Update_20SUSE,kernel-rtopenSUSE,kernel-rt_debugopenSUSE +2 more +4 moreSecurity update for the Linux KernelNo score- ece software electronic ticket systemReflected XSS in Ece Software's Electronic Ticket System9.3 Critical
- grafana-plugin-sdk-go grafana plugin sdkInformation Leakage in grafana-plugin-sdk-go9.1 Critical
- qemu, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreQemu-kvm: usb: assertion failure in usb_ep_get()5.5 Medium
- apex softcell ld geo, apexsoftcell ld dp back office +1 moreUnauthorized Transaction Manipulation Vulnerability8.7 High
- apex softcell ld geo, apexsoftcell ld dp back office +1 moreUser Enumeration vulnerability9.3 Critical
- apex softcell ld geo, apexsoftcell ld dp back office +1 moreInformation Disclosure Vulnerability8.7 High
- apex softcell ld dp back office, apexsoftcell ld geo +1 moreOTP Bypass Vulnerability8.7 High
- apex softcell ld dp back office, apexsoftcell ld geo +1 moreParameter Manipulation Vulnerability8.7 High
- don benjamin wp custom fields searchWP Custom Fields Search <= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcode6.4 Medium
- devfelixmoira limit login attempts plus, limit login attempts project login attempts plus, devfelixmoira limit login attempts plus – wordpress limit login attempts by felix +2 moreLimit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypass5.3 Medium
- dvankooten mc4wp: mailchimp for wordpress, ibericode mailchimp +1 moreMC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting6.1 Medium
- google protobuf, protocol buffers, google-protobuf [jruby gem] +8 more +10 moreStack overflow in Protocol Buffers Java Lite8.7 High
apache-commons-configurationOSS-FuzzSecurity exception in java.xml/com.sun.org.apache.xalan.internal.xsltc.trax.DOM2TO.parseNo scorellamacppOSS-FuzzUNKNOWN READ in ggml_freeNo score- langchain experimental, langchain-experimental +1 moreLangChain Experimental Eval Injection vulnerability9.8 Critical
- frogcms project frogcmsFrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add8.8 High
- linlinjava litemallA SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain...7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +12 more +14 morePcp: pmpost symlink attack allows escalating pcp to root user4.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +12 more +14 morePcp: pmcd heap corruption through metric pmstore operations5.5 Medium
- pixlone logiopslogiops through 0.3.4, in its default configuration, allows any unprivileged user to configure...8.5 High
- closed-loop cless serverAn arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology...9.8 Critical
- ergophone tiptel ip 286 firmware, yealink sip-t28p firmware +1 moreDirectory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10...9.9 Critical
- freeimage project freeimagelibfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM...9.8 Critical
- couchbase serverCouchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP...6.1 Medium
- brave android browserIn Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right...7.5 High
- acquia mauticInsufficient authentication in upgrade flow7.8 High
- Show moreLoading…