CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- thecosy icecmsAn access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users'...7.5 High
- icecms project icecmsAn access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and...7.5 High
- thecosy icecmsIncorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering...7.6 High
- kashipara music management systemAn Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in...9.8 Critical
- cs-cart multivendorDirectory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run...7.2 High
- cs-cart multivendorFile Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary...8.8 High
- cs-cart multivendorAn issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user...9.8 Critical
- cs-cart multivendorCross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to...5.4 Medium
- cs-cart multivendorDirectory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain...8.8 High
- cs-cart multivendorFile Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary...9.8 Critical
- google chromeInsufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote...8.8 High
camaleon_cmsRubyGemsCamaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)4.8 Medium- google chromeUse after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to...8.8 High
- google chromeInsufficient data validation in PDF in Google Chrome prior to 73.0.3683.75 allowed a remote...7.8 High
- github enterprise serverAn improper privilege management vulnerability allowed arbitrary workflows to be committed using...6.2 Medium
- github enterprise serverA Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of...5.8 Medium
- planet fitness workouts, planetfitness planet fitness workouts +1 morePlanet Fitness Workouts mobile apps do not properly validate TLS certificates8.7 High
- purestorage flasharray, flashblade, purity\/\/fa +1 more +3 moreA condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute...9.1 Critical
- purestorage flasharray, purity\/\/fa +1 moreA condition exists in FlashArray Purity whereby an user with array admin role can execute...9.1 Critical
- purestorage flasharray, purity\/\/fa +1 moreA condition exists in FlashArray Purity whereby a malicious user could use a remote...9.1 Critical
- purestorage flasharray, purity\/\/fa +1 moreA condition exists in FlashArray Purity whereby an attacker can employ a privileged account...10.0 Critical
- pure storage flasharray, purestorage purity\/\/fa +1 moreA condition exists in FlashArray Purity whereby a local account intended for initial array...10.0 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreOAuth2 client id and secret exposed through the web browser in pgAdmin 49.9 Critical
- rollupDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS6.1 Medium
- lobehub lobe chat, lobe-chat +1 moreLobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)9.0 Critical
- dataeaseDataEase's H2 datasource has a remote command execution risk9.8 Critical
- dataeaseDataEase has an XXE vulnerability7.5 High
- sony xav-ax5500, xav-ax5500 firmware +1 moreSony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability6.8 Medium
- sony xav-ax5500, xav-ax5500 firmware +1 moreSony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability6.8 Medium
- sony xav-ax5500Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- sony xav-ax5500Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability6.8 Medium
- exnet informatics software ferry reservation systemReflected XSS in Exnet Informatics Software's Ferry Reservation System8.8 High
- exnet informatics software ferry reservation systemSQLi in Exnet Informatics Software's Ferry Reservation System9.3 Critical
- apache tomcat connectors, debian linux +1 moreApache Tomcat Connectors: mod_jk: local users can view and modify configuration5.9 Medium
- linux, linux kernel +1 moremedia: vivid: fix compose size exceed boundary7.8 High
- acronis cyber protect cloud agentLocal active protection service settings manipulation due to unnecessary privileges assignment....4.7 Medium
- xiaomi router ax9000, mi ax9000 firmware +1 moreXiaomi Router AX9000 has a post-authorization command injection vulnerability6.4 Medium
- checkmkFix 2FA bypass via RestAPI9.2 Critical
- expresstech quiz and survey master, unknown quiz and survey master (qsm) +1 moreQuiz and Survey Master (QSM) < 9.1.3 - Author+ Stored XSS4.8 Medium
- unknown yith woocommerce ajax searchYITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSS5.4 Medium
- code-projects blood bank systemcode-projects Blood Bank System o-.php sql injection5.3 Medium
firefoxUbuntufirefox regressionsNo score- sourcecodester profile registration without reload refresh, rems profile registration without reload\/refresh +1 moreSourceCodester Profile Registration without Reload Refresh GET Parameter del.php sql injection5.3 Medium
- sourcecodester profile registration without reload refresh, rems profile registration without reload\/refresh +1 moreSourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scripting5.3 Medium
- peter hardy-vandoorn maintenance redirectWordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability3.7 Low
- wpwax product carousel slider & grid ultimate for woocommerceWordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerability6.5 Medium
- elementskit pro, wpmet elementskit, elementskit pro +2 moreWordPress ElementsKit Pro plugin <= 3.6.0 - Local File Inclusion vulnerability6.5 Medium
- code-projects student record systemcode-projects Student Record System index.php sql injection6.9 Medium
- iredmail iredadminiRedAdmin before 2.6 allows XSS, e.g., via order_name.6.1 Medium
- myoffice my office sdkNew Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via...9.8 Critical
- Show moreLoading…