CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- linux, linux kernel +1 moreACPICA: Avoid undefined behavior: applying zero offset to null pointer5.5 Medium
- linux, linux kernel +1 moremd/raid10: prevent soft lockup while flush writes5.5 Medium
- linux, linux kernel +1 morescsi: qla2xxx: Pointer may be dereferenced5.5 Medium
- linux, linux kernel +1 moreigb: Fix igb_down hung on surprise removal7.8 High
- linux, linux kernel +1 morescsi: core: Remove the /proc/scsi/${proc_name} directory earlier5.5 Medium
- linux, linux kernel +1 morebnxt_en: Avoid order-5 memory allocation for TPA data5.5 Medium
- linuxext4: fix bug_on in __es_tree_search caused by bad quota inode7.1 High
- linuxext4: fix bug_on in __es_tree_search caused by bad boot loader inode7.8 High
- linux, linux kernel +1 moreext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode5.5 Medium
- linux, linux kernel +1 moreext4: init quota for 'old.inode' in 'ext4_rename'5.5 Medium
- linux, linux kernel +1 moreext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline7.8 High
- linux, linux kernel +1 moreBluetooth: L2CAP: Fix u8 overflow5.5 Medium
- hahncgdev wp easy gallery – wordpress gallery plugin, plugingarden wp easy gallery +1 moreWP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection9.9 Critical
- hahncgdev wp easy gallery – wordpress gallery plugin, plugingarden wp easy gallery +1 moreWP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation4.3 Medium
- boldgrid w3 total cacheW3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext3.7 Low
- apache linkis, apache software foundation linkis spark engineconn +1 moreApache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability7.5 High
- proxmox virtual environment, libpve-common-perl (promox mail gateway 8), libpve-common-perl (promox ve 8) +5 more +7 moreProxmox Virtual Environment is an open-source server management platform for enterprise...8.2 High
- haibasoft thanh toán quét mã qr code tự động – momo, viettelpay, vnpay và 40 ngân hàng việt nam, wordpress thanh toan quet ma qr code tu dong +1 moreThanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- gcsdesign wp category dropdown, cguntur category dropdown by gcs design +1 moreWP Category Dropdown <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter6.4 Medium
- shakeelu confetti fall animationConfetti Fall Animation <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcode6.4 Medium
- princeahmed radio player – live shoutcast, icecast and any audio stream player, softlabbd radio player +1 moreRadio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute6.4 Medium
- anwp football leagues, anwppro anwp football leagues +1 moreAnWP Football Leagues <= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- mailoptin, properfraction mailoptin – popup, optin forms & email newsletters for mailchimp, hubspot, aweber etc. +1 morePopup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserialization7.2 High
- codecanyon wooevents, ex-themes wooevents - calendar and event booking +1 moreWooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite9.1 Critical
- realmag777 mdtf – meta data and taxonomies filter, pluginus wordpress meta data and taxonomies filter +1 moreMDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- ba-booking ba book everythingBA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset5.3 Medium
- realmag777 mdtf – meta data and taxonomies filter, pluginus wordpress meta data and taxonomies filter +1 moreMDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection9.9 Critical
- wpcharitable charitable, smub charitable – donation plugin for wordpress – fundraising with recurring donations & more +1 moreDonation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation9.8 Critical
- linux, linux kernel +1 moreALSA: pcm: Fix races among concurrent hw_params and hw_free calls7.8 High
- castos seriously simple statsSeriously Simple Stats <= 1.6.0 - Reflected Cross-Site Scripting6.1 Medium
- fatcatapps pixel cat – conversion pixel manager, pixel cat +1 morePixel Cat – Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting6.1 Medium
- ba-booking ba book everythingBA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover8.8 High
- ibericode koko analytics, dvankooten koko analytics – privacy friendly statistics for wordpress +1 moreKoko Analytics <= 1.3.12 - Reflected Cross-Site Scripting6.1 Medium
- xplodedthemes xt ajax add to cart for woocommerceXT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site Scripting6.1 Medium
- chief gnome garden gnome packageGarden Gnome Package <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webba-booking webba booking, webba-agency easy appointment booking & scheduling system – webba booking calendar +1 moreAppointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update4.3 Medium
- zyxel vmg8825-t50k firmware, ax7501-b1 firmware, dx3300-t0 firmware +38 more +40 moreAn improper restriction of operations within the bounds of a memory buffer in the USB file...4.9 Medium
- zyxel vmg8825-t50k firmware, ax7501-b1 firmware, dx3300-t0 firmware +38 more +40 moreAn improper restriction of operations within the bounds of a memory buffer in the MAC address...4.9 Medium
- zyxel vmg8825-t50k firmware, ax7501-b1 firmware, dx3300-t0 firmware +38 more +40 moreAn improper restriction of operations within the bounds of a memory buffer in the IPv6 address...4.9 Medium
- zyxel vmg8825-t50k firmware, ax7501-b0 firmware, ax7501-b1 firmware +39 more +41 moreAn improper restriction of operations within the bounds of a memory buffer in the parameter type...4.9 Medium
graphql-javaOSS-FuzzSecurity exception in graphql.schema.GraphQLTypeUtil.simplePrintNo scorecheckstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo scoremrubyOSS-FuzzSegv on unknown address in udivNo score- rocket.chatRocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the...5.4 Medium
- mellium xmppMellium allows Authentication Bypass by Spoofing9.8 Critical
- rocketchat rocket.chatRocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message...7.5 High
- rocket.chatDenial of service in rocket chat message parser7.5 High
- rocket.chatRocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based...6.1 Medium
- icecms project icecmsIceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to...9.8 Critical
- Show moreLoading…