CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- enpass password managerEnpass Password Manager sensitive information in memory2.0 Low
- atelmo atemio am 520 hd full hd satellite receiver, atemio am 520 hd firmware +1 moreOS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver9.3 Critical
- aimeos ai-controller-frontend, frontend controller +1 moreaimeos/ai-controller-frontend has IDOR vulnerability in account profile page5.3 Medium
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 moreEmail Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Expos…4.3 Medium
- ovirt ovirt-engine, red hat virtualization 4 +1 moreOvirt-engine: potential exposure of cleartext provider passwords via web ui4.9 Medium
- ibm cloud pak for multicloud management, cloud pak for multicloud management monitoring +1 moreIBM ManageIQ command execution7.2 High
- mattermost, mattermost server +1 moreInsufficient Authorization On Unlinked Channel Files4.3 Medium
- hcl software traveler for microsoft outlook, hcltech traveler +1 moreHCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability6.7 Medium
- mahodder themedy toolbox, themedy toolbox +1 moreThemedy Toolbox <= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- ibm cognos command centerIBM Cognos Command Center information disclosure4.3 Medium
- ibm cloud pak for multicloud management, cloud pak for multicloud management monitoring +1 moreIBM Cloud Pak for Multicloud Management information disclosure4.4 Medium
- national keep cyber security services cybermathIncorrect Authorization in National Keep's CyberMath8.2 High
- national keep cyber security services cybermathDirectory Traversal in National Keep's CyberMath6.8 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builder, form maker +1 moreForm Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Upload6.8 Medium
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale7.2 High
- advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 moreAdvanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload7.5 High
ca-certificatesUbuntuca-certificates updateNo score- clibo manager manager, clibomanager clibo manager +1 moreRate limit vulnerability in Clibo Manager5.8 Medium
- clibo manager manager, clibomanager clibo manager +1 moreStored Cross-Site Scripting vulnerability in Clibo Manager7.6 High
- nitinmaurya wordpress visitorsWordPress Visitors <= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header7.2 High
- mapplic, sekler mapplic lite +1 moreMapplic Lite <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- chetanvaghela common tools for siteCommon Tools for Site <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- alefypf gf custom styleGF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- codecabin super testimonialsSuper Testimonials <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter6.4 Medium
- kingblack king ieking_IE <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- phillip dane joy of text liteWordPress Joy Of Text Lite plugin <= 2.3.1 - Broken Access Control vulnerability4.3 Medium
- nippon telegraph and telephone east corporation hikari denwa router pr-400mi, hikari denwa router rt-400mi, hikari denwa router rv-440mi +5 more +7 moreMultiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST...5.3 Medium
- codesupply sight, codesupplyco sight – professional image gallery and portfolio, sight professional image gallery and portfolio +2 moreSight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title5.3 Medium
- bizswoop store hours for woocommerceStore Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site Scripting6.1 Medium
- mattermost, mattermost server +1 moreDoS via non-string message using permalink embed3.1 Low
- mattermost, mattermost server +1 moreUnauthorized access on archived channels5.4 Medium
- mattermost, mattermost server +1 moreWeak SSRF Filtering3.1 Low
- mattermost, mattermost server +1 moreUnauthorized access on archived channels via file links3.1 Low
- apache maven archetype, apache software foundation maven archetype plugin +1 moreMaven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials7.5 High
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- gitlabIncorrect Synchronization in GitLab5.5 Medium
- contact form 7 captcha project form 7 math captcha, dotsquares contact form 7 math captcha +1 moreContact Form 7 Math Captcha <= 2.0.1 - Reflected XSS6.1 Medium
- nvidia container toolkit, gpu operator +1 moreNVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system4.1 Medium
- nvidia container toolkit, gpu operator +1 moreNVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability9.0 Critical
- artbees jupiter x coreJupiter X Core <= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover8.1 High
- artbees jupiter x coreJupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload9.8 Critical
- planex cs-qr10 firmware, cs-qr20 firmware, cs-qr220 firmware +7 more +9 moreCross-site scripting vulnerability exists in the web management page of PLANEX COMMUNICATIONS...6.1 Medium
- planex mzk-dp300n firmware, planex communications inc. mzk-dp300n +1 moreMZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability....6.5 Medium
- synology active backup for business agentMissing authentication for critical function vulnerability in proxy settings functionality in...5.5 Medium
- synology active backup for business agentMissing encryption of sensitive data vulnerability in settings functionality in Synology Active...5.0 Medium
- synology active backup for business agentMissing authentication for critical function vulnerability in logout functionality in Synology...4.0 Medium
- synology active backup for business agentMissing encryption of sensitive data vulnerability in login component in Synology Active Backup...5.3 Medium
- synology drive clientBuffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup...4.4 Medium
- synology drive clientBuffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in...4.4 Medium
- Show moreLoading…