CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- oceanic software valeappStored XSS in Oceanic Software's ValeApp7.2 High
- kalvingit kvf-adminkalvinGit kvf-admin FileUploadKit.java fileUpload unrestricted upload5.1 Medium
- oceanic software valeappImproper Access Control in Oceanic Software's ValeApp8.8 High
- oceanic software valeappSession Hijacking in Oceanic Software's ValeApp9.3 Critical
- oceanic software valeappCleartext Storage of Sensitive Information in Oceanic Software's ValeApp9.3 Critical
- funnyzpc mee-adminfunnyzpc Mee-Admin User Center index cross site scripting5.1 Medium
- huankemao scrmHuankeMao SCRM Administrator Backend WxkConfig.php upload_domain_verification_file unrestricted upload5.1 Medium
- langflowLangflow HTTP POST Request utils.py redos5.1 Medium
- tmsoft myauth gateway, myauthgateway +1 moreTMsoft MyAuth Gateway index.php cross site scripting5.3 Medium
- jeanmarc77 123solarjeanmarc77 123solar admin_invt2.php file inclusion5.3 Medium
- huawei emui, harmonyos +1 moreAccess permission verification vulnerability in the App Multiplier module Impact: Successful...6.7 Medium
- huawei emui, harmonyos +1 moreAccess permission verification vulnerability in the input method framework module Impact:...4.4 Medium
- huawei emui, harmonyos +1 moreOut-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this...4.7 Medium
- huawei emui, harmonyos +1 morePath traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this...6.2 Medium
- huawei emui, harmonyos +1 morePermission vulnerability in the ActivityManagerService (AMS) module Impact: Successful...5.6 Medium
- huawei emui, harmonyos +1 moreInput validation vulnerability in the USB service module Impact: Successful exploitation of this...5.5 Medium
- eclipse dataspace componentsEDC DataSetResolver policy filtering missing5.3 Medium
- media fusion co.,ltd. mf teacher performance management systemCross-site scripting vulnerability exists in MF Teacher Performance Management System version 6....6.1 Medium
- eset, spol. s r.o. eset cyber security, eset endpoint security for macos +1 moreDenial of Service vulnerability in ESET products for macOS6.8 Medium
- stellarwp the events calendarThe Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting7.2 High
- tomtretbar mikrotikLack of TLS validation in plugin MikroTik on Checkmk Exchange4.9 Medium
- google android, unisoc t820, unisoc (shanghai) technologies co., ltd. sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000 +2 moreIn Logmanager service, there is a possible missing verification incorrect input. This could lead...6.5 Medium
- google android, unisoc (shanghai) technologies co., ltd. t606/t612/t616/t610/t618/t760/t770/t820/s8000 +1 moreIn drm service, there is a possible out of bounds read due to a missing bounds check. This could...6.2 Medium
- google android, unisoc (shanghai) technologies co., ltd. t606/t612/t616/t610/t618/t760/t770/t820/s8000 +1 moreIn drm service, there is a possible out of bounds write due to a missing bounds check. This could...6.2 Medium
- eset endpoint antivirus, safe server, small business security +14 more +16 moreLocal privilege escalation in ESET products for Windows8.5 High
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget6.4 Medium
- hyumika openstreetmap, mika osm – openstreetmap +1 moreOSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes6.4 Medium
- fastlinemedia beaver builder, beaverbuilder beaver builder page builder – drag and drop website builder +1 moreBeaver Builder – WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module6.4 Medium
- freeimage project freeimageFreeimage: heap buffer overflow in tiff_read_iptc_profile7.5 High
- ays-pro ai chatbot with chatgpt and content generator by ays, ai chatbot with chatgpt, chatgpt assistant +2 moreAI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls7.5 High
- ays-pro ai chatbot with chatgpt and content generator by ays, ai chatbot with chatgpt, chatgpt assistant +2 moreAI Chatbot with ChatGPT by AYS <= 2.0.9 - Unauthenticated OpenAI Key Disclosure7.5 High
- piwebsolution product enquiry for woocommerce, rajeshsingh520 piweb product enquiry or product catalog for woocommerce +1 moreProduct Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php8.8 High
- givewp, stellarwp givewp – donation plugin and fundraising platform +1 moreGiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter7.2 High
- code supply co. absolute reviewsAbsolute Reviews <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name6.4 Medium
- sharp display solutions, ltd. np-ca4120x, np-ca4160w, np-ca4160x +146 more +148 moreSharp NEC Projectors (NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG,...6.5 Medium
tryton-serverDebiantryton-server - security updateNo score- phpPHP-FPM logs from children may be altered3.3 Low
- phpcgi.force_redirect configuration is bypassable due to the environment variable collision7.5 High
- phpErroneous parsing of multipart form data3.1 Low
- codeastro membership management systemCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter ...8.6 High
- codeastro membership management systemThe Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes...7.5 High
- codeastro membership management systemCross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers...6.1 Medium
- honeywell iq3xcite firmwareA cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05...6.1 Medium
- kacins ypayAn arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code...8.8 High
- webkul krayin crmA Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote...9.6 Critical
- webkul krayin crmA Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote...8.8 High
- piwigoAn authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to...4.8 Medium
- modstart modstartcms, mostartcms +1 moreModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect...7.2 High
- jc21 nginx proxy managerA Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2...6.3 Medium
- jc21 nginx proxy managerA Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an...9.8 Critical
- Show moreLoading…