CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- clinical-genomics scoutScout contains an Open Redirect on Login via `next`5.4 Medium
- expressjs basic-auth-connectbasic-auth-connect's callback uses time unsafe string comparison8.7 High
- cvat computer vision annotation tool, cvat-ai cvat +1 moreComputer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints5.4 Medium
- cvat computer vision annotation tool, cvat-ai cvat +1 moreComputer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints6.3 Medium
- cvat computer vision annotation tool, cvat-ai cvat +1 moreComputer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint6.2 Medium
- mantisbtMantisBT vulnerable to information disclosure with user profiles5.3 Medium
- vercom s.a. redlink sdkCross Application Scripting in Redlink SDK4.3 Medium
- muhammad shakeel confetti fall animationWordPress Confetti Fall Animation plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- apache lucene replicatorApache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue5.1 Medium
- parisneo lollms-webui, parisneo/lollms-webui, lollms web ui +2 moreLocal File Inclusion in parisneo/lollms-webui7.5 High
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +2 more +4 morePLANET Technology switch devices - Cleartext storage of SNMPv3 users' passwords7.2 High
- techno support company smart-tab android appSmart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of...2.4 Low
- techno support company smart-tab android app, android app smart tab +1 moreSmart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability...6.8 Medium
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +2 more +4 morePLANET Technology switch devices - Cross-site Request Forgery8.8 High
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - Stored cross-site scripting (XSS) in the User Management4.8 Medium
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +2 more +4 morePLANET Technology switch devices - Missing Authentication for multiple HTTP routes9.8 Critical
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, igs-5225-4up1t2s firmware +4 more +6 morePLANET Technology switch devices - Swctrl service exchanges weakly encoded passwords8.1 High
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +3 more +5 morePLANET Technology switch devices - Swctrl service DoS attack5.3 Medium
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - Weak hash for users' passwords4.9 Medium
- eclipse glassfishGlassfish redirect to untrusted site6.9 Medium
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - Insecure hash functions used for SNMPv3 credentials7.5 High
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - SSH server DoS attack7.5 High
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +1 more +3 morePLANET Technology switch devices - Hard-coded SNMPv1 read-write community string8.6 High
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +2 more +4 morePLANET Technology switch devices - Local users' passwords recovery through hard-coded credentials6.8 Medium
- planet gs-4210-24p2s firmware, gs-4210-24pl4c firmware, planet technology gs-4210-24p2s hardware 3.0 +2 more +4 morePLANET Technology switch devices - Remote privilege escalation using hard-coded credentials8.8 High
- dotcamp ultimate blocks, ultimate blocks blocks, ultimateblocks +2 moreUltimate Blocks < 3.2.2 - Contributor+ Stored XSS5.4 Medium
- stylemix cost calculator builderCost Calculator Builder < 3.2.29 - Admin+ SQL Injection7.2 High
- 10web slider, unknown slider by 10web +1 moreSlider by 10Web < 1.2.59 - Admin+ Stored XSS4.8 Medium
- squirrly starboxStarbox < 3.5.3 - Contributor+ Stored XSS5.4 Medium
- post grid team by radiustheme the post gridThe Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation4.8 Medium
libjpeg-turboOSS-FuzzUse-of-uninitialized-value in decompress_yuv.ccNo scorelibultrahdrOSS-FuzzUse-of-uninitialized-value in format_messageNo scoredebian-security-supportDebiandebian-security-support - updateNo score- No product listedAn issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows...5.9 Medium
- tplink kasa kp125mAn issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows...7.6 High
- tplink kasa kp125m, tapo p125m +1 moreTP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates,...6.3 Medium
- emlog, emlog pro project pro +1 moreA remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before...6.3 Medium
- loadzilla loadlogicLoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitrary code via the LogicLoadEc2DeployLambda and CredsGenFuncti…7.5 High
- esafenet cdgESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in...7.6 High
- metronicA reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard...4.8 Medium
- tp-link tl-wr941nd, wr941nd firmware +1 moreTP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm...8.0 High
- online medicine ordering system project medicine ordering system, oretnom23 online medicine ordering system +1 moreSourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control....9.8 Critical
- pix-link lv-wr22PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service...8.8 High
- giflib project giflibGiflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.6.5 Medium
- solvaitA Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to...5.4 Medium
- nintendo mario kart 8In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows...6.3 Medium
- No product listedAn issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web...10.0 Critical
- No product listedAn Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0...4.3 Medium
- infinera hit 7300, nokia hit 7300 firmware +1 moreAn issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the ...8.4 High
- infinera hit 7300, nokia hit 7300 firmware +1 moreAn issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local...8.8 High
- Show moreLoading…