CVEs published September 2, 2024
76 CVEs were published on September 2, 2024: 5 critical, 41 high.
- Published
- 76
- Critical
- 5
- High
- 41
- Medium
- 25
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Qualcomm Snapdragon
- 21
- OpenHarmony
- 8
- Huachu Digital Technology Easytest Online Test Platform
- 6
- Dassault Systèmes 3DSwymer
- 3
- NAC Telecommunication Systems NACPremium
- 3
- Flaming Forms
- 2
- MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- 2
- MediaTek MT6765, MT6768, MT6779, MT6785, MT8385, MT8666, MT…
- 2
- overleaf
- 2
- actions toolkit · @actions/artifact
- 1
Critical 5
- CVE-2024-6919SQLi in NAC Telecommunication's NACPremiumNAC Telecommunication Systems NACPremium
- CVE-2024-43773Huachu Easytest Online Learning Test Platform - SQL InjectionHuachu Digital Technology Easytest Online Test Platform
- CVE-2024-43772Huachu Easytest Online Learning Test Platform - SQL InjectionHuachu Digital Technology Easytest Online Test Platform
- CVE-2024-45622ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass
- CVE-2024-45623D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP
High 41
- CVE-2024-1621uniFLOW Online device registration susceptible to compromiseNT-ware uniFLOW Online
- CVE-2024-45311Denial of service in quinn-proto when using `Endpoint::retry()`quinn-rs quinn · quinn-proto
- CVE-2024-42471Arbitrary File Write via artifact extraction in actions/artifactactions toolkit · @actions/artifact
- CVE-2024-28100Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftwelabftw
- CVE-2024-45388Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)SpectoLabs hoverfly · github.com/SpectoLabs/hoverfly
- CVE-2024-6921Cleartext Username and Password in NAC Telecommunication's NACPremiumNAC Telecommunication Systems NACPremium
- CVE-2024-8004Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2024-7939Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-7938Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-7932Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-5148Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificategnome-remote-desktop · Red Hat Enterprise Linux
- CVE-2024-38402Use After Free in DSP ServicesQualcomm Snapdragon
- CVE-2024-38401Use After Free in Qualcomm IPCQualcomm Snapdragon
- CVE-2024-33060Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2024-33057Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-33054Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer VisionQualcomm Snapdragon
- CVE-2024-33052Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM HostQualcomm Snapdragon
- CVE-2024-33051Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2024-33050Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-33048Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33047Buffer Over-read in DisplayQualcomm Snapdragon
- CVE-2024-33045Return of Stack Variable Address in BusesQualcomm Snapdragon
- CVE-2024-33042Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM HostQualcomm Snapdragon
- CVE-2024-33038Untrusted Pointer Dereference in Computer VisionQualcomm Snapdragon
- CVE-2024-33035Integer Overflow or Wraparound in DisplayQualcomm Snapdragon
- CVE-2024-23365Use After Free in SCE-MinkQualcomm Snapdragon
- CVE-2024-23364Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2024-23362Improper Input Validation in Trusted Execution EnvironmentQualcomm Snapdragon
- CVE-2024-23359Buffer Over-read in Multi Mode Call ProcessorQualcomm Snapdragon
- CVE-2024-23358Buffer Over-read in Multi Mode Call ProcessorQualcomm Snapdragon
- CVE-2024-43776Huachu Easytest Online Learning Test Platform - SQL InjectionHuachu Digital Technology Easytest Online Test Platform
- CVE-2024-43775Huachu Easytest Online Learning Test Platform - SQL InjectionHuachu Digital Technology Easytest Online Test Platform
- CVE-2024-43774Huachu Easytest Online Learning Test Platform - SQL InjectionHuachu Digital Technology Easytest Online Test Platform
- CVE-2024-7871Huachu Easytest Online Learning Test Platform - SQL InjectionHuachu Digital Technology Easytest Online Test Platform
- CVE-2024-41160Liteos-A has an use after free vulnerabilityOpenHarmony
- CVE-2024-41157Liteos-A has an use after free vulnerabilityOpenHarmony
- CVE-2024-39816Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-38386Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-20089In wlan, there is a possible denial of service due to incorrect error handling.MediaTek MT6835, MT6878, MT6886, MT6897, MT6980, MT6985, MT…
- CVE-2024-20087In vdec, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6779, MT6785, MT8385, MT8666, MT…
- CVE-2024-20086In vdec, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6765, MT6768, MT6779, MT6785, MT8385, MT8666, MT…
Medium, low and unrated 30
- CVE-2024-44947fuse: Initialize beyond-EOF page contents before setting uptodateLinux
- CVE-2024-45313Insecure default setting for Server Pro installed via Overleaf toolkitoverleaf
- CVE-2024-45312Arbitrary language parameter can passed to `aspell` executable via spelling requests in overleafoverleaf
- CVE-2024-45308MySQL & free URL mode allows to hide existing notes in hedgedochedgedoc
- CVE-2024-45306heap-buffer-overflow in Vimvim
- CVE-2024-45305gix-path uses local config across repos when it is the highest scopeByron gitoxide · gix-path
- CVE-2024-43801Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfinjellyfin
- CVE-2024-43797Path Traversal in audiobookshelfadvplyr audiobookshelf
- CVE-2024-43792Halo's editor has a stored Cross-Site Scripting vulnerabilityhalo-dev halo
- CVE-2020-36830nescalante urlregex Backtracking index.js redosnescalante urlregex · urlregex
- CVE-2023-7279Secure Systems Engineering Connaisseur Delegation Name targets_schema.json redosSecure Systems Engineering Connaisseur
- CVE-2024-6920Stored XSS in NAC Telecommunication's NACPremiumNAC Telecommunication Systems NACPremium
- CVE-2024-33043Buffer Over-read in FM HostQualcomm Snapdragon
- CVE-2024-33016Improper Restriction of Operations within the Bounds of a Memory Buffer in StorageQualcomm Snapdragon
- CVE-2024-38858Cross-site scripting in Robotmk logs viewCheckmk
- CVE-2024-7692Flaming Forms <= 1.0.1 - Reflected XSSFlaming Forms
- CVE-2024-7691Flaming Forms <= 1.0.1 - Unauthenticated Stored XSSFlaming Forms
- CVE-2024-7690DN Popup <= 1.2.2 - Settings Update via CSRFDN Popup
- CVE-2024-7354Ninja Forms 3.8.6-3.8.10 - Reflected XSSNinja Forms
- CVE-2024-39775Net Manager has an out-of-bounds read permission bypass vulnerabilityOpenHarmony
- CVE-2024-39612Background Task Manager has an out-of-bounds read permission bypass vulnerabilityOpenHarmony
- CVE-2024-38382Ability Runtime has an out-of-bounds read permission bypass vulnerabilityOpenHarmony
- CVE-2024-28044Liteos-A has an integer overflow vulnerabilityOpenHarmony
- CVE-2024-20088In keyinstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6765, MT6768, MT6781, MT6833, MT6835, MT6855, MT…
- CVE-2024-20085In power, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-20084In power, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-8365Vault Leaks AppRole Client Tokens And Accessor in Audit LogHashiCorp Vault · github.com/hashicorp/vault
- CVE-2024-45527REDCap 14.7.0 allows HTML injection via the project title of a New Project action.
- CVE-2024-45528CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add_members.php fullname stored XSS.
- CVE-2024-45621The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a s