# CVEs published 2024-09-02

76 CVEs were published on September 2, 2024: 5 critical, 41 high. Days are UTC.

- [CVE-2024-1621](https://cve.now/CVE-2024-1621.md): uniFLOW Online device registration susceptible to compromise (CVSS 8.3, NT-ware uniFLOW Online)
- [CVE-2024-44947](https://cve.now/CVE-2024-44947.md): fuse: Initialize beyond-EOF page contents before setting uptodate (no CVSS, Linux)
- [CVE-2024-45313](https://cve.now/CVE-2024-45313.md): Insecure default setting for Server Pro installed via Overleaf toolkit (CVSS 5.4, overleaf)
- [CVE-2024-45312](https://cve.now/CVE-2024-45312.md): Arbitrary language parameter can passed to \`aspell\` executable via spelling requests in overleaf (CVSS 5.3, overleaf)
- [CVE-2024-45311](https://cve.now/CVE-2024-45311.md): Denial of service in quinn-proto when using \`Endpoint::retry()\` (CVSS 7.5, quinn-rs quinn · quinn-proto)
- [CVE-2024-45308](https://cve.now/CVE-2024-45308.md): MySQL & free URL mode allows to hide existing notes in hedgedoc (CVSS 6.5, hedgedoc)
- [CVE-2024-45306](https://cve.now/CVE-2024-45306.md): heap-buffer-overflow in Vim (CVSS 4.5, vim)
- [CVE-2024-45305](https://cve.now/CVE-2024-45305.md): gix-path uses local config across repos when it is the highest scope (CVSS 2.5, Byron gitoxide · gix-path)
- [CVE-2024-43801](https://cve.now/CVE-2024-43801.md): Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin (CVSS 4.6, jellyfin)
- [CVE-2024-43797](https://cve.now/CVE-2024-43797.md): Path Traversal in audiobookshelf (CVSS 6.3, advplyr audiobookshelf)
- [CVE-2024-43792](https://cve.now/CVE-2024-43792.md): Halo's editor has a stored Cross-Site Scripting vulnerability (CVSS 6.3, halo-dev halo)
- [CVE-2024-42471](https://cve.now/CVE-2024-42471.md): Arbitrary File Write via artifact extraction in actions/artifact (CVSS 7.3, actions toolkit · @actions/artifact)
- [CVE-2024-28100](https://cve.now/CVE-2024-28100.md): Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw (CVSS 8.9, elabftw)
- [CVE-2024-45388](https://cve.now/CVE-2024-45388.md): Arbitrary file read in the \`/api/v2/simulation\` endpoint in hoverfly (\`GHSL-2023-274\`) (CVSS 7.5, SpectoLabs hoverfly · github.com/SpectoLabs/hoverfly)
- [CVE-2020-36830](https://cve.now/CVE-2020-36830.md): nescalante urlregex Backtracking index.js redos (CVSS 5.3, nescalante urlregex · urlregex)
- [CVE-2023-7279](https://cve.now/CVE-2023-7279.md): Secure Systems Engineering Connaisseur Delegation Name targets\_schema.json redos (CVSS 2.1, Secure Systems Engineering Connaisseur)
- [CVE-2024-6921](https://cve.now/CVE-2024-6921.md): Cleartext Username and Password in NAC Telecommunication's NACPremium (CVSS 8.7, NAC Telecommunication Systems NACPremium)
- [CVE-2024-6920](https://cve.now/CVE-2024-6920.md): Stored XSS in NAC Telecommunication's NACPremium (CVSS 4.8, NAC Telecommunication Systems NACPremium)
- [CVE-2024-6919](https://cve.now/CVE-2024-6919.md): SQLi in NAC Telecommunication's NACPremium (CVSS 9.3, NAC Telecommunication Systems NACPremium)
- [CVE-2024-8004](https://cve.now/CVE-2024-8004.md): Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes ENOVIA Collaborative Industry Innovator)
- [CVE-2024-7939](https://cve.now/CVE-2024-7939.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes 3DSwymer)
- [CVE-2024-7938](https://cve.now/CVE-2024-7938.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes 3DSwymer)
- [CVE-2024-7932](https://cve.now/CVE-2024-7932.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x (CVSS 8.7, Dassault Systèmes 3DSwymer)
- [CVE-2024-5148](https://cve.now/CVE-2024-5148.md): Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate (CVSS 7.5, gnome-remote-desktop · Red Hat Enterprise Linux)
- [CVE-2024-38402](https://cve.now/CVE-2024-38402.md): Use After Free in DSP Services (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-38401](https://cve.now/CVE-2024-38401.md): Use After Free in Qualcomm IPC (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-33060](https://cve.now/CVE-2024-33060.md): Use After Free in DSP Service (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33057](https://cve.now/CVE-2024-33057.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33054](https://cve.now/CVE-2024-33054.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-33052](https://cve.now/CVE-2024-33052.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in FM Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-33051](https://cve.now/CVE-2024-33051.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33050](https://cve.now/CVE-2024-33050.md): Buffer Over-read in WLAN Host Communication (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33048](https://cve.now/CVE-2024-33048.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33047](https://cve.now/CVE-2024-33047.md): Buffer Over-read in Display (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33045](https://cve.now/CVE-2024-33045.md): Return of Stack Variable Address in Buses (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33043](https://cve.now/CVE-2024-33043.md): Buffer Over-read in FM Host (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2024-33042](https://cve.now/CVE-2024-33042.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in FM Host (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-33038](https://cve.now/CVE-2024-33038.md): Untrusted Pointer Dereference in Computer Vision (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-33035](https://cve.now/CVE-2024-33035.md): Integer Overflow or Wraparound in Display (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33016](https://cve.now/CVE-2024-33016.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2024-23365](https://cve.now/CVE-2024-23365.md): Use After Free in SCE-Mink (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23364](https://cve.now/CVE-2024-23364.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-23362](https://cve.now/CVE-2024-23362.md): Improper Input Validation in Trusted Execution Environment (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2024-23359](https://cve.now/CVE-2024-23359.md): Buffer Over-read in Multi Mode Call Processor (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2024-23358](https://cve.now/CVE-2024-23358.md): Buffer Over-read in Multi Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-38858](https://cve.now/CVE-2024-38858.md): Cross-site scripting in Robotmk logs view (CVSS 2.3, Checkmk)
- [CVE-2024-7692](https://cve.now/CVE-2024-7692.md): Flaming Forms \<= 1.0.1 - Reflected XSS (CVSS 6.1, Flaming Forms)
- [CVE-2024-7691](https://cve.now/CVE-2024-7691.md): Flaming Forms \<= 1.0.1 - Unauthenticated Stored XSS (CVSS 5.4, Flaming Forms)
- [CVE-2024-7690](https://cve.now/CVE-2024-7690.md): DN Popup \<= 1.2.2 - Settings Update via CSRF (CVSS 5.4, DN Popup)
- [CVE-2024-7354](https://cve.now/CVE-2024-7354.md): Ninja Forms 3.8.6-3.8.10 - Reflected XSS (CVSS 6.1, Ninja Forms)
- [CVE-2024-43776](https://cve.now/CVE-2024-43776.md): Huachu Easytest Online Learning Test Platform - SQL Injection (CVSS 8.7, Huachu Digital Technology Easytest Online Test Platform)
- [CVE-2024-43775](https://cve.now/CVE-2024-43775.md): Huachu Easytest Online Learning Test Platform - SQL Injection (CVSS 8.7, Huachu Digital Technology Easytest Online Test Platform)
- [CVE-2024-43774](https://cve.now/CVE-2024-43774.md): Huachu Easytest Online Learning Test Platform - SQL Injection (CVSS 8.7, Huachu Digital Technology Easytest Online Test Platform)
- [CVE-2024-43773](https://cve.now/CVE-2024-43773.md): Huachu Easytest Online Learning Test Platform - SQL Injection (CVSS 9.3, Huachu Digital Technology Easytest Online Test Platform)
- [CVE-2024-43772](https://cve.now/CVE-2024-43772.md): Huachu Easytest Online Learning Test Platform - SQL Injection (CVSS 9.3, Huachu Digital Technology Easytest Online Test Platform)
- [CVE-2024-7871](https://cve.now/CVE-2024-7871.md): Huachu Easytest Online Learning Test Platform - SQL Injection (CVSS 8.7, Huachu Digital Technology Easytest Online Test Platform)
- [CVE-2024-41160](https://cve.now/CVE-2024-41160.md): Liteos-A has an use after free vulnerability (CVSS 8.8, OpenHarmony)
- [CVE-2024-41157](https://cve.now/CVE-2024-41157.md): Liteos-A has an use after free vulnerability (CVSS 8.8, OpenHarmony)
- [CVE-2024-39816](https://cve.now/CVE-2024-39816.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 8.4, OpenHarmony)
- [CVE-2024-39775](https://cve.now/CVE-2024-39775.md): Net Manager has an out-of-bounds read permission bypass vulnerability (CVSS 6.5, OpenHarmony)
- [CVE-2024-39612](https://cve.now/CVE-2024-39612.md): Background Task Manager has an out-of-bounds read permission bypass vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2024-38386](https://cve.now/CVE-2024-38386.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 8.4, OpenHarmony)
- [CVE-2024-38382](https://cve.now/CVE-2024-38382.md): Ability Runtime has an out-of-bounds read permission bypass vulnerability (CVSS 5.5, OpenHarmony)
- [CVE-2024-28044](https://cve.now/CVE-2024-28044.md): Liteos-A has an integer overflow vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-20089](https://cve.now/CVE-2024-20089.md): In wlan, there is a possible denial of service due to incorrect error handling. (CVSS 7.5, MediaTek MT6835, MT6878, MT6886, MT6897, MT6980, MT6985, MT…)
- [CVE-2024-20088](https://cve.now/CVE-2024-20088.md): In keyinstall, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6765, MT6768, MT6781, MT6833, MT6835, MT6855, MT…)
- [CVE-2024-20087](https://cve.now/CVE-2024-20087.md): In vdec, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek MT6765, MT6768, MT6779, MT6785, MT8385, MT8666, MT…)
- [CVE-2024-20086](https://cve.now/CVE-2024-20086.md): In vdec, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek MT6765, MT6768, MT6779, MT6785, MT8385, MT8666, MT…)
- [CVE-2024-20085](https://cve.now/CVE-2024-20085.md): In power, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20084](https://cve.now/CVE-2024-20084.md): In power, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-8365](https://cve.now/CVE-2024-8365.md): Vault Leaks AppRole Client Tokens And Accessor in Audit Log (CVSS 6.2, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2024-45527](https://cve.now/CVE-2024-45527.md): REDCap 14.7.0 allows HTML injection via the project title of a New Project action. (CVSS 6.1)
- [CVE-2024-45528](https://cve.now/CVE-2024-45528.md): CodeAstro MembershipM-PHP (aka Membership Management System in PHP) 1.0 allows add\_members.php fullname stored XSS. (CVSS 5.4)
- [CVE-2024-45621](https://cve.now/CVE-2024-45621.md): The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a s (CVSS 5.4)
- [CVE-2024-45622](https://cve.now/CVE-2024-45622.md): ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass (CVSS 9.8)
- [CVE-2024-45623](https://cve.now/CVE-2024-45623.md): D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.