CVEs published September 3, 2024
69 CVEs were published on September 3, 2024: 12 critical, 29 high.
- Published
- 69
- Critical
- 12
- High
- 29
- Medium
- 21
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- libopensc · Red Hat Enterprise Linux
- 6
- Mozilla Firefox · Mozilla Thunderbird
- 6
- Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- 6
- Mozilla Firefox
- 3
- Progress OpenEdge
- 3
- Google Chrome
- 2
- Symphony Fintech XTS Web Trader
- 2
- xibosignage xibo-cms
- 2
- Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- 1
- Authenticator-Extension Authenticator
- 1
Critical 12
- CVE-2024-8389Memory safety bugs present in Firefox 129.Mozilla Firefox
- CVE-2024-8387Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-8385A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-8384The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two paMozilla Firefox · Mozilla Thunderbird
- CVE-2024-8381A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmenMozilla Firefox · Mozilla Thunderbird
- CVE-2024-45588Information Disclosure VulnerabilitySymphony Fintech XTS Web Trader
- CVE-2024-45587Unauthorized Modification VulnerabilitySymphony Fintech XTS Web Trader
- CVE-2024-45586Account Take Over VulnerabilitySymphony Fintech XTS Web Trader · Symphony Fintech XTS Mobi…
- CVE-2024-7261The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4Zyxel NWA1123ACv3 firmware · Zyxel WAC500 firmware +3
- CVE-2024-41433PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpressionList.
- CVE-2024-44809A remote code execution (RCE) vulnerability exists in the Pi Camera project, version 1.0, maintained by RECANTHA.
- CVE-2024-44921SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.
High 29
- CVE-2024-7970Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2024-8362Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2024-45394Secret encryption vulnerable to brute-force attacksAuthenticator-Extension Authenticator
- CVE-2024-45391Tina search token leak via lock file in TinaCMStinacms · @tinacms/cli
- CVE-2024-45390@blakeembrey/template vulnerable to code injection when attacker controls template inputblakeembrey js-template · @blakeembrey/template
- CVE-2024-45307SudoBot missing authorization check in `-config` commandonesoft-sudo sudobot
- CVE-2024-6119Possible denial of service in X.509 name checksOpenSSL
- CVE-2024-7346Client connections using default TLS certificates from OpenEdge may bypass TLS host name validationProgress OpenEdge
- CVE-2024-7345Direct local client connections to MS Agents can bypass authenticationProgress OpenEdge
- CVE-2024-7654Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery serviceProgress OpenEdge
- CVE-2024-8383Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does noMozilla Firefox
- CVE-2024-8382Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-6232Regular-expression DoS when parsing TarFile headersPython Software Foundation CPython
- CVE-2024-6473DLL Hijacking in Yandex BrowserYandex Browser
- CVE-2024-8374Arbitrary Code Injection in CuraUltimaker Cura
- CVE-2024-38811Code-execution vulnerabilityFusion
- CVE-2024-3655Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2024-42060A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmwaZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2024-42059A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, USG FLEX series firmwaZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2024-42058A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions fZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2024-42057A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series fZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2024-7203A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firZyxel ATP series firmware · Zyxel USG FLEX series firmware
- CVE-2024-5412A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 could allow an unauthenZyxel VMG8825-T50K firmware
- CVE-2023-49233Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative V
- CVE-2024-38456HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vul
- CVE-2024-41435YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the "insert into" parameter.
- CVE-2024-41436ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.
- CVE-2024-42902An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted
- CVE-2024-42991MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.
Medium, low and unrated 28
- CVE-2024-45620Libopensc: incorrect handling of the length of buffers or files in pkcs15initlibopensc · Red Hat Enterprise Linux
- CVE-2024-45619Libopensc: incorrect handling length of buffers or files in libopensclibopensc · Red Hat Enterprise Linux
- CVE-2024-45618Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15initlibopensc · Red Hat Enterprise Linux
- CVE-2024-45617Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensclibopensc · Red Hat Enterprise Linux
- CVE-2024-45616Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensclibopensc · Red Hat Enterprise Linux
- CVE-2024-45615Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15initlibopensc · Red Hat Enterprise Linux
- CVE-2024-8399Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.Mozilla Focus for iOS
- CVE-2024-4629Keycloak: potential bypass of brute force protectionkeycloak · Red Hat Build of Keycloak +4
- CVE-2024-45389Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)CloudCannon pagefind · pagefind +2
- CVE-2024-45310runc can be confused to create empty files/directories on the hostopencontainers runc · github.com/opencontainers/runc
- CVE-2024-43803BMO can expose particularly named secrets from other namespaces via BMH CRDmetal3-io baremetal-operator · github.com/metal3-io/baremet…
- CVE-2024-43413Xibo CMS XSS vulnerability using DataSet HTML columnsxibosignage xibo-cms
- CVE-2024-43412Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JSxibosignage xibo-cms
- CVE-2024-4259Sensetive Data Exposure in SAMPAS's AKOSSAMPAŞ Holding AKOS
- CVE-2024-8388Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullMozilla Firefox
- CVE-2024-8386If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-37136Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability.Dell Path to Power
- CVE-2024-42061A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmware versions from V4.3Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2024-6343A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2024-8380SourceCodester Contact Manager with Export to VCF Delete Contact delete-account.php sql injectionSourceCodester Contact Manager with Export to VCF
- CVE-2024-34463BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets.
- CVE-2024-41434PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal.
- CVE-2024-42901A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.
- CVE-2024-42903A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users
- CVE-2024-42904A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafte
- CVE-2024-44920A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to execute arbitrary web
- CVE-2024-45180SquaredUp DS for SCOM 6.2.1.11104 allows XSS.
- CVE-2024-45678Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extrac