# CVEs published 2024-09-04

173 CVEs were published on September 4, 2024: 16 critical, 46 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-45429](https://cve.now/CVE-2024-45429.md): Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 (CVSS 6.1, WP Engine Advanced Custom Fields)
- [CVE-2024-2166](https://cve.now/CVE-2024-2166.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time M (CVSS 8.8, Forcepoint Email Security)
- [CVE-2024-20506](https://cve.now/CVE-2024-20506.md): ClamAV Privilege Handling Escalation Vulnerability (CVSS 6.1, Cisco ClamAV)
- [CVE-2024-20505](https://cve.now/CVE-2024-20505.md): ClamAV Memory Handling DoS (CVSS 4.0, Cisco ClamAV)
- [CVE-2024-45395](https://cve.now/CVE-2024-45395.md): Unbounded loop over untrusted input can lead to endless data attack (CVSS 3.1, sigstore-go · github.com/sigstore/sigstore-go)
- [CVE-2024-45399](https://cve.now/CVE-2024-45399.md): Indico has a Cross-Site-Scripting during account creation (CVSS 4.3, indico)
- [CVE-2024-45008](https://cve.now/CVE-2024-45008.md): Input: MT - limit max slots (no CVSS, Linux)
- [CVE-2024-45007](https://cve.now/CVE-2024-45007.md): char: xillybus: Don't destroy workqueue from work item running on it (no CVSS, Linux)
- [CVE-2024-45006](https://cve.now/CVE-2024-45006.md): xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration (no CVSS, Linux)
- [CVE-2024-45005](https://cve.now/CVE-2024-45005.md): KVM: s390: fix validity interception issue when gisa is switched off (no CVSS, Linux)
- [CVE-2024-45004](https://cve.now/CVE-2024-45004.md): KEYS: trusted: dcp: fix leak of blob encryption key (no CVSS, Linux)
- [CVE-2024-45003](https://cve.now/CVE-2024-45003.md): vfs: Don't evict inode under the inode lru traversing context (no CVSS, Linux)
- [CVE-2024-45002](https://cve.now/CVE-2024-45002.md): rtla/osnoise: Prevent NULL dereference in error handling (no CVSS, Linux)
- [CVE-2024-45001](https://cve.now/CVE-2024-45001.md): net: mana: Fix RX buf alloc\_size alignment and atomic op panic (CVSS 7.5, Linux)
- [CVE-2024-45000](https://cve.now/CVE-2024-45000.md): fs/netfs/fscache\_cookie: add missing "n\_accesses" check (CVSS 7.8, Linux)
- [CVE-2024-44999](https://cve.now/CVE-2024-44999.md): gtp: pull network headers in gtp\_dev\_xmit() (no CVSS, Linux)
- [CVE-2024-44998](https://cve.now/CVE-2024-44998.md): atm: idt77252: prevent use after free in dequeue\_rx() (CVSS 9.8, Linux)
- [CVE-2024-44997](https://cve.now/CVE-2024-44997.md): net: ethernet: mtk\_wed: fix use-after-free panic in mtk\_wed\_setup\_tc\_block\_cb() (CVSS 7.8, Linux)
- [CVE-2024-44996](https://cve.now/CVE-2024-44996.md): vsock: fix recursive -\>recvmsg calls (no CVSS, Linux)
- [CVE-2024-44995](https://cve.now/CVE-2024-44995.md): net: hns3: fix a deadlock problem when config TC during resetting (CVSS 7.8, Linux)
- [CVE-2024-44994](https://cve.now/CVE-2024-44994.md): iommu: Restore lost return in iommu\_report\_device\_fault() (CVSS 8.8, Linux)
- [CVE-2024-44993](https://cve.now/CVE-2024-44993.md): drm/v3d: Fix out-of-bounds read in \`v3d\_csd\_job\_run()\` (no CVSS, Linux)
- [CVE-2024-44992](https://cve.now/CVE-2024-44992.md): smb/client: avoid possible NULL dereference in cifs\_free\_subrequest() (CVSS 7.5, Linux)
- [CVE-2024-44991](https://cve.now/CVE-2024-44991.md): tcp: prevent concurrent execution of tcp\_sk\_exit\_batch (no CVSS, Linux)
- [CVE-2024-44990](https://cve.now/CVE-2024-44990.md): bonding: fix null pointer deref in bond\_ipsec\_offload\_ok (no CVSS, Linux)
- [CVE-2024-44989](https://cve.now/CVE-2024-44989.md): bonding: fix xfrm real\_dev null pointer dereference (no CVSS, Linux)
- [CVE-2024-44988](https://cve.now/CVE-2024-44988.md): net: dsa: mv88e6xxx: Fix out-of-bound access (CVSS 8.8, Linux)
- [CVE-2024-44987](https://cve.now/CVE-2024-44987.md): ipv6: prevent UAF in ip6\_send\_skb() (CVSS 7.8, Linux)
- [CVE-2024-44986](https://cve.now/CVE-2024-44986.md): ipv6: fix possible UAF in ip6\_finish\_output2() (CVSS 8.1, Linux)
- [CVE-2024-44985](https://cve.now/CVE-2024-44985.md): ipv6: prevent possible UAF in ip6\_xmit() (CVSS 9.8, Linux)
- [CVE-2024-44984](https://cve.now/CVE-2024-44984.md): bnxt\_en: Fix double DMA unmapping for XDP\_REDIRECT (CVSS 10.0, Linux)
- [CVE-2024-44983](https://cve.now/CVE-2024-44983.md): netfilter: flowtable: validate vlan header (no CVSS, Linux)
- [CVE-2024-44982](https://cve.now/CVE-2024-44982.md): drm/msm/dpu: cleanup FB if dpu\_format\_populate\_layout fails (no CVSS, Linux)
- [CVE-2024-44981](https://cve.now/CVE-2024-44981.md): workqueue: Fix UBSAN 'subtraction overflow' error in shift\_and\_mask() (no CVSS, Linux)
- [CVE-2024-44980](https://cve.now/CVE-2024-44980.md): drm/xe: Fix opregion leak (no CVSS, Linux)
- [CVE-2024-44979](https://cve.now/CVE-2024-44979.md): drm/xe: Fix missing workqueue destroy in xe\_gt\_pagefault (no CVSS, Linux)
- [CVE-2024-44978](https://cve.now/CVE-2024-44978.md): drm/xe: Free job before xe\_exec\_queue\_put (CVSS 7.8, Linux)
- [CVE-2024-44977](https://cve.now/CVE-2024-44977.md): drm/amdgpu: Validate TA binary size (no CVSS, Linux)
- [CVE-2024-44976](https://cve.now/CVE-2024-44976.md): ata: pata\_macio: Fix DMA table overflow (no CVSS, Linux)
- [CVE-2024-44975](https://cve.now/CVE-2024-44975.md): cgroup/cpuset: fix panic caused by partcmd\_update (no CVSS, Linux)
- [CVE-2024-44974](https://cve.now/CVE-2024-44974.md): mptcp: pm: avoid possible UaF when selecting endp (CVSS 7.8, Linux)
- [CVE-2024-44973](https://cve.now/CVE-2024-44973.md): mm, slub: do not call do\_slab\_free for kfence object (CVSS 8.1, Linux)
- [CVE-2024-44971](https://cve.now/CVE-2024-44971.md): net: dsa: bcm\_sf2: Fix a possible memory leak in bcm\_sf2\_mdio\_register() (no CVSS, Linux)
- [CVE-2024-44970](https://cve.now/CVE-2024-44970.md): net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (CVSS 9.8, Linux)
- [CVE-2024-44969](https://cve.now/CVE-2024-44969.md): s390/sclp: Prevent release of buffer in I/O (no CVSS, Linux)
- [CVE-2024-44968](https://cve.now/CVE-2024-44968.md): tick/broadcast: Move per CPU pointer access into the atomic section (no CVSS, Linux)
- [CVE-2024-44967](https://cve.now/CVE-2024-44967.md): drm/mgag200: Bind I2C lifetime to DRM device (CVSS 7.8, Linux)
- [CVE-2024-44966](https://cve.now/CVE-2024-44966.md): binfmt\_flat: Fix corruption when not offsetting data start (CVSS 7.8, Linux)
- [CVE-2024-44965](https://cve.now/CVE-2024-44965.md): x86/mm: Fix pti\_clone\_pgtable() alignment assumption (no CVSS, Linux)
- [CVE-2024-44964](https://cve.now/CVE-2024-44964.md): idpf: fix memory leaks and crashes while performing a soft reset (no CVSS, Linux)
- [CVE-2024-44963](https://cve.now/CVE-2024-44963.md): btrfs: do not BUG\_ON() when freeing tree block after error (no CVSS, Linux)
- [CVE-2024-44962](https://cve.now/CVE-2024-44962.md): Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading (no CVSS, Linux)
- [CVE-2024-44961](https://cve.now/CVE-2024-44961.md): drm/amdgpu: Forward soft recovery errors to userspace (no CVSS, Linux)
- [CVE-2024-44960](https://cve.now/CVE-2024-44960.md): usb: gadget: core: Check for unset descriptor (no CVSS, Linux)
- [CVE-2024-44959](https://cve.now/CVE-2024-44959.md): tracefs: Use generic inode RCU for synchronizing freeing (CVSS 7.8, Linux)
- [CVE-2024-44958](https://cve.now/CVE-2024-44958.md): sched/smt: Fix unbalance sched\_smt\_present dec/inc (no CVSS, Linux)
- [CVE-2024-44957](https://cve.now/CVE-2024-44957.md): xen: privcmd: Switch from mutex to spinlock for irqfds (no CVSS, Linux)
- [CVE-2024-44956](https://cve.now/CVE-2024-44956.md): drm/xe/preempt\_fence: enlarge the fence critical section (no CVSS, Linux)
- [CVE-2024-44954](https://cve.now/CVE-2024-44954.md): ALSA: line6: Fix racy access to midibuf (CVSS 7.8, Linux)
- [CVE-2024-44953](https://cve.now/CVE-2024-44953.md): scsi: ufs: core: Fix deadlock during RTC update (no CVSS, Linux)
- [CVE-2024-44951](https://cve.now/CVE-2024-44951.md): serial: sc16is7xx: fix TX fifo corruption (CVSS 7.8, Linux)
- [CVE-2024-44950](https://cve.now/CVE-2024-44950.md): serial: sc16is7xx: fix invalid FIFO access with special register set (CVSS 7.1, Linux)
- [CVE-2024-44949](https://cve.now/CVE-2024-44949.md): parisc: fix a possible DMA corruption (CVSS 7.8, Linux)
- [CVE-2024-44948](https://cve.now/CVE-2024-44948.md): x86/mtrr: Check if fixed MTRRs exist before saving them (no CVSS, Linux)
- [CVE-2024-8417](https://cve.now/CVE-2024-8417.md): 云课网络科技有限公司 Yunke Online School System videobind.html sensitive information in source (CVSS 2.3, 云课网络科技有限公司 Yunke Online School System)
- [CVE-2024-8416](https://cve.now/CVE-2024-8416.md): SourceCodester Food Ordering Management System ticket-status.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-8415](https://cve.now/CVE-2024-8415.md): SourceCodester Food Ordering Management System add-ticket.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-8414](https://cve.now/CVE-2024-8414.md): SourceCodester Insurance Management System cross-site request forgery (CVSS 6.9, SourceCodester Insurance Management System)
- [CVE-2024-20497](https://cve.now/CVE-2024-20497.md): Cisco Expressway Edge Improper Authorization Vulnerability (CVSS 4.3, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2024-20503](https://cve.now/CVE-2024-20503.md): Cisco Duo Epic for Hyperdrive Information Disclosure Vulnerability (CVSS 5.5, Cisco Duo Authentication for Epic)
- [CVE-2024-20469](https://cve.now/CVE-2024-20469.md): Cisco Identity Services Engine Command Injection Vulnerability (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2024-20440](https://cve.now/CVE-2024-20440.md): A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. (CVSS 7.5, Cisco Smart License Utility)
- [CVE-2024-20439](https://cve.now/CVE-2024-20439.md): A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by us (CVSS 9.8, KEV, Cisco Smart License Utility)
- [CVE-2024-45314](https://cve.now/CVE-2024-45314.md): Flask-AppBuilder login form allows browser to cache sensitive fields (CVSS 3.6, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2024-45053](https://cve.now/CVE-2024-45053.md): Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine (CVSS 9.1, ethyca fides · ethyca-fides)
- [CVE-2024-45074](https://cve.now/CVE-2024-45074.md): IBM webMethods Integration directory traversal (CVSS 6.5, IBM webMethods Integration)
- [CVE-2024-45075](https://cve.now/CVE-2024-45075.md): IBM webMethods Integration privilege escalation (CVSS 8.8, IBM webMethods Integration)
- [CVE-2024-45076](https://cve.now/CVE-2024-45076.md): IBM webMethods Integration code execution (CVSS 9.9, IBM webMethods Integration)
- [CVE-2024-45052](https://cve.now/CVE-2024-45052.md): Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability (CVSS 5.3, ethyca fides · ethyca-fides)
- [CVE-2024-45050](https://cve.now/CVE-2024-45050.md): Ringer Server Does Not Check Members When Loading Messages (CVSS 7.1, Lif-Platforms New-Ringer-Server)
- [CVE-2024-43405](https://cve.now/CVE-2024-43405.md): Nuclei Template Signature Verification Bypass (CVSS 7.4, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2024-8412](https://cve.now/CVE-2024-8412.md): LinuxOSsk Shakal-NG views.py redirect (CVSS 5.3, LinuxOSsk Shakal-NG)
- [CVE-2024-43402](https://cve.now/CVE-2024-43402.md): Rust OS Command Injection/Argument Injection vulnerability (CVSS 8.2, rust-lang rust)
- [CVE-2024-8391](https://cve.now/CVE-2024-8391.md): Eclipse Vert.x gRPC server does not limit the maximum message size (CVSS 6.9, Eclipse Foundation Eclipse Vert.x · io.vertx:vertx-grpc-… +1)
- [CVE-2024-8411](https://cve.now/CVE-2024-8411.md): ABCD ABCD2 buscar\_integrada.php cross site scripting (CVSS 5.1, ABCD2)
- [CVE-2024-8410](https://cve.now/CVE-2024-8410.md): ABCD ABCD2 otros\_sitios.php path traversal (CVSS 5.3, ABCD2)
- [CVE-2024-7078](https://cve.now/CVE-2024-7078.md): Unauthenticate SQLi in Semtek Informatics Software's Semtek Sempos (CVSS 9.2, Semtek Informatics Software Consulting Semtek Sempos)
- [CVE-2024-8409](https://cve.now/CVE-2024-8409.md): ABCD ABCD2 show\_image.php path traversal (CVSS 5.3, ABCD2)
- [CVE-2024-7077](https://cve.now/CVE-2024-7077.md): Reflected XSS in Semtek Informatics Software's Semtek Sempos (CVSS 5.3, Semtek Informatics Software Consulting Semtek Sempos)
- [CVE-2024-8418](https://cve.now/CVE-2024-8418.md): Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service (CVSS 7.5, containers/aardvark-dns · Red Hat Enterprise Linux +2)
- [CVE-2024-7076](https://cve.now/CVE-2024-7076.md): SQLi in Semtek Informatics Software's Semtek Sempos (CVSS 9.3, Semtek Informatics Software Consulting Semtek Sempos)
- [CVE-2024-8408](https://cve.now/CVE-2024-8408.md): Linksys WRT54G POST Parameter apply.cgi validate\_services\_port stack-based overflow (CVSS 5.3, Linksys WRT54G)
- [CVE-2024-8407](https://cve.now/CVE-2024-8407.md): alwindoss akademy handlers.go cross site scripting (CVSS 5.3, alwindoss akademy)
- [CVE-2024-7923](https://cve.now/CVE-2024-7923.md): Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore (CVSS 9.8, pulpcore · Red Hat Satellite 6.13 for RHEL +4)
- [CVE-2024-7012](https://cve.now/CVE-2024-7012.md): Puppet-foreman: an authentication bypass vulnerability exists in foreman (CVSS 9.8, puppet-foreman · Red Hat Satellite 6.13 for RHEL +3)
- [CVE-2024-7834](https://cve.now/CVE-2024-7834.md): Local privilege escalation in Overwolf (CVSS 7.8, Overwolf)
- [CVE-2024-8413](https://cve.now/CVE-2024-8413.md): Cross Site Scripting (XSS) in Raspcontrol (CVSS 5.4, RaspControl)
- [CVE-2024-8289](https://cve.now/CVE-2024-8289.md): MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution \<= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover (CVSS 9.8, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2024-7870](https://cve.now/CVE-2024-7870.md): PixelYourSite – Your smart PIXEL (TAG) & API Manager \<= 9.7.1 and PixelYourSite PRO \<= 10.4.2 - Unauthenticated Information Exposure and Log Deletion (CVSS 6.5, PixelYourSite – Your smart PIXEL (TAG) & API Manager · Pixe…)
- [CVE-2024-45195](https://cve.now/CVE-2024-45195.md): Apache OFBiz: Confused controller-view authorization logic (forced browsing) (CVSS 9.8, KEV, Apache Software Foundation Apache OFBiz)
- [CVE-2024-45507](https://cve.now/CVE-2024-45507.md): Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE (CVSS 8.8, Apache Software Foundation Apache OFBiz)
- [CVE-2024-8318](https://cve.now/CVE-2024-8318.md): Attributes for Blocks \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks Parameter (CVSS 6.4, skadev Attributes for Blocks)
- [CVE-2024-8121](https://cve.now/CVE-2024-8121.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.8 - Missing Authorization to Admin Username Change (CVSS 5.4, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-8123](https://cve.now/CVE-2024-8123.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.8 - Insecure Direct Object Reference (CVSS 5.4, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-8102](https://cve.now/CVE-2024-8102.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-8106](https://cve.now/CVE-2024-8106.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 6.5, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-8119](https://cve.now/CVE-2024-8119.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.8 - Reflected Cross-Site Scripting via page (CVSS 6.1, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-8104](https://cve.now/CVE-2024-8104.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download (CVSS 8.8, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-8117](https://cve.now/CVE-2024-8117.md): The Ultimate WordPress Toolkit – WP Extended \<= 3.0.8 - Reflected Cross-Site Scripting via selected\_option (CVSS 6.1, wpextended The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-7786](https://cve.now/CVE-2024-7786.md): Sensei LMS \< 4.24.2 - Unauthenticated Email Template Leak (CVSS 7.5, Sensei LMS)
- [CVE-2024-6926](https://cve.now/CVE-2024-6926.md): Viral Signup \<= 2.1 - Unauthenticated SQLi (CVSS 9.8, Viral Signup)
- [CVE-2024-6889](https://cve.now/CVE-2024-6889.md): Secure Copy Content Protection and Content Locking \< 4.1.7 - Admin+ Stored XSS (CVSS 4.8, Secure Copy Content Protection and Content Locking)
- [CVE-2024-6888](https://cve.now/CVE-2024-6888.md): Secure Copy Content Protection and Content Locking \< 4.1.7 - Admin+ Stored XSS (CVSS 4.8, Secure Copy Content Protection and Content Locking)
- [CVE-2024-6722](https://cve.now/CVE-2024-6722.md): Chatbot Support AI \<= 1.0.2 - Admin+ Stored XSS (CVSS 4.8, Chatbot Support AI: Free ChatGPT Chatbot, Woocommerce Chatb…)
- [CVE-2024-6020](https://cve.now/CVE-2024-6020.md): Sign-up Sheets \< 2.2.13 - Reflected XSS (CVSS 6.1, Sign-up Sheets)
- [CVE-2024-34661](https://cve.now/CVE-2024-34661.md): Improper handling of insufficient permissions in Samsung Assistant prior to version 9.1.00.7 allows remote attackers to access location data (CVSS 4.3, Samsung Mobile Samsung Assistant)
- [CVE-2024-34660](https://cve.now/CVE-2024-34660.md): Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2024-34659](https://cve.now/CVE-2024-34659.md): Exposure of sensitive information in GroupSharing prior to version 13.6.13.3 allows remote attackers can force the victim to join the group. (CVSS 7.5, Samsung Mobile Group Sharing)
- [CVE-2024-34658](https://cve.now/CVE-2024-34658.md): Out-of-bounds read in Samsung Notes allows local attackers to bypass ASLR. (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2024-34657](https://cve.now/CVE-2024-34657.md): Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary code. (CVSS 8.6, Samsung Mobile Samsung Notes)
- [CVE-2024-34656](https://cve.now/CVE-2024-34656.md): Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2024-34655](https://cve.now/CVE-2024-34655.md): Incorrect use of privileged API in UniversalCredentialManager prior to SMR Sep-2024 Release 1 allows local attackers to access privileged AP (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34654](https://cve.now/CVE-2024-34654.md): Improper Export of android application component in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access files with My (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34653](https://cve.now/CVE-2024-34653.md): Path Traversal in My Files prior to SMR Sep-2024 Release 1 allows physical attackers to access directories with My Files' privilege. (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2024-34652](https://cve.now/CVE-2024-34652.md): Incorrect authorization in kperfmon prior to SMR Sep-2024 Release 1 allows local attackers to access information related to performance incl (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34651](https://cve.now/CVE-2024-34651.md): Improper authorization in My Files prior to SMR Sep-2024 Release 1 allows local attackers to access restricted data in My Files. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34650](https://cve.now/CVE-2024-34650.md): Incorrect authorization in CocktailbarService prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs related to Ed (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34649](https://cve.now/CVE-2024-34649.md): Improper access control in new Dex Mode in multitasking framework prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily a (CVSS 2.4, Samsung Mobile Devices)
- [CVE-2024-34648](https://cve.now/CVE-2024-34648.md): Improper Handling of Insufficient Permissions in KnoxMiscPolicy prior to SMR Sep-2024 Release 1 allows local attackers to access sensitive d (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-34647](https://cve.now/CVE-2024-34647.md): Incorrect use of privileged API in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to access privileged APIs rela (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34646](https://cve.now/CVE-2024-34646.md): Improper access control in DualDarManagerProxy prior to SMR Sep-2024 Release 1 allows local attackers to cause local permanent denial of ser (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2024-34645](https://cve.now/CVE-2024-34645.md): Improper input validation in ThemeCenter prior to SMR Sep-2024 Release 1 allows physical attackers to install privileged applications. (CVSS 6.1, Samsung Mobile Devices)
- [CVE-2024-34644](https://cve.now/CVE-2024-34644.md): Improper access control in item selection related in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protected da (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2024-34643](https://cve.now/CVE-2024-34643.md): Improper access control in key input related function in Dressroom prior to SMR Sep-2024 Release 1 allows local attackers to access protecte (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2024-34642](https://cve.now/CVE-2024-34642.md): Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information. (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2024-34641](https://cve.now/CVE-2024-34641.md): Improper Export of Android Application Components in FeliCaTest prior to SMR Sep-2024 Release 1 allows local attackers to enable NFC configu (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-34640](https://cve.now/CVE-2024-34640.md): Improper access control vulnerability in BGProtectManager prior to SMR Sep-2024 Release 1 allows local attackers to bypass restriction of pr (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2024-34639](https://cve.now/CVE-2024-34639.md): Improper handling of exceptional conditions in Setupwizard prior to SMR Aug-2024 Release 1 allows physical attackers to bypass proper valida (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2024-34638](https://cve.now/CVE-2024-34638.md): Improper handling of exceptional conditions in ThemeCenter prior to SMR Sep-2024 Release 1 allows local attackers to delete non-preloaded ap (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2024-34637](https://cve.now/CVE-2024-34637.md): Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-8325](https://cve.now/CVE-2024-8325.md): Gutenberg Page Builder Blocks & Ready-Made Patterns Library \<= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, BlockSpare — News, Magazine and Blog Addons for (Gutenberg)…)
- [CVE-2024-7950](https://cve.now/CVE-2024-7950.md): WP Job Portal \<= 2.1.6 - Missing Authorization to Unauthenticated Local File Inclusion, Arbitrary Settings Update, and User Creation (CVSS 9.8, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2024-8298](https://cve.now/CVE-2024-8298.md): Memory request vulnerability in the memory management module Impact: Successful exploitation of this vulnerability may affect service confid (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45449](https://cve.now/CVE-2024-45449.md): Access permission verification vulnerability in the ringtone setting module Impact: Successful exploitation of this vulnerability may affect (CVSS 5.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45448](https://cve.now/CVE-2024-45448.md): Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may a (CVSS 4.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45447](https://cve.now/CVE-2024-45447.md): Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confide (CVSS 4.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45446](https://cve.now/CVE-2024-45446.md): Access permission verification vulnerability in the camera driver module Impact: Successful exploitation of this vulnerability will affect a (CVSS 5.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45445](https://cve.now/CVE-2024-45445.md): Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will af (CVSS 4.0, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45444](https://cve.now/CVE-2024-45444.md): Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service conf (CVSS 5.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-39921](https://cve.now/CVE-2024-39921.md): Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V (CVSS 7.5, Fsas Technologies IPCOM EX2 Series · Fsas Technologies IPCO…)
- [CVE-2024-45443](https://cve.now/CVE-2024-45443.md): Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and conf (CVSS 6.1, Huawei HarmonyOS)
- [CVE-2024-45442](https://cve.now/CVE-2024-45442.md): Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability w (CVSS 5.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45441](https://cve.now/CVE-2024-45441.md): Input verification vulnerability in the system service module Impact: Successful exploitation of this vulnerability will affect availability (CVSS 6.2, huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-42039](https://cve.now/CVE-2024-42039.md): Access control vulnerability in the SystemUI module Impact: Successful exploitation of this vulnerability may affect service confidentiality (CVSS 4.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-45450](https://cve.now/CVE-2024-45450.md): Permission control vulnerability in the software update module. (CVSS 4.0, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-41927](https://cve.now/CVE-2024-41927.md): Cleartext transmission of sensitive information vulnerability exists in multiple IDEC PLCs. (CVSS 4.6, IDEC FC6A Series MICROSmart All-in-One CPU module · IDEC… +3)
- [CVE-2024-41716](https://cve.now/CVE-2024-41716.md): Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. (CVSS 8.1, IDEC WindLDR · IDEC WindO/I-NV4)
- [CVE-2024-42642](https://cve.now/CVE-2024-42642.md): Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted (CVSS 6.7)
- [CVE-2024-44383](https://cve.now/CVE-2024-44383.md): WAYOS FBM-291W v19.09.11 is vulnerable to Command Execution via msp\_info\_htm. (CVSS 8.0)
- [CVE-2024-44400](https://cve.now/CVE-2024-44400.md): A vulnerability was discovered in DI\_8400-16.07.26A1, which has been classified as critical. (CVSS 8.0)
- [CVE-2024-44808](https://cve.now/CVE-2024-44808.md): An issue in Vypor Attack API System v.1.0 allows a remote attacker to execute arbitrary code via the user GET parameter. (CVSS 9.8)
- [CVE-2024-44817](https://cve.now/CVE-2024-44817.md): SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the id parameter in the (CVSS 8.8)
- [CVE-2024-44818](https://cve.now/CVE-2024-44818.md): Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the HTTP\_Referer (CVSS 5.4)
- [CVE-2024-44819](https://cve.now/CVE-2024-44819.md): Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script (CVSS 6.1)
- [CVE-2024-44820](https://cve.now/CVE-2024-44820.md): A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/E\_bak5.1/upload/ (CVSS 7.5)
- [CVE-2024-44821](https://cve.now/CVE-2024-44821.md): ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. (CVSS 5.3)
- [CVE-2024-44859](https://cve.now/CVE-2024-44859.md): Tenda FH1201 v1.2.0.14 has a stack buffer overflow vulnerability in \`formWrlExtraGet\`. (CVSS 8.0)
- [CVE-2024-45170](https://cve.now/CVE-2024-45170.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. (CVSS 8.1)
- [CVE-2024-45172](https://cve.now/CVE-2024-45172.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. (CVSS 6.8)
- [CVE-2024-45174](https://cve.now/CVE-2024-45174.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. (CVSS 8.1)
- [CVE-2024-45177](https://cve.now/CVE-2024-45177.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. (CVSS 5.4)
- [CVE-2024-45506](https://cve.now/CVE-2024-45506.md): HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwardin (CVSS 7.5)
- [CVE-2024-45692](https://cve.now/CVE-2024-45692.md): Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.