CVEs published September 5, 2024
67 CVEs were published on September 5, 2024: 18 critical, 16 high.
- Published
- 67
- Critical
- 18
- High
- 16
- Medium
- 33
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- PHPGurukul Job Portal
- 11
- FreeBSD
- 9
- IBM Aspera Faspex
- 3
- creativform Geo Controller
- 2
- D-Link DNS-320
- 2
- Hughes Network Systems WL3000 Fusion Software
- 2
- Trellix Intrusion Prevention System (IPS) Manager
- 2
- 389-ds-base · Red Hat Enterprise Linux 7 Extended Lifecy… +2
- 1
- Adobe Acrobat Reader
- 1
- ameliabooking Booking for Appointments and Events Calendar…
- 1
Critical 18
- CVE-2024-8395FlyCASS Cockpit Access Security System (CASS) SQL InjectionFlyCASS Cockpit Access Security System · FlyCASS Known Crew…
- CVE-2024-7591Improper Input Validation vulnerability in Progress LoadMaster allows OS Command InjectionProgress LoadMaster
- CVE-2024-24759MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebindingmindsdb
- CVE-2024-8470SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8469SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8468SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8467SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8466SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8465SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8464SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8463File upload restriction bypass vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-43102umtx Kernel panic or Use-After-FreeFreeBSD
- CVE-2024-45063Multiple issues in ctl(4) CAM Target LayerFreeBSD
- CVE-2024-8178Multiple issues in ctl(4) CAM Target LayerFreeBSD
- CVE-2024-45287Multiple vulnerabilities in libnvFreeBSD
- CVE-2024-42885SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp
- CVE-2024-45158An issue was discovered in Mbed TLS 3.6 before 3.6.1.
- CVE-2024-45159An issue was discovered in Mbed TLS 3.x before 3.6.1.
High 16
- CVE-2024-45401stripe-cli Path Traversal vulnerabilitystripe-cli · github.com/stripe/stripe-cli
- CVE-2024-45392SuiteCRM has wrong deletion permission checks on API delete callsalesagility SuiteCRM
- CVE-2024-7884Memory leak when calling a canister method via `ic_cdk::call`Internet Computer ic-cdk · ic_cdk +1
- CVE-2024-32668bhyve(8) privileged guest escape via USB controllerFreeBSD
- CVE-2024-43110Multiple issues in ctl(4) CAM Target LayerFreeBSD
- CVE-2024-42416Multiple issues in ctl(4) CAM Target LayerFreeBSD
- CVE-2024-41928bhyve(8) privileged guest escape via TPM device passthroughFreeBSD
- CVE-2024-45288Multiple vulnerabilities in libnvFreeBSD
- CVE-2024-7627Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Conditionbitpressadmin Bit File Manager – 100% Free & Open Source Fi…
- CVE-2024-44587itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo_save.php via the "menu" parameter.
- CVE-2024-44727Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
- CVE-2024-44728Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /cli
- CVE-2024-45171An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.
- CVE-2024-45173An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.
- CVE-2024-45175An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.
- CVE-2024-45178An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.
Medium, low and unrated 33
- CVE-2024-45400CKEditor Open Link plugin vulnerable to Cross-site Scriptingmlewand ckeditor-plugin-openlink
- CVE-2024-42495Hughes Network Systems WL3000 Missing Encryption of Sensitive DataHughes Network Systems WL3000 Fusion Software
- CVE-2024-39278Hughes Network Systems Insufficiently Protected CredentialsHughes Network Systems WL3000 Fusion Software
- CVE-2024-42491A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is usedasterisk
- CVE-2024-45097IBM Aspera Faspex bypass securityIBM Aspera Faspex
- CVE-2024-45096IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2024-45098IBM Aspera Faspex bypass securityIBM Aspera Faspex
- CVE-2024-8445389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)389-ds-base · Red Hat Enterprise Linux 7 Extended Lifecy… +2
- CVE-2024-8473SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8472SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8471SQL injection vulnerability in Job PortalPHPGurukul Job Portal
- CVE-2024-8462Windmill HTTP Request users.rs excessive authenticationWindmill · github.com/windmill-labs/windmill
- CVE-2024-8461D-Link DNS-320 Web Management Interface discovery.cgi information disclosureD-Link DNS-320
- CVE-2024-8460D-Link DNS-320 Web Management Interface widget_api.cgi information disclosureD-Link DNS-320
- CVE-2022-4529Security, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypassmsoftplugins Security, Antivirus, Firewall – S.A.F
- CVE-2024-7381Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Executioncreativform Geo Controller
- CVE-2024-7380Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletioncreativform Geo Controller
- CVE-2022-3556Cab fare calculator <= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scriptingkanev Cab fare calculator
- CVE-2024-7605HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options UpdateHelloAsso
- CVE-2024-5957This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.Trellix Intrusion Prevention System (IPS) Manager
- CVE-2024-5956This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix ITrellix Intrusion Prevention System (IPS) Manager
- CVE-2024-6894RD Station <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingfilipe-mateus-do-nascimento RD Station
- CVE-2024-6929Dynamic Featured Image <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameterankitpokhrel Dynamic Featured Image
- CVE-2024-6332Booking for Appointments and Events Calendar – Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposureameliabooking Booking for Appointments and Events Calendar…
- CVE-2024-45107ZDI-CAN-24186: Adobe Acrobat Reader DC Doc Object Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2024-8363Share This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcodemihail-barinov Share This Image
- CVE-2024-5309Form Vibes – Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functionswpvibes Form Vibes – Database Manager for Forms
- CVE-2024-6835Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Formvinod-dalvi Ivory Search – WordPress Search Plugin
- CVE-2024-6846SmartSearchWP <= 2.4.4 - Unauthenticated Log PurgeChatbot with ChatGPT WordPress
- CVE-2023-51712An issue was discovered in Trusted Firmware-M through 2.0.0.
- CVE-2024-45157An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used.
- CVE-2024-45176An issue was discovered in za-internet C-MOR Video Surveillance 5.2401.
- CVE-2024-45589RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote at