# CVEs published 2024-09-05

67 CVEs were published on September 5, 2024: 18 critical, 16 high. Days are UTC.

- [CVE-2024-45400](https://cve.now/CVE-2024-45400.md): CKEditor Open Link plugin vulnerable to Cross-site Scripting (CVSS 6.1, mlewand ckeditor-plugin-openlink)
- [CVE-2024-42495](https://cve.now/CVE-2024-42495.md): Hughes Network Systems WL3000 Missing Encryption of Sensitive Data (CVSS 6.5, Hughes Network Systems WL3000 Fusion Software)
- [CVE-2024-39278](https://cve.now/CVE-2024-39278.md): Hughes Network Systems Insufficiently Protected Credentials (CVSS 4.2, Hughes Network Systems WL3000 Fusion Software)
- [CVE-2024-8395](https://cve.now/CVE-2024-8395.md): FlyCASS Cockpit Access Security System (CASS) SQL Injection (CVSS 9.8, FlyCASS Cockpit Access Security System · FlyCASS Known Crew…)
- [CVE-2024-42491](https://cve.now/CVE-2024-42491.md): A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res\_resolver\_unbound is used (CVSS 5.7, asterisk)
- [CVE-2024-7591](https://cve.now/CVE-2024-7591.md): Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection (CVSS 10.0, Progress LoadMaster)
- [CVE-2024-45401](https://cve.now/CVE-2024-45401.md): stripe-cli Path Traversal vulnerability (CVSS 7.6, stripe-cli · github.com/stripe/stripe-cli)
- [CVE-2024-45392](https://cve.now/CVE-2024-45392.md): SuiteCRM has wrong deletion permission checks on API delete call (CVSS 7.7, salesagility SuiteCRM)
- [CVE-2024-24759](https://cve.now/CVE-2024-24759.md): MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding (CVSS 9.3, mindsdb)
- [CVE-2024-45097](https://cve.now/CVE-2024-45097.md): IBM Aspera Faspex bypass security (CVSS 5.9, IBM Aspera Faspex)
- [CVE-2024-45096](https://cve.now/CVE-2024-45096.md): IBM Aspera Faspex information disclosure (CVSS 6.5, IBM Aspera Faspex)
- [CVE-2024-45098](https://cve.now/CVE-2024-45098.md): IBM Aspera Faspex bypass security (CVSS 6.8, IBM Aspera Faspex)
- [CVE-2024-8445](https://cve.now/CVE-2024-8445.md): 389-ds-base: server crash while modifying \`userpassword\` using malformed input (incomplete fix for cve-2024-2199) (CVSS 5.7, 389-ds-base · Red Hat Enterprise Linux 7 Extended Lifecy… +2)
- [CVE-2024-8473](https://cve.now/CVE-2024-8473.md): SQL injection vulnerability in Job Portal (CVSS 6.3, PHPGurukul Job Portal)
- [CVE-2024-8472](https://cve.now/CVE-2024-8472.md): SQL injection vulnerability in Job Portal (CVSS 6.3, PHPGurukul Job Portal)
- [CVE-2024-8471](https://cve.now/CVE-2024-8471.md): SQL injection vulnerability in Job Portal (CVSS 6.3, PHPGurukul Job Portal)
- [CVE-2024-7884](https://cve.now/CVE-2024-7884.md): Memory leak when calling a canister method via \`ic\_cdk::call\` (CVSS 7.5, Internet Computer ic-cdk · ic\_cdk +1)
- [CVE-2024-8462](https://cve.now/CVE-2024-8462.md): Windmill HTTP Request users.rs excessive authentication (CVSS 6.3, Windmill · github.com/windmill-labs/windmill)
- [CVE-2024-8470](https://cve.now/CVE-2024-8470.md): SQL injection vulnerability in Job Portal (CVSS 9.8, PHPGurukul Job Portal)
- [CVE-2024-8469](https://cve.now/CVE-2024-8469.md): SQL injection vulnerability in Job Portal (CVSS 9.8, PHPGurukul Job Portal)
- [CVE-2024-8468](https://cve.now/CVE-2024-8468.md): SQL injection vulnerability in Job Portal (CVSS 9.8, PHPGurukul Job Portal)
- [CVE-2024-8467](https://cve.now/CVE-2024-8467.md): SQL injection vulnerability in Job Portal (CVSS 9.8, PHPGurukul Job Portal)
- [CVE-2024-8466](https://cve.now/CVE-2024-8466.md): SQL injection vulnerability in Job Portal (CVSS 9.8, PHPGurukul Job Portal)
- [CVE-2024-8465](https://cve.now/CVE-2024-8465.md): SQL injection vulnerability in Job Portal (CVSS 9.8, PHPGurukul Job Portal)
- [CVE-2024-8464](https://cve.now/CVE-2024-8464.md): SQL injection vulnerability in Job Portal (CVSS 9.8, PHPGurukul Job Portal)
- [CVE-2024-8463](https://cve.now/CVE-2024-8463.md): File upload restriction bypass vulnerability in Job Portal (CVSS 9.9, PHPGurukul Job Portal)
- [CVE-2024-8461](https://cve.now/CVE-2024-8461.md): D-Link DNS-320 Web Management Interface discovery.cgi information disclosure (CVSS 6.9, D-Link DNS-320)
- [CVE-2024-8460](https://cve.now/CVE-2024-8460.md): D-Link DNS-320 Web Management Interface widget\_api.cgi information disclosure (CVSS 6.3, D-Link DNS-320)
- [CVE-2022-4529](https://cve.now/CVE-2022-4529.md): Security, Antivirus, Firewall – S.A.F \<= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass (CVSS 5.3, msoftplugins Security, Antivirus, Firewall – S.A.F)
- [CVE-2024-7381](https://cve.now/CVE-2024-7381.md): Geo Controller \<= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution (CVSS 5.3, creativform Geo Controller)
- [CVE-2024-7380](https://cve.now/CVE-2024-7380.md): Geo Controller \<= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion (CVSS 4.3, creativform Geo Controller)
- [CVE-2022-3556](https://cve.now/CVE-2022-3556.md): Cab fare calculator \<= 1.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, kanev Cab fare calculator)
- [CVE-2024-7605](https://cve.now/CVE-2024-7605.md): HelloAsso \<= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update (CVSS 4.3, HelloAsso)
- [CVE-2024-5957](https://cve.now/CVE-2024-5957.md): This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. (CVSS 6.3, Trellix Intrusion Prevention System (IPS) Manager)
- [CVE-2024-5956](https://cve.now/CVE-2024-5956.md): This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix I (CVSS 6.5, Trellix Intrusion Prevention System (IPS) Manager)
- [CVE-2024-6894](https://cve.now/CVE-2024-6894.md): RD Station \<= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, filipe-mateus-do-nascimento RD Station)
- [CVE-2024-6929](https://cve.now/CVE-2024-6929.md): Dynamic Featured Image \<= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter (CVSS 6.4, ankitpokhrel Dynamic Featured Image)
- [CVE-2024-6332](https://cve.now/CVE-2024-6332.md): Booking for Appointments and Events Calendar – Amelia Premium \<= 7.7 and Lite \<= 1.2.4 - Missing Authorization to Sensitive Information Exposure (CVSS 6.5, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2024-45107](https://cve.now/CVE-2024-45107.md): ZDI-CAN-24186: Adobe Acrobat Reader DC Doc Object Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-8363](https://cve.now/CVE-2024-8363.md): Share This Image \<= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode (CVSS 6.4, mihail-barinov Share This Image)
- [CVE-2024-5309](https://cve.now/CVE-2024-5309.md): Form Vibes – Database Manager for Forms \<= 1.4.12 - Missing Authorization in Multiple Functions (CVSS 5.4, wpvibes Form Vibes – Database Manager for Forms)
- [CVE-2024-6835](https://cve.now/CVE-2024-6835.md): Ivory Search – WordPress Search Plugin \<= 5.5.6 - Information Exposure via AJAX Search Form (CVSS 5.3, vinod-dalvi Ivory Search – WordPress Search Plugin)
- [CVE-2024-6846](https://cve.now/CVE-2024-6846.md): SmartSearchWP \<= 2.4.4 - Unauthenticated Log Purge (CVSS 5.3, Chatbot with ChatGPT WordPress)
- [CVE-2024-43102](https://cve.now/CVE-2024-43102.md): umtx Kernel panic or Use-After-Free (CVSS 9.8, FreeBSD)
- [CVE-2024-32668](https://cve.now/CVE-2024-32668.md): bhyve(8) privileged guest escape via USB controller (CVSS 8.2, FreeBSD)
- [CVE-2024-45063](https://cve.now/CVE-2024-45063.md): Multiple issues in ctl(4) CAM Target Layer (CVSS 9.8, FreeBSD)
- [CVE-2024-43110](https://cve.now/CVE-2024-43110.md): Multiple issues in ctl(4) CAM Target Layer (CVSS 8.4, FreeBSD)
- [CVE-2024-42416](https://cve.now/CVE-2024-42416.md): Multiple issues in ctl(4) CAM Target Layer (CVSS 8.4, FreeBSD)
- [CVE-2024-8178](https://cve.now/CVE-2024-8178.md): Multiple issues in ctl(4) CAM Target Layer (CVSS 9.3, FreeBSD)
- [CVE-2024-41928](https://cve.now/CVE-2024-41928.md): bhyve(8) privileged guest escape via TPM device passthrough (CVSS 8.4, FreeBSD)
- [CVE-2024-45288](https://cve.now/CVE-2024-45288.md): Multiple vulnerabilities in libnv (CVSS 8.4, FreeBSD)
- [CVE-2024-45287](https://cve.now/CVE-2024-45287.md): Multiple vulnerabilities in libnv (CVSS 9.1, FreeBSD)
- [CVE-2024-7627](https://cve.now/CVE-2024-7627.md): Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition (CVSS 8.1, bitpressadmin Bit File Manager – 100% Free & Open Source Fi…)
- [CVE-2023-51712](https://cve.now/CVE-2023-51712.md): An issue was discovered in Trusted Firmware-M through 2.0.0. (CVSS 4.7)
- [CVE-2024-42885](https://cve.now/CVE-2024-42885.md): SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id parameter of the data.jsp (CVSS 9.1)
- [CVE-2024-44587](https://cve.now/CVE-2024-44587.md): itsourcecode Alton Management System 1.0 is vulnerable to SQL Injection in /noncombo\_save.php via the "menu" parameter. (CVSS 8.8)
- [CVE-2024-44727](https://cve.now/CVE-2024-44727.md): Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php. (CVSS 7.4)
- [CVE-2024-44728](https://cve.now/CVE-2024-44728.md): Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /cli (CVSS 7.6)
- [CVE-2024-45157](https://cve.now/CVE-2024-45157.md): An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. (CVSS 5.1)
- [CVE-2024-45158](https://cve.now/CVE-2024-45158.md): An issue was discovered in Mbed TLS 3.6 before 3.6.1. (CVSS 9.8)
- [CVE-2024-45159](https://cve.now/CVE-2024-45159.md): An issue was discovered in Mbed TLS 3.x before 3.6.1. (CVSS 9.8)
- [CVE-2024-45171](https://cve.now/CVE-2024-45171.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. (CVSS 8.8)
- [CVE-2024-45173](https://cve.now/CVE-2024-45173.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. (CVSS 8.8)
- [CVE-2024-45175](https://cve.now/CVE-2024-45175.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. (CVSS 8.8)
- [CVE-2024-45176](https://cve.now/CVE-2024-45176.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. (CVSS 6.1)
- [CVE-2024-45178](https://cve.now/CVE-2024-45178.md): An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. (CVSS 7.1)
- [CVE-2024-45589](https://cve.now/CVE-2024-45589.md): RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote at (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.