CVEs published September 6, 2024
73 CVEs were published on September 6, 2024: 11 critical, 28 high.
- Published
- 73
- Critical
- 11
- High
- 28
- Medium
- 29
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- QNAP Systems QTS · QNAP Systems QuTS hero
- 12
- QNAP Systems QTS · QNAP Systems QuTS hero +1
- 3
- alfio-event alf.io
- 2
- Consensys gnark · github.com/consensys/gnark
- 2
- Dell SmartFabric OS10 Software
- 2
- Linux
- 2
- QNAP Systems Notes Station
- 2
- QNAP Systems Video Station
- 2
- Apple visionOS
- 1
- Ariva Computer Accord ORS
- 1
Critical 11
- CVE-2024-8517SPIP Bigup Multipart File Upload OS Command InjectionSPIP
- CVE-2024-7493WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Metawhyun WPCOM Member
- CVE-2024-6445Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeXDataFlowX Technology DataDiodeX
- CVE-2024-1744IDOR in Ariva Computer's Accord ORSAriva Computer Accord ORS
- CVE-2024-8292WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Updatewppost WP-Recall – Registration, Profile, Commerce & More
- CVE-2024-44401D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file
- CVE-2024-44402D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.
- CVE-2024-44838RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php.
- CVE-2024-44839RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php.
- CVE-2024-45758H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command exh2o · ai.h2o:h2o-core
- CVE-2024-45771RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php.
High 28
- CVE-2024-34158Stack exhaustion in Parse in go/build/constraintGo standard library go/build/constraint · stdlib
- CVE-2024-34156Stack exhaustion in Decoder.Decode in encoding/gobGo standard library encoding/gob · stdlib
- CVE-2024-7652Type Confusion in Async Generators in Javascript EngineMozilla Firefox · Mozilla Thunderbird
- CVE-2024-38640Download StationQNAP Systems Download Station
- CVE-2024-38641QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-34974QTS, QuTS hero, QuTScloud, QVR, QESQNAP Systems QTS · QNAP Systems QuTS hero +3
- CVE-2024-32762QuLog CenterQNAP Systems QuLog Center
- CVE-2023-39298QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-39300QTSQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-50360Video StationQNAP Systems Video Station
- CVE-2023-47563Video StationQNAP Systems Video Station
- CVE-2024-21898QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-21897QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-51366QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-45294`org.hl7.fhir.core` XXE vulnerability in XSLT transformshapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +5
- CVE-2024-8509Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authenticationforklift-controller · Red Hat Migration Toolkit for Virtual…
- CVE-2024-8428ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeoverultimatemember ForumWP – Forum & Discussion Board
- CVE-2024-45300Bypassing promo code limitations with race conditionsalfio-event alf.io
- CVE-2023-52916media: aspeed: Fix memory overwrite if timing is 1600x900Linux
- CVE-2024-7349LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injectionchrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- CVE-2024-39585Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability.Dell SmartFabric OS10 Software
- CVE-2024-38486Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special ElemenDell SmartFabric OS10 Software
- CVE-2024-8247Newsletters <= 4.9.9.2 - Authenticated Privilege Escalationcontrid Newsletters
- CVE-2024-8480Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File UploadImage Optimizer, Resizer and CDN – Sirv
- CVE-2024-44408D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure.
- CVE-2024-44739Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=.
- CVE-2024-44844DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run_comm
- CVE-2024-44845DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter_
Medium, low and unrated 34
- CVE-2024-34155Stack exhaustion in all Parse functions in go/parserGo standard library go/parser · stdlib
- CVE-2024-38642QuMagieQNAP Systems QuMagie
- CVE-2024-32763QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-21906QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-34979QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-27125HelpdeskQNAP Systems Helpdesk
- CVE-2024-32771QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-45038Music StationQNAP Systems Music Station
- CVE-2024-21904QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2022-27592QVR Smart ClientQNAP Systems QVR Smart Client
- CVE-2024-27126Notes Station 3QNAP Systems Notes Station
- CVE-2024-27122Notes Station 3QNAP Systems Notes Station
- CVE-2024-21903QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-51368QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-51367QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-50366QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-8394When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitabMozilla Thunderbird
- CVE-2024-25584Dovecot accepts dot LF DOT LF symbol as end of DATA command.Open-Xchange OX Dovecot Pro
- CVE-2024-7611Enter Addons – Ultimate Template Builder for Elementor <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widgetthemelooks Enter Addons – Ultimate Template Builder for Ele…
- CVE-2024-7599Advanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpcodeus Advanced Sermons
- CVE-2024-7622Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sendingthemastercut Revision Manager TMC
- CVE-2024-45405gix-path improperly resolves configuration path reported by GitByron gitoxide · gix-path
- CVE-2024-45299alf.io's preloaded data as json is not escaped correctlyalfio-event alf.io
- CVE-2024-45039gnark's Groth16 commitment extension unsound for more than one commitmentConsensys gnark · github.com/consensys/gnark
- CVE-2024-45040gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge propertyConsensys gnark · github.com/consensys/gnark
- CVE-2023-52915media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xferLinux
- CVE-2024-8427Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Updatewpshuffle Frontend Post Submission Manager Lite – Frontend…
- CVE-2024-8317WP AdCenter – Ad Manager & Adsense Ads <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_alignment Attributewpeka-club WP AdCenter – Ad Manager & Adsense Ads
- CVE-2024-6792WP ULike < 4.7.2.1 - Subscriber+ Stored-XSSWP ULike
- CVE-2024-7415Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosurecoffee2code Remember Me Controls
- CVE-2024-40865The issue was addressed by suspending Persona when the virtual keyboard is active.Apple visionOS
- CVE-2024-44082In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted im
- CVE-2024-44837A cross-site scripting (XSS) vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web script
- CVE-2024-45751tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand.