# CVEs published 2024-09-06

73 CVEs were published on September 6, 2024: 11 critical, 28 high. Days are UTC.

- [CVE-2024-34158](https://cve.now/CVE-2024-34158.md): Stack exhaustion in Parse in go/build/constraint (CVSS 7.5, Go standard library go/build/constraint · stdlib)
- [CVE-2024-34156](https://cve.now/CVE-2024-34156.md): Stack exhaustion in Decoder.Decode in encoding/gob (CVSS 7.5, Go standard library encoding/gob · stdlib)
- [CVE-2024-34155](https://cve.now/CVE-2024-34155.md): Stack exhaustion in all Parse functions in go/parser (CVSS 4.3, Go standard library go/parser · stdlib)
- [CVE-2024-7652](https://cve.now/CVE-2024-7652.md): Type Confusion in Async Generators in Javascript Engine (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-38640](https://cve.now/CVE-2024-38640.md): Download Station (CVSS 7.0, QNAP Systems Download Station)
- [CVE-2024-38642](https://cve.now/CVE-2024-38642.md): QuMagie (CVSS 1.0, QNAP Systems QuMagie)
- [CVE-2024-38641](https://cve.now/CVE-2024-38641.md): QTS, QuTS hero (CVSS 7.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-32763](https://cve.now/CVE-2024-32763.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-21906](https://cve.now/CVE-2024-21906.md): QTS, QuTS hero (CVSS 4.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-34979](https://cve.now/CVE-2023-34979.md): QTS, QuTS hero (CVSS 6.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-34974](https://cve.now/CVE-2023-34974.md): QTS, QuTS hero, QuTScloud, QVR, QES (CVSS 8.8, QNAP Systems QTS · QNAP Systems QuTS hero +3)
- [CVE-2024-32762](https://cve.now/CVE-2024-32762.md): QuLog Center (CVSS 8.2, QNAP Systems QuLog Center)
- [CVE-2024-27125](https://cve.now/CVE-2024-27125.md): Helpdesk (CVSS 3.5, QNAP Systems Helpdesk)
- [CVE-2024-32771](https://cve.now/CVE-2024-32771.md): QTS, QuTS hero (CVSS 2.6, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-39298](https://cve.now/CVE-2023-39298.md): QTS, QuTS hero (CVSS 7.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-39300](https://cve.now/CVE-2023-39300.md): QTS (CVSS 7.2, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-45038](https://cve.now/CVE-2023-45038.md): Music Station (CVSS 4.3, QNAP Systems Music Station)
- [CVE-2023-50360](https://cve.now/CVE-2023-50360.md): Video Station (CVSS 8.8, QNAP Systems Video Station)
- [CVE-2023-47563](https://cve.now/CVE-2023-47563.md): Video Station (CVSS 7.4, QNAP Systems Video Station)
- [CVE-2024-21904](https://cve.now/CVE-2024-21904.md): QTS, QuTS hero (CVSS 5.9, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2022-27592](https://cve.now/CVE-2022-27592.md): QVR Smart Client (CVSS 6.7, QNAP Systems QVR Smart Client)
- [CVE-2024-27126](https://cve.now/CVE-2024-27126.md): Notes Station 3 (CVSS 6.3, QNAP Systems Notes Station)
- [CVE-2024-27122](https://cve.now/CVE-2024-27122.md): Notes Station 3 (CVSS 6.3, QNAP Systems Notes Station)
- [CVE-2024-21903](https://cve.now/CVE-2024-21903.md): QTS, QuTS hero (CVSS 6.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-21898](https://cve.now/CVE-2024-21898.md): QTS, QuTS hero (CVSS 8.8, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-21897](https://cve.now/CVE-2024-21897.md): QTS, QuTS hero (CVSS 8.9, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-51368](https://cve.now/CVE-2023-51368.md): QTS, QuTS hero (CVSS 5.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-51367](https://cve.now/CVE-2023-51367.md): QTS, QuTS hero (CVSS 5.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-51366](https://cve.now/CVE-2023-51366.md): QTS, QuTS hero (CVSS 8.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-50366](https://cve.now/CVE-2023-50366.md): QTS, QuTS hero (CVSS 4.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-8394](https://cve.now/CVE-2024-8394.md): When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitab (CVSS 6.5, Mozilla Thunderbird)
- [CVE-2024-8517](https://cve.now/CVE-2024-8517.md): SPIP Bigup Multipart File Upload OS Command Injection (CVSS 9.8, SPIP)
- [CVE-2024-45294](https://cve.now/CVE-2024-45294.md): \`org.hl7.fhir.core\` XXE vulnerability in XSLT transforms (CVSS 8.6, hapifhir org.hl7.fhir.core · ca.uhn.hapi.fhir:org.hl7.fh… +5)
- [CVE-2024-8509](https://cve.now/CVE-2024-8509.md): Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication (CVSS 7.5, forklift-controller · Red Hat Migration Toolkit for Virtual…)
- [CVE-2024-25584](https://cve.now/CVE-2024-25584.md): Dovecot accepts dot LF DOT LF symbol as end of DATA command. (CVSS 5.3, Open-Xchange OX Dovecot Pro)
- [CVE-2024-7611](https://cve.now/CVE-2024-7611.md): Enter Addons – Ultimate Template Builder for Elementor \<= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Events Card Widget (CVSS 6.4, themelooks Enter Addons – Ultimate Template Builder for Ele…)
- [CVE-2024-7493](https://cve.now/CVE-2024-7493.md): WPCOM Member \<= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta (CVSS 9.8, whyun WPCOM Member)
- [CVE-2024-8428](https://cve.now/CVE-2024-8428.md): ForumWP – Forum & Discussion Board Plugin \<= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover (CVSS 8.8, ultimatemember ForumWP – Forum & Discussion Board)
- [CVE-2024-7599](https://cve.now/CVE-2024-7599.md): Advanced Sermons \<= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpcodeus Advanced Sermons)
- [CVE-2024-7622](https://cve.now/CVE-2024-7622.md): Revision Manager TMC \<= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending (CVSS 4.3, themastercut Revision Manager TMC)
- [CVE-2024-6445](https://cve.now/CVE-2024-6445.md): Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX (CVSS 10.0, DataFlowX Technology DataDiodeX)
- [CVE-2024-45405](https://cve.now/CVE-2024-45405.md): gix-path improperly resolves configuration path reported by Git (CVSS 6.0, Byron gitoxide · gix-path)
- [CVE-2024-45300](https://cve.now/CVE-2024-45300.md): Bypassing promo code limitations with race conditions (CVSS 7.5, alfio-event alf.io)
- [CVE-2024-45299](https://cve.now/CVE-2024-45299.md): alf.io's preloaded data as json is not escaped correctly (CVSS 6.5, alfio-event alf.io)
- [CVE-2024-45039](https://cve.now/CVE-2024-45039.md): gnark's Groth16 commitment extension unsound for more than one commitment (CVSS 6.2, Consensys gnark · github.com/consensys/gnark)
- [CVE-2024-45040](https://cve.now/CVE-2024-45040.md): gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge property (CVSS 5.9, Consensys gnark · github.com/consensys/gnark)
- [CVE-2024-1744](https://cve.now/CVE-2024-1744.md): IDOR in Ariva Computer's Accord ORS (CVSS 9.2, Ariva Computer Accord ORS)
- [CVE-2023-52916](https://cve.now/CVE-2023-52916.md): media: aspeed: Fix memory overwrite if timing is 1600x900 (CVSS 7.8, Linux)
- [CVE-2023-52915](https://cve.now/CVE-2023-52915.md): media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035\_i2c\_master\_xfer (no CVSS, Linux)
- [CVE-2024-8427](https://cve.now/CVE-2024-8427.md): Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin \<= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, wpshuffle Frontend Post Submission Manager Lite – Frontend…)
- [CVE-2024-8317](https://cve.now/CVE-2024-8317.md): WP AdCenter – Ad Manager & Adsense Ads \<= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad\_alignment Attribute (CVSS 6.4, wpeka-club WP AdCenter – Ad Manager & Adsense Ads)
- [CVE-2024-8292](https://cve.now/CVE-2024-8292.md): WP-Recall – Registration, Profile, Commerce & More \<= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update (CVSS 9.8, wppost WP-Recall – Registration, Profile, Commerce & More)
- [CVE-2024-7349](https://cve.now/CVE-2024-7349.md): LifterLMS \<= 7.7.5 - Authenticated (Admin+) SQL Injection (CVSS 7.2, chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…)
- [CVE-2024-6792](https://cve.now/CVE-2024-6792.md): WP ULike \< 4.7.2.1 - Subscriber+ Stored-XSS (CVSS 3.5, WP ULike)
- [CVE-2024-39585](https://cve.now/CVE-2024-39585.md): Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. (CVSS 7.9, Dell SmartFabric OS10 Software)
- [CVE-2024-38486](https://cve.now/CVE-2024-38486.md): Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elemen (CVSS 7.5, Dell SmartFabric OS10 Software)
- [CVE-2024-8247](https://cve.now/CVE-2024-8247.md): Newsletters \<= 4.9.9.2 - Authenticated Privilege Escalation (CVSS 8.8, contrid Newsletters)
- [CVE-2024-8480](https://cve.now/CVE-2024-8480.md): Image Optimizer, Resizer and CDN – Sirv \<= 7.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, Image Optimizer, Resizer and CDN – Sirv)
- [CVE-2024-7415](https://cve.now/CVE-2024-7415.md): Remember Me Controls \<= 2.0.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code Remember Me Controls)
- [CVE-2024-40865](https://cve.now/CVE-2024-40865.md): The issue was addressed by suspending Persona when the virtual keyboard is active. (CVSS 5.3, Apple visionOS)
- [CVE-2024-44082](https://cve.now/CVE-2024-44082.md): In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted im (CVSS 4.3)
- [CVE-2024-44401](https://cve.now/CVE-2024-44401.md): D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade\_filter.asp file (CVSS 9.8)
- [CVE-2024-44402](https://cve.now/CVE-2024-44402.md): D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp\_info.htm. (CVSS 9.8)
- [CVE-2024-44408](https://cve.now/CVE-2024-44408.md): D-Link DIR-823G v1.0.2B05\_20181207 is vulnerable to Information Disclosure. (CVSS 7.5)
- [CVE-2024-44739](https://cve.now/CVE-2024-44739.md): Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage\_user&id=. (CVSS 8.8)
- [CVE-2024-44837](https://cve.now/CVE-2024-44837.md): A cross-site scripting (XSS) vulnerability in the component \\bean\\Manager.java of Drug v1.0 allows attackers to execute arbitrary web script (CVSS 5.4)
- [CVE-2024-44838](https://cve.now/CVE-2024-44838.md): RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogin.php. (CVSS 9.8)
- [CVE-2024-44839](https://cve.now/CVE-2024-44839.md): RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article.php. (CVSS 9.8)
- [CVE-2024-44844](https://cve.now/CVE-2024-44844.md): DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the name parameter in the run\_comm (CVSS 8.0)
- [CVE-2024-44845](https://cve.now/CVE-2024-44845.md): DrayTek Vigor3900 v1.5.1.6 was discovered to contain an authenticated command injection vulnerability via the value parameter in the filter\_ (CVSS 8.0)
- [CVE-2024-45751](https://cve.now/CVE-2024-45751.md): tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. (CVSS 5.9)
- [CVE-2024-45758](https://cve.now/CVE-2024-45758.md): H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command ex (CVSS 9.1, h2o · ai.h2o:h2o-core)
- [CVE-2024-45771](https://cve.now/CVE-2024-45771.md): RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogin.php. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.