CVEs published September 7, 2024
51 CVEs were published on September 7, 2024: 5 critical, 23 high. 1 is now in CISA KEV.
- Published
- 51
- Critical
- 5
- High
- 23
- Medium
- 22
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- NodeJS Node
- 8
- Veeam Backup and Recovery
- 6
- Veeam One
- 6
- SourceCodester PHP CRUD
- 4
- Veeam Service Provider Console
- 4
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- IBM MQ
- 2
- SourceCodester Clinics Patient Management System
- 2
- SourceCodester Food Ordering Management System
- 2
- beaverbuilder Customizer Export/Import
- 1
Critical 5
- CVE-2024-38650An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.Veeam Service Provider Console
- CVE-2024-42024A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution onVeeam One
- CVE-2024-40711A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).Veeam Backup and Recovery
- CVE-2024-39714A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution Veeam Service Provider Console
- CVE-2024-42019A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account.Veeam One
High 23
- CVE-2024-42021An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.Veeam One
- CVE-2024-40718A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vuVeeam Nutanix AHV · Veeam Nutanix KVM
- CVE-2024-42023An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely.Veeam One
- CVE-2024-40714An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitiveVeeam Backup and Recovery
- CVE-2024-42022An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.Veeam One
- CVE-2024-40709A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level.Veeam Backup and Recovery
- CVE-2024-40713A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor AutheVeeam Backup and Recovery
- CVE-2024-39715A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPCVeeam Service Provider Console
- CVE-2024-40712A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege esVeeam Backup and Recovery
- CVE-2024-38651A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code executiVeeam Service Provider Console
- CVE-2024-42020A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.Veeam One
- CVE-2024-40710A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extractiVeeam Backup and Recovery
- CVE-2024-39718An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalVeeam Backup and Recovery
- CVE-2023-46809Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched areNodeJS Node
- CVE-2024-36138Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via childNodeJS Node
- CVE-2023-30587A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspectNodeJS Node
- CVE-2023-30583fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the `--allow-fs-read` flag in NodeJS Node
- CVE-2023-30584A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.NodeJS Node
- CVE-2024-40681IBM MQ security bypassIBM MQ
- CVE-2024-7112Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injectiondotonpaper Pinpoint Booking System –
- CVE-2024-1596Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File UploadSaturdayDrive Ninja Forms - File Uploads
- CVE-2024-45034Apache Airflow: Authenticated DAG authors could execute code on scheduler nodesApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-45498Apache Airflow: Command Injection in an example DAGApache Software Foundation Apache Airflow · apache-airflow
Medium, low and unrated 23
- CVE-2024-8566code-projects Online Shop Store settings.php cross site scriptingcode-projects Online Shop Store
- CVE-2024-8565SourceCodesters Clinics Patient Management System print_diseases.php sql injectionSourceCodesters Clinics Patient Management System
- CVE-2024-8564SourceCodester PHP CRUD update.php sql injectionSourceCodester PHP CRUD
- CVE-2024-8563SourceCodester PHP CRUD update.php cross site scriptingSourceCodester PHP CRUD
- CVE-2024-8562SourceCodester PHP CRUD Add.php cross site scriptingSourceCodester PHP CRUD
- CVE-2024-8561SourceCodester PHP CRUD Delete Person delete.php sql injectionSourceCodester PHP CRUD
- CVE-2024-8560SourceCodester Simple Invoice Generator System save_invoice.php sql injectionSourceCodester Simple Invoice Generator System
- CVE-2024-8559SourceCodester Online Food Menu delete-menu.php sql injectionSourceCodester Online Food Menu
- CVE-2023-39333Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code.NodeJS Node
- CVE-2024-36137A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.NodeJS Node
- CVE-2023-30582A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flaNodeJS Node
- CVE-2024-8558SourceCodester Food Ordering Management System Price place-order.php improper validation of specified quantity in inputSourceCodester Food Ordering Management System
- CVE-2024-8557SourceCodester Food Ordering Management System cancel-order.php sql injectionSourceCodester Food Ordering Management System
- CVE-2024-8555SourceCodester Clinics Patient Management System congratulations.php redirectSourceCodester Clinics Patient Management System
- CVE-2024-40680IBM MQ denial of serviceIBM MQ
- CVE-2024-37068IBM Maximo Application Suite information disclosureIBM Maximo Application Suite
- CVE-2024-8554SourceCodester Clinics Patient Management System users.php cross site scriptingSourceCodester Clinics Patient Management System
- CVE-2024-6010Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price ManipulationStylemixThemes Cost Calculator Builder PRO
- CVE-2024-7620Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Importbeaverbuilder Customizer Export/Import
- CVE-2024-8523lmxcms SQL Command Execution Module admin.php formatData code injectionlmxcms
- CVE-2024-6849Preloader Plus – WordPress Loading Screen Plugin <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmaxsdesign Preloader Plus – WordPress Loading Screen Plugin
- CVE-2024-8538Big File Uploads <= 2.1.2 - Authenticated (Author+) Full Path Disclosurebww Big File Uploads – Increase Maximum File Upload Size
- CVE-2024-8521Wavelog Live QSO qso index cross site scriptingWavelog