# CVEs published 2024-09-07

51 CVEs were published on September 7, 2024: 5 critical, 23 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-8566](https://cve.now/CVE-2024-8566.md): code-projects Online Shop Store settings.php cross site scripting (CVSS 6.9, code-projects Online Shop Store)
- [CVE-2024-8565](https://cve.now/CVE-2024-8565.md): SourceCodesters Clinics Patient Management System print\_diseases.php sql injection (CVSS 6.9, SourceCodesters Clinics Patient Management System)
- [CVE-2024-8564](https://cve.now/CVE-2024-8564.md): SourceCodester PHP CRUD update.php sql injection (CVSS 5.3, SourceCodester PHP CRUD)
- [CVE-2024-8563](https://cve.now/CVE-2024-8563.md): SourceCodester PHP CRUD update.php cross site scripting (CVSS 5.3, SourceCodester PHP CRUD)
- [CVE-2024-8562](https://cve.now/CVE-2024-8562.md): SourceCodester PHP CRUD Add.php cross site scripting (CVSS 5.3, SourceCodester PHP CRUD)
- [CVE-2024-8561](https://cve.now/CVE-2024-8561.md): SourceCodester PHP CRUD Delete Person delete.php sql injection (CVSS 5.3, SourceCodester PHP CRUD)
- [CVE-2024-8560](https://cve.now/CVE-2024-8560.md): SourceCodester Simple Invoice Generator System save\_invoice.php sql injection (CVSS 5.3, SourceCodester Simple Invoice Generator System)
- [CVE-2024-8559](https://cve.now/CVE-2024-8559.md): SourceCodester Online Food Menu delete-menu.php sql injection (CVSS 5.1, SourceCodester Online Food Menu)
- [CVE-2024-38650](https://cve.now/CVE-2024-38650.md): An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server. (CVSS 9.9, Veeam Service Provider Console)
- [CVE-2024-42021](https://cve.now/CVE-2024-42021.md): An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials. (CVSS 7.5, Veeam One)
- [CVE-2024-40718](https://cve.now/CVE-2024-40718.md): A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vu (CVSS 8.8, Veeam Nutanix AHV · Veeam Nutanix KVM)
- [CVE-2024-42023](https://cve.now/CVE-2024-42023.md): An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely. (CVSS 7.8, Veeam One)
- [CVE-2024-40714](https://cve.now/CVE-2024-40714.md): An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive (CVSS 8.3, Veeam Backup and Recovery)
- [CVE-2024-42022](https://cve.now/CVE-2024-42022.md): An incorrect permission assignment vulnerability allows an attacker to modify product configuration files. (CVSS 7.5, Veeam One)
- [CVE-2024-42024](https://cve.now/CVE-2024-42024.md): A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on (CVSS 9.1, Veeam One)
- [CVE-2024-40709](https://cve.now/CVE-2024-40709.md): A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level. (CVSS 7.8, Veeam Backup and Recovery)
- [CVE-2024-40713](https://cve.now/CVE-2024-40713.md): A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authe (CVSS 7.8, Veeam Backup and Recovery)
- [CVE-2024-40711](https://cve.now/CVE-2024-40711.md): A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). (CVSS 9.8, KEV, Veeam Backup and Recovery)
- [CVE-2024-39715](https://cve.now/CVE-2024-39715.md): A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC (CVSS 8.5, Veeam Service Provider Console)
- [CVE-2024-40712](https://cve.now/CVE-2024-40712.md): A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege es (CVSS 7.8, Veeam Backup and Recovery)
- [CVE-2024-38651](https://cve.now/CVE-2024-38651.md): A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code executi (CVSS 8.5, Veeam Service Provider Console)
- [CVE-2024-42020](https://cve.now/CVE-2024-42020.md): A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection. (CVSS 7.3, Veeam One)
- [CVE-2024-39714](https://cve.now/CVE-2024-39714.md): A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution (CVSS 9.9, Veeam Service Provider Console)
- [CVE-2024-40710](https://cve.now/CVE-2024-40710.md): A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extracti (CVSS 8.8, Veeam Backup and Recovery)
- [CVE-2024-39718](https://cve.now/CVE-2024-39718.md): An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equival (CVSS 8.1, Veeam Backup and Recovery)
- [CVE-2024-42019](https://cve.now/CVE-2024-42019.md): A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. (CVSS 9.0, Veeam One)
- [CVE-2023-46809](https://cve.now/CVE-2023-46809.md): Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched are (CVSS 7.4, NodeJS Node)
- [CVE-2024-36138](https://cve.now/CVE-2024-36138.md): Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child (CVSS 8.1, NodeJS Node)
- [CVE-2023-39333](https://cve.now/CVE-2023-39333.md): Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. (CVSS 5.3, NodeJS Node)
- [CVE-2024-36137](https://cve.now/CVE-2024-36137.md): A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. (CVSS 3.3, NodeJS Node)
- [CVE-2023-30582](https://cve.now/CVE-2023-30582.md): A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla (CVSS 5.3, NodeJS Node)
- [CVE-2023-30587](https://cve.now/CVE-2023-30587.md): A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspect (CVSS 7.5, NodeJS Node)
- [CVE-2023-30583](https://cve.now/CVE-2023-30583.md): fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the \`--allow-fs-read\` flag in (CVSS 7.5, NodeJS Node)
- [CVE-2023-30584](https://cve.now/CVE-2023-30584.md): A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. (CVSS 7.7, NodeJS Node)
- [CVE-2024-8558](https://cve.now/CVE-2024-8558.md): SourceCodester Food Ordering Management System Price place-order.php improper validation of specified quantity in input (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-8557](https://cve.now/CVE-2024-8557.md): SourceCodester Food Ordering Management System cancel-order.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System)
- [CVE-2024-8555](https://cve.now/CVE-2024-8555.md): SourceCodester Clinics Patient Management System congratulations.php redirect (CVSS 6.9, SourceCodester Clinics Patient Management System)
- [CVE-2024-40681](https://cve.now/CVE-2024-40681.md): IBM MQ security bypass (CVSS 7.5, IBM MQ)
- [CVE-2024-40680](https://cve.now/CVE-2024-40680.md): IBM MQ denial of service (CVSS 5.5, IBM MQ)
- [CVE-2024-37068](https://cve.now/CVE-2024-37068.md): IBM Maximo Application Suite information disclosure (CVSS 5.9, IBM Maximo Application Suite)
- [CVE-2024-8554](https://cve.now/CVE-2024-8554.md): SourceCodester Clinics Patient Management System users.php cross site scripting (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-6010](https://cve.now/CVE-2024-6010.md): Cost Calculator Builder PRO \<= 3.2.1 - Unauthenticated Price Manipulation (CVSS 5.3, StylemixThemes Cost Calculator Builder PRO)
- [CVE-2024-7620](https://cve.now/CVE-2024-7620.md): Customizer Export/Import \<= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import (CVSS 6.6, beaverbuilder Customizer Export/Import)
- [CVE-2024-7112](https://cve.now/CVE-2024-7112.md): Pinpoint Booking System \<= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection (CVSS 8.8, dotonpaper Pinpoint Booking System –)
- [CVE-2024-1596](https://cve.now/CVE-2024-1596.md): Ninja Forms File Uploads \<= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 7.2, SaturdayDrive Ninja Forms - File Uploads)
- [CVE-2024-8523](https://cve.now/CVE-2024-8523.md): lmxcms SQL Command Execution Module admin.php formatData code injection (CVSS 5.1, lmxcms)
- [CVE-2024-6849](https://cve.now/CVE-2024-6849.md): Preloader Plus – WordPress Loading Screen Plugin \<= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, maxsdesign Preloader Plus – WordPress Loading Screen Plugin)
- [CVE-2024-8538](https://cve.now/CVE-2024-8538.md): Big File Uploads \<= 2.1.2 - Authenticated (Author+) Full Path Disclosure (CVSS 4.3, bww Big File Uploads – Increase Maximum File Upload Size)
- [CVE-2024-8521](https://cve.now/CVE-2024-8521.md): Wavelog Live QSO qso index cross site scripting (CVSS 6.9, Wavelog)
- [CVE-2024-45034](https://cve.now/CVE-2024-45034.md): Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-45498](https://cve.now/CVE-2024-45498.md): Apache Airflow: Command Injection in an example DAG (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.