CVEs published September 9, 2024
56 CVEs were published on September 9, 2024: 10 critical, 14 high.
- Published
- 56
- Critical
- 10
- High
- 14
- Medium
- 31
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- AZIndex
- 2
- Baxter Connex Health Portal
- 2
- Google AngularJS · angular
- 2
- LEARNING DIGITAL Orca HCM
- 2
- Checkmk
- 1
- code-projects Inventory Management
- 1
- craftcms cms · craftcms/cms
- 1
- Elastic Kibana
- 1
- EventON
- 1
- external-secrets · github.com/external-secrets/external-sec…
- 1
Critical 10
- CVE-2024-6795Vulnerability in Baxter Connex Health PortalBaxter Connex Health Portal
- CVE-2024-42500HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.Hewlett Packard Enterprise (HPE) HPE HP-UX ONCplus
- CVE-2024-40643Joplin has a parsing error leading to Cross-site Scripting (XSS)laurent22 joplin
- CVE-2024-37288A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted paElastic Kibana
- CVE-2024-8584LEARNING DIGITAL Orca HCM - Missing AuthenticationLEARNING DIGITAL Orca HCM
- CVE-2024-44410D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade_filter_asp function.
- CVE-2024-44411D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.
- CVE-2024-44721SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.
- CVE-2024-44849Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.
- CVE-2024-44902A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.topthink/framework
High 14
- CVE-2024-6796Vulnerability in Baxter Connex Health PortalBaxter Connex Health Portal
- CVE-2024-45296path-to-regexp outputs backtracking regular expressionspillarjs path-to-regexp · path-to-regexp
- CVE-2024-7341Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adaptersorg.keycloak:keycloak-services · Red Hat Build of Keyclo… +3
- CVE-2024-45411Twig has a possible sandbox bypasstwigphp Twig · twig/twig
- CVE-2024-45041External Secrets Operator vulnerable to privilege escalationexternal-secrets · github.com/external-secrets/external-sec…
- CVE-2024-7015Improper Authentication in Profelis Informatics and Consulting's PassBOXProfelis Informatics and Consulting PassBox
- CVE-2024-8601Improper Access Control Vulnerability in TechExcel Back Office SoftwareTechExcel Software Solutions Back Office Software
- CVE-2024-44333D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400
- CVE-2024-44334D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400
- CVE-2024-44335D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v2
- CVE-2024-44375D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function.
- CVE-2024-44720SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.
- CVE-2024-44724AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_add.php.
- CVE-2024-44725AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php.
Medium, low and unrated 32
- CVE-2024-8611itsourcecode Tailoring Management System ssms.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-8610SourceCodester Best House Rental Management System New Tenant Page index.php cross site scriptingSourceCodester Best House Rental Management System
- CVE-2024-7318Keycloak-core: one time passcode (otp) is valid longer than expiration timeseveritykeycloak-core · Red Hat Build of Keycloak +1
- CVE-2024-7260Keycloak-core: open redirect on account pagekeycloak · Red Hat Build of Keycloak +1
- CVE-2024-45406Craft CMS stored XSS in breadcrumb list and title fieldscraftcms cms · craftcms/cms
- CVE-2024-8605code-projects Inventory Management Registration Form registration.php cross site scriptingcode-projects Inventory Management
- CVE-2024-8604SourceCodester Online Food Ordering System Create an Account Page index.php cross site scriptingSourceCodester Online Food Ordering System
- CVE-2024-8042Rapid7 Insight Platform Unauthorized Empty Group CreationRapid7 Insight Platform
- CVE-2024-8373AngularJS improper sanitization in '<source>' elementGoogle AngularJS · angular
- CVE-2024-8372AngularJS improper sanitization in 'srcset' attributeGoogle AngularJS · angular
- CVE-2024-6572Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem'Checkmk
- CVE-2024-45203Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS veristyle "@cosme" App for Android · istyle "@cosme" App for i…
- CVE-2024-7918Pocket Widget <= 0.1.3 - Admin+ Stored XSSPocket Widget
- CVE-2024-7689Snapshot Backup <= 2.1.1 - Stored XSS via CSRFSnapshot Backup
- CVE-2024-7688AZIndex <= 0.8.1 - Index Deletion via CSRFAZIndex
- CVE-2024-7687AZIndex <= 0.8.1 - Stored XSS via CSRFAZIndex
- CVE-2024-6910EventON < 2.2.17 - Admin+ Stored XSSEventON
- CVE-2024-5561Popup Maker < 1.19.1 - Admin+ Stored XSSPopup Maker
- CVE-2024-45625Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1.WPMU DEV Forminator
- CVE-2024-8586Uniong WebITR - Open RedirectUniong WebITR
- CVE-2024-8585LEARNING DIGITAL Orca HCM - Arbitrary File DownloadLEARNING DIGITAL Orca HCM
- CVE-2023-50883ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape
- CVE-2024-24510Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function t
- CVE-2024-27364An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330,
- CVE-2024-27365An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyno
- CVE-2024-27366An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380
- CVE-2024-27367An issue was discovered in Samsung Mobile Processor Exynos Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380,
- CVE-2024-27368An issue was discovered in Samsung Mobile Processor Exynos Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos
- CVE-2024-27383An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27387An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-42759An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.
- CVE-2024-44085ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro.