# CVEs published 2024-09-09

56 CVEs were published on September 9, 2024: 10 critical, 14 high. Days are UTC.

- [CVE-2024-8611](https://cve.now/CVE-2024-8611.md): itsourcecode Tailoring Management System ssms.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-8610](https://cve.now/CVE-2024-8610.md): SourceCodester Best House Rental Management System New Tenant Page index.php cross site scripting (CVSS 5.3, SourceCodester Best House Rental Management System)
- [CVE-2024-6796](https://cve.now/CVE-2024-6796.md): Vulnerability in Baxter Connex Health Portal (CVSS 8.2, Baxter Connex Health Portal)
- [CVE-2024-6795](https://cve.now/CVE-2024-6795.md): Vulnerability in Baxter Connex Health Portal (CVSS 10.0, Baxter Connex Health Portal)
- [CVE-2024-42500](https://cve.now/CVE-2024-42500.md): HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services. (CVSS 9.3, Hewlett Packard Enterprise (HPE) HPE HP-UX ONCplus)
- [CVE-2024-45296](https://cve.now/CVE-2024-45296.md): path-to-regexp outputs backtracking regular expressions (CVSS 7.5, pillarjs path-to-regexp · path-to-regexp)
- [CVE-2024-7341](https://cve.now/CVE-2024-7341.md): Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters (CVSS 7.1, org.keycloak:keycloak-services · Red Hat Build of Keyclo… +3)
- [CVE-2024-7318](https://cve.now/CVE-2024-7318.md): Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity (CVSS 4.8, keycloak-core · Red Hat Build of Keycloak +1)
- [CVE-2024-7260](https://cve.now/CVE-2024-7260.md): Keycloak-core: open redirect on account page (CVSS 6.1, keycloak · Red Hat Build of Keycloak +1)
- [CVE-2024-45411](https://cve.now/CVE-2024-45411.md): Twig has a possible sandbox bypass (CVSS 8.6, twigphp Twig · twig/twig)
- [CVE-2024-45406](https://cve.now/CVE-2024-45406.md): Craft CMS stored XSS in breadcrumb list and title fields (CVSS 5.5, craftcms cms · craftcms/cms)
- [CVE-2024-8605](https://cve.now/CVE-2024-8605.md): code-projects Inventory Management Registration Form registration.php cross site scripting (CVSS 6.9, code-projects Inventory Management)
- [CVE-2024-8604](https://cve.now/CVE-2024-8604.md): SourceCodester Online Food Ordering System Create an Account Page index.php cross site scripting (CVSS 6.9, SourceCodester Online Food Ordering System)
- [CVE-2024-8042](https://cve.now/CVE-2024-8042.md): Rapid7 Insight Platform Unauthorized Empty Group Creation (CVSS 2.4, Rapid7 Insight Platform)
- [CVE-2024-45041](https://cve.now/CVE-2024-45041.md): External Secrets Operator vulnerable to privilege escalation (CVSS 8.3, external-secrets · github.com/external-secrets/external-sec…)
- [CVE-2024-8373](https://cve.now/CVE-2024-8373.md): AngularJS improper sanitization in '\<source\>' element (CVSS 4.8, Google AngularJS · angular)
- [CVE-2024-8372](https://cve.now/CVE-2024-8372.md): AngularJS improper sanitization in 'srcset' attribute (CVSS 4.8, Google AngularJS · angular)
- [CVE-2024-40643](https://cve.now/CVE-2024-40643.md): Joplin has a parsing error leading to Cross-site Scripting (XSS) (CVSS 9.7, laurent22 joplin)
- [CVE-2024-7015](https://cve.now/CVE-2024-7015.md): Improper Authentication in Profelis Informatics and Consulting's PassBOX (CVSS 7.1, Profelis Informatics and Consulting PassBox)
- [CVE-2024-6572](https://cve.now/CVE-2024-6572.md): Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' (CVSS 6.3, Checkmk)
- [CVE-2024-8601](https://cve.now/CVE-2024-8601.md): Improper Access Control Vulnerability in TechExcel Back Office Software (CVSS 8.7, TechExcel Software Solutions Back Office Software)
- [CVE-2024-37288](https://cve.now/CVE-2024-37288.md): A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted pa (CVSS 9.9, Elastic Kibana)
- [CVE-2024-45203](https://cve.now/CVE-2024-45203.md): Improper authorization in handler for custom URL scheme issue in "@cosme" App for Android versions prior 5.69.0 and "@cosme" App for iOS ver (CVSS 4.3, istyle "@cosme" App for Android · istyle "@cosme" App for i…)
- [CVE-2024-7918](https://cve.now/CVE-2024-7918.md): Pocket Widget \<= 0.1.3 - Admin+ Stored XSS (CVSS 4.8, Pocket Widget)
- [CVE-2024-7689](https://cve.now/CVE-2024-7689.md): Snapshot Backup \<= 2.1.1 - Stored XSS via CSRF (CVSS 4.7, Snapshot Backup)
- [CVE-2024-7688](https://cve.now/CVE-2024-7688.md): AZIndex \<= 0.8.1 - Index Deletion via CSRF (CVSS 6.5, AZIndex)
- [CVE-2024-7687](https://cve.now/CVE-2024-7687.md): AZIndex \<= 0.8.1 - Stored XSS via CSRF (CVSS 6.1, AZIndex)
- [CVE-2024-6910](https://cve.now/CVE-2024-6910.md): EventON \< 2.2.17 - Admin+ Stored XSS (CVSS 4.8, EventON)
- [CVE-2024-5561](https://cve.now/CVE-2024-5561.md): Popup Maker \< 1.19.1 - Admin+ Stored XSS (CVSS 4.8, Popup Maker)
- [CVE-2024-45625](https://cve.now/CVE-2024-45625.md): Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. (CVSS 6.1, WPMU DEV Forminator)
- [CVE-2024-8586](https://cve.now/CVE-2024-8586.md): Uniong WebITR - Open Redirect (CVSS 6.1, Uniong WebITR)
- [CVE-2024-8585](https://cve.now/CVE-2024-8585.md): LEARNING DIGITAL Orca HCM - Arbitrary File Download (CVSS 6.5, LEARNING DIGITAL Orca HCM)
- [CVE-2024-8584](https://cve.now/CVE-2024-8584.md): LEARNING DIGITAL Orca HCM - Missing Authentication (CVSS 9.8, LEARNING DIGITAL Orca HCM)
- [CVE-2023-50883](https://cve.now/CVE-2023-50883.md): ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression (IIFE), and therefore a sandbox escape (CVSS 6.1)
- [CVE-2024-24510](https://cve.now/CVE-2024-24510.md): Cross Site Scripting vulnerability in Alinto SOGo before 5.10.0 allows a remote attacker to execute arbitrary code via the import function t (CVSS 6.1)
- [CVE-2024-27364](https://cve.now/CVE-2024-27364.md): An issue was discovered in Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, (CVSS 4.4)
- [CVE-2024-27365](https://cve.now/CVE-2024-27365.md): An issue was discovered in Samsung Mobile Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, Exynos 1330, Exyno (CVSS 4.4)
- [CVE-2024-27366](https://cve.now/CVE-2024-27366.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor Exynos Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380 (CVSS 4.4)
- [CVE-2024-27367](https://cve.now/CVE-2024-27367.md): An issue was discovered in Samsung Mobile Processor Exynos Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos 1280, Exynos 1380, (CVSS 4.4)
- [CVE-2024-27368](https://cve.now/CVE-2024-27368.md): An issue was discovered in Samsung Mobile Processor Exynos Mobile Processor, Wearable Processor Exynos 980, Exynos 850, Exynos 1080, Exynos (CVSS 4.4)
- [CVE-2024-27383](https://cve.now/CVE-2024-27383.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27387](https://cve.now/CVE-2024-27387.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-42759](https://cve.now/CVE-2024-42759.md): An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint. (CVSS 6.3)
- [CVE-2024-44085](https://cve.now/CVE-2024-44085.md): ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunction Object attack against a macro. (CVSS 6.1)
- [CVE-2024-44333](https://cve.now/CVE-2024-44333.md): D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400 (CVSS 8.8)
- [CVE-2024-44334](https://cve.now/CVE-2024-44334.md): D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400 (CVSS 8.8)
- [CVE-2024-44335](https://cve.now/CVE-2024-44335.md): D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v2 (CVSS 8.8)
- [CVE-2024-44375](https://cve.now/CVE-2024-44375.md): D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv\_asp function. (CVSS 7.5)
- [CVE-2024-44410](https://cve.now/CVE-2024-44410.md): D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the upgrade\_filter\_asp function. (CVSS 9.8)
- [CVE-2024-44411](https://cve.now/CVE-2024-44411.md): D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp\_info\_htm function. (CVSS 9.8)
- [CVE-2024-44720](https://cve.now/CVE-2024-44720.md): SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin\_safe.php. (CVSS 7.5)
- [CVE-2024-44721](https://cve.now/CVE-2024-44721.md): SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin\_reslib.php. (CVSS 9.8)
- [CVE-2024-44724](https://cve.now/CVE-2024-44724.md): AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite\_url parameter at /admin/site\_add.php. (CVSS 7.2)
- [CVE-2024-44725](https://cve.now/CVE-2024-44725.md): AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php. (CVSS 7.2)
- [CVE-2024-44849](https://cve.now/CVE-2024-44849.md): Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php. (CVSS 9.8)
- [CVE-2024-44902](https://cve.now/CVE-2024-44902.md): A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. (CVSS 9.8, topthink/framework)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.