CVEs published September 10, 2024
237 CVEs were published on September 10, 2024: 16 critical, 114 high. 5 are now in CISA KEV.
- Published
- 237
- Critical
- 16
- High
- 114
- Medium
- 97
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 5
- Fix available
- 136
Most affected products
- Microsoft Windows
- 36
- PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- 12
- Microsoft SQL Server
- 10
- SAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- 8
- Microsoft Windows Server 2008 Service Pack · Microsoft… +2
- 7
- Ivanti Workspace Control
- 6
- Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25
- 6
- Axis Communications AB AXIS OS
- 5
- Dell PowerScale InsightIQ
- 5
- Ivanti Endpoint Manager
- 5
Critical 16
- CVE-2024-8503VICIdial Unauthenticated SQL InjectionVICIdial
- CVE-2024-45409The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectorSAML-Toolkits ruby-saml · ruby-saml
- CVE-2024-43491Microsoft Windows Update Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38220Azure Stack Hub Elevation of Privilege VulnerabilityMicrosoft Azure Stack Hub
- CVE-2024-45593Nix affected by unsafe NAR unpackingNixOS nix
- CVE-2024-45032A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versiSiemens Industrial Edge Management Pro · Siemens Industrial…
- CVE-2024-35783A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions < V2020 SP2 Update 5Siemens SIMATIC BATCH · Siemens SIMATIC Information Serv… +4
- CVE-2024-33698A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (Siemens Opcenter Quality · Siemens Opcenter RDnL +4
- CVE-2024-6596Endress+Hauser: Multiple products are vulnerable to code injectionEndress+Hauser Echo Curve Viewer · Endress+Hauser FieldC… +5
- CVE-2024-6342**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-37226Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.
- CVE-2023-37227Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
- CVE-2023-37231Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.
- CVE-2024-43040Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid paramet
- CVE-2024-44677eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the Datab
- CVE-2024-44893An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET reque
High 114
- CVE-2024-8191SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attackerIvanti Endpoint Manager
- CVE-2024-44107DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker Ivanti Workspace Control
- CVE-2024-44106Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local autIvanti Workspace Control
- CVE-2024-44105Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allIvanti Workspace Control
- CVE-2024-44104An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace ControIvanti Workspace Control
- CVE-2024-44103DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker Ivanti Workspace Control
- CVE-2024-8012An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a localIvanti Workspace Control
- CVE-2024-8190An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attIvanti CSA
- CVE-2024-8232iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous TypeiniNet Solutions SpiderControl SCADA Web Server
- CVE-2024-8504VICIdial Authenticated Remote Code ExecutionVICIdial
- CVE-2024-45596Directus's session is cached for OpenID and OAuth2 if `redirect` is not useddirectus · @directus/api
- CVE-2024-37980Microsoft SQL Server Elevation of Privilege VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2024-38194Azure Web Apps Elevation of Privilege VulnerabilityMicrosoft Azure Web Apps
- CVE-2024-43495Windows libarchive Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30073Windows Security Zone Mapping Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-43479Microsoft Power Automate Desktop Remote Code Execution VulnerabilityMicrosoft Power Automate for Desktop
- CVE-2024-43476Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2024-43475Microsoft Windows Admin Center Information Disclosure VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft Win…
- CVE-2024-43470Azure Network Watcher VM Agent Elevation of Privilege VulnerabilityMicrosoft Azure Network Watcher VM Extension
- CVE-2024-43469Azure CycleCloud Remote Code Execution VulnerabilityMicrosoft Azure CycleCloud
- CVE-2024-43461Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-43458Windows Networking Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-43457Windows Setup and Deployment Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-43455Windows Remote Desktop Licensing Service Spoofing VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft… +2
- CVE-2024-43454Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft… +2
- CVE-2024-38119Windows Network Address Translation (NAT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38045Windows TCP/IP Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-21416Windows TCP/IP Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38263Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft… +2
- CVE-2024-38260Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsoft W…
- CVE-2024-38259Microsoft Management Console Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38257Microsoft AllJoyn API Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38248Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38247Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38246Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38245Kernel Streaming Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38244Kernel Streaming Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38243Kernel Streaming Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38239Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38238Kernel Streaming Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38237Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38233Windows Networking Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38232Windows Networking Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38228Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-38227Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-38226Microsoft Publisher Security Feature Bypass VulnerabilityMicrosoft Office · Microsoft Publisher
- CVE-2024-38225Microsoft Dynamics 365 Business Central Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 Business Central 2023 Release Wave ·…
- CVE-2024-38046PowerShell Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38014Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-37341Microsoft SQL Server Elevation of Privilege VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2024-37965Microsoft SQL Server Elevation of Privilege VulnerabilityMicrosoft SQL Server 2016 Service Pack · Microsoft SQL Serv…
- CVE-2024-43465Microsoft Excel Elevation of Privilege VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel +1
- CVE-2024-43492Microsoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityMicrosoft AutoUpdate for Mac
- CVE-2024-43474Microsoft SQL Server Information Disclosure VulnerabilityMicrosoft SQL Server
- CVE-2024-43467Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft… +2
- CVE-2024-43464Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-43463Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2024-38253Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38252Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38250Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Office for Android · Microsoft Office for Univ… +2
- CVE-2024-38249Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38242Kernel Streaming Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38241Kernel Streaming Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38240Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38236DHCP Server Service Denial of Service VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft… +2
- CVE-2024-38188Azure Network Watcher VM Agent Elevation of Privilege VulnerabilityMicrosoft Azure Network Watcher VM Extension
- CVE-2024-38216Azure Stack Hub Elevation of Privilege VulnerabilityMicrosoft Azure Stack Hub
- CVE-2024-38018Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-26191Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-26186Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37342Microsoft SQL Server Native Scoring Information Disclosure VulnerabilityMicrosoft SQL Server
- CVE-2024-37337Microsoft SQL Server Native Scoring Information Disclosure VulnerabilityMicrosoft SQL Server
- CVE-2024-37339Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37340Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37335Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37966Microsoft SQL Server Native Scoring Information Disclosure VulnerabilityMicrosoft SQL Server
- CVE-2024-37338Microsoft SQL Server Native Scoring Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2023-6841Keycloak: amount of attributes per object is not limited and it may lead to doskeycloak · Red Hat build of Quarkus +7
- CVE-2024-45592auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escapedDamienHarper auditor-bundle · damienharper/auditor-bundle
- CVE-2024-45590body-parser vulnerable to denial of service when url encoding is enabledexpressjs body-parser · body-parser
- CVE-2024-45044Bareos's negative command ACLs can be circumvented by abbreviating commandsbareos
- CVE-2024-23185Very large headers can cause resource exhaustion when parsing message.Open-Xchange OX Dovecot Pro
- CVE-2024-7770Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Uploadbitpressadmin File Manager
- CVE-2024-44087A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SPSiemens Automation License Manager
- CVE-2024-43647A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ESSiemens SIMATIC S7-200 SMART CPU CR40 · Siemens SIMATIC… +8
- CVE-2024-41171A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (AllSiemens SINUMERIK 828D · Siemens SINUMERIK 840D sl +1
- CVE-2024-41170A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0015), Tecnomatix Plant Simulation V2404 (AllSiemens Tecnomatix Plant Simulation
- CVE-2024-39581Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability.Dell PowerScale InsightIQ
- CVE-2024-39583Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability.Dell PowerScale InsightIQ
- CVE-2024-43393Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43392Phoenix Contact: Firewall reconfiguration through the FW_environment variables in MGUARD devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43391Phoenix Contact: Firewall reconfiguration through the FW_PORTFORWARDING.SRC_IP in MGUARD devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43390Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43389Phoenix Contact: OSPF reconfiguration due to improper input validation in MGUARD devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43388Phoenix Contact: SNMP reconfiguration due to improper input validation in MGUARD devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43387Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43386Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-43385Phoenix Contact: OS command execution through PROXY_HTTP_PORT in mGuard devicesPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-7699Phoenix Contact: OS command execution in MGUARD productsPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-42427Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerabDell Wyse Proprietary OS
- CVE-2024-8478Affiliate Super Assistent <= 1.5.3 - Unauthenticated Arbitrary Shortcode Executionworschtebrot Affiliate Super Assistent
- CVE-2024-8268Frontend Dashboard <= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Callvinoth06 Frontend Dashboard
- CVE-2023-36103Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands
- CVE-2023-37229Loftware Spectrum before 5.1 allows SSRF.
- CVE-2023-37230Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.
- CVE-2023-37232Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor.
- CVE-2023-37233Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.
- CVE-2023-37234Loftware Spectrum through 4.6 has unprotected JMX Registry.
- CVE-2024-31960An issue was discovered in Samsung Mobile Processor Exynos 1480, Exynos 2400.
- CVE-2024-37728Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attack
- CVE-2024-44667Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to Incorrect Access Contr
- CVE-2024-44815Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash F
- CVE-2024-44867phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.
- CVE-2024-44871An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via up
Medium, low and unrated 107
- CVE-2024-45597Pluto's http.request allows CR and LF in header valuesPlutoLang Pluto
- CVE-2024-8441An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker wIvanti Endpoint Manager
- CVE-2024-8322Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker tIvanti Endpoint Manager
- CVE-2024-8321Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attaIvanti Endpoint Manager
- CVE-2024-8320Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attaIvanti Endpoint Manager
- CVE-2024-8655Mercury MNVR816 web-static file accessMercury MNVR816
- CVE-2024-43487Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-43466Microsoft SharePoint Server Denial of Service VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-38258Windows Remote Desktop Licensing Service Information Disclosure VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft… +2
- CVE-2024-38235Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38234Windows Networking Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38231Windows Remote Desktop Licensing Service Denial of Service VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft… +2
- CVE-2024-38217Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-43482Microsoft Outlook for iOS Information Disclosure VulnerabilityMicrosoft Outlook for iOS
- CVE-2024-38256Windows Kernel-Mode Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38254Windows Authentication Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38230Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2024-45595D-Tale allows Remote Code Execution through the Query input on Chart Builderman-group dtale · dtale
- CVE-2024-45591XWiki Platform document history including authors of any page exposed to unauthorized actorsxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2024-45412Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attackyeti-platform yeti
- CVE-2024-45407Sunshine has incorrect state management during pairing process may lead to incorrectly authorized clientLizardByte Sunshine
- CVE-2024-6876Out-of-bounds read in OSCAT-Libraryoscat.de OSCAT Basic Library · CODESYS OSCAT Basic Library
- CVE-2024-45393Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveriescvat-ai cvat
- CVE-2024-42423Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled foDell Wyse Proprietary OS
- CVE-2024-43800serve-static affected by template injection that can lead to XSSexpressjs serve-static · serve-static
- CVE-2024-43799send vulnerable to template injection that can lead to XSSpillarjs send · send
- CVE-2022-45856An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 aFortinet FortiClientiOS · Fortinet FortiClientAndroid +3
- CVE-2024-21753A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.Fortinet FortiClientEMS
- CVE-2024-31489AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinFortinet FortiClientMac · Fortinet FortiClientEMS +2
- CVE-2024-36511An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4Fortinet FortiADC
- CVE-2024-35282A cleartext storage of sensitive information in memory vulnerability [CWE-316] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versiFortinet FortiClientiOS
- CVE-2024-33508An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in Fortinet FortiClientEMS 7.2Fortinet FortiClientEMS
- CVE-2023-44254An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManagerFortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2024-31490An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1Fortinet FortiSandbox
- CVE-2024-45323An improper access control vulnerability [CWE-284] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared envirFortinet FortiEDR Manager
- CVE-2024-43796express vulnerable to XSS via response.redirect()expressjs express · express
- CVE-2024-23184Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive.Open-Xchange OX Dovecot Pro
- CVE-2024-27257IBM OpenPages information disclosureIBM OpenPages
- CVE-2024-8654MongoDB Server may access non-initialized region of memory leading to unexpected behaviourMongoDB Server
- CVE-2024-8443Libopensc: heap buffer overflow in openpgp driver when generating keyopensc · Red Hat Enterprise Linux
- CVE-2024-8369EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosuremetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-6282Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Elementlitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2024-40754Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects EscargSamsung Open Source Escargot
- CVE-2024-8645Access of Uninitialized Pointer in WiresharkWireshark Foundation Wireshark
- CVE-2024-43781A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in conneSiemens SINUMERIK 828D · Siemens SINUMERIK 840D sl +1
- CVE-2024-42345A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2).Siemens SINEMA Remote Connect Server
- CVE-2024-42344A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2).Siemens SINEMA Remote Connect Client
- CVE-2024-37995A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25
- CVE-2024-37994A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25
- CVE-2024-37993A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25
- CVE-2024-37992A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25
- CVE-2024-37991A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25
- CVE-2024-37990A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25
- CVE-2024-32006A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2).Siemens SINEMA Remote Connect Client
- CVE-2023-49069A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by theSiemens Mendix Runtime
- CVE-2023-30756A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl.Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +8
- CVE-2023-30755A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl.Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +8
- CVE-2023-28827A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl.Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +8
- CVE-2023-2919Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'themeum Tutor LMS – eLearning and online course solution
- CVE-2024-8241Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align AttributeNova Blocks by Pixelgrade
- CVE-2024-8543Slider comparison image before and after <= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scriptinghardwaremaster Slider comparison image before and after
- CVE-2024-39582Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability.Dell PowerScale InsightIQ
- CVE-2024-39574Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability.Dell PowerScale InsightIQ
- CVE-2024-39580Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability.Dell PowerScale InsightIQ
- CVE-2024-7698Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD productsPHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-8258Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOSLogitech Options Plus
- CVE-2024-42425Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability.Dell Precision Rack BIOS
- CVE-2024-42424Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Improper Input Validation vulnerability.Dell Precision Rack BIOS
- CVE-2024-7734Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors.PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7
- CVE-2024-7618Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content ParameterCommunity by PeepSo – Download from PeepSo.com
- CVE-2024-7655Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site ScriptingCommunity by PeepSo – Download from PeepSo.com
- CVE-2024-44072OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters.BUFFALO WHR-1166DHP2 · BUFFALO WHR-1166DHP3 +16
- CVE-2024-7955Starbox < 3.5.2 - Admin+ Stored XSSStarbox
- CVE-2024-7891Floating Contact Button < 2.8 - Admin+ Stored XSSFloating Contact Button
- CVE-2024-7784During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly kAxis Communications AB AXIS OS
- CVE-2024-6979Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- anAxis Communications AB AXIS OS
- CVE-2024-617351l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allowAxis Communications AB AXIS OS
- CVE-2024-21528All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to impronode-gettext
- CVE-2024-45285Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-6509Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which couAxis Communications AB AXIS OS
- CVE-2024-45284Missing authorization check in SAP Student Life Cycle Management (SLcM)SAP_SE SAP Student Life Cycle Management
- CVE-2024-0067Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks allAxis Communications AB AXIS OS
- CVE-2024-45283Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)SAP_SE SAP NetWeaver AS for Java
- CVE-2024-45504Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthenticAlps System Integration Co. InterSafe WebFilter · Alps… +12
- CVE-2024-45281DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-45280Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)SAP_SE SAP NetWeaver AS Java
- CVE-2024-45279Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)SAP_SE SAP NetWeaver Application Server for ABAP
- CVE-2024-44121Information Disclosure in SAP S/4 HANA (Statutory Reports)SAP_SE SAP S/4 HANA
- CVE-2024-44120Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalSAP_SE SAP NetWeaver Enterprise Portal
- CVE-2024-44117Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-44112Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution)SAP_SE SAP for Oil & Gas
- CVE-2024-41728Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-45286Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface)SAP_SE SAP Production and Revenue Accounting
- CVE-2024-44116Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-44115Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-44114Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-44113Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer)SAP_SE SAP Business Warehouse
- CVE-2024-42380Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-42378Cross-Site Scripting (XSS) in eProcurement on S/4HANASAP_SE SAP S/4HANA eProcurement
- CVE-2024-42371Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-41729Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)SAP_SE SAP NetWeaver BW
- CVE-2024-38270An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens genZyxel GS1900-10HP firmware
- CVE-2024-25073An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Ex
- CVE-2024-25074An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Ex
- CVE-2024-34831cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in
- CVE-2024-44676eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreControl
- CVE-2024-44872A reflected cross-site scripting (XSS) vulnerability in moziloCMS v3.0 allows attackers to execute arbitrary code in the context of a user's