# CVEs published 2024-09-10

237 CVEs were published on September 10, 2024: 16 critical, 114 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2024-45597](https://cve.now/CVE-2024-45597.md): Pluto's http.request allows CR and LF in header values (CVSS 5.3, PlutoLang Pluto)
- [CVE-2024-8441](https://cve.now/CVE-2024-8441.md): An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker w (CVSS 6.7, Ivanti Endpoint Manager)
- [CVE-2024-8322](https://cve.now/CVE-2024-8322.md): Weak authentication in Patch Management of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker t (CVSS 4.3, Ivanti Endpoint Manager)
- [CVE-2024-8321](https://cve.now/CVE-2024-8321.md): Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated atta (CVSS 5.8, Ivanti Endpoint Manager)
- [CVE-2024-8320](https://cve.now/CVE-2024-8320.md): Missing authentication in Network Isolation of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated atta (CVSS 5.3, Ivanti Endpoint Manager)
- [CVE-2024-8191](https://cve.now/CVE-2024-8191.md): SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker (CVSS 7.8, Ivanti Endpoint Manager)
- [CVE-2024-44107](https://cve.now/CVE-2024-44107.md): DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker (CVSS 8.8, Ivanti Workspace Control)
- [CVE-2024-44106](https://cve.now/CVE-2024-44106.md): Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local aut (CVSS 8.8, Ivanti Workspace Control)
- [CVE-2024-44105](https://cve.now/CVE-2024-44105.md): Cleartext transmission of sensitive information in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) all (CVSS 8.2, Ivanti Workspace Control)
- [CVE-2024-44104](https://cve.now/CVE-2024-44104.md): An incorrectly implemented authentication scheme that is subjected to a spoofing attack in the management console of Ivanti Workspace Contro (CVSS 8.8, Ivanti Workspace Control)
- [CVE-2024-44103](https://cve.now/CVE-2024-44103.md): DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker (CVSS 8.8, Ivanti Workspace Control)
- [CVE-2024-8012](https://cve.now/CVE-2024-8012.md): An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local (CVSS 7.8, Ivanti Workspace Control)
- [CVE-2024-8190](https://cve.now/CVE-2024-8190.md): An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated att (CVSS 7.2, KEV, Ivanti CSA)
- [CVE-2024-8232](https://cve.now/CVE-2024-8232.md): iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Type (CVSS 7.5, iniNet Solutions SpiderControl SCADA Web Server)
- [CVE-2024-8655](https://cve.now/CVE-2024-8655.md): Mercury MNVR816 web-static file access (CVSS 6.9, Mercury MNVR816)
- [CVE-2024-8504](https://cve.now/CVE-2024-8504.md): VICIdial Authenticated Remote Code Execution (CVSS 8.8, VICIdial)
- [CVE-2024-8503](https://cve.now/CVE-2024-8503.md): VICIdial Unauthenticated SQL Injection (CVSS 9.8, VICIdial)
- [CVE-2024-45409](https://cve.now/CVE-2024-45409.md): The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector (CVSS 10.0, SAML-Toolkits ruby-saml · ruby-saml)
- [CVE-2024-45596](https://cve.now/CVE-2024-45596.md): Directus's session is cached for OpenID and OAuth2 if \`redirect\` is not used (CVSS 7.4, directus · @directus/api)
- [CVE-2024-37980](https://cve.now/CVE-2024-37980.md): Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…)
- [CVE-2024-38194](https://cve.now/CVE-2024-38194.md): Azure Web Apps Elevation of Privilege Vulnerability (CVSS 8.4, Microsoft Azure Web Apps)
- [CVE-2024-43495](https://cve.now/CVE-2024-43495.md): Windows libarchive Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-43491](https://cve.now/CVE-2024-43491.md): Microsoft Windows Update Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2024-43487](https://cve.now/CVE-2024-43487.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-30073](https://cve.now/CVE-2024-30073.md): Windows Security Zone Mapping Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-43479](https://cve.now/CVE-2024-43479.md): Microsoft Power Automate Desktop Remote Code Execution Vulnerability (CVSS 8.5, Microsoft Power Automate for Desktop)
- [CVE-2024-43476](https://cve.now/CVE-2024-43476.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-43475](https://cve.now/CVE-2024-43475.md): Microsoft Windows Admin Center Information Disclosure Vulnerability (CVSS 7.3, Microsoft Windows Server 2008 Service Pack · Microsoft Win…)
- [CVE-2024-43470](https://cve.now/CVE-2024-43470.md): Azure Network Watcher VM Agent Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Azure Network Watcher VM Extension)
- [CVE-2024-43469](https://cve.now/CVE-2024-43469.md): Azure CycleCloud Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Azure CycleCloud)
- [CVE-2024-43466](https://cve.now/CVE-2024-43466.md): Microsoft SharePoint Server Denial of Service Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-43461](https://cve.now/CVE-2024-43461.md): Windows MSHTML Platform Spoofing Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2024-43458](https://cve.now/CVE-2024-43458.md): Windows Networking Information Disclosure Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2024-43457](https://cve.now/CVE-2024-43457.md): Windows Setup and Deployment Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-43455](https://cve.now/CVE-2024-43455.md): Windows Remote Desktop Licensing Service Spoofing Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-43454](https://cve.now/CVE-2024-43454.md): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVSS 7.1, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-38119](https://cve.now/CVE-2024-38119.md): Windows Network Address Translation (NAT) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38045](https://cve.now/CVE-2024-38045.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-21416](https://cve.now/CVE-2024-21416.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-38263](https://cve.now/CVE-2024-38263.md): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-38260](https://cve.now/CVE-2024-38260.md): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsoft W…)
- [CVE-2024-38259](https://cve.now/CVE-2024-38259.md): Microsoft Management Console Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38258](https://cve.now/CVE-2024-38258.md): Windows Remote Desktop Licensing Service Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-38257](https://cve.now/CVE-2024-38257.md): Microsoft AllJoyn API Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38248](https://cve.now/CVE-2024-38248.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-38247](https://cve.now/CVE-2024-38247.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38246](https://cve.now/CVE-2024-38246.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-38245](https://cve.now/CVE-2024-38245.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38244](https://cve.now/CVE-2024-38244.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38243](https://cve.now/CVE-2024-38243.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38239](https://cve.now/CVE-2024-38239.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2024-38238](https://cve.now/CVE-2024-38238.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38237](https://cve.now/CVE-2024-38237.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38235](https://cve.now/CVE-2024-38235.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38234](https://cve.now/CVE-2024-38234.md): Windows Networking Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38233](https://cve.now/CVE-2024-38233.md): Windows Networking Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38232](https://cve.now/CVE-2024-38232.md): Windows Networking Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38231](https://cve.now/CVE-2024-38231.md): Windows Remote Desktop Licensing Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-38228](https://cve.now/CVE-2024-38228.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-38227](https://cve.now/CVE-2024-38227.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-38226](https://cve.now/CVE-2024-38226.md): Microsoft Publisher Security Feature Bypass Vulnerability (CVSS 7.3, KEV, Microsoft Office · Microsoft Publisher)
- [CVE-2024-38225](https://cve.now/CVE-2024-38225.md): Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Dynamics 365 Business Central 2023 Release Wave ·…)
- [CVE-2024-38217](https://cve.now/CVE-2024-38217.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 5.4, KEV, Microsoft Windows)
- [CVE-2024-38046](https://cve.now/CVE-2024-38046.md): PowerShell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38014](https://cve.now/CVE-2024-38014.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-37341](https://cve.now/CVE-2024-37341.md): Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…)
- [CVE-2024-37965](https://cve.now/CVE-2024-37965.md): Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…)
- [CVE-2024-43465](https://cve.now/CVE-2024-43465.md): Microsoft Excel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2024-43492](https://cve.now/CVE-2024-43492.md): Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft AutoUpdate for Mac)
- [CVE-2024-43482](https://cve.now/CVE-2024-43482.md): Microsoft Outlook for iOS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Outlook for iOS)
- [CVE-2024-43474](https://cve.now/CVE-2024-43474.md): Microsoft SQL Server Information Disclosure Vulnerability (CVSS 7.6, Microsoft SQL Server)
- [CVE-2024-43467](https://cve.now/CVE-2024-43467.md): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-43464](https://cve.now/CVE-2024-43464.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-43463](https://cve.now/CVE-2024-43463.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2024-38256](https://cve.now/CVE-2024-38256.md): Windows Kernel-Mode Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38254](https://cve.now/CVE-2024-38254.md): Windows Authentication Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38253](https://cve.now/CVE-2024-38253.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38252](https://cve.now/CVE-2024-38252.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38250](https://cve.now/CVE-2024-38250.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Office for Android · Microsoft Office for Univ… +2)
- [CVE-2024-38249](https://cve.now/CVE-2024-38249.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38242](https://cve.now/CVE-2024-38242.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38241](https://cve.now/CVE-2024-38241.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38240](https://cve.now/CVE-2024-38240.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-38236](https://cve.now/CVE-2024-38236.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2008 Service Pack · Microsoft… +2)
- [CVE-2024-38230](https://cve.now/CVE-2024-38230.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2024-38188](https://cve.now/CVE-2024-38188.md): Azure Network Watcher VM Agent Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Azure Network Watcher VM Extension)
- [CVE-2024-38220](https://cve.now/CVE-2024-38220.md): Azure Stack Hub Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Azure Stack Hub)
- [CVE-2024-38216](https://cve.now/CVE-2024-38216.md): Azure Stack Hub Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Azure Stack Hub)
- [CVE-2024-38018](https://cve.now/CVE-2024-38018.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-26191](https://cve.now/CVE-2024-26191.md): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-26186](https://cve.now/CVE-2024-26186.md): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37342](https://cve.now/CVE-2024-37342.md): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (CVSS 7.1, Microsoft SQL Server)
- [CVE-2024-37337](https://cve.now/CVE-2024-37337.md): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (CVSS 7.1, Microsoft SQL Server)
- [CVE-2024-37339](https://cve.now/CVE-2024-37339.md): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37340](https://cve.now/CVE-2024-37340.md): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37335](https://cve.now/CVE-2024-37335.md): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37966](https://cve.now/CVE-2024-37966.md): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (CVSS 7.1, Microsoft SQL Server)
- [CVE-2024-37338](https://cve.now/CVE-2024-37338.md): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2023-6841](https://cve.now/CVE-2023-6841.md): Keycloak: amount of attributes per object is not limited and it may lead to dos (CVSS 7.5, keycloak · Red Hat build of Quarkus +7)
- [CVE-2024-45595](https://cve.now/CVE-2024-45595.md): D-Tale allows Remote Code Execution through the Query input on Chart Builder (CVSS 6.1, man-group dtale · dtale)
- [CVE-2024-45592](https://cve.now/CVE-2024-45592.md): auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped (CVSS 8.2, DamienHarper auditor-bundle · damienharper/auditor-bundle)
- [CVE-2024-45591](https://cve.now/CVE-2024-45591.md): XWiki Platform document history including authors of any page exposed to unauthorized actors (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2024-45590](https://cve.now/CVE-2024-45590.md): body-parser vulnerable to denial of service when url encoding is enabled (CVSS 7.5, expressjs body-parser · body-parser)
- [CVE-2024-45593](https://cve.now/CVE-2024-45593.md): Nix affected by unsafe NAR unpacking (CVSS 9.1, NixOS nix)
- [CVE-2024-45412](https://cve.now/CVE-2024-45412.md): Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack (CVSS 5.3, yeti-platform yeti)
- [CVE-2024-45407](https://cve.now/CVE-2024-45407.md): Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client (CVSS 6.5, LizardByte Sunshine)
- [CVE-2024-6876](https://cve.now/CVE-2024-6876.md): Out-of-bounds read in OSCAT-Library (CVSS 4.4, oscat.de OSCAT Basic Library · CODESYS OSCAT Basic Library)
- [CVE-2024-45393](https://cve.now/CVE-2024-45393.md): Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries (CVSS 6.4, cvat-ai cvat)
- [CVE-2024-45044](https://cve.now/CVE-2024-45044.md): Bareos's negative command ACLs can be circumvented by abbreviating commands (CVSS 8.8, bareos)
- [CVE-2024-42423](https://cve.now/CVE-2024-42423.md): Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled fo (CVSS 6.1, Dell Wyse Proprietary OS)
- [CVE-2024-43800](https://cve.now/CVE-2024-43800.md): serve-static affected by template injection that can lead to XSS (CVSS 5.0, expressjs serve-static · serve-static)
- [CVE-2024-43799](https://cve.now/CVE-2024-43799.md): send vulnerable to template injection that can lead to XSS (CVSS 5.0, pillarjs send · send)
- [CVE-2024-23185](https://cve.now/CVE-2024-23185.md): Very large headers can cause resource exhaustion when parsing message. (CVSS 7.5, Open-Xchange OX Dovecot Pro)
- [CVE-2022-45856](https://cve.now/CVE-2022-45856.md): An improper certificate validation vulnerability \[CWE-295\] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 a (CVSS 4.6, Fortinet FortiClientiOS · Fortinet FortiClientAndroid +3)
- [CVE-2024-21753](https://cve.now/CVE-2024-21753.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2. (CVSS 5.5, Fortinet FortiClientEMS)
- [CVE-2024-31489](https://cve.now/CVE-2024-31489.md): AAn improper certificate validation vulnerability \[CWE-295\] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLin (CVSS 6.4, Fortinet FortiClientMac · Fortinet FortiClientEMS +2)
- [CVE-2024-36511](https://cve.now/CVE-2024-36511.md): An improperly implemented security check for standard vulnerability \[CWE-358\] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4 (CVSS 3.4, Fortinet FortiADC)
- [CVE-2024-35282](https://cve.now/CVE-2024-35282.md): A cleartext storage of sensitive information in memory vulnerability \[CWE-316\] affecting FortiClient VPN iOS 7.2 all versions, 7.0 all versi (CVSS 3.9, Fortinet FortiClientiOS)
- [CVE-2024-33508](https://cve.now/CVE-2024-33508.md): An improper neutralization of special elements used in a command ('Command Injection') vulnerability \[CWE-77\] in Fortinet FortiClientEMS 7.2 (CVSS 6.9, Fortinet FortiClientEMS)
- [CVE-2023-44254](https://cve.now/CVE-2023-44254.md): An authorization bypass through user-controlled key \[CWE-639\] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 and FortiManager (CVSS 4.7, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2024-31490](https://cve.now/CVE-2024-31490.md): An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 (CVSS 4.2, Fortinet FortiSandbox)
- [CVE-2024-45323](https://cve.now/CVE-2024-45323.md): An improper access control vulnerability \[CWE-284\] in FortiEDR Manager API 6.2.0 through 6.2.2, 6.0 all versions may allow in a shared envir (CVSS 4.6, Fortinet FortiEDR Manager)
- [CVE-2024-43796](https://cve.now/CVE-2024-43796.md): express vulnerable to XSS via response.redirect() (CVSS 5.0, expressjs express · express)
- [CVE-2024-23184](https://cve.now/CVE-2024-23184.md): Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. (CVSS 5.0, Open-Xchange OX Dovecot Pro)
- [CVE-2024-27257](https://cve.now/CVE-2024-27257.md): IBM OpenPages information disclosure (CVSS 4.3, IBM OpenPages)
- [CVE-2024-8654](https://cve.now/CVE-2024-8654.md): MongoDB Server may access non-initialized region of memory leading to unexpected behaviour (CVSS 5.0, MongoDB Server)
- [CVE-2024-8443](https://cve.now/CVE-2024-8443.md): Libopensc: heap buffer overflow in openpgp driver when generating key (CVSS 2.9, opensc · Red Hat Enterprise Linux)
- [CVE-2024-8369](https://cve.now/CVE-2024-8369.md): EventPrime \<= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure (CVSS 5.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-6282](https://cve.now/CVE-2024-6282.md): Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \<= 2.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-jltma-wrapper-link Element (CVSS 5.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-7770](https://cve.now/CVE-2024-7770.md): Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress \<= 6.5.5 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, bitpressadmin File Manager)
- [CVE-2024-40754](https://cve.now/CVE-2024-40754.md): Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escarg (CVSS 6.9, Samsung Open Source Escargot)
- [CVE-2024-8645](https://cve.now/CVE-2024-8645.md): Access of Uninitialized Pointer in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2024-45032](https://cve.now/CVE-2024-45032.md): A vulnerability has been identified in Industrial Edge Management Pro (All versions \< V1.9.5), Industrial Edge Management Virtual (All versi (CVSS 10.0, Siemens Industrial Edge Management Pro · Siemens Industrial…)
- [CVE-2024-44087](https://cve.now/CVE-2024-44087.md): A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions \< V6.0 SP (CVSS 8.6, Siemens Automation License Manager)
- [CVE-2024-43781](https://cve.now/CVE-2024-43781.md): A vulnerability has been identified in SINUMERIK 828D V4 (All versions \< V4.95 SP3), SINUMERIK 840D sl V4 (All versions \< V4.95 SP3 in conne (CVSS 5.5, Siemens SINUMERIK 828D · Siemens SINUMERIK 840D sl +1)
- [CVE-2024-43647](https://cve.now/CVE-2024-43647.md): A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES (CVSS 7.5, Siemens SIMATIC S7-200 SMART CPU CR40 · Siemens SIMATIC… +8)
- [CVE-2024-42345](https://cve.now/CVE-2024-42345.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP2). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2024-42344](https://cve.now/CVE-2024-42344.md): A vulnerability has been identified in SINEMA Remote Connect Client (All versions \< V3.2 SP2). (CVSS 4.4, Siemens SINEMA Remote Connect Client)
- [CVE-2024-41171](https://cve.now/CVE-2024-41171.md): A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions \< V5.24), SINUMERIK 840D sl V4 (All (CVSS 8.8, Siemens SINUMERIK 828D · Siemens SINUMERIK 840D sl +1)
- [CVE-2024-41170](https://cve.now/CVE-2024-41170.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions \< V2302.0015), Tecnomatix Plant Simulation V2404 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-37995](https://cve.now/CVE-2024-37995.md): A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions \< V4.2), SIMATIC Reader RF610R ETSI (6 (CVSS 2.7, Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25)
- [CVE-2024-37994](https://cve.now/CVE-2024-37994.md): A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions \< V4.2), SIMATIC Reader RF610R ETSI (6 (CVSS 4.3, Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25)
- [CVE-2024-37993](https://cve.now/CVE-2024-37993.md): A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions \< V4.2), SIMATIC Reader RF610R ETSI (6 (CVSS 5.3, Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25)
- [CVE-2024-37992](https://cve.now/CVE-2024-37992.md): A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions \< V4.2), SIMATIC Reader RF610R ETSI (6 (CVSS 4.9, Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25)
- [CVE-2024-37991](https://cve.now/CVE-2024-37991.md): A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions \< V4.2), SIMATIC Reader RF610R ETSI (6 (CVSS 5.3, Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25)
- [CVE-2024-37990](https://cve.now/CVE-2024-37990.md): A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions \< V4.2), SIMATIC Reader RF610R ETSI (6 (CVSS 6.5, Siemens SIMATIC Reader RF610R CMIIT · Siemens SIMATIC R… +25)
- [CVE-2024-35783](https://cve.now/CVE-2024-35783.md): A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions \< V2020 SP2 Update 5 (CVSS 9.1, Siemens SIMATIC BATCH · Siemens SIMATIC Information Serv… +4)
- [CVE-2024-33698](https://cve.now/CVE-2024-33698.md): A vulnerability has been identified in Opcenter Quality (All versions \< V2406), Opcenter RDnL (All versions \< V2410), SIMATIC PCS neo V4.0 ( (CVSS 9.8, Siemens Opcenter Quality · Siemens Opcenter RDnL +4)
- [CVE-2024-32006](https://cve.now/CVE-2024-32006.md): A vulnerability has been identified in SINEMA Remote Connect Client (All versions \< V3.2 SP2). (CVSS 4.3, Siemens SINEMA Remote Connect Client)
- [CVE-2023-49069](https://cve.now/CVE-2023-49069.md): A vulnerability has been identified in Mendix Runtime V10 (All versions \< V10.17.0 only if the basic authentication mechanism is used by the (CVSS 5.3, Siemens Mendix Runtime)
- [CVE-2023-30756](https://cve.now/CVE-2023-30756.md): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. (CVSS 5.9, Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +8)
- [CVE-2023-30755](https://cve.now/CVE-2023-30755.md): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. (CVSS 4.4, Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +8)
- [CVE-2023-28827](https://cve.now/CVE-2023-28827.md): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. (CVSS 5.9, Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +8)
- [CVE-2023-2919](https://cve.now/CVE-2023-2919.md): Tutor LMS \<= 2.7.4 - Cross-Site Request Forgery via 'addon\_enable\_disable' (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-8241](https://cve.now/CVE-2024-8241.md): Nova Blocks by Pixelgrade \<= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute (CVSS 6.4, Nova Blocks by Pixelgrade)
- [CVE-2024-8543](https://cve.now/CVE-2024-8543.md): Slider comparison image before and after \<= 0.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, hardwaremaster Slider comparison image before and after)
- [CVE-2024-39582](https://cve.now/CVE-2024-39582.md): Dell PowerScale InsightIQ, version 5.0, contain a Use of hard coded Credentials vulnerability. (CVSS 2.3, Dell PowerScale InsightIQ)
- [CVE-2024-39574](https://cve.now/CVE-2024-39574.md): Dell PowerScale InsightIQ, version 5.1, contain an Improper Privilege Management vulnerability. (CVSS 6.7, Dell PowerScale InsightIQ)
- [CVE-2024-39580](https://cve.now/CVE-2024-39580.md): Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains an Improper Access Control vulnerability. (CVSS 6.7, Dell PowerScale InsightIQ)
- [CVE-2024-39581](https://cve.now/CVE-2024-39581.md): Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a File or Directories Accessible to External Parties vulnerability. (CVSS 7.3, Dell PowerScale InsightIQ)
- [CVE-2024-39583](https://cve.now/CVE-2024-39583.md): Dell PowerScale InsightIQ, versions 5.0 through 5.1, contains a Use of a Broken or Risky Cryptographic Algorithm vulnerability. (CVSS 8.1, Dell PowerScale InsightIQ)
- [CVE-2024-43393](https://cve.now/CVE-2024-43393.md): Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD devices (CVSS 8.1, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43392](https://cve.now/CVE-2024-43392.md): Phoenix Contact: Firewall reconfiguration through the FW\_environment variables in MGUARD devices (CVSS 8.1, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43391](https://cve.now/CVE-2024-43391.md): Phoenix Contact: Firewall reconfiguration through the FW\_PORTFORWARDING.SRC\_IP in MGUARD devices (CVSS 8.1, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43390](https://cve.now/CVE-2024-43390.md): Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devices (CVSS 8.1, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43389](https://cve.now/CVE-2024-43389.md): Phoenix Contact: OSPF reconfiguration due to improper input validation in MGUARD devices (CVSS 8.1, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43388](https://cve.now/CVE-2024-43388.md): Phoenix Contact: SNMP reconfiguration due to improper input validation in MGUARD devices (CVSS 8.8, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43387](https://cve.now/CVE-2024-43387.md): Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices (CVSS 8.8, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43386](https://cve.now/CVE-2024-43386.md): Phoenix Contact: OS command execution through EMAIL\_NOTIFICATION.TO in mGuard devices. (CVSS 8.8, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-43385](https://cve.now/CVE-2024-43385.md): Phoenix Contact: OS command execution through PROXY\_HTTP\_PORT in mGuard devices (CVSS 8.8, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-7699](https://cve.now/CVE-2024-7699.md): Phoenix Contact: OS command execution in MGUARD products (CVSS 8.8, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-7698](https://cve.now/CVE-2024-7698.md): Phoenix Contact: Access to CSRF tokens of higher privileged users in MGUARD products (CVSS 5.7, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-8258](https://cve.now/CVE-2024-8258.md): Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS (CVSS 2.0, Logitech Options Plus)
- [CVE-2024-42425](https://cve.now/CVE-2024-42425.md): Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. (CVSS 3.8, Dell Precision Rack BIOS)
- [CVE-2024-42424](https://cve.now/CVE-2024-42424.md): Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Improper Input Validation vulnerability. (CVSS 5.3, Dell Precision Rack BIOS)
- [CVE-2024-7734](https://cve.now/CVE-2024-7734.md): Phoenix Contact: Multiple mGuard devices are vulnerable to a drain of open file descriptors. (CVSS 5.3, PHOENIX CONTACT FL MGUARD · PHOENIX CONTACT TC MGUARD RS… +7)
- [CVE-2024-6596](https://cve.now/CVE-2024-6596.md): Endress+Hauser: Multiple products are vulnerable to code injection (CVSS 9.8, Endress+Hauser Echo Curve Viewer · Endress+Hauser FieldC… +5)
- [CVE-2024-42427](https://cve.now/CVE-2024-42427.md): Dell ThinOS versions 2402 and 2405, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerab (CVSS 7.6, Dell Wyse Proprietary OS)
- [CVE-2024-7618](https://cve.now/CVE-2024-7618.md): Community by PeepSo – Social Network, Membership, Registration, User Profiles \<= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter (CVSS 4.4, Community by PeepSo – Download from PeepSo.com)
- [CVE-2024-7655](https://cve.now/CVE-2024-7655.md): Community by PeepSo – Social Network, Membership, Registration, User Profiles \<= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, Community by PeepSo – Download from PeepSo.com)
- [CVE-2024-44072](https://cve.now/CVE-2024-44072.md): OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. (CVSS 5.7, BUFFALO WHR-1166DHP2 · BUFFALO WHR-1166DHP3 +16)
- [CVE-2024-7955](https://cve.now/CVE-2024-7955.md): Starbox \< 3.5.2 - Admin+ Stored XSS (CVSS 4.8, Starbox)
- [CVE-2024-7891](https://cve.now/CVE-2024-7891.md): Floating Contact Button \< 2.8 - Admin+ Stored XSS (CVSS 4.8, Floating Contact Button)
- [CVE-2024-7784](https://cve.now/CVE-2024-7784.md): During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly k (CVSS 6.1, Axis Communications AB AXIS OS)
- [CVE-2024-6979](https://cve.now/CVE-2024-6979.md): Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- an (CVSS 6.8, Axis Communications AB AXIS OS)
- [CVE-2024-6173](https://cve.now/CVE-2024-6173.md): 51l3nc3, member of the AXIS OS Bug Bounty Program, has found that a Guard Tour VAPIX API parameter allowed the use of arbitrary values allow (CVSS 6.5, Axis Communications AB AXIS OS)
- [CVE-2024-21528](https://cve.now/CVE-2024-21528.md): All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to impro (CVSS 5.9, node-gettext)
- [CVE-2024-45285](https://cve.now/CVE-2024-45285.md): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 5.4, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-6509](https://cve.now/CVE-2024-6509.md): Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which cou (CVSS 6.5, Axis Communications AB AXIS OS)
- [CVE-2024-45284](https://cve.now/CVE-2024-45284.md): Missing authorization check in SAP Student Life Cycle Management (SLcM) (CVSS 2.4, SAP\_SE SAP Student Life Cycle Management)
- [CVE-2024-0067](https://cve.now/CVE-2024-0067.md): Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API ledlimit.cgi was vulnerable for path traversal attacks all (CVSS 4.3, Axis Communications AB AXIS OS)
- [CVE-2024-45283](https://cve.now/CVE-2024-45283.md): Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service) (CVSS 6.0, SAP\_SE SAP NetWeaver AS for Java)
- [CVE-2024-45504](https://cve.now/CVE-2024-45504.md): Cross-site request forgery (CSRF) vulnerability in multiple Alps System Integration products and the OEM products allow a remote unauthentic (CVSS 6.5, Alps System Integration Co. InterSafe WebFilter · Alps… +12)
- [CVE-2024-45281](https://cve.now/CVE-2024-45281.md): DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 5.8, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-45280](https://cve.now/CVE-2024-45280.md): Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application) (CVSS 4.8, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2024-45279](https://cve.now/CVE-2024-45279.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel) (CVSS 6.1, SAP\_SE SAP NetWeaver Application Server for ABAP)
- [CVE-2024-44121](https://cve.now/CVE-2024-44121.md): Information Disclosure in SAP S/4 HANA (Statutory Reports) (CVSS 4.3, SAP\_SE SAP S/4 HANA)
- [CVE-2024-44120](https://cve.now/CVE-2024-44120.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 4.7, SAP\_SE SAP NetWeaver Enterprise Portal)
- [CVE-2024-44117](https://cve.now/CVE-2024-44117.md): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 5.4, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-44112](https://cve.now/CVE-2024-44112.md): Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution) (CVSS 4.3, SAP\_SE SAP for Oil & Gas)
- [CVE-2024-41728](https://cve.now/CVE-2024-41728.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 2.7, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-45286](https://cve.now/CVE-2024-45286.md): Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface) (CVSS 6.5, SAP\_SE SAP Production and Revenue Accounting)
- [CVE-2024-44116](https://cve.now/CVE-2024-44116.md): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-44115](https://cve.now/CVE-2024-44115.md): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-44114](https://cve.now/CVE-2024-44114.md): Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 2.0, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-44113](https://cve.now/CVE-2024-44113.md): Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer) (CVSS 4.3, SAP\_SE SAP Business Warehouse)
- [CVE-2024-42380](https://cve.now/CVE-2024-42380.md): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-42378](https://cve.now/CVE-2024-42378.md): Cross-Site Scripting (XSS) in eProcurement on S/4HANA (CVSS 6.1, SAP\_SE SAP S/4HANA eProcurement)
- [CVE-2024-42371](https://cve.now/CVE-2024-42371.md): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 5.4, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-41729](https://cve.now/CVE-2024-41729.md): Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer) (CVSS 4.3, SAP\_SE SAP NetWeaver BW)
- [CVE-2024-8478](https://cve.now/CVE-2024-8478.md): Affiliate Super Assistent \<= 1.5.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, worschtebrot Affiliate Super Assistent)
- [CVE-2024-8268](https://cve.now/CVE-2024-8268.md): Frontend Dashboard \<= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Call (CVSS 8.8, vinoth06 Frontend Dashboard)
- [CVE-2024-6342](https://cve.now/CVE-2024-6342.md): \*\*UNSUPPORTED WHEN ASSIGNED\*\* A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AA (CVSS 9.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2024-38270](https://cve.now/CVE-2024-38270.md): An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens gen (CVSS 5.3, Zyxel GS1900-10HP firmware)
- [CVE-2023-36103](https://cve.now/CVE-2023-36103.md): Command Injection vulnerability in goform/SetIPTVCfg interface of Tenda AC15 V15.03.05.20 allows remote attackers to run arbitrary commands (CVSS 8.0)
- [CVE-2023-37226](https://cve.now/CVE-2023-37226.md): Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function. (CVSS 9.8)
- [CVE-2023-37227](https://cve.now/CVE-2023-37227.md): Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data. (CVSS 9.8)
- [CVE-2023-37229](https://cve.now/CVE-2023-37229.md): Loftware Spectrum before 5.1 allows SSRF. (CVSS 8.8)
- [CVE-2023-37230](https://cve.now/CVE-2023-37230.md): Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF. (CVSS 8.8)
- [CVE-2023-37231](https://cve.now/CVE-2023-37231.md): Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password. (CVSS 9.8)
- [CVE-2023-37232](https://cve.now/CVE-2023-37232.md): Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor. (CVSS 7.5)
- [CVE-2023-37233](https://cve.now/CVE-2023-37233.md): Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks. (CVSS 8.8)
- [CVE-2023-37234](https://cve.now/CVE-2023-37234.md): Loftware Spectrum through 4.6 has unprotected JMX Registry. (CVSS 7.5)
- [CVE-2024-25073](https://cve.now/CVE-2024-25073.md): An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Ex (CVSS 5.9)
- [CVE-2024-25074](https://cve.now/CVE-2024-25074.md): An issue was discovered in Samsung Semiconductor Mobile Processor and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Ex (CVSS 5.9)
- [CVE-2024-31960](https://cve.now/CVE-2024-31960.md): An issue was discovered in Samsung Mobile Processor Exynos 1480, Exynos 2400. (CVSS 7.8)
- [CVE-2024-34831](https://cve.now/CVE-2024-34831.md): cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in (CVSS 6.1)
- [CVE-2024-37728](https://cve.now/CVE-2024-37728.md): Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attack (CVSS 7.5)
- [CVE-2024-43040](https://cve.now/CVE-2024-43040.md): Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid paramet (CVSS 9.1)
- [CVE-2024-44667](https://cve.now/CVE-2024-44667.md): Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2\_v1.0.1557.15.35\_P0 is vulnerable to Incorrect Access Contr (CVSS 8.0)
- [CVE-2024-44676](https://cve.now/CVE-2024-44676.md): eladmin v2.7 and before is vulnerable to Cross Site Scripting (XSS) which allows an attacker to execute arbitrary code via LocalStoreControl (CVSS 6.1)
- [CVE-2024-44677](https://cve.now/CVE-2024-44677.md): eladmin v2.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the Datab (CVSS 9.8)
- [CVE-2024-44815](https://cve.now/CVE-2024-44815.md): Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash F (CVSS 8.0)
- [CVE-2024-44867](https://cve.now/CVE-2024-44867.md): phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php. (CVSS 7.5)
- [CVE-2024-44871](https://cve.now/CVE-2024-44871.md): An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via up (CVSS 7.2)
- [CVE-2024-44872](https://cve.now/CVE-2024-44872.md): A reflected cross-site scripting (XSS) vulnerability in moziloCMS v3.0 allows attackers to execute arbitrary code in the context of a user's (CVSS 6.1)
- [CVE-2024-44893](https://cve.now/CVE-2024-44893.md): An issue in the component /jeecg-boot/jmreport/dict/list of JimuReport v1.7.8 allows attacker to escalate privileges via a crafted GET reque (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.