CVEs published September 12, 2024
118 CVEs were published on September 12, 2024: 20 critical, 39 high.
- Published
- 118
- Critical
- 20
- High
- 39
- Medium
- 57
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 52
Most affected products
- GitLab
- 15
- Ivanti EPM
- 11
- mindsdb
- 11
- OpenText eDirectory
- 6
- Music Request Manager
- 3
- Pegasystems Pega Infinity
- 3
- Docker Desktop
- 2
- espressif esp-now
- 2
- Misiek Photo Album
- 2
- MM-Breaking News
- 2
Critical 20
- CVE-2024-6678Authentication Bypass by Spoofing in GitLabGitLab
- CVE-2024-8695A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.Docker Desktop
- CVE-2024-45823FactoryTalk® Batch View™ Authentication Bypass Vulnerability via shared secretsRockwell Automation FactoryTalk® Batch View™
- CVE-2024-45824FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input ValidationRockwell Automation FactoryTalk View Site Edition
- CVE-2024-28991SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionSolarWinds Access Rights Manager
- CVE-2024-45856A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whmindsdb
- CVE-2024-8522LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'thimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-8529LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'thimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-32840An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-34783An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-29847Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthentiIvanti EPM
- CVE-2024-34779An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-32848An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-34785An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-32843An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-32845An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-32846An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-32842An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin pIvanti EPM
- CVE-2024-34334ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password function.
- CVE-2024-40457No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file.
High 39
- CVE-2024-8751CVE-2024-8751SICK AG MSC800 · Endress+Hauser MARSIC200 +14
- CVE-2024-7961Rockwell Automation Path Traversal Vulnerability in Pavilion8®Rockwell Automation Pavilion8®
- CVE-2024-7960Rockwell Automation Incorrect Privileges and Path Traversal Vulnerability in Pavilion8®Rockwell Automation Pavilion8®
- CVE-2024-8533Rockwell Automation OptixPanel™ Privilege Escalation Vulnerability via File PermissionsRockwell Automation 2800C OptixPanel™ Compact · Rockwell… +1
- CVE-2024-6077Rockwell Automation ControlLogix/GuardLogix 5580 and CompactLogix/Compact GuardLogix® 5380 Vulnerable to DoS vulnerability via CIPRockwell Automation CompactLogix · Rockwell Automation C… +3
- CVE-2024-20430Cisco Meraki Systems Manager Agent for Windows Privilege Escalation VulnerabilityCisco Meraki Systems Manager Agent
- CVE-2024-8696A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.Docker Desktop
- CVE-2024-8635Server-Side Request Forgery (SSRF) in GitLabGitLab
- CVE-2024-8124Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2024-8640Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabGitLab
- CVE-2024-6658Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows OS Command Injection.Progress LoadMaster
- CVE-2024-45826ThinManager® Code Execution VulnerabilityRockwell Automation ThinManager
- CVE-2024-458255015-U8IHFT Denial-of-Service Vulnerability via CIP MessageRockwell Automation 5015-U8IHFT
- CVE-2024-6510Local privilege escalation vulnerability in AVG Internet SecurityAVG Internet Security
- CVE-2024-3306IDOR in Utarit Information's SoliClubUtarit Information SoliClub
- CVE-2024-45855Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousmindsdb
- CVE-2024-45854Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousmindsdb
- CVE-2024-3305IDOR in Utarit Information's SoliClubUtarit Information SoliClub
- CVE-2024-45853Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousmindsdb
- CVE-2024-45852Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model tomindsdb
- CVE-2024-45851An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointmindsdb
- CVE-2024-45850An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointmindsdb
- CVE-2024-45849An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointmindsdb
- CVE-2024-45848An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integrationmindsdb
- CVE-2024-45847An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integratimindsdb
- CVE-2024-45846An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integrationmindsdb
- CVE-2024-45857Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl fcleanlab
- CVE-2024-27321An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabRefuel autolabel · refuel-autolabel
- CVE-2024-27320An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classifiRefuel autolabel · refuel-autolabel
- CVE-2021-22532Possible NLDAP Denial of Service attack VulnerabilityOpenText eDirectory
- CVE-2021-38133Possible Improper authentication Vulnerability in OpenText eDirectoryOpenText eDirectory
- CVE-2024-8749SQL Injection vulnerability in Idoit proSynetics Idoit pro
- CVE-2024-2010Reflected XSS in TE Informatics' V5 SoftwareTE Informatics
- CVE-2024-7766Adicon Server <= 1.2 - Admin+ SQL InjectionAdicon Server
- CVE-2024-45624Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II.PgPool Global Development Group Pgpool-II
- CVE-2024-37397An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allowIvanti EPM
- CVE-2024-44459A memory allocation issue in vernemq v2.0.1 allows attackers to cause a Denial of Service (DoS) via excessive memory consumption.
- CVE-2024-44460An invalid read size in Nanomq v0.21.9 allows attackers to cause a Denial of Service (DoS).
- CVE-2024-45181An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70.
Medium, low and unrated 59
- CVE-2024-45607whatsapp-api-js fails to validate message's signatureSecreto31126 whatsapp-api-js · whatsapp-api-js
- CVE-2024-8311Improper Protection of Alternate Path in GitLabGitLab
- CVE-2024-4472Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2024-8641Privilege Context Switching Error in GitLabGitLab
- CVE-2024-45383A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36Microsoft HDAudBus.sys
- CVE-2024-45303Discourse Calendar plugin event names susceptible to XSSdiscourse-calendar
- CVE-2024-8631Privilege Defined With Unsafe Actions in GitLabGitLab
- CVE-2024-8754External Control of Critical State Data in GitLabGitLab
- CVE-2024-2743Incorrect Authorization in GitLabGitLab
- CVE-2024-4612URL Redirection to Untrusted Site ('Open Redirect') in GitLabGitLab
- CVE-2024-4660Missing Authorization in GitLabGitLab
- CVE-2024-5435Generation of Error Message Containing Sensitive Information in GitLabGitLab
- CVE-2024-6446Business Logic Errors in GitLabGitLab
- CVE-2024-6389Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLabGitLab
- CVE-2024-6840Automation-controller: gain access to the k8s api server via job execution with container groupautomation-controller · Red Hat Ansible Automation Platform…
- CVE-2024-6702Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.Pegasystems Pega Infinity
- CVE-2024-6701Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.Pegasystems Pega Infinity
- CVE-2024-6700Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.Pegasystems Pega Infinity
- CVE-2024-42483ESP-NOW Replay Attacks Vulnerabilityespressif esp-now
- CVE-2024-42484ESP-NOW OOB Vulnerability In Group Type Messageespressif esp-now
- CVE-2024-28990SolarWinds Access Rights Manager (ARM) Hardcoded Credentials Authentication Bypass VulnerabilitySolarWinds Access Rights Manager
- CVE-2021-22503Improper Neutralization of Input During Web Page Generation VulnerabilityOpenText eDirectory
- CVE-2021-22518Sensitive Information logging in NetIQ Identity Manager DriverOpenText Identity Manager AzureAD Driver
- CVE-2021-22533Possible Insertion of Sensitive Information into Log File VulnerabilityOpenText eDirectory
- CVE-2021-38131Cross-Site Scripting (XSS) VulnerabilityOpenText eDirectory
- CVE-2021-38132Possible External service interaction VulnerabilityOpenText eDirectory
- CVE-2022-26322Possible Insertion of Sensitive Information into Log File Vulnerability in Identity ManagerOpenText Identity Manager REST Driver
- CVE-2024-8750Cross-site Scripting vulnerability in Idoit proSynetics Idoit pro
- CVE-2024-8622amCharts: Charts and Maps <= 1.4.4 - Reflected Cross-Site Scripting via Cross-Site Request Forgerymartynasma amCharts: Charts and Maps
- CVE-2024-8056MM-Breaking News <= 0.7.9 - Reflected XSSMM-Breaking News
- CVE-2024-8054MM-Breaking News <= 0.7.9 - Stored XSS via CSRFMM-Breaking News
- CVE-2024-7862Blog Introduction <= 0.3.0 - Settings Update via CSRFblogintroduction-wordpress-plugin
- CVE-2024-7861Misiek Paypal <= 1.1.20090324 - Stored XSS via CSRFMisiek Paypal
- CVE-2024-7860Simple Headline Rotator <= 1.0 - Stored XSS via CSRFSimple Headline Rotator
- CVE-2024-7859Visual Sound <= 1.03 - Settings Update via CSRFVisual Sound
- CVE-2024-7822Quick Code <= 1.0 - Stored XSS via CSRFQuick Code
- CVE-2024-7820ILC Thickbox <= 1.0 - Settings update via CSRFILC Thickbox
- CVE-2024-7818Misiek Photo Album <= 1.4.3 - Stored XSS via CSRFMisiek Photo Album
- CVE-2024-7817Misiek Photo Album <= 1.4.3 - Album Deletion via CSRFMisiek Photo Album
- CVE-2024-7816Gixaw Chat <= 1.0 - Stored XSS via CSRFGixaw Chat
- CVE-2024-6887Giveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSSGiveaways and Contests by RafflePress
- CVE-2024-6019Music Request Manager <= 1.3 - Unauthenticated Stored XSSMusic Request Manager
- CVE-2024-6018Music Request Manager <= 1.3 - Reflected XSSMusic Request Manager
- CVE-2024-6017Music Request Manager <= 1.3 - Stored XSS via CSRFMusic Request Manager
- CVE-2024-5799CM Pop-Up Banners for WordPress < 1.7.3 - Contributor+ Stored XSSCM Pop-Up Banners for WordPress
- CVE-2024-3163Easy Property Listings < 3.5.4 - Arbitrary Contact Deletion via CSRFEasy Property Listings
- CVE-2024-8711SourceCodester Food Ordering Management System includes exposure of information through directory listingSourceCodester Food Ordering Management System
- CVE-2024-38222Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2024-8710code-projects Inventory Management Products Table Page viewProduct.php sql injectioncode-projects Inventory Management
- CVE-2024-8709SourceCodester Best House Rental Management System admin_class.php save_user sql injectionSourceCodester Best House Rental Management System
- CVE-2024-8708SourceCodester Best House Rental Management System categories.php cross site scriptingSourceCodester Best House Rental Management System
- CVE-2024-8707云课网络科技有限公司 Yunke Online School System Appadmin.php downfile path traversal云课网络科技有限公司 Yunke Online School System
- CVE-2020-24061Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbi
- CVE-2024-25270An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulnerability by manipulat
- CVE-2024-34335ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page.
- CVE-2024-34336User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by
- CVE-2024-36066The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RF
- CVE-2024-41629An issue in Texas Instruments Fusion Digital Power Designer v.7.10.1 allows a local attacker to obtain sensitive information via the plainte
- CVE-2024-45182An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS WibuKey before v6.70 and fixed in v.6.70 An improper bounds check allows specially