CVEs published September 13, 2024
152 CVEs were published on September 13, 2024: 6 critical, 52 high.
- Published
- 152
- Critical
- 6
- High
- 52
- Medium
- 68
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Linux
- 40
- Google Android
- 6
- zephyrproject-rtos Zephyr
- 6
- Adobe After Effects
- 5
- Adobe Illustrator
- 5
- Adobe Media Encoder
- 5
- Lenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138
- 5
- Adobe Photoshop Desktop
- 4
- lunary-ai/lunary
- 4
- Eaton Foreseer
- 3
Critical 6
- CVE-2024-41874ColdFusion | Deserialization of Untrusted Data (CWE-502)Adobe ColdFusion
- CVE-2024-46697nfsd: ensure that nfsd4_fattr_args.context is zeroed outLinux
- CVE-2024-46696nfsd: fix potential UAF in nfsd4_cb_getattr_releaseLinux
- CVE-2024-46695selinux,smack: don't bypass permissions check in inode_setsecctx hookLinux
- CVE-2024-46690nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party leaseLinux
- CVE-2024-44430SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensiti
High 52
- CVE-2024-44095In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible corrupt memory due to a logic error in the code.Google Android
- CVE-2024-44094In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible memory corruption due to improper input validation.Google Android
- CVE-2024-44093In ppmp_unprotect_buf of drm/code/drm_fw.c, there is a possible memory corruption due to a logic error in the code.Google Android
- CVE-2024-44092There is a possible LCS signing enforcement missing due to test/debugging code left in a production build.Google Android
- CVE-2024-29779there is a possible escalation of privilege due to an unusual root cause.Google Android
- CVE-2024-6259BT: HCI: adv_ext_report Improper discarding in adv_ext_reportzephyrproject-rtos Zephyr
- CVE-2024-6137BT: Classic: SDP OOB access in get_att_search_listzephyrproject-rtos Zephyr
- CVE-2024-6135BT:Classic: Multiple missing buf length checkszephyrproject-rtos Zephyr
- CVE-2024-5754BT: Encryption procedure host vulnerabilityzephyrproject-rtos Zephyr
- CVE-2024-8281An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform commLenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138
- CVE-2024-8280An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform commLenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138
- CVE-2024-8279A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perfLenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138
- CVE-2024-8278A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perfLenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138
- CVE-2024-45368AutomationDirect DirectLogic H2-DM1E Session FixationAutomationDirect DirectLogic H2-DM1E
- CVE-2024-43099AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replayAutomationDirect DirectLogic H2-DM1E
- CVE-2024-6862Cross-Site Request Forgery (CSRF) in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-6587SSRF in berriai/litellmberriai/litellm · litellm
- CVE-2024-42025A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and eaUbiquiti UniFi Network Application
- CVE-2022-2446WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserializationbenjaminprojas WP Editor
- CVE-2024-7423Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Updatexwp Stream
- CVE-2024-8269MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registrationinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2024-46713perf/aux: Fix AUX buffer serializationLinux
- CVE-2024-43760Photoshop Desktop | Out-of-bounds Write (CWE-787)Adobe Photoshop Desktop
- CVE-2024-45109Photoshop Desktop | Out-of-bounds Write (CWE-787)Adobe Photoshop Desktop
- CVE-2024-43756Photoshop Desktop | Heap-based Buffer Overflow (CWE-122)Adobe Photoshop Desktop
- CVE-2024-45108Photoshop Desktop | Out-of-bounds Write (CWE-787)Adobe Photoshop Desktop
- CVE-2024-45113ColdFusion | Improper Authentication (CWE-287)Adobe ColdFusion
- CVE-2024-41869Acrobat Reader | Use After Free (CWE-416)Adobe Acrobat Reader
- CVE-2024-45112Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)Adobe Acrobat Reader
- CVE-2024-6656Hardcoded Credentals in TNB Mobile Solutions' Cockpit SoftwareTNB Mobile Solutions Cockpit Software
- CVE-2024-41857Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe Illustrator
- CVE-2024-34121Illustrator | Integer Overflow or Wraparound (CWE-190)Adobe Illustrator
- CVE-2024-43758Illustrator | Use After Free (CWE-416)Adobe Illustrator
- CVE-2024-39384Premiere Pro | Out-of-bounds Write (CWE-787)Adobe Premiere Pro
- CVE-2024-39381After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2024-39380After Effects | Heap-based Buffer Overflow (CWE-122)Adobe After Effects
- CVE-2024-41859After Effects | Out-of-bounds Write (CWE-787)Adobe After Effects
- CVE-2024-39377Media Encoder | Out-of-bounds Write (CWE-787)Adobe Media Encoder
- CVE-2024-46710drm/vmwgfx: Prevent unmapping active read buffersLinux
- CVE-2024-46709drm/vmwgfx: Fix prime with external buffersLinux
- CVE-2024-46705drm/xe: reset mmio mappings with devmLinux
- CVE-2024-38816CVE-2024-38816: Path traversal vulnerability in functional web frameworksSpring · org.springframework:spring-webmvc +1
- CVE-2024-7863Favicon Generator < 2.1 - Arbitrary File Upload via CSRFFavicon Generator
- CVE-2024-7129Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCEAppointment Booking Calendar — Simply Schedule Appointments…
- CVE-2024-46687btrfs: fix a use-after-free when hitting errors inside btrfs_submit_chunk()Linux
- CVE-2024-46683drm/xe: prevent UAF around preempt fenceLinux
- CVE-2024-46680Bluetooth: btnxpuart: Fix random crash seen while removing driverLinux
- CVE-2024-46678bonding: change ipsec_lock from spin lock to mutexLinux
- CVE-2024-46674usb: dwc3: st: fix probed platform device ref count on probe error pathLinux
- CVE-2024-46673scsi: aacraid: Fix double-free on probe failureLinux
- CVE-2024-39924An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
- CVE-2024-46048Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i
Medium, low and unrated 94
- CVE-2024-44096there is a possible arbitrary read due to an insecure default value.Google Android
- CVE-2024-5931BT: Unchecked user input in bap_broadcast_assistantzephyrproject-rtos Zephyr
- CVE-2024-6258BT: Missing length checks of net_buf in rfcomm_handle_datazephyrproject-rtos Zephyr
- CVE-2024-8784QDocs Smart School Management System Chat mynewuser sql injectionQDocs Smart School Management System
- CVE-2024-8783OpenTibiaBR MyAAC Post Reply new_post.php cross site scriptingOpenTibiaBR MyAAC
- CVE-2024-8782JFinalCMS edit delete path traversalJFinalCMS
- CVE-2024-45105An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that couLenovo HX5530 Appliance (ThinkAgile) BIOS · Lenovo HX64… +97
- CVE-2024-45104A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device thrLenovo XClarity Administrator
- CVE-2024-45103A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileLenovo XClarity Administrator
- CVE-2024-45101A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, Lenovo XClarity Administrator
- CVE-2024-8059IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.Lenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138
- CVE-2024-7756A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges b10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS · Lenovo L390… +1
- CVE-2024-4550A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attackeLenovo P360 Workstation (ThinkStation) BIOS · Lenovo ST5… +3
- CVE-2024-3100A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated priv100w Gen 3 Laptop (Lenovo) BIOS · 100w Gen 4 Laptop (Le… +53
- CVE-2024-31416The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, reporEaton Foreseer
- CVE-2024-31415The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network manageEaton Foreseer
- CVE-2024-31414The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages.Eaton Foreseer
- CVE-2024-6867Information Disclosure in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-6087Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-6582Broken Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-8242MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Uploadinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2024-5870Tweaker5 <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodearnoldgoodway Tweaker5
- CVE-2024-5869Neighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodearnoldgoodway Neighborly
- CVE-2024-8730Exit Notifier <= 1.10.4 - Reflected Cross-Site Scriptingcvscvstechcom Exit Notifier
- CVE-2024-5867Delicate <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodenattywp Delicate
- CVE-2024-8734Lucas String Replace <= 2.0.5 - Reflected Cross-Site Scriptinglucasstad Lucas String Replace
- CVE-2024-5884Beauty <= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via tpl_featured_cat_id Parameterallprices Beauty
- CVE-2024-8737PDF Thumbnail Generator <= 1.3 - Reflected Cross-Site Scriptingkubiq PDF Thumbnail Generator
- CVE-2024-6544Custom Post Limits <= 4.4.1 - Unauthenticated Full Path Disclosurecoffee2code Custom Post Limits
- CVE-2024-8747Email Obfuscate Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingkhromov Email Obfuscate Shortcode
- CVE-2024-8731Cron Jobs <= 1.2.9 - Reflected Cross-Site Scriptingarielhr1987 Cron Jobs
- CVE-2024-8714WordPress Affiliates Plugin — SliceWP Affiliates <= 1.1.20 - Reflected Cross-Site Scriptingiovamihai Affiliate Program Suite — SliceWP Affiliates
- CVE-2024-8732Roles & Capabilities <= 1.1.9 - Reflected Cross-Site Scriptingarielhr1987 Roles & Capabilities
- CVE-2024-5789Triton Lite <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button ShortcodeTowfiq I. Triton Lite
- CVE-2024-43759Illustrator | NULL Pointer Dereference (CWE-476)Adobe Illustrator
- CVE-2024-45111Illustrator | Out-of-bounds Read (CWE-125)Adobe Illustrator
- CVE-2024-39385Premiere Pro | Use After Free (CWE-416)Adobe Premiere Pro
- CVE-2024-41867After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2024-39382After Effects | Out-of-bounds Read (CWE-125)Adobe After Effects
- CVE-2024-41872Media Encoder | Out-of-bounds Read (CWE-125)Adobe Media Encoder
- CVE-2024-41870Media Encoder | Out-of-bounds Read (CWE-125)Adobe Media Encoder
- CVE-2024-41871Media Encoder | Out-of-bounds Read (CWE-125)Adobe Media Encoder
- CVE-2024-41873Media Encoder | Out-of-bounds Read (CWE-125)Adobe Media Encoder
- CVE-2024-8663WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scriptingmurgroland WP Simple Booking Calendar
- CVE-2024-8742Essential Addons for Elementor <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widgetwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-8664WP Test Email <= 1.1.7 - Reflected Cross-Site Scriptingboopathi0001 WP Test Email
- CVE-2024-5567Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG FileMuffinGroup Betheme
- CVE-2024-7888Classified Listing – Classified ads & Business Directory Plugin <= 3.1.7 - Missing Authorizationtechlabpro1 Classified Listing – AI-Powered Classified ads…
- CVE-2024-8665YITH Custom Login <= 1.7.3 - Reflected Cross-Site Scriptingyithemes YITH Custom Login
- CVE-2024-46712drm/vmwgfx: Disable coherent dumb buffers without 3dLinux
- CVE-2024-46711mptcp: pm: fix ID 0 endp usage after multiple re-creationsLinux
- CVE-2024-46708pinctrl: qcom: x1e80100: Fix special pin offsetsLinux
- CVE-2024-46707KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3Linux
- CVE-2024-46706tty: serial: fsl_lpuart: mark last busy before uart_add_one_portLinux
- CVE-2024-46704workqueue: Fix spruious data race in __flush_work()Linux
- CVE-2024-46703Revert "serial: 8250_omap: Set the console genpd always on if no console suspend"Linux
- CVE-2024-46702thunderbolt: Mark XDomain as unplugged when router is removedLinux
- CVE-2024-46701libfs: fix infinite directory reads for offset dirLinux
- CVE-2024-7864Favicon Generator < 2.1 - Arbitrary File Deletion via CSRFFavicon Generator
- CVE-2024-7133My Sticky Bar < 2.7.3 - Admin+ Stored XSSFloating Notification Bar, Sticky Menu on Scroll, Announcem…
- CVE-2024-6850Carousel Slider < 2.2.14 - Editor+ Stored XSSCarousel Slider
- CVE-2024-6723AI Engine < 2.4.8 - Admin+ SQLiAI Engine
- CVE-2024-6617NinjaTeam Header Footer Custom Code <= 1.2 - Admin+ Stored XSS via CSS StylesNinjaTeam Header Footer Custom Code
- CVE-2024-6493NinjaTeam Header Footer Custom Code < 1.2 - Admin+ Stored XSSNinjaTeam Header Footer Custom Code
- CVE-2024-5628Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcodethemefusion Avada (Fusion) Builder
- CVE-2024-46699drm/v3d: Disable preemption while updating GPU statsLinux
- CVE-2024-46698video/aperture: optionally match the device in sysfb_disable()Linux
- CVE-2024-46694drm/amd/display: avoid using null object of framebufferLinux
- CVE-2024-46693soc: qcom: pmic_glink: Fix race during initializationLinux
- CVE-2024-46692firmware: qcom: scm: Mark get_wq_ctx() as atomic callLinux
- CVE-2024-46691usb: typec: ucsi: Move unregister out of atomic sectionLinux
- CVE-2024-46689soc: qcom: cmd-db: Map shared memory as WC, not WBLinux
- CVE-2024-46688erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially failsLinux
- CVE-2024-46686smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req()Linux
- CVE-2024-46685pinctrl: single: fix potential NULL dereference in pcs_get_function()Linux
- CVE-2024-46684binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is definedLinux
- CVE-2024-46682nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_openLinux
- CVE-2024-46681pktgen: use cpus_read_lock() in pg_net_init()Linux
- CVE-2024-46679ethtool: check device is present when getting link settingsLinux
- CVE-2024-46677gtp: fix a potential NULL pointer dereferenceLinux
- CVE-2024-46676nfc: pn533: Add poll mod list filling checkLinux
- CVE-2024-46675usb: dwc3: core: Prevent USB core invalid event buffer address accessLinux
- CVE-2024-8656WPFactory Helper <= 1.7.0 - Reflected Cross-Site Scriptingalgoritmika WPFactory Helper
- CVE-2024-43180IBM Concert information disclosureIBM Concert
- CVE-2024-8762code-projects Crud Operation System updatedata.php sql injectioncode-projects Crud Operation System
- CVE-2024-39925An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
- CVE-2024-39926An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.
- CVE-2024-44685Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including password
- CVE-2024-44798phpgurukul Bus Pass Management System 1.0 is vulnerable to Cross-site scripting (XSS) in /admin/pass-bwdates-reports-details.php via fromdat
- CVE-2024-46044CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function.
- CVE-2024-46045Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.
- CVE-2024-46046Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function.
- CVE-2024-46047Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function.
- CVE-2024-46049Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function.