# CVEs published 2024-09-13

152 CVEs were published on September 13, 2024: 6 critical, 52 high. Days are UTC.

- [CVE-2024-44096](https://cve.now/CVE-2024-44096.md): there is a possible arbitrary read due to an insecure default value. (CVSS 4.4, Google Android)
- [CVE-2024-44095](https://cve.now/CVE-2024-44095.md): In ppmp\_protect\_mfcfw\_buf of code/drm\_fw.c, there is a possible corrupt memory due to a logic error in the code. (CVSS 7.4, Google Android)
- [CVE-2024-44094](https://cve.now/CVE-2024-44094.md): In ppmp\_protect\_mfcfw\_buf of code/drm\_fw.c, there is a possible memory corruption due to improper input validation. (CVSS 7.4, Google Android)
- [CVE-2024-44093](https://cve.now/CVE-2024-44093.md): In ppmp\_unprotect\_buf of drm/code/drm\_fw.c, there is a possible memory corruption due to a logic error in the code. (CVSS 7.4, Google Android)
- [CVE-2024-44092](https://cve.now/CVE-2024-44092.md): There is a possible LCS signing enforcement missing due to test/debugging code left in a production build. (CVSS 7.8, Google Android)
- [CVE-2024-29779](https://cve.now/CVE-2024-29779.md): there is a possible escalation of privilege due to an unusual root cause. (CVSS 7.4, Google Android)
- [CVE-2024-6259](https://cve.now/CVE-2024-6259.md): BT: HCI: adv\_ext\_report Improper discarding in adv\_ext\_report (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2024-6137](https://cve.now/CVE-2024-6137.md): BT: Classic: SDP OOB access in get\_att\_search\_list (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2024-6135](https://cve.now/CVE-2024-6135.md): BT:Classic: Multiple missing buf length checks (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2024-5931](https://cve.now/CVE-2024-5931.md): BT: Unchecked user input in bap\_broadcast\_assistant (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2024-6258](https://cve.now/CVE-2024-6258.md): BT: Missing length checks of net\_buf in rfcomm\_handle\_data (CVSS 6.8, zephyrproject-rtos Zephyr)
- [CVE-2024-5754](https://cve.now/CVE-2024-5754.md): BT: Encryption procedure host vulnerability (CVSS 8.2, zephyrproject-rtos Zephyr)
- [CVE-2024-8784](https://cve.now/CVE-2024-8784.md): QDocs Smart School Management System Chat mynewuser sql injection (CVSS 5.3, QDocs Smart School Management System)
- [CVE-2024-8783](https://cve.now/CVE-2024-8783.md): OpenTibiaBR MyAAC Post Reply new\_post.php cross site scripting (CVSS 5.3, OpenTibiaBR MyAAC)
- [CVE-2024-8782](https://cve.now/CVE-2024-8782.md): JFinalCMS edit delete path traversal (CVSS 5.3, JFinalCMS)
- [CVE-2024-45105](https://cve.now/CVE-2024-45105.md): An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that cou (CVSS 6.7, Lenovo HX5530 Appliance (ThinkAgile) BIOS · Lenovo HX64… +97)
- [CVE-2024-45104](https://cve.now/CVE-2024-45104.md): A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device thr (CVSS 6.3, Lenovo XClarity Administrator)
- [CVE-2024-45103](https://cve.now/CVE-2024-45103.md): A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privile (CVSS 4.3, Lenovo XClarity Administrator)
- [CVE-2024-45101](https://cve.now/CVE-2024-45101.md): A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, (CVSS 6.8, Lenovo XClarity Administrator)
- [CVE-2024-8281](https://cve.now/CVE-2024-8281.md): An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform comm (CVSS 7.2, Lenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138)
- [CVE-2024-8280](https://cve.now/CVE-2024-8280.md): An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform comm (CVSS 7.2, Lenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138)
- [CVE-2024-8279](https://cve.now/CVE-2024-8279.md): A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perf (CVSS 7.2, Lenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138)
- [CVE-2024-8278](https://cve.now/CVE-2024-8278.md): A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perf (CVSS 7.2, Lenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138)
- [CVE-2024-8059](https://cve.now/CVE-2024-8059.md): IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. (CVSS 4.3, Lenovo HX5530 Appliance (ThinkAgile) XCC · Lenovo HX75… +138)
- [CVE-2024-7756](https://cve.now/CVE-2024-7756.md): A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges b (CVSS 6.8, 10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS · Lenovo L390… +1)
- [CVE-2024-4550](https://cve.now/CVE-2024-4550.md): A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacke (CVSS 6.7, Lenovo P360 Workstation (ThinkStation) BIOS · Lenovo ST5… +3)
- [CVE-2024-3100](https://cve.now/CVE-2024-3100.md): A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated priv (CVSS 6.7, 100w Gen 3 Laptop (Lenovo) BIOS · 100w Gen 4 Laptop (Le… +53)
- [CVE-2024-31416](https://cve.now/CVE-2024-31416.md): The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the tool like alarms, repor (CVSS 5.6, Eaton Foreseer)
- [CVE-2024-31415](https://cve.now/CVE-2024-31415.md): The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network manage (CVSS 6.3, Eaton Foreseer)
- [CVE-2024-31414](https://cve.now/CVE-2024-31414.md): The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. (CVSS 6.7, Eaton Foreseer)
- [CVE-2024-45368](https://cve.now/CVE-2024-45368.md): AutomationDirect DirectLogic H2-DM1E Session Fixation (CVSS 8.8, AutomationDirect DirectLogic H2-DM1E)
- [CVE-2024-43099](https://cve.now/CVE-2024-43099.md): AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay (CVSS 8.8, AutomationDirect DirectLogic H2-DM1E)
- [CVE-2024-6862](https://cve.now/CVE-2024-6862.md): Cross-Site Request Forgery (CSRF) in lunary-ai/lunary (CVSS 7.4, lunary-ai/lunary)
- [CVE-2024-6867](https://cve.now/CVE-2024-6867.md): Information Disclosure in lunary-ai/lunary (CVSS 4.3, lunary-ai/lunary)
- [CVE-2024-6087](https://cve.now/CVE-2024-6087.md): Improper Access Control in lunary-ai/lunary (CVSS 6.5, lunary-ai/lunary)
- [CVE-2024-6582](https://cve.now/CVE-2024-6582.md): Broken Access Control in lunary-ai/lunary (CVSS 6.5, lunary-ai/lunary)
- [CVE-2024-6587](https://cve.now/CVE-2024-6587.md): SSRF in berriai/litellm (CVSS 7.5, berriai/litellm · litellm)
- [CVE-2024-42025](https://cve.now/CVE-2024-42025.md): A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and ea (CVSS 7.8, Ubiquiti UniFi Network Application)
- [CVE-2024-8242](https://cve.now/CVE-2024-8242.md): MStore API – Create Native Android & iOS Apps On The Cloud \<= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2024-5870](https://cve.now/CVE-2024-5870.md): Tweaker5 \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (CVSS 6.4, arnoldgoodway Tweaker5)
- [CVE-2024-5869](https://cve.now/CVE-2024-5869.md): Neighborly \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (CVSS 6.4, arnoldgoodway Neighborly)
- [CVE-2022-2446](https://cve.now/CVE-2022-2446.md): WP Editor \<= 1.2.9 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2, benjaminprojas WP Editor)
- [CVE-2024-8730](https://cve.now/CVE-2024-8730.md): Exit Notifier \<= 1.10.4 - Reflected Cross-Site Scripting (CVSS 6.1, cvscvstechcom Exit Notifier)
- [CVE-2024-5867](https://cve.now/CVE-2024-5867.md): Delicate \<= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (CVSS 6.4, nattywp Delicate)
- [CVE-2024-8734](https://cve.now/CVE-2024-8734.md): Lucas String Replace \<= 2.0.5 - Reflected Cross-Site Scripting (CVSS 6.1, lucasstad Lucas String Replace)
- [CVE-2024-5884](https://cve.now/CVE-2024-5884.md): Beauty \<= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via tpl\_featured\_cat\_id Parameter (CVSS 6.4, allprices Beauty)
- [CVE-2024-8737](https://cve.now/CVE-2024-8737.md): PDF Thumbnail Generator \<= 1.3 - Reflected Cross-Site Scripting (CVSS 6.1, kubiq PDF Thumbnail Generator)
- [CVE-2024-7423](https://cve.now/CVE-2024-7423.md): Stream \<= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update (CVSS 8.8, xwp Stream)
- [CVE-2024-6544](https://cve.now/CVE-2024-6544.md): Custom Post Limits \<= 4.4.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code Custom Post Limits)
- [CVE-2024-8747](https://cve.now/CVE-2024-8747.md): Email Obfuscate Shortcode \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, khromov Email Obfuscate Shortcode)
- [CVE-2024-8731](https://cve.now/CVE-2024-8731.md): Cron Jobs \<= 1.2.9 - Reflected Cross-Site Scripting (CVSS 6.1, arielhr1987 Cron Jobs)
- [CVE-2024-8269](https://cve.now/CVE-2024-8269.md): MStore API – Create Native Android & iOS Apps On The Cloud \<= 4.15.3 - Unauthorized User Registration (CVSS 7.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2024-8714](https://cve.now/CVE-2024-8714.md): WordPress Affiliates Plugin — SliceWP Affiliates \<= 1.1.20 - Reflected Cross-Site Scripting (CVSS 6.1, iovamihai Affiliate Program Suite — SliceWP Affiliates)
- [CVE-2024-8732](https://cve.now/CVE-2024-8732.md): Roles & Capabilities \<= 1.1.9 - Reflected Cross-Site Scripting (CVSS 6.1, arielhr1987 Roles & Capabilities)
- [CVE-2024-5789](https://cve.now/CVE-2024-5789.md): Triton Lite \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (CVSS 6.4, Towfiq I. Triton Lite)
- [CVE-2024-46713](https://cve.now/CVE-2024-46713.md): perf/aux: Fix AUX buffer serialization (CVSS 7.8, Linux)
- [CVE-2024-43760](https://cve.now/CVE-2024-43760.md): Photoshop Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2024-45109](https://cve.now/CVE-2024-45109.md): Photoshop Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2024-43756](https://cve.now/CVE-2024-43756.md): Photoshop Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2024-45108](https://cve.now/CVE-2024-45108.md): Photoshop Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2024-41874](https://cve.now/CVE-2024-41874.md): ColdFusion | Deserialization of Untrusted Data (CWE-502) (CVSS 9.8, Adobe ColdFusion)
- [CVE-2024-45113](https://cve.now/CVE-2024-45113.md): ColdFusion | Improper Authentication (CWE-287) (CVSS 7.5, Adobe ColdFusion)
- [CVE-2024-41869](https://cve.now/CVE-2024-41869.md): Acrobat Reader | Use After Free (CWE-416) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-45112](https://cve.now/CVE-2024-45112.md): Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-6656](https://cve.now/CVE-2024-6656.md): Hardcoded Credentals in TNB Mobile Solutions' Cockpit Software (CVSS 8.8, TNB Mobile Solutions Cockpit Software)
- [CVE-2024-41857](https://cve.now/CVE-2024-41857.md): Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-43759](https://cve.now/CVE-2024-43759.md): Illustrator | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-34121](https://cve.now/CVE-2024-34121.md): Illustrator | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-43758](https://cve.now/CVE-2024-43758.md): Illustrator | Use After Free (CWE-416) (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-45111](https://cve.now/CVE-2024-45111.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-39384](https://cve.now/CVE-2024-39384.md): Premiere Pro | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Premiere Pro)
- [CVE-2024-39385](https://cve.now/CVE-2024-39385.md): Premiere Pro | Use After Free (CWE-416) (CVSS 5.5, Adobe Premiere Pro)
- [CVE-2024-39381](https://cve.now/CVE-2024-39381.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2024-39380](https://cve.now/CVE-2024-39380.md): After Effects | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe After Effects)
- [CVE-2024-41867](https://cve.now/CVE-2024-41867.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2024-39382](https://cve.now/CVE-2024-39382.md): After Effects | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe After Effects)
- [CVE-2024-41859](https://cve.now/CVE-2024-41859.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects)
- [CVE-2024-41872](https://cve.now/CVE-2024-41872.md): Media Encoder | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Media Encoder)
- [CVE-2024-39377](https://cve.now/CVE-2024-39377.md): Media Encoder | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Media Encoder)
- [CVE-2024-41870](https://cve.now/CVE-2024-41870.md): Media Encoder | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Media Encoder)
- [CVE-2024-41871](https://cve.now/CVE-2024-41871.md): Media Encoder | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Media Encoder)
- [CVE-2024-41873](https://cve.now/CVE-2024-41873.md): Media Encoder | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Media Encoder)
- [CVE-2024-8663](https://cve.now/CVE-2024-8663.md): WP Simple Booking Calendar \<= 2.0.10 - Reflected Cross-Site Scripting (CVSS 6.1, murgroland WP Simple Booking Calendar)
- [CVE-2024-8742](https://cve.now/CVE-2024-8742.md): Essential Addons for Elementor \<= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery Widget (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-8664](https://cve.now/CVE-2024-8664.md): WP Test Email \<= 1.1.7 - Reflected Cross-Site Scripting (CVSS 6.1, boopathi0001 WP Test Email)
- [CVE-2024-5567](https://cve.now/CVE-2024-5567.md): Betheme | Responsive Multipurpose WordPress & WooCommerce Theme \<= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File (CVSS 6.4, MuffinGroup Betheme)
- [CVE-2024-7888](https://cve.now/CVE-2024-7888.md): Classified Listing – Classified ads & Business Directory Plugin \<= 3.1.7 - Missing Authorization (CVSS 6.3, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2024-8665](https://cve.now/CVE-2024-8665.md): YITH Custom Login \<= 1.7.3 - Reflected Cross-Site Scripting (CVSS 6.1, yithemes YITH Custom Login)
- [CVE-2024-46712](https://cve.now/CVE-2024-46712.md): drm/vmwgfx: Disable coherent dumb buffers without 3d (no CVSS, Linux)
- [CVE-2024-46711](https://cve.now/CVE-2024-46711.md): mptcp: pm: fix ID 0 endp usage after multiple re-creations (no CVSS, Linux)
- [CVE-2024-46710](https://cve.now/CVE-2024-46710.md): drm/vmwgfx: Prevent unmapping active read buffers (CVSS 7.8, Linux)
- [CVE-2024-46709](https://cve.now/CVE-2024-46709.md): drm/vmwgfx: Fix prime with external buffers (CVSS 7.8, Linux)
- [CVE-2024-46708](https://cve.now/CVE-2024-46708.md): pinctrl: qcom: x1e80100: Fix special pin offsets (no CVSS, Linux)
- [CVE-2024-46707](https://cve.now/CVE-2024-46707.md): KVM: arm64: Make ICC\_\*SGI\*\_EL1 undef in the absence of a vGICv3 (no CVSS, Linux)
- [CVE-2024-46706](https://cve.now/CVE-2024-46706.md): tty: serial: fsl\_lpuart: mark last busy before uart\_add\_one\_port (no CVSS, Linux)
- [CVE-2024-46705](https://cve.now/CVE-2024-46705.md): drm/xe: reset mmio mappings with devm (CVSS 7.8, Linux)
- [CVE-2024-46704](https://cve.now/CVE-2024-46704.md): workqueue: Fix spruious data race in \_\_flush\_work() (no CVSS, Linux)
- [CVE-2024-46703](https://cve.now/CVE-2024-46703.md): Revert "serial: 8250\_omap: Set the console genpd always on if no console suspend" (no CVSS, Linux)
- [CVE-2024-46702](https://cve.now/CVE-2024-46702.md): thunderbolt: Mark XDomain as unplugged when router is removed (no CVSS, Linux)
- [CVE-2024-46701](https://cve.now/CVE-2024-46701.md): libfs: fix infinite directory reads for offset dir (no CVSS, Linux)
- [CVE-2024-38816](https://cve.now/CVE-2024-38816.md): CVE-2024-38816: Path traversal vulnerability in functional web frameworks (CVSS 7.5, Spring · org.springframework:spring-webmvc +1)
- [CVE-2024-7864](https://cve.now/CVE-2024-7864.md): Favicon Generator \< 2.1 - Arbitrary File Deletion via CSRF (CVSS 6.5, Favicon Generator)
- [CVE-2024-7863](https://cve.now/CVE-2024-7863.md): Favicon Generator \< 2.1 - Arbitrary File Upload via CSRF (CVSS 8.1, Favicon Generator)
- [CVE-2024-7133](https://cve.now/CVE-2024-7133.md): My Sticky Bar \< 2.7.3 - Admin+ Stored XSS (CVSS 4.8, Floating Notification Bar, Sticky Menu on Scroll, Announcem…)
- [CVE-2024-7129](https://cve.now/CVE-2024-7129.md): Appointment Booking Calendar \< 1.6.7.43 - Admin+ Template Injection to RCE (CVSS 7.2, Appointment Booking Calendar — Simply Schedule Appointments…)
- [CVE-2024-6850](https://cve.now/CVE-2024-6850.md): Carousel Slider \< 2.2.14 - Editor+ Stored XSS (CVSS 4.8, Carousel Slider)
- [CVE-2024-6723](https://cve.now/CVE-2024-6723.md): AI Engine \< 2.4.8 - Admin+ SQLi (CVSS 4.7, AI Engine)
- [CVE-2024-6617](https://cve.now/CVE-2024-6617.md): NinjaTeam Header Footer Custom Code \<= 1.2 - Admin+ Stored XSS via CSS Styles (CVSS 4.8, NinjaTeam Header Footer Custom Code)
- [CVE-2024-6493](https://cve.now/CVE-2024-6493.md): NinjaTeam Header Footer Custom Code \< 1.2 - Admin+ Stored XSS (CVSS 4.8, NinjaTeam Header Footer Custom Code)
- [CVE-2024-5628](https://cve.now/CVE-2024-5628.md): Avada | Website Builder For WordPress & eCommerce \<= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion\_button Shortcode (CVSS 6.4, themefusion Avada (Fusion) Builder)
- [CVE-2024-46699](https://cve.now/CVE-2024-46699.md): drm/v3d: Disable preemption while updating GPU stats (no CVSS, Linux)
- [CVE-2024-46698](https://cve.now/CVE-2024-46698.md): video/aperture: optionally match the device in sysfb\_disable() (no CVSS, Linux)
- [CVE-2024-46697](https://cve.now/CVE-2024-46697.md): nfsd: ensure that nfsd4\_fattr\_args.context is zeroed out (CVSS 9.8, Linux)
- [CVE-2024-46696](https://cve.now/CVE-2024-46696.md): nfsd: fix potential UAF in nfsd4\_cb\_getattr\_release (CVSS 9.8, Linux)
- [CVE-2024-46695](https://cve.now/CVE-2024-46695.md): selinux,smack: don't bypass permissions check in inode\_setsecctx hook (CVSS 9.8, Linux)
- [CVE-2024-46694](https://cve.now/CVE-2024-46694.md): drm/amd/display: avoid using null object of framebuffer (no CVSS, Linux)
- [CVE-2024-46693](https://cve.now/CVE-2024-46693.md): soc: qcom: pmic\_glink: Fix race during initialization (no CVSS, Linux)
- [CVE-2024-46692](https://cve.now/CVE-2024-46692.md): firmware: qcom: scm: Mark get\_wq\_ctx() as atomic call (no CVSS, Linux)
- [CVE-2024-46691](https://cve.now/CVE-2024-46691.md): usb: typec: ucsi: Move unregister out of atomic section (no CVSS, Linux)
- [CVE-2024-46690](https://cve.now/CVE-2024-46690.md): nfsd: fix nfsd4\_deleg\_getattr\_conflict in presence of third party lease (CVSS 9.8, Linux)
- [CVE-2024-46689](https://cve.now/CVE-2024-46689.md): soc: qcom: cmd-db: Map shared memory as WC, not WB (no CVSS, Linux)
- [CVE-2024-46688](https://cve.now/CVE-2024-46688.md): erofs: fix out-of-bound access when z\_erofs\_gbuf\_growsize() partially fails (no CVSS, Linux)
- [CVE-2024-46687](https://cve.now/CVE-2024-46687.md): btrfs: fix a use-after-free when hitting errors inside btrfs\_submit\_chunk() (CVSS 7.8, Linux)
- [CVE-2024-46686](https://cve.now/CVE-2024-46686.md): smb/client: avoid dereferencing rdata=NULL in smb2\_new\_read\_req() (no CVSS, Linux)
- [CVE-2024-46685](https://cve.now/CVE-2024-46685.md): pinctrl: single: fix potential NULL dereference in pcs\_get\_function() (no CVSS, Linux)
- [CVE-2024-46684](https://cve.now/CVE-2024-46684.md): binfmt\_elf\_fdpic: fix AUXV size calculation when ELF\_HWCAP2 is defined (no CVSS, Linux)
- [CVE-2024-46683](https://cve.now/CVE-2024-46683.md): drm/xe: prevent UAF around preempt fence (CVSS 7.8, Linux)
- [CVE-2024-46682](https://cve.now/CVE-2024-46682.md): nfsd: prevent panic for nfsv4.0 closed files in nfs4\_show\_open (no CVSS, Linux)
- [CVE-2024-46681](https://cve.now/CVE-2024-46681.md): pktgen: use cpus\_read\_lock() in pg\_net\_init() (no CVSS, Linux)
- [CVE-2024-46680](https://cve.now/CVE-2024-46680.md): Bluetooth: btnxpuart: Fix random crash seen while removing driver (CVSS 7.8, Linux)
- [CVE-2024-46679](https://cve.now/CVE-2024-46679.md): ethtool: check device is present when getting link settings (no CVSS, Linux)
- [CVE-2024-46678](https://cve.now/CVE-2024-46678.md): bonding: change ipsec\_lock from spin lock to mutex (CVSS 7.8, Linux)
- [CVE-2024-46677](https://cve.now/CVE-2024-46677.md): gtp: fix a potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2024-46676](https://cve.now/CVE-2024-46676.md): nfc: pn533: Add poll mod list filling check (no CVSS, Linux)
- [CVE-2024-46675](https://cve.now/CVE-2024-46675.md): usb: dwc3: core: Prevent USB core invalid event buffer address access (no CVSS, Linux)
- [CVE-2024-46674](https://cve.now/CVE-2024-46674.md): usb: dwc3: st: fix probed platform device ref count on probe error path (CVSS 7.8, Linux)
- [CVE-2024-46673](https://cve.now/CVE-2024-46673.md): scsi: aacraid: Fix double-free on probe failure (CVSS 7.8, Linux)
- [CVE-2024-8656](https://cve.now/CVE-2024-8656.md): WPFactory Helper \<= 1.7.0 - Reflected Cross-Site Scripting (CVSS 6.1, algoritmika WPFactory Helper)
- [CVE-2024-43180](https://cve.now/CVE-2024-43180.md): IBM Concert information disclosure (CVSS 4.3, IBM Concert)
- [CVE-2024-8762](https://cve.now/CVE-2024-8762.md): code-projects Crud Operation System updatedata.php sql injection (CVSS 5.3, code-projects Crud Operation System)
- [CVE-2024-39924](https://cve.now/CVE-2024-39924.md): An issue was discovered in Vaultwarden (formerly Bitwarden\_RS) 1.30.3. (CVSS 8.8)
- [CVE-2024-39925](https://cve.now/CVE-2024-39925.md): An issue was discovered in Vaultwarden (formerly Bitwarden\_RS) 1.30.3. (CVSS 6.5)
- [CVE-2024-39926](https://cve.now/CVE-2024-39926.md): An issue was discovered in Vaultwarden (formerly Bitwarden\_RS) 1.30.3. (CVSS 5.4)
- [CVE-2024-44430](https://cve.now/CVE-2024-44430.md): SQL Injection vulnerability in Best Free Law Office Management Software-v1.0 allows an attacker to execute arbitrary code and obtain sensiti (CVSS 9.8)
- [CVE-2024-44685](https://cve.now/CVE-2024-44685.md): Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including password (CVSS 5.0)
- [CVE-2024-44798](https://cve.now/CVE-2024-44798.md): phpgurukul Bus Pass Management System 1.0 is vulnerable to Cross-site scripting (XSS) in /admin/pass-bwdates-reports-details.php via fromdat (CVSS 6.3)
- [CVE-2024-46044](https://cve.now/CVE-2024-46044.md): CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the fromqossetting function. (CVSS 5.7)
- [CVE-2024-46045](https://cve.now/CVE-2024-46045.md): Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function. (CVSS 5.7)
- [CVE-2024-46046](https://cve.now/CVE-2024-46046.md): Tenda FH451 v1.0.0.9 has a stack overflow vulnerability located in the RouteStatic function. (CVSS 6.5)
- [CVE-2024-46047](https://cve.now/CVE-2024-46047.md): Tenda FH451 v1.0.0.9 has a stack overflow vulnerability in the fromDhcpListClient function. (CVSS 6.5)
- [CVE-2024-46048](https://cve.now/CVE-2024-46048.md): Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i (CVSS 8.8)
- [CVE-2024-46049](https://cve.now/CVE-2024-46049.md): Tenda O6 V3.0 firmware V1.0.0.7(2054) contains a stack overflow vulnerability in the formexeCommand function. (CVSS 5.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.