# CVEs published 2024-09-14

13 CVEs were published on September 14, 2024: 2 critical, 4 high. Days are UTC.

- [CVE-2024-8863](https://cve.now/CVE-2024-8863.md): aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scripting (CVSS 5.3, aimhubio aim · aim)
- [CVE-2024-8862](https://cve.now/CVE-2024-8862.md): h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization (CVSS 6.9, h2oai h2o-3 · dtale)
- [CVE-2024-6482](https://cve.now/CVE-2024-6482.md): Login with phone number \<= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation (CVSS 8.8, glboy OTP Login With Phone Number, OTP Verification)
- [CVE-2023-3410](https://cve.now/CVE-2023-3410.md): Bricks \<= 1.10.1 - Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting (CVSS 5.4, Bricks Builder Bricks)
- [CVE-2024-8797](https://cve.now/CVE-2024-8797.md): WP Booking System – Booking Calendar \<= 2.0.19.8 - Reflected Cross-Site Scripting (CVSS 6.1, murgroland WP Booking System – Booking Calendar)
- [CVE-2024-8669](https://cve.now/CVE-2024-8669.md): Backuply – Backup, Restore, Migrate and Clone \<= 1.3.4 - Authenticated (Admin+) SQL Injection (CVSS 9.1, softaculous Backuply – Backup, Restore, Migrate and Clone)
- [CVE-2024-8039](https://cve.now/CVE-2024-8039.md): Improper permission configurationDomain configuration vulnerability of the mobile application (com.afmobi.boomplayer) can lead to account ta (CVSS 9.8, TECNO com.afmobi.boomplayer)
- [CVE-2024-8724](https://cve.now/CVE-2024-8724.md): Waitlist Woocommerce ( Back in stock notifier ) \<= 2.7.5 - Reflected Cross-Site Scripting (CVSS 6.1, xootix Waitlist Woocommerce)
- [CVE-2024-8479](https://cve.now/CVE-2024-8479.md): Simple Spoiler 1.2 - 1.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, webliberty Simple Spoiler)
- [CVE-2024-8246](https://cve.now/CVE-2024-8246.md): Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) \<= 2.8.11 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8, themekraft Post Form – Registration Form – Profile Form for…)
- [CVE-2024-8775](https://cve.now/CVE-2024-8775.md): Ansible-core: exposure of sensitive information in ansible vault files due to improper logging (CVSS 5.5, ansible-core · Red Hat Ansible Automation Platform Execu… +4)
- [CVE-2024-8271](https://cve.now/CVE-2024-8271.md): FOX – Currency Switcher Professional for WooCommerce \<= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, realmag777 FOX – Currency Switcher Professional for WooComm…)
- [CVE-2022-3459](https://cve.now/CVE-2022-3459.md): WooCommerce Multiple Free Gift \<= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding (CVSS 5.3, ankitpokhrel WooCommerce Multiple Free Gift)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.