CVEs published September 16, 2024
163 CVEs were published on September 16, 2024: 19 critical, 42 high.
- Published
- 163
- Critical
- 19
- High
- 42
- Medium
- 90
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 110
Most affected products
- Apple macOS
- 50
- Apple iOS and iPadOS
- 11
- Apple iOS and iPadOS · Apple macOS
- 8
- Intel(R) RAID Web Console software
- 7
- Apple iOS and iPadOS · Apple macOS +3
- 6
- UEFI firmware for some Intel(R) Processors
- 6
- Apple iOS and iPadOS · Apple macOS +1
- 5
- The SYSCOM Group OMFLOW
- 4
- D-Link DIR-X4860 A1
- 3
- Intel(R) Processors
- 3
Critical 19
- CVE-2024-45496Openshift-controller-manager: elevated build pods can lead to node compromise in openshiftopenshift-controller-manager · Red Hat OpenShift Contain… +1
- CVE-2024-7387Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategyopenshift/builder · Red Hat OpenShift Container Platform +1
- CVE-2024-44148This issue was addressed with improved validation of file attributes.Apple macOS
- CVE-2024-44146A logic issue was addressed with improved file handling.Apple macOS
- CVE-2024-8752WebIQ 2.15.9 Runtime on Windows - Directory Traversal VulnerabilitySmart HMI WebIQ
- CVE-2024-6401SQLi in SFS Consulting's InsureE GLSFS Consulting InsureE GL
- CVE-2024-7104Remote Code Execution in SFS Consulting's ww.WinsureSFS Consulting ww.Winsure
- CVE-2024-7098XML Injection in SFS Consulting's ww.WinsureSFS Consulting ww.Winsure
- CVE-2024-22399Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata ServerApache Software Foundation Apache Seata · org.apache.seata:…
- CVE-2024-45698D-Link WiFi router - OS Command InjectionD-Link DIR-X4860 A1
- CVE-2024-45697D-Link WiFi router - Hidden FunctionalityD-Link DIR-X4860 A1
- CVE-2024-45695D-Link WiFi router - Stack-based Buffer OverflowD-Link DIR-X4860 A1
- CVE-2024-45694D-Link WiFi router - Stack-based Buffer OverflowD-Link DIR-X5460 A1 · D-Link DIR-X4860 A1
- CVE-2024-45414The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function.
- CVE-2024-45415The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function.
- CVE-2024-46419TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter.
- CVE-2024-46451TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.
- CVE-2024-46937An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication S
- CVE-2024-46958In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or
High 42
- CVE-2024-40848A downgrade issue was addressed with additional code-signing restrictions.Apple macOS
- CVE-2024-44149A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44165A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-44132This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2024-40852This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2024-44169The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44152A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-44164This issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-40862A privacy issue was addressed by removing sensitive data.Apple Xcode
- CVE-2024-44162This issue was addressed by enabling hardened runtime.Apple Xcode
- CVE-2024-27876A race condition was addressed with improved locking.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-40770A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-40856An integrity issue was addressed with Beacon Protection.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-27879The issue was addressed with improved bounds checks.Apple iOS and iPadOS
- CVE-2024-27874This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2024-44160A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2024-40861The issue was addressed with improved checks.Apple macOS
- CVE-2024-40841An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2024-44167This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-27795A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44147This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2024-27869The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-40846The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-44189The issue was addressed with improved checks.Apple macOS
- CVE-2024-45799Javascript Injection in Vending Info/Buyers Info Module in FluxCPrathena FluxCP
- CVE-2024-45801Tampering by prototype polution in DOMPurifycure53 DOMPurify · dompurify
- CVE-2023-41833A race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege viaUEFI firmware for some Intel(R) processors
- CVE-2024-21781Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to enable information disclosure or deniUEFI firmware for some Intel(R) Processors
- CVE-2024-21829Improper input validation in UEFI firmware error handler for some Intel(R) Processors may allow a privileged user to potentially enable escaIntel(R) Processors
- CVE-2023-42772Untrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to potentially enable escaUEFI firmware for some Intel(R) reference processors
- CVE-2023-43626Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilUEFI firmware for some Intel(R) Processors
- CVE-2024-21871Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privUEFI firmware for some Intel(R) Processors
- CVE-2024-23599Race condition in Seamless Firmware Updates for some Intel(R) reference platforms may allow a privileged user to potentially enable denial oSeamless Firmware Updates for some Intel® reference platfo…
- CVE-2024-45696D-Link WiFi router - Hidden FunctionalityD-Link DIR-X4860 A1 · D-Link COVR-X1870
- CVE-2024-8779The SYSCOM Group OMFLOW - Broken Access ControlThe SYSCOM Group OMFLOW
- CVE-2024-8777The SYSCOM Group OMFLOW - Information LeakageThe SYSCOM Group OMFLOW
- CVE-2023-45854A Business Logic vulnerability in Shopkit 1.0 allows an attacker to add products with negative quantities to the shopping cart via the qtd p
- CVE-2024-42798An Incorrect Access Control vulnerability was found in /music/index.php?page=user_list and /music/index.php?page=edit_user in Kashipara Musi
- CVE-2024-44623An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function.
- CVE-2024-45413The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function.
- CVE-2024-45416The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function.
- CVE-2024-46424TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to
Medium, low and unrated 102
- CVE-2024-40825The issue was addressed with improved checks.Apple macOS · Apple visionOS
- CVE-2024-44124This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2024-40844A privacy issue was addressed with improved handling of temporary files.Apple iOS and iPadOS · Apple macOS
- CVE-2024-44153The issue was addressed with improved permissions logic.Apple macOS
- CVE-2024-44186An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2024-44128This issue was addressed by adding an additional prompt for user consent.Apple macOS
- CVE-2024-44190A path handling issue was addressed with improved validation.Apple macOS
- CVE-2024-44191This issue was addressed through improved state management.Apple Xcode · Apple iOS and iPadOS +4
- CVE-2024-44129The issue was addressed with improved checks.Apple macOS
- CVE-2024-44187A cross-origin issue existed with "iframe" elements.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-44168A library injection issue was addressed with additional restrictions.Apple macOS
- CVE-2024-40845The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-44125The issue was addressed with improved checks.Apple macOS
- CVE-2024-44133This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2024-40842An issue was addressed with improved validation of environment variables.Apple macOS
- CVE-2024-44180The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2024-27861The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-44163The issue was addressed with improved checks.Apple macOS
- CVE-2024-44134This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2024-40863This issue was addressed with improved data protection.Apple iOS and iPadOS
- CVE-2024-44135A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-40859A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44158This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS
- CVE-2024-27860The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-44178This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2024-40838A privacy issue was addressed by moving sensitive data to a protected location.Apple macOS
- CVE-2024-44139The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2024-44181An issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2024-44154A memory initialization issue was addressed with improved memory handling.Apple macOS
- CVE-2024-40843The issue was addressed with improved checks.Apple macOS
- CVE-2024-44182This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2024-40801A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-27880An out-of-bounds read issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-40840This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2024-40790The issue was addressed with improved handling of caches.Apple visionOS
- CVE-2024-40837A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44177A privacy issue was addressed by removing sensitive data.Apple macOS
- CVE-2024-44198An integer overflow was addressed through improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-40860A logic issue was addressed with improved checks.Apple macOS
- CVE-2024-44161An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2024-27875A logic issue was addressed with improved state management.Apple macOS
- CVE-2024-27858A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44176An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-40791A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS
- CVE-2024-40857This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-44183A logic error was addressed with improved error handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-40831A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44171This issue was addressed through improved state management.Apple iOS and iPadOS · Apple watchOS
- CVE-2024-40866The issue was addressed with improved UI.Apple Safari · Apple macOS
- CVE-2024-44130This issue was addressed with improved data protection.Apple macOS
- CVE-2024-44188A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-44184A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2024-40850A file access issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-44151A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-40797This issue was addressed through improved state management.Apple macOS
- CVE-2024-40847The issue was addressed with additional code-signing restrictions.Apple macOS
- CVE-2024-44202An authentication issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS
- CVE-2024-44166A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-40826A privacy issue was addressed with improved handling of files.Apple iOS and iPadOS · Apple macOS
- CVE-2024-23237The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-44131This issue was addressed with improved validation of symlinks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-44127This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2024-40830This issue was addressed with improved data protection.Apple iOS and iPadOS
- CVE-2024-44170A privacy issue was addressed by moving sensitive data to a more secure location.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-4283URL Redirection to Untrusted Site ('Open Redirect') in GitLabGitLab
- CVE-2024-6685Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2024-22013U-Boot environment is read from unauthenticated partition.Google Nest Wifi Pro
- CVE-2024-8766Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2024-34016Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent
- CVE-2024-45800Multiple mXSS found in snappymail HTML parserthe-djmaze snappymail
- CVE-2024-39910Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editordecidim
- CVE-2024-32034Cross-site scripting (XSS) in the decidim admin activity logdecidim · decidim-admin
- CVE-2024-8661Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" blockConcrete CMS · concrete5/concrete5
- CVE-2024-23984Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosuIntel(R) Processors
- CVE-2024-24968Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to potentially enable a denIntel(R) Processors
- CVE-2023-25546Out-of-bounds read in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable denial of service via locUEFI firmware for some Intel(R) Processors
- CVE-2023-43753Improper conditions check in some Intel(R) Processors with Intel(R) SGX may allow a privileged user to potentially enable information discloIntel(R) Processors with Intel(R) SGX
- CVE-2023-22351Out-of-bounds write in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege UEFI firmware for some Intel(R) Processors
- CVE-2023-23904NULL pointer dereference in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of pUEFI firmware for some Intel(R) Processors
- CVE-2024-28170Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable information disclosuIntel(R) RAID Web Console
- CVE-2024-36261Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of sIntel(R) RAID Web Console software
- CVE-2024-36247Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable denial of service viIntel(R) RAID Web Console
- CVE-2024-32666NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denialIntel(R) RAID Web Console software
- CVE-2024-34545Improper input validation in some Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable infoIntel(R) RAID Web Console software
- CVE-2024-33848Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially enable denial of servicIntel(R) RAID Web Console software
- CVE-2024-32940Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denial Intel(R) RAID Web Console software
- CVE-2024-34153Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enablIntel(R) RAID Web Console software
- CVE-2024-34543Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable escalatIntel(R) RAID Web Console software
- CVE-2024-38315IBM Aspera Shares session fixationIBM Aspera Shares
- CVE-2024-45835Insufficient Electron Fuses ConfigurationMattermost · mattermost-desktop
- CVE-2024-39772Silent Desktop Screenshot CaptureMattermost · mattermost-desktop
- CVE-2024-46970In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possibleJetBrains IntelliJ IDEA
- CVE-2024-1578Multiple MiCard PLUS card reader dropped charactersRebranded by NT-ware (originally developed and provided by…
- CVE-2024-45833Mobile password gets saved in dictionary under conditionsMattermost
- CVE-2024-39613RCE in desktop app in Windows by local attackerMattermost · mattermost-desktop
- CVE-2024-8780The SYSCOM Group OMFLOW - Improper Authorization for Data Query FunctionThe SYSCOM Group OMFLOW
- CVE-2024-8778The SYSCOM Group OMFLOW - Arbitrary File ReadThe SYSCOM Group OMFLOW
- CVE-2024-8776INTUMIT SmartRobot - Cross-site ScriptingINTUMIT SmartRobot
- CVE-2024-8880playSMS Template index.php code injectionplaySMS
- CVE-2024-42794Kashipara Music Management System v1.0 is vulnerable to Incorrect Access Control via /music/ajax.php?action=save_user.
- CVE-2024-42795An Incorrect Access Control vulnerability was found in /music/view_user.php?id=3 and /music/controller.php?page=edit_user&id=3 in Kashipara
- CVE-2024-42796An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_genre in Kashipara Music Management System v1.0.