CVEs published September 17, 2024
105 CVEs were published on September 17, 2024: 9 critical, 36 high. 4 are now in CISA KEV.
- Published
- 105
- Critical
- 9
- High
- 36
- Medium
- 60
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 4
- Fix available
- 47
Most affected products
- Google Chrome
- 6
- contao · contao/core-bundle
- 3
- Hewlett Packard Enterprise (HPE) Aruba OS
- 3
- highwarden Super Store Finder
- 3
- backstage · @backstage/plugin-techdocs-backend
- 2
- getsentry sentry · sentry
- 2
- Mautic · mautic/core
- 2
- Millbeck Communications Proroute H685t-w
- 2
- PTZOptics PT30X-SDI · PTZOptics PT30X-NDI
- 2
- vitejs vite · vite
- 2
Critical 9
- CVE-2024-43976WordPress Super Store Finder plugin <= 6.9.7 - SQL Injection vulnerabilityhighwarden Super Store Finder
- CVE-2024-43978WordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerabilityhighwarden Super Store Finder
- CVE-2024-44004WordPress WPCargo Track & Trace plugin <= 8.0.2 - SQL Injection vulnerabilityArni Cinco WPCargo Track & Trace
- CVE-2024-8956PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient AuthenticationPTZOptics PT30X-SDI · PTZOptics PT30X-NDI
- CVE-2024-38183GroupMe Elevation of Privilege VulnerabilityMicrosoft GroupMe
- CVE-2024-45798Multiple Poisoned Pipeline Execution (PPE) vulnerabilitiesespressif arduino-esp32
- CVE-2024-38812Heap-overflow vulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2024-7873Stored XSS in Veribilim Software's Veribase Order ManagementVeribilim Software Veribase Order
- CVE-2024-8767Sensitive data disclosure and manipulation due to unnecessary privileges assignment.Acronis Backup plugin for cPanel & WHM · Acronis Backup… +1
High 36
- CVE-2024-43970WordPress SureCart plugin <= 2.29.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySureCart
- CVE-2024-43971WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2024-43975WordPress Super Store Finder plugin <= 6.9.7 - Cross Site Scripting (XSS) vulnerabilityhighwarden Super Store Finder
- CVE-2024-44002WordPress Team Showcase plugin <= 1.22.25 - Reflected Cross Site Scripting (XSS) vulnerabilityPickPlugins Team Showcase
- CVE-2024-44003WordPress Spice Starter Sites plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityspicethemes Spice Starter Sites
- CVE-2024-44007WordPress SKT Templates – Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) vulnerabilitysonalsinha21 SKT Templates – Elementor & Gutenberg templates
- CVE-2024-44009WordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerabilityWC Lovers WCFM Marketplace
- CVE-2024-43938WordPress Name Directory plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerabilityJeroen Peters Name Directory
- CVE-2024-44064WordPress Like Button Rating LikeBtn plugin <= 2.6.53 - Reflected Cross Site Scripting (XSS) vulnerabilityLikeBtn Like Button Rating
- CVE-2024-43969WordPress Spiffy Calendar plugin <= 4.9.12 - SQL Injection vulnerabilitySpiffy Plugins Spiffy Calendar
- CVE-2024-46982Cache Poisoning in next.jsvercel next.js · next
- CVE-2024-8905Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit stack corruptionGoogle Chrome
- CVE-2024-8904Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-8957PTZOptics NDI and SDI Cameras Command Injection via NTP Address ConfigurationPTZOptics PT30X-SDI · PTZOptics PT30X-NDI
- CVE-2024-45398Remote command execution through file upload in contao/core-bundlecontao · contao/core-bundle
- CVE-2024-45606Improper authorization on muting of alert rules in sentrygetsentry sentry · sentry
- CVE-2024-43460Dynamics 365 Business Central Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 Business Central Online
- CVE-2024-8900An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-42503Authenticated Remote Command Execution (RCE) Vulnerability in the Lua Package Within the AOS Command Line Interface (CLI)Hewlett Packard Enterprise (HPE) Aruba OS
- CVE-2024-42502Authenticated Remote Command Execution (RCE) Vulnerability in the AOS Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba OS
- CVE-2024-42501Authenticated Path Traversal Vulnerability Leads to a Remote Command Execution (RCE)Hewlett Packard Enterprise (HPE) Aruba OS
- CVE-2024-45682Millbeck Communications Proroute H685t-w Command Injection.Millbeck Communications Proroute H685t-w
- CVE-2024-38813Privilege escalation vulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2024-8768Vllm: a completions api request with an empty prompt will crash the vllm api server.vllm · Red Hat Enterprise Linux AI
- CVE-2024-7788Signatures in "repair mode" should not be trustedThe Document Foundation LibreOffice
- CVE-2021-27916Relative Path Traversal / Arbitrary File Deletion in Mautic (GrapesJS Builder)Mautic · mautic/core
- CVE-2021-27915XSS Cross-site Scripting Stored (XSS) - Description fieldMautic · mautic/core
- CVE-2024-22303WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerabilityfavethemes Houzez
- CVE-2024-21743WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerabilityfavethemes Houzez Login Register
- CVE-2024-8761Share This Image <= 2.03 - Open Redirect via link Parametermihail-barinov Share This Image
- CVE-2024-8490PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_detailspropertyhive Property Hive
- CVE-2024-8110Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer.Yokogawa Electric Dual-redundant Platform for Computer
- CVE-2024-46085FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/rename
- CVE-2024-46362FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_directory
- CVE-2024-47047An issue was discovered in the powermail extension through 12.4.0 for TYPO3.in2code/powermail
- CVE-2024-47049The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrlczim/file-handling
Medium, low and unrated 60
- CVE-2024-43972WordPress Page Builder: Pagelayer – Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerabilityPagelayer Team PageLayer
- CVE-2024-43983WordPress Podlove Podcast Publisher plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerabilityPodlove Podcast Publisher
- CVE-2024-43987WordPress Sliding Door theme <= 3.6 - Cross Site Scripting (XSS) vulnerabilitywayneconnor Sliding Door
- CVE-2024-43988WordPress Mystique theme <= 2.5.7 - Cross Site Scripting (XSS) vulnerabilitydigitalnature Mystique
- CVE-2024-43991WordPress Hotel Galaxy theme <= 4.4.24 - Cross Site Scripting (XSS) vulnerabilitywebdzier Hotel Galaxy
- CVE-2024-43992WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerabilityLatePoint
- CVE-2024-43993WordPress Liquido theme <= 1.0.1.2 - Cross Site Scripting (XSS) vulnerabilityCryoutCreations Liquido
- CVE-2024-43994WordPress Kahuna theme <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityCryoutCreations Kahuna
- CVE-2024-43995WordPress Posterity theme <= 3.6 - Cross Site Scripting (XSS) vulnerabilitysonalsinha21 Posterity
- CVE-2024-43999WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerabilitySaturday Drive Ninja Forms
- CVE-2024-44001WordPress Royal Elementor Addons and Templates plugin <= 1.3.982 - Cross Site Scripting (XSS) vulnerabilityWP Royal Royal Elementor Addons
- CVE-2024-44005WordPress Greenshift plugin <= 9.3.7 - Cross Site Scripting (XSS) vulnerabilitywpsoul Greenshift
- CVE-2024-44008WordPress Geo Mashup plugin <= 1.13.12 - Cross Site Scripting (XSS) vulnerabilityDylan Kuhn Geo Mashup
- CVE-2024-44047WordPress IMPress for IDX Broker plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityIMPress for IDX Broker
- CVE-2024-44049WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerabilityThemeHunk Gutenberg Blocks
- CVE-2024-43985WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.3.5 - Cross Site Scripting (XSS) vulnerabilityMagePeople Team Bus Ticket Booking with Seat Reservation
- CVE-2024-43977WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Cross Site Scripting (XSS) vulnerabilityPOSIMYTH The Plus Addons for Elementor Page Builder Lite
- CVE-2024-37985Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-44050WordPress Verbosa theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilitycryout-creations Verbosa
- CVE-2024-44051WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerabilityJohan van der Wijk Content Blocks
- CVE-2024-45451WordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitycryout-creations Roseta
- CVE-2024-45452WordPress Septera theme <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilitycryout-creations Septera
- CVE-2024-8909Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2024-8908Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafGoogle Chrome
- CVE-2024-8907Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user toGoogle Chrome
- CVE-2024-8906Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2024-45815Prototype pollution in @backstage/plugin-catalog-backendbackstage · @backstage/plugin-catalog-backend
- CVE-2024-45816Storage bucket Directory Traversal in @backstage/plugin-techdocs-backendbackstage · @backstage/plugin-techdocs-backend
- CVE-2024-46976Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backendbackstage · @backstage/plugin-techdocs-backend
- CVE-2024-45812DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vitevitejs vite · vite
- CVE-2024-45811server.fs.deny bypassed when using ?import&raw in vitevitejs vite · vite
- CVE-2024-8951SourceCodester Resort Reservation System manage_fee.php cross site scriptingSourceCodester Resort Reservation System
- CVE-2024-45604Directory traversal in the file selector widget in contao/core-bundlecontao · contao/core-bundle
- CVE-2024-45605Improper authorization on deletion of user issue alert notifications in sentrygetsentry sentry · sentry
- CVE-2024-8949SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership managementSourceCodester Online Eyewear Shop
- CVE-2024-8948MicroPython objint.c mpz_as_bytes heap-based overflowMicroPython · micropython-os +2
- CVE-2024-45537Apache Druid: Users can provide MySQL JDBC properties not on allow listApache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2024-45384Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle AttackApache Software Foundation Apache Druid · org.apache.druid.…
- CVE-2024-8947MicroPython objarray.c use after freeMicroPython · micropython-io +1
- CVE-2024-8946MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflowMicroPython · micropython-string +3
- CVE-2024-45612Insert tag injection via canonical URL in Contaocontao · contao/core-bundle
- CVE-2024-45803Cross site scripting (XSS) Vulnerability on route /wireui/button?label=Content in wireuiwireui · wireui/wireui
- CVE-2024-8660Stored XSS in the "Top Navigator Bar" blockConcrete CMS · concrete5/concrete5
- CVE-2024-8945CodeCanyon RISE Ultimate Project Manager save sql injectionCodeCanyon RISE Ultimate Project Manager
- CVE-2024-8944code-projects Hospital Management System check_availability.php sql injectioncode-projects Hospital Management System
- CVE-2024-38380Millbeck Communications Proroute H685t-w Cross-site Scripting.Millbeck Communications Proroute H685t-w
- CVE-2024-8796Insufficient Default OTP Shared Secret Lengthdevise-two-factor
- CVE-2024-8939Vllm: denials of service in vllm json web apivllm · Red Hat Enterprise Linux AI
- CVE-2024-38860Reflected links in error message facilitate phishing attacksCheckmk
- CVE-2024-8897Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be Mozilla Firefox for Android
- CVE-2024-5998Deserialization of Untrusted Data in langchain-ai/langchainlangchain-ai/langchain · langchain-community +1
- CVE-2024-8093Posts reminder <= 0.20 - Settings Update via CSRFPosts reminder
- CVE-2024-8092Accordion Image Menu <= 3.1.3 - Stored XSS via CSRFAccordion Image Menu
- CVE-2024-8091Enhanced Search Box <= 0.6.1 - Settings Update via CSRFEnhanced Search Box
- CVE-2024-8052Review Ratings <= 1.6 - Stored XSS via CSRFReview Ratings
- CVE-2024-8051Special Feed Items <= 1.0.1 - Stored XSS via CSRFSpecial Feed Items
- CVE-2024-8047Visual Sound (old) <= 1.06 - Settings Update via CSRFVisual Sound
- CVE-2024-8044infolinks Ad Wrap <= 1.0.2 - Settings Update via CSRFinfolinks Ad Wrap
- CVE-2024-8043Vikinghammer Tweet <= 0.2.4 - Stored XSS via CSRFVikinghammer Tweet
- CVE-2024-5170Logo Manager For Enamad <= 0.7.1 - Admin+ Stored XSS via WidgetLogo Manager For Enamad