CVEs published September 19, 2024
60 CVEs were published on September 19, 2024: 12 critical, 16 high. 1 is now in CISA KEV.
- Published
- 60
- Critical
- 12
- High
- 16
- Medium
- 32
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 32
Most affected products
- envoyproxy envoy
- 5
- Apex Softcell LD Geo
- 3
- JetBrains YouTrack
- 3
- Microsoft Edge
- 3
- NetCat CMS
- 3
- zitadel · github.com/zitadel/zitadel +1
- 3
- Apex Softcell LD DP Back Office
- 2
- jeanmarc77 123solar
- 2
- Kastle Systems Access Control System
- 2
- pcp · Red Hat Enterprise Linux
- 2
Critical 12
- CVE-2023-27584Dragonfly2 vulnerable to hard coded cyptographic keydragonflyoss Dragonfly2 · d7y.io/dragonfly/v2
- CVE-2024-45410HTTP client can remove the X-Forwarded headers in Traefiktraefik · github.com/traefik/traefik +2
- CVE-2024-46983Remote Command Execution(RCE) Vulnerbility in sofa-hessiansofastack sofa-hessian · com.alipay.sofa:hessian
- CVE-2024-8963Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.Ivanti CSA
- CVE-2024-45861Use of Hard-coded Credentials in Kastle Systems Access Control SystemKastle Systems Access Control System
- CVE-2024-7785Reflected XSS in Ece Software's Electronic Ticket SystemEce Software Electronic Ticket System
- CVE-2024-8986Information Leakage in grafana-plugin-sdk-gografana-plugin-sdk-go Grafana Plugin SDK · github.com/grafa…
- CVE-2024-47088User Enumeration vulnerabilityApex Softcell LD Geo
- CVE-2024-31570libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.
- CVE-2024-33109Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files
- CVE-2024-40125An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execu
- CVE-2024-46946langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sylangchain-experimental
High 16
- CVE-2024-45807oghttp2 crash on OnBeginHeadersForStream in envoyenvoyproxy envoy
- CVE-2024-46999User Grant Deactivation not Working in Zitadelzitadel · github.com/zitadel/zitadel +1
- CVE-2024-47000Service Users Deactivation not Working in Zitadelzitadel · github.com/zitadel/zitadel +1
- CVE-2024-46984XML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidatorgematik app-referencevalidator · de.gematik.refv.commons:co…
- CVE-2024-38016Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2024-45862Cleartext Storage of Sensitive Information in Kastle Systems Access Control SystemKastle Systems Access Control System
- CVE-2024-8698Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloakkeycloak · Red Hat Build of Keycloak +4
- CVE-2024-7737Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-7736Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2024-47089Unauthorized Transaction Manipulation VulnerabilityApex Softcell LD Geo
- CVE-2024-47087Information Disclosure VulnerabilityApex Softcell LD Geo
- CVE-2024-47086OTP Bypass VulnerabilityApex Softcell LD DP Back Office
- CVE-2024-47085Parameter Manipulation VulnerabilityApex Softcell LD DP Back Office
- CVE-2024-7254Stack overflow in Protocol Buffers Java LiteGoogle Protocol Buffers · Google protobuf-java +9
- CVE-2024-45752logiops through 0.3.4, in its default configuration, allows any unprivileged user to configure its logid daemon via an unrestricted D-Bus se
- CVE-2024-46394FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add
Medium, low and unrated 32
- CVE-2024-45806Potential manipulate `x-envoy` headers from external sources in envoyenvoyproxy envoy
- CVE-2024-45808Malicious log injection via access logs in envoyenvoyproxy envoy
- CVE-2024-45809Jwt filter crash in the clear route cache with remote JWKs in envoyenvoyproxy envoy
- CVE-2024-45810Envoy crashes for LocalReply in http async clientenvoyproxy envoy
- CVE-2024-9009code-projects Online Quiz Site showtest.php sql injectioncode-projects Online Quiz Site
- CVE-2024-47060Unauthorized Access After Organization or Project Deactivation in Zitadelzitadel · github.com/zitadel/zitadel +1
- CVE-2024-9008SourceCodester Best Online News Portal Comment Section news-details.php sql injectionSourceCodester Best Online News Portal
- CVE-2024-45614Header normalization allows for client to clobber proxy set headers in Pumapuma
- CVE-2024-9007jeanmarc77 123solar detailed.php cross site scriptingjeanmarc77 123solar
- CVE-2024-9006jeanmarc77 123solar config_invt1.php code injectionjeanmarc77 123solar
- CVE-2024-9004D-Link DAR-7000 Backup_Server_commit.php os command injectionD-Link DAR-7000
- CVE-2024-9003Jinan Chicheng Company JFlow Attachment EntityMutliFile_Load.do AttachmentUploadController access controlJinan Chicheng Company JFlow
- CVE-2024-43489Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-43496Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-38221Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-9001TOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injectionTOTOLINK T10
- CVE-2024-47162In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports pageJetBrains YouTrack
- CVE-2024-47160In JetBrains YouTrack before 2024.3.44799 access to global app config data without appropriate permissions was possibleJetBrains YouTrack
- CVE-2024-47159In JetBrains YouTrack before 2024.3.44799 user without appropriate permissions could restore workflows attached to a projectJetBrains YouTrack
- CVE-2024-8653Netcat CMS: multiple reflected cross-site scripting vulnerabilities in netshop moduleNetCat CMS
- CVE-2024-8652Netcat CMS: reflected cross-site scripting in openstat moduleNetCat CMS
- CVE-2024-8651Netcat CMS: user enumerationNetCat CMS
- CVE-2024-8375Object deserialization in Reverb leading to RCEGoogle Deepmind Reverb · dm-reverb-nightly +1
- CVE-2024-8883Keycloak: vulnerable redirect uri validation results in open redireckeycloak-services · Red Hat Build of Keycloak +4
- CVE-2024-8354Qemu-kvm: usb: assertion failure in usb_ep_get()qemu · Red Hat Enterprise Linux
- CVE-2024-45770Pcp: pmpost symlink attack allows escalating pcp to root userpcp · Red Hat Enterprise Linux
- CVE-2024-45769Pcp: pmcd heap corruption through metric pmstore operationspcp · Red Hat Enterprise Linux
- CVE-2024-8364WP Custom Fields Search <= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcodedondon-benjamincouk WP Custom Fields Search
- CVE-2022-4533Limit Login Attempts Plus <= 1.1.0 - IP Address Spoofing to Protection Mechanism Bypassdevfelixmoira Limit Login Attempts Plus – WordPress Limit L…
- CVE-2024-8850MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scriptingdvankooten MC4WP: Mailchimp for WordPress
- CVE-2024-25673Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.
- CVE-2024-46382A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via the goodsId, goodsSn