CVEs published September 20, 2024
38 CVEs were published on September 20, 2024: 8 critical, 7 high.
- Published
- 38
- Critical
- 8
- High
- 7
- Medium
- 22
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- SourceCodester Best House Rental Management System
- 3
- code-projects Blood Bank Management System
- 2
- CodeCanyon CRMGo SaaS
- 2
- Cellopoint Secure Email Gateway
- 1
- code-projects Crud Operation System
- 1
- code-projects Patient Record Management System
- 1
- Codezips Internal Marks Calculation
- 1
- Codezips Online Shopping Portal
- 1
- FreeBSD
- 1
- galaxyproject galaxy
- 1
Critical 8
- CVE-2024-47062Multiple SQL Injections and ORM Leak in navidromenavidrome · github.com/navidrome/navidrome
- CVE-2024-9043Cellopoint Secure Email Gateway - Buffer OverflowCellopoint Secure Email Gateway
- CVE-2024-8853Webo-facto <= 1.40 - Unauthenticated Privilege Escalationjeremieglotin Webo-facto
- CVE-2024-45489Arc before 2024-08-26 allows remote code execution in JavaScript boosts.
- CVE-2024-46101GDidees CMS <= v3.9.1 has a file upload vulnerability.
- CVE-2024-46103SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.
- CVE-2024-46640SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp.
- CVE-2024-46652Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function.
High 7
- CVE-2024-47061Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejsudecode plate · @udecode/plate-core
- CVE-2024-42346Stored Cross Site Scripting (Stored XSS) in Galaxygalaxyproject galaxy · galaxy-auth +1
- CVE-2024-41721bhyve(8) out-of-bounds read access via XHCI emulationFreeBSD
- CVE-2023-47480An issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function.
- CVE-2024-46645eNMS 4.0.0 is vulnerable to Directory Traversal via get_tree_files.
- CVE-2024-46648eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan_folder.
- CVE-2024-46649eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder.
Medium, low and unrated 23
- CVE-2024-45793Cross-site Scripting from in Confidant API calllyft confidant · confidant
- CVE-2024-42351Possible Data Tampering & Loss of Public Datasets in Galaxygalaxyproject galaxy
- CVE-2024-45229The Versa Director offers REST APIs for orchestration and management.Versa Director
- CVE-2024-8612Qemu-kvm: information leak in virtio devicesqemu · Red Hat Enterprise Linux
- CVE-2024-9041SourceCodester Best House Rental Management System ajax.php sql injectionSourceCodester Best House Rental Management System
- CVE-2024-9040code-projects Blood Bank Management System Password cleartext storage in a file or on diskcode-projects Blood Bank Management System
- CVE-2024-9039SourceCodester Best House Rental Management System ajax.php sql injectionSourceCodester Best House Rental Management System
- CVE-2024-9038Codezips Online Shopping Portal insert-product.php unrestricted uploadCodezips Online Shopping Portal
- CVE-2024-9037Codezips Internal Marks Calculation index.php sql injectionCodezips Internal Marks Calculation
- CVE-2024-9036itsourcecode Online Bookstore admin_add.php unrestricted uploaditsourcecode Online Bookstore
- CVE-2024-9035code-projects Blood Bank Management System Admin Login login.php sql injectioncode-projects Blood Bank Management System
- CVE-2024-9034code-projects Patient Record Management System login.php sql injectioncode-projects Patient Record Management System
- CVE-2024-9033SourceCodester Best House Rental Management System ajax.php cross site scriptingSourceCodester Best House Rental Management System
- CVE-2024-9032SourceCodester Simple Forum-Discussion System index.php path traversalSourceCodester Simple Forum-Discussion System
- CVE-2024-9031CodeCanyon CRMGo SaaS show cross site scriptingCodeCanyon CRMGo SaaS
- CVE-2024-9030CodeCanyon CRMGo SaaS note cross site scriptingCodeCanyon CRMGo SaaS
- CVE-2024-9011code-projects Crud Operation System updata.php sql injectioncode-projects Crud Operation System
- CVE-2024-37879Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitr
- CVE-2024-42697Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary c
- CVE-2024-46644eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit_file.
- CVE-2024-46646eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file.
- CVE-2024-46647eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload_files.
- CVE-2024-46654A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute a