# CVEs published 2024-09-20 38 CVEs were published on September 20, 2024: 8 critical, 7 high. Days are UTC. - [CVE-2024-45793](https://cve.now/CVE-2024-45793.md): Cross-site Scripting from in Confidant API call (CVSS 4.8, lyft confidant · confidant) - [CVE-2024-47061](https://cve.now/CVE-2024-47061.md): Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs (CVSS 8.3, udecode plate · @udecode/plate-core) - [CVE-2024-47062](https://cve.now/CVE-2024-47062.md): Multiple SQL Injections and ORM Leak in navidrome (CVSS 9.4, navidrome · github.com/navidrome/navidrome) - [CVE-2024-42351](https://cve.now/CVE-2024-42351.md): Possible Data Tampering & Loss of Public Datasets in Galaxy (CVSS 6.5, galaxyproject galaxy) - [CVE-2024-42346](https://cve.now/CVE-2024-42346.md): Stored Cross Site Scripting (Stored XSS) in Galaxy (CVSS 7.6, galaxyproject galaxy · galaxy-auth +1) - [CVE-2024-45229](https://cve.now/CVE-2024-45229.md): The Versa Director offers REST APIs for orchestration and management. (CVSS 6.6, Versa Director) - [CVE-2024-8612](https://cve.now/CVE-2024-8612.md): Qemu-kvm: information leak in virtio devices (CVSS 3.8, qemu · Red Hat Enterprise Linux) - [CVE-2024-9041](https://cve.now/CVE-2024-9041.md): SourceCodester Best House Rental Management System ajax.php sql injection (CVSS 5.3, SourceCodester Best House Rental Management System) - [CVE-2024-9040](https://cve.now/CVE-2024-9040.md): code-projects Blood Bank Management System Password cleartext storage in a file or on disk (CVSS 4.6, code-projects Blood Bank Management System) - [CVE-2024-9039](https://cve.now/CVE-2024-9039.md): SourceCodester Best House Rental Management System ajax.php sql injection (CVSS 6.9, SourceCodester Best House Rental Management System) - [CVE-2024-9038](https://cve.now/CVE-2024-9038.md): Codezips Online Shopping Portal insert-product.php unrestricted upload (CVSS 5.3, Codezips Online Shopping Portal) - [CVE-2024-9037](https://cve.now/CVE-2024-9037.md): Codezips Internal Marks Calculation index.php sql injection (CVSS 6.9, Codezips Internal Marks Calculation) - [CVE-2024-9036](https://cve.now/CVE-2024-9036.md): itsourcecode Online Bookstore admin\_add.php unrestricted upload (CVSS 5.3, itsourcecode Online Bookstore) - [CVE-2024-9035](https://cve.now/CVE-2024-9035.md): code-projects Blood Bank Management System Admin Login login.php sql injection (CVSS 6.9, code-projects Blood Bank Management System) - [CVE-2024-9034](https://cve.now/CVE-2024-9034.md): code-projects Patient Record Management System login.php sql injection (CVSS 6.9, code-projects Patient Record Management System) - [CVE-2024-9033](https://cve.now/CVE-2024-9033.md): SourceCodester Best House Rental Management System ajax.php cross site scripting (CVSS 5.3, SourceCodester Best House Rental Management System) - [CVE-2024-9032](https://cve.now/CVE-2024-9032.md): SourceCodester Simple Forum-Discussion System index.php path traversal (CVSS 5.3, SourceCodester Simple Forum-Discussion System) - [CVE-2024-9031](https://cve.now/CVE-2024-9031.md): CodeCanyon CRMGo SaaS show cross site scripting (CVSS 5.3, CodeCanyon CRMGo SaaS) - [CVE-2024-9030](https://cve.now/CVE-2024-9030.md): CodeCanyon CRMGo SaaS note cross site scripting (CVSS 5.3, CodeCanyon CRMGo SaaS) - [CVE-2024-9043](https://cve.now/CVE-2024-9043.md): Cellopoint Secure Email Gateway - Buffer Overflow (CVSS 9.8, Cellopoint Secure Email Gateway) - [CVE-2024-41721](https://cve.now/CVE-2024-41721.md): bhyve(8) out-of-bounds read access via XHCI emulation (CVSS 8.1, FreeBSD) - [CVE-2024-8853](https://cve.now/CVE-2024-8853.md): Webo-facto \<= 1.40 - Unauthenticated Privilege Escalation (CVSS 9.8, jeremieglotin Webo-facto) - [CVE-2024-9011](https://cve.now/CVE-2024-9011.md): code-projects Crud Operation System updata.php sql injection (CVSS 5.3, code-projects Crud Operation System) - [CVE-2023-47480](https://cve.now/CVE-2023-47480.md): An issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set\*id () function. (CVSS 8.4) - [CVE-2024-37879](https://cve.now/CVE-2024-37879.md): Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitr (CVSS 4.8) - [CVE-2024-42697](https://cve.now/CVE-2024-42697.md): Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary c (CVSS 6.1) - [CVE-2024-45489](https://cve.now/CVE-2024-45489.md): Arc before 2024-08-26 allows remote code execution in JavaScript boosts. (CVSS 9.8) - [CVE-2024-46101](https://cve.now/CVE-2024-46101.md): GDidees CMS \<= v3.9.1 has a file upload vulnerability. (CVSS 9.8) - [CVE-2024-46103](https://cve.now/CVE-2024-46103.md): SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS\_Main.php. (CVSS 9.8) - [CVE-2024-46640](https://cve.now/CVE-2024-46640.md): SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. (CVSS 9.8) - [CVE-2024-46644](https://cve.now/CVE-2024-46644.md): eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via edit\_file. (CVSS 6.5) - [CVE-2024-46645](https://cve.now/CVE-2024-46645.md): eNMS 4.0.0 is vulnerable to Directory Traversal via get\_tree\_files. (CVSS 7.5) - [CVE-2024-46646](https://cve.now/CVE-2024-46646.md): eNMS up to 4.7.1 is vulnerable to Directory Traversal via /download/file. (CVSS 6.5) - [CVE-2024-46647](https://cve.now/CVE-2024-46647.md): eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via upload\_files. (CVSS 6.5) - [CVE-2024-46648](https://cve.now/CVE-2024-46648.md): eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan\_folder. (CVSS 7.5) - [CVE-2024-46649](https://cve.now/CVE-2024-46649.md): eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder. (CVSS 7.5) - [CVE-2024-46652](https://cve.now/CVE-2024-46652.md): Tenda AC8v4 V16.03.34.06 has a stack overflow vulnerability in the fromAdvSetMacMtuWan function. (CVSS 9.8) - [CVE-2024-46654](https://cve.now/CVE-2024-46654.md): A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute a (CVSS 4.8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-09-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.