CVEs published September 23, 2024
60 CVEs were published on September 23, 2024: 13 critical, 16 high.
- Published
- 60
- Critical
- 13
- High
- 16
- Medium
- 30
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Google Chrome
- 10
- Sony XAV-AX5500
- 4
- PureStorage FlashArray
- 3
- dataease · io.dataease:common
- 2
- Exnet Informatics Software Ferry Reservation System
- 2
- GitHub Enterprise Server
- 2
- SourceCodester Profile Registration without Reload Refresh
- 2
- Acronis Cyber Protect Cloud Agent
- 1
- Apache Software Foundation Apache Tomcat Connectors
- 1
- Checkmk
- 1
Critical 13
- CVE-2024-7024Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escapeGoogle Chrome
- CVE-2024-0005A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specificPureStorage FlashArray · PureStorage FlashBlade
- CVE-2024-0004A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege PureStorage FlashArray
- CVE-2024-0003A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the arrayPureStorage FlashArray
- CVE-2024-0002A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.PureStorage FlashArray
- CVE-2024-0001A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowingPure Storage FlashArray
- CVE-2024-9014OAuth2 client id and secret exposed through the web browser in pgAdmin 4pgadmin.org pgAdmin · pgadmin4
- CVE-2024-47066Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)lobehub lobe-chat · @lobehub/chat
- CVE-2024-46997DataEase's H2 datasource has a remote command execution riskdataease · io.dataease:common
- CVE-2024-7735SQLi in Exnet Informatics Software's Ferry Reservation SystemExnet Informatics Software Ferry Reservation System
- CVE-2024-8606Fix 2FA bypass via RestAPICheckmk
- CVE-2024-34331A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted m
- CVE-2024-47222New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storag
High 16
- CVE-2024-7023Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation viaGoogle Chrome
- CVE-2018-20072Insufficient data validation in PDF in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform out of bounds memory access Google Chrome
- CVE-2021-38023Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2024-7022Uninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a craftGoogle Chrome
- CVE-2024-7018Heap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2024-43201Planet Fitness Workouts mobile apps do not properly validate TLS certificatesPlanet Fitness Workouts
- CVE-2024-46985DataEase has an XXE vulnerabilitydataease · io.dataease:common
- CVE-2024-23934Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilitySony XAV-AX5500
- CVE-2024-7835Reflected XSS in Exnet Informatics Software's Ferry Reservation SystemExnet Informatics Software Ferry Reservation System
- CVE-2022-48945media: vivid: fix compose size exceed boundaryLinux
- CVE-2024-37779WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script
- CVE-2024-39842A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive
- CVE-2024-40442An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann
- CVE-2024-41228A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges an
- CVE-2024-42861An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay_Req message
- CVE-2024-46639A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo
Medium, low and unrated 31
- CVE-2023-7282Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2023-7281Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a Google Chrome
- CVE-2024-7020Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafGoogle Chrome
- CVE-2024-7019Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2024-8263An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use ofGitHub Enterprise Server
- CVE-2024-8770A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attacGitHub Enterprise Server
- CVE-2024-47069Oveleon Cookiebar reflected Cross-site Scripting vulnerabilityoveleon contao-cookiebar · oveleon/contao-cookiebar
- CVE-2024-47068DOM Clobbering Gadget found in rollup bundled scripts that leads to XSSrollup
- CVE-2024-23922Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution VulnerabilitySony XAV-AX5500
- CVE-2024-23972Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution VulnerabilitySony XAV-AX5500
- CVE-2024-23933Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution VulnerabilitySony XAV-AX5500
- CVE-2024-46544Apache Tomcat Connectors: mod_jk: local users can view and modify configurationApache Software Foundation Apache Tomcat Connectors
- CVE-2024-8903Local active protection service settings manipulation due to unnecessary privileges assignment.Acronis Cyber Protect Cloud Agent
- CVE-2024-45348Xiaomi Router AX9000 has a post-authorization command injection vulnerabilityXiaomi Router AX9000
- CVE-2024-8758Quiz and Survey Master (QSM) < 9.1.3 - Author+ Stored XSSQuiz and Survey Master
- CVE-2024-7846YITH WooCommerce Ajax Search < 2.7.1 - Contributor+ Stored XSSYITH WooCommerce Ajax Search
- CVE-2024-9094code-projects Blood Bank System o-.php sql injectioncode-projects Blood Bank System
- CVE-2024-9093SourceCodester Profile Registration without Reload Refresh GET Parameter del.php sql injectionSourceCodester Profile Registration without Reload Refresh
- CVE-2024-9092SourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scriptingSourceCodester Profile Registration without Reload Refresh
- CVE-2024-45453WordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerabilityPeter Hardy-vanDoorn Maintenance Redirect
- CVE-2024-44048WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerabilitywpWax Product Carousel Slider & Grid Ultimate for WooCommer…
- CVE-2024-43996WordPress ElementsKit Pro plugin <= 3.6.0 - Local File Inclusion vulnerabilityElementsKit Pro
- CVE-2024-9091code-projects Student Record System index.php sql injectioncode-projects Student Record System
- CVE-2023-46948A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbit
- CVE-2024-39341Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier l
- CVE-2024-39342Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e
- CVE-2024-39843A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user
- CVE-2024-40441An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann
- CVE-2024-44540Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART De
- CVE-2024-46241PHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add_product.php and
- CVE-2024-47227iRedAdmin before 2.6 allows XSS, e.g., via order_name.