# CVEs published 2024-09-23

60 CVEs were published on September 23, 2024: 13 critical, 16 high. Days are UTC.

- [CVE-2024-7024](https://cve.now/CVE-2024-7024.md): Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform a sandbox escape (CVSS 9.3, Google Chrome)
- [CVE-2024-7023](https://cve.now/CVE-2024-7023.md): Insufficient data validation in Updater in Google Chrome prior to 128.0.6537.0 allowed a remote attacker to perform privilege escalation via (CVSS 8.0, Google Chrome)
- [CVE-2018-20072](https://cve.now/CVE-2018-20072.md): Insufficient data validation in PDF in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform out of bounds memory access (CVSS 7.8, Google Chrome)
- [CVE-2021-38023](https://cve.now/CVE-2021-38023.md): Use after free in Extensions in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2023-7282](https://cve.now/CVE-2023-7282.md): Inappropriate implementation in Navigation in Google Chrome prior to 113.0.5672.63 allowed a remote attacker who convinced a user to engage (CVSS 4.3, Google Chrome)
- [CVE-2023-7281](https://cve.now/CVE-2023-7281.md): Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform UI spoofing via a (CVSS 4.3, Google Chrome)
- [CVE-2024-7022](https://cve.now/CVE-2024-7022.md): Uninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a craft (CVSS 8.8, Google Chrome)
- [CVE-2024-7020](https://cve.now/CVE-2024-7020.md): Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a craf (CVSS 4.3, Google Chrome)
- [CVE-2024-7019](https://cve.now/CVE-2024-7019.md): Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in speci (CVSS 4.3, Google Chrome)
- [CVE-2024-7018](https://cve.now/CVE-2024-7018.md): Heap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2024-8263](https://cve.now/CVE-2024-8263.md): An improper privilege management vulnerability allowed arbitrary workflows to be committed using an improperly scoped PAT through the use of (CVSS 6.2, GitHub Enterprise Server)
- [CVE-2024-8770](https://cve.now/CVE-2024-8770.md): A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attac (CVSS 5.8, GitHub Enterprise Server)
- [CVE-2024-43201](https://cve.now/CVE-2024-43201.md): Planet Fitness Workouts mobile apps do not properly validate TLS certificates (CVSS 8.8, Planet Fitness Workouts)
- [CVE-2024-0005](https://cve.now/CVE-2024-0005.md): A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specific (CVSS 9.1, PureStorage FlashArray · PureStorage FlashBlade)
- [CVE-2024-0004](https://cve.now/CVE-2024-0004.md): A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege (CVSS 9.1, PureStorage FlashArray)
- [CVE-2024-0003](https://cve.now/CVE-2024-0003.md): A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array (CVSS 9.1, PureStorage FlashArray)
- [CVE-2024-0002](https://cve.now/CVE-2024-0002.md): A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array. (CVSS 10.0, PureStorage FlashArray)
- [CVE-2024-0001](https://cve.now/CVE-2024-0001.md): A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing (CVSS 10.0, Pure Storage FlashArray)
- [CVE-2024-9014](https://cve.now/CVE-2024-9014.md): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 (CVSS 9.9, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2024-47069](https://cve.now/CVE-2024-47069.md): Oveleon Cookiebar reflected Cross-site Scripting vulnerability (CVSS 6.1, oveleon contao-cookiebar · oveleon/contao-cookiebar)
- [CVE-2024-47068](https://cve.now/CVE-2024-47068.md): DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS (CVSS 6.1, rollup)
- [CVE-2024-47066](https://cve.now/CVE-2024-47066.md): Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) (CVSS 9.0, lobehub lobe-chat · @lobehub/chat)
- [CVE-2024-46997](https://cve.now/CVE-2024-46997.md): DataEase's H2 datasource has a remote command execution risk (CVSS 9.8, dataease · io.dataease:common)
- [CVE-2024-46985](https://cve.now/CVE-2024-46985.md): DataEase has an XXE vulnerability (CVSS 7.5, dataease · io.dataease:common)
- [CVE-2024-23922](https://cve.now/CVE-2024-23922.md): Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability (CVSS 6.8, Sony XAV-AX5500)
- [CVE-2024-23972](https://cve.now/CVE-2024-23972.md): Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8, Sony XAV-AX5500)
- [CVE-2024-23934](https://cve.now/CVE-2024-23934.md): Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Sony XAV-AX5500)
- [CVE-2024-23933](https://cve.now/CVE-2024-23933.md): Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8, Sony XAV-AX5500)
- [CVE-2024-7835](https://cve.now/CVE-2024-7835.md): Reflected XSS in Exnet Informatics Software's Ferry Reservation System (CVSS 8.8, Exnet Informatics Software Ferry Reservation System)
- [CVE-2024-7735](https://cve.now/CVE-2024-7735.md): SQLi in Exnet Informatics Software's Ferry Reservation System (CVSS 9.3, Exnet Informatics Software Ferry Reservation System)
- [CVE-2024-46544](https://cve.now/CVE-2024-46544.md): Apache Tomcat Connectors: mod\_jk: local users can view and modify configuration (CVSS 5.9, Apache Software Foundation Apache Tomcat Connectors)
- [CVE-2022-48945](https://cve.now/CVE-2022-48945.md): media: vivid: fix compose size exceed boundary (CVSS 7.8, Linux)
- [CVE-2024-8903](https://cve.now/CVE-2024-8903.md): Local active protection service settings manipulation due to unnecessary privileges assignment. (CVSS 4.7, Acronis Cyber Protect Cloud Agent)
- [CVE-2024-45348](https://cve.now/CVE-2024-45348.md): Xiaomi Router AX9000 has a post-authorization command injection vulnerability (CVSS 6.4, Xiaomi Router AX9000)
- [CVE-2024-8606](https://cve.now/CVE-2024-8606.md): Fix 2FA bypass via RestAPI (CVSS 9.2, Checkmk)
- [CVE-2024-8758](https://cve.now/CVE-2024-8758.md): Quiz and Survey Master (QSM) \< 9.1.3 - Author+ Stored XSS (CVSS 4.8, Quiz and Survey Master)
- [CVE-2024-7846](https://cve.now/CVE-2024-7846.md): YITH WooCommerce Ajax Search \< 2.7.1 - Contributor+ Stored XSS (CVSS 5.4, YITH WooCommerce Ajax Search)
- [CVE-2024-9094](https://cve.now/CVE-2024-9094.md): code-projects Blood Bank System o-.php sql injection (CVSS 5.3, code-projects Blood Bank System)
- [CVE-2024-9093](https://cve.now/CVE-2024-9093.md): SourceCodester Profile Registration without Reload Refresh GET Parameter del.php sql injection (CVSS 5.3, SourceCodester Profile Registration without Reload Refresh)
- [CVE-2024-9092](https://cve.now/CVE-2024-9092.md): SourceCodester Profile Registration without Reload Refresh Registration Form add.php cross site scripting (CVSS 5.3, SourceCodester Profile Registration without Reload Refresh)
- [CVE-2024-45453](https://cve.now/CVE-2024-45453.md): WordPress Maintenance Redirect plugin \<= 2.0.1 - IP Bypass vulnerability (CVSS 3.7, Peter Hardy-vanDoorn Maintenance Redirect)
- [CVE-2024-44048](https://cve.now/CVE-2024-44048.md): WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin \<= 1.9.10 - Authenticated Local File Inclusion vulnerability (CVSS 6.5, wpWax Product Carousel Slider & Grid Ultimate for WooCommer…)
- [CVE-2024-43996](https://cve.now/CVE-2024-43996.md): WordPress ElementsKit Pro plugin \<= 3.6.0 - Local File Inclusion vulnerability (CVSS 6.5, ElementsKit Pro)
- [CVE-2024-9091](https://cve.now/CVE-2024-9091.md): code-projects Student Record System index.php sql injection (CVSS 6.9, code-projects Student Record System)
- [CVE-2023-46948](https://cve.now/CVE-2023-46948.md): A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbit (CVSS 5.4)
- [CVE-2024-34331](https://cve.now/CVE-2024-34331.md): A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted m (CVSS 9.8)
- [CVE-2024-37779](https://cve.now/CVE-2024-37779.md): WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script (CVSS 8.8)
- [CVE-2024-39341](https://cve.now/CVE-2024-39341.md): Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier l (CVSS 5.9)
- [CVE-2024-39342](https://cve.now/CVE-2024-39342.md): Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e (CVSS 6.6)
- [CVE-2024-39842](https://cve.now/CVE-2024-39842.md): A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive (CVSS 7.2)
- [CVE-2024-39843](https://cve.now/CVE-2024-39843.md): A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user (CVSS 6.7)
- [CVE-2024-40441](https://cve.now/CVE-2024-40441.md): An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann (CVSS 6.6)
- [CVE-2024-40442](https://cve.now/CVE-2024-40442.md): An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann (CVSS 7.2)
- [CVE-2024-41228](https://cve.now/CVE-2024-41228.md): A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges an (CVSS 7.6)
- [CVE-2024-42861](https://cve.now/CVE-2024-42861.md): An issue in IEEE 802.1AS linuxptp v.4.2 and before allowing a remote attacker to cause a denial of service via a crafted Pdelay\_Req message (CVSS 7.5)
- [CVE-2024-44540](https://cve.now/CVE-2024-44540.md): Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART De (CVSS 6.6)
- [CVE-2024-46241](https://cve.now/CVE-2024-46241.md): PHPGurukul Dairy Farm Shop Management System v1.1 is vulnerable to Cross-Site Scripting (XSS) via the pname parameter in add\_product.php and (CVSS 5.9)
- [CVE-2024-46639](https://cve.now/CVE-2024-46639.md): A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo (CVSS 7.6)
- [CVE-2024-47222](https://cve.now/CVE-2024-47222.md): New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from external document storag (CVSS 9.8)
- [CVE-2024-47227](https://cve.now/CVE-2024-47227.md): iRedAdmin before 2.6 allows XSS, e.g., via order\_name. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.