CVEs published September 24, 2024
74 CVEs were published on September 24, 2024: 20 critical, 23 high.
- Published
- 74
- Critical
- 20
- High
- 23
- Medium
- 28
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…
- 6
- Google Chrome
- 4
- Zyxel VMG8825-T50K firmware
- 4
- Hewlett Packard Enterprise (HPE) Aruba OS
- 3
- Scriptcase
- 3
- bookingalgorithms BA Book Everything
- 2
- Concrete CMS · concrete5/concrete5
- 2
- hahncgdev WP Easy Gallery – WordPress Gallery Plugin
- 2
- IBM Aspera Console
- 2
- realmag777 MDTF – Meta Data and Taxonomies Filter
- 2
Critical 20
- CVE-2024-45066Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command InjectionDover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…
- CVE-2024-43693Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command InjectionDover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…
- CVE-2024-43423Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded PasswordDover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…
- CVE-2024-43692Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or ChannelDover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…
- CVE-2024-42507Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba OS
- CVE-2024-42506Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba OS
- CVE-2024-42505Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba OS
- CVE-2024-8878Unauthenticated Password ResetRiello Netman
- CVE-2024-9148Flowise Stored Cross-Site ScriptingFlowiseAI FlowiseChatEmbed · flowise-embed +1
- CVE-2024-8940Unrestricted Upload of File with Dangerous Type vulnerability on ScriptcaseScriptcase
- CVE-2024-9142Local File Inclusion (LFI) in Olgu Computer Systems' e-BelediyeOlgu Computer Systems e-Belediye
- CVE-2024-8436WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injectionhahncgdev WP Easy Gallery – WordPress Gallery Plugin
- CVE-2024-8671WooEvents <= 4.1.2 - Unauthenticated Arbitrary File OverwriteEx-Themes WooEvents - Calendar and Event Booking
- CVE-2024-8624MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injectionrealmag777 MDTF – Meta Data and Taxonomies Filter
- CVE-2024-8791Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalationsmub Charitable – Donation Plugin for WordPress – Fundraisi…
- CVE-2023-26686File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when cust
- CVE-2023-26689An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
- CVE-2024-42797An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete_playlist in Kashipara Music Management System v1.0.
- CVE-2024-46612IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information.
- CVE-2024-46957Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is mellium.im/xmpp
High 23
- CVE-2024-45373Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege ManagementDover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…
- CVE-2024-41725Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Cross-site ScriptingDover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…
- CVE-2024-8497Franklin Fueling Systems TS-550 EVO Absolute Path TraversalFranklin Fueling Systems TS-550 EVO
- CVE-2024-9123Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a crGoogle Chrome
- CVE-2024-9122Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted Google Chrome
- CVE-2024-9121Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds meGoogle Chrome
- CVE-2024-9120Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2024-8941Path Traversal vulnerability on ScriptcaseScriptcase
- CVE-2021-38963IBM Aspera Console CSV injectionIBM Aspera Console
- CVE-2024-39928Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerabilityApache Software Foundation Apache Linkis Spark EngineConn ·…
- CVE-2024-21545Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization.Proxmox pve-manager · Proxmox libpve-storage-perl +3
- CVE-2024-8914Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam <= 2.0.1 - Unauthenticated Stored Cross-Site Scriptinghaibasoft Thanh Toán Quét Mã QR Code Tự Động – MoMo, Viette…
- CVE-2022-2439Easy Digital Downloads – Simple eCommerce for Selling Digital Files <= 3.3.3 - Authenticated (Admin+) PHAR Deserializationsmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2024-8623MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Executionrealmag777 MDTF – Meta Data and Taxonomies Filter
- CVE-2024-8795BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeoverbookingalgorithms BA Book Everything
- CVE-2023-26687Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data
- CVE-2023-26690File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in t
- CVE-2023-26691Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when inst
- CVE-2024-46607Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and p
- CVE-2024-46609An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to acce
- CVE-2024-46610An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and passwo
- CVE-2024-46935Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS).@rocket.chat/message-parser
- CVE-2024-46936Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue.
Medium, low and unrated 31
- CVE-2024-7398Concrete CMS Stored XSS Vulnerability in Calendar Event Addition FeatureConcrete CMS · concrete5/concrete5
- CVE-2024-8291Concrete CMS Stored XSS in Image Editor Background ColorConcrete CMS · concrete5/concrete5
- CVE-2024-45599TCC Bypass in Cursor's macOS Applicationgetcursor cursor
- CVE-2024-8067Unicode "best fit" argument injectionHelix Core
- CVE-2024-8877SQL InjectionRiello Netman
- CVE-2024-8942Cross-site Scripting vulnerability on ScriptcaseScriptcase
- CVE-2024-8801Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposurethehappymonster Happy Addons for Elementor
- CVE-2024-9141Cross-Site Scripting (XSS) vulnerability in Oct8neOct8ne
- CVE-2024-38324IBM Storage Defender improper certificate validationIBM Storage Defender - Resiliency Service
- CVE-2022-43845IBM Aspera Console information disclosureIBM Aspera Console
- CVE-2024-8437WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulationhahncgdev WP Easy Gallery – WordPress Gallery Plugin
- CVE-2023-5359W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintextboldgrid W3 Total Cache
- CVE-2024-8103WP Category Dropdown <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parametercguntur Category Dropdown by GCS Design
- CVE-2024-8919Confetti Fall Animation <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcodeshakeelu Confetti Fall Animation
- CVE-2024-8267Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attributeprinceahmed Radio Player – Live Shoutcast, Icecast and Any…
- CVE-2024-8917AnWP Football Leagues <= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadanwppro AnWP Football Leagues
- CVE-2024-8628Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingproperfraction MailOptin – Popup, Optin Forms & Email Newsl…
- CVE-2024-8794BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Resetbookingalgorithms BA Book Everything
- CVE-2024-8544Pixel Cat – Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scriptingfatcatapps Pixel Cat – Conversion Pixel Manager
- CVE-2024-8738Seriously Simple Stats <= 1.6.0 - Reflected Cross-Site Scriptingpodcastmotor Seriously Simple Stats
- CVE-2024-8662Koko Analytics <= 1.3.12 - Reflected Cross-Site Scriptingdvankooten Koko Analytics – Privacy Friendly Statistics for…
- CVE-2024-8716XT Ajax Add To Cart for WooCommerce <= 1.1.2 - Reflected Cross-Site Scriptingxplodedthemes XT Ajax Add To Cart for WooCommerce
- CVE-2024-8657Garden Gnome Package <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingggnomes Garden Gnome Package
- CVE-2024-8432Appointment & Event Booking Calendar Plugin – Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Updatewebba-agency Easy Appointment Booking & Scheduling System –…
- CVE-2024-38269An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmwarZyxel VMG8825-T50K firmware
- CVE-2024-38268An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware versZyxel VMG8825-T50K firmware
- CVE-2024-38267An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG8825-T50K firmware verZyxel VMG8825-T50K firmware
- CVE-2024-38266An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware vZyxel VMG8825-T50K firmware
- CVE-2023-26688Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data pa
- CVE-2024-46934Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS).
- CVE-2024-47048Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketpla