# CVEs published 2024-09-24

74 CVEs were published on September 24, 2024: 20 critical, 23 high. Days are UTC.

- [CVE-2024-45066](https://cve.now/CVE-2024-45066.md): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection (CVSS 10.0, Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…)
- [CVE-2024-43693](https://cve.now/CVE-2024-43693.md): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection (CVSS 10.0, Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…)
- [CVE-2024-45373](https://cve.now/CVE-2024-45373.md): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege Management (CVSS 8.8, Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…)
- [CVE-2024-43423](https://cve.now/CVE-2024-43423.md): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded Password (CVSS 9.8, Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…)
- [CVE-2024-43692](https://cve.now/CVE-2024-43692.md): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel (CVSS 9.8, Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…)
- [CVE-2024-41725](https://cve.now/CVE-2024-41725.md): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Cross-site Scripting (CVSS 8.8, Dover Fueling Solutions (DFS) ProGauge MAGLINK LX CONSOLE ·…)
- [CVE-2024-8497](https://cve.now/CVE-2024-8497.md): Franklin Fueling Systems TS-550 EVO Absolute Path Traversal (CVSS 8.7, Franklin Fueling Systems TS-550 EVO)
- [CVE-2024-7398](https://cve.now/CVE-2024-7398.md): Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature (CVSS 4.6, Concrete CMS · concrete5/concrete5)
- [CVE-2024-8291](https://cve.now/CVE-2024-8291.md): Concrete CMS Stored XSS in Image Editor Background Color (CVSS 5.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-9123](https://cve.now/CVE-2024-9123.md): Integer overflow in Skia in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform an out of bounds memory write via a cr (CVSS 8.8, Google Chrome)
- [CVE-2024-9122](https://cve.now/CVE-2024-9122.md): Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-9121](https://cve.now/CVE-2024-9121.md): Inappropriate implementation in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to potentially perform out of bounds me (CVSS 8.8, Google Chrome)
- [CVE-2024-9120](https://cve.now/CVE-2024-9120.md): Use after free in Dawn in Google Chrome on Windows prior to 129.0.6668.70 allowed a remote attacker to potentially exploit heap corruption v (CVSS 8.8, Google Chrome)
- [CVE-2024-42507](https://cve.now/CVE-2024-42507.md): Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba OS)
- [CVE-2024-42506](https://cve.now/CVE-2024-42506.md): Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba OS)
- [CVE-2024-42505](https://cve.now/CVE-2024-42505.md): Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba OS)
- [CVE-2024-45599](https://cve.now/CVE-2024-45599.md): TCC Bypass in Cursor's macOS Application (CVSS 3.8, getcursor cursor)
- [CVE-2024-8067](https://cve.now/CVE-2024-8067.md): Unicode "best fit" argument injection (CVSS 5.8, Helix Core)
- [CVE-2024-8877](https://cve.now/CVE-2024-8877.md): SQL Injection (CVSS 6.9, Riello Netman)
- [CVE-2024-8878](https://cve.now/CVE-2024-8878.md): Unauthenticated Password Reset (CVSS 10.0, Riello Netman)
- [CVE-2024-9148](https://cve.now/CVE-2024-9148.md): Flowise Stored Cross-Site Scripting (CVSS 9.6, FlowiseAI FlowiseChatEmbed · flowise-embed +1)
- [CVE-2024-8942](https://cve.now/CVE-2024-8942.md): Cross-site Scripting vulnerability on Scriptcase (CVSS 6.3, Scriptcase)
- [CVE-2024-8941](https://cve.now/CVE-2024-8941.md): Path Traversal vulnerability on Scriptcase (CVSS 7.5, Scriptcase)
- [CVE-2024-8940](https://cve.now/CVE-2024-8940.md): Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase (CVSS 10.0, Scriptcase)
- [CVE-2024-8801](https://cve.now/CVE-2024-8801.md): Happy Addons for Elementor \<= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3, thehappymonster Happy Addons for Elementor)
- [CVE-2024-9141](https://cve.now/CVE-2024-9141.md): Cross-Site Scripting (XSS) vulnerability in Oct8ne (CVSS 5.4, Oct8ne)
- [CVE-2024-38324](https://cve.now/CVE-2024-38324.md): IBM Storage Defender improper certificate validation (CVSS 5.9, IBM Storage Defender - Resiliency Service)
- [CVE-2021-38963](https://cve.now/CVE-2021-38963.md): IBM Aspera Console CSV injection (CVSS 8.0, IBM Aspera Console)
- [CVE-2022-43845](https://cve.now/CVE-2022-43845.md): IBM Aspera Console information disclosure (CVSS 3.7, IBM Aspera Console)
- [CVE-2024-9142](https://cve.now/CVE-2024-9142.md): Local File Inclusion (LFI) in Olgu Computer Systems' e-Belediye (CVSS 9.4, Olgu Computer Systems e-Belediye)
- [CVE-2024-8436](https://cve.now/CVE-2024-8436.md): WP Easy Gallery – WordPress Gallery Plugin \<= 4.8.5 - Authenticated (Subscriber+) SQL Injection (CVSS 9.9, hahncgdev WP Easy Gallery – WordPress Gallery Plugin)
- [CVE-2024-8437](https://cve.now/CVE-2024-8437.md): WP Easy Gallery – WordPress Gallery Plugin \<= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation (CVSS 4.3, hahncgdev WP Easy Gallery – WordPress Gallery Plugin)
- [CVE-2023-5359](https://cve.now/CVE-2023-5359.md): W3 Total Cache \<= 2.7.5 - Sensitive Credentials Stored in Plaintext (CVSS 3.7, boldgrid W3 Total Cache)
- [CVE-2024-39928](https://cve.now/CVE-2024-39928.md): Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability (CVSS 7.5, Apache Software Foundation Apache Linkis Spark EngineConn ·…)
- [CVE-2024-21545](https://cve.now/CVE-2024-21545.md): Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. (CVSS 8.2, Proxmox pve-manager · Proxmox libpve-storage-perl +3)
- [CVE-2024-8914](https://cve.now/CVE-2024-8914.md): Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam \<= 2.0.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, haibasoft Thanh Toán Quét Mã QR Code Tự Động – MoMo, Viette…)
- [CVE-2024-8103](https://cve.now/CVE-2024-8103.md): WP Category Dropdown \<= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter (CVSS 6.4, cguntur Category Dropdown by GCS Design)
- [CVE-2024-8919](https://cve.now/CVE-2024-8919.md): Confetti Fall Animation \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcode (CVSS 6.4, shakeelu Confetti Fall Animation)
- [CVE-2024-8267](https://cve.now/CVE-2024-8267.md): Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress \<= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute (CVSS 6.4, princeahmed Radio Player – Live Shoutcast, Icecast and Any…)
- [CVE-2024-8917](https://cve.now/CVE-2024-8917.md): AnWP Football Leagues \<= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, anwppro AnWP Football Leagues)
- [CVE-2022-2439](https://cve.now/CVE-2022-2439.md): Easy Digital Downloads – Simple eCommerce for Selling Digital Files \<= 3.3.3 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2024-8628](https://cve.now/CVE-2024-8628.md): Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin \<= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, properfraction MailOptin – Popup, Optin Forms & Email Newsl…)
- [CVE-2024-8671](https://cve.now/CVE-2024-8671.md): WooEvents \<= 4.1.2 - Unauthenticated Arbitrary File Overwrite (CVSS 9.1, Ex-Themes WooEvents - Calendar and Event Booking)
- [CVE-2024-8623](https://cve.now/CVE-2024-8623.md): MDTF – Meta Data and Taxonomies Filter \<= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, realmag777 MDTF – Meta Data and Taxonomies Filter)
- [CVE-2024-8624](https://cve.now/CVE-2024-8624.md): MDTF – Meta Data and Taxonomies Filter \<= 1.3.3.3 - Authenticated (Contributor+) SQL Injection (CVSS 9.9, realmag777 MDTF – Meta Data and Taxonomies Filter)
- [CVE-2024-8794](https://cve.now/CVE-2024-8794.md): BA Book Everything \<= 1.6.20 - Unauthenticated Arbitrary User Password Reset (CVSS 5.3, bookingalgorithms BA Book Everything)
- [CVE-2024-8791](https://cve.now/CVE-2024-8791.md): Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress \<= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation (CVSS 9.8, smub Charitable – Donation Plugin for WordPress – Fundraisi…)
- [CVE-2024-8544](https://cve.now/CVE-2024-8544.md): Pixel Cat – Conversion Pixel Manager \<= 3.0.5 - Reflected Cross-Site Scripting (CVSS 6.1, fatcatapps Pixel Cat – Conversion Pixel Manager)
- [CVE-2024-8738](https://cve.now/CVE-2024-8738.md): Seriously Simple Stats \<= 1.6.0 - Reflected Cross-Site Scripting (CVSS 6.1, podcastmotor Seriously Simple Stats)
- [CVE-2024-8662](https://cve.now/CVE-2024-8662.md): Koko Analytics \<= 1.3.12 - Reflected Cross-Site Scripting (CVSS 6.1, dvankooten Koko Analytics – Privacy Friendly Statistics for…)
- [CVE-2024-8795](https://cve.now/CVE-2024-8795.md): BA Book Everything \<= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover (CVSS 8.8, bookingalgorithms BA Book Everything)
- [CVE-2024-8716](https://cve.now/CVE-2024-8716.md): XT Ajax Add To Cart for WooCommerce \<= 1.1.2 - Reflected Cross-Site Scripting (CVSS 6.1, xplodedthemes XT Ajax Add To Cart for WooCommerce)
- [CVE-2024-8657](https://cve.now/CVE-2024-8657.md): Garden Gnome Package \<= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ggnomes Garden Gnome Package)
- [CVE-2024-8432](https://cve.now/CVE-2024-8432.md): Appointment & Event Booking Calendar Plugin – Webba Booking \<= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update (CVSS 4.3, webba-agency Easy Appointment Booking & Scheduling System –…)
- [CVE-2024-38269](https://cve.now/CVE-2024-38269.md): An improper restriction of operations within the bounds of a memory buffer in the USB file-sharing handler of the Zyxel VMG8825-T50K firmwar (CVSS 4.9, Zyxel VMG8825-T50K firmware)
- [CVE-2024-38268](https://cve.now/CVE-2024-38268.md): An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware vers (CVSS 4.9, Zyxel VMG8825-T50K firmware)
- [CVE-2024-38267](https://cve.now/CVE-2024-38267.md): An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG8825-T50K firmware ver (CVSS 4.9, Zyxel VMG8825-T50K firmware)
- [CVE-2024-38266](https://cve.now/CVE-2024-38266.md): An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware v (CVSS 4.9, Zyxel VMG8825-T50K firmware)
- [CVE-2023-26686](https://cve.now/CVE-2023-26686.md): File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when cust (CVSS 9.8)
- [CVE-2023-26687](https://cve.now/CVE-2023-26687.md): Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product\_data (CVSS 8.8)
- [CVE-2023-26688](https://cve.now/CVE-2023-26688.md): Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product\_data pa (CVSS 5.4)
- [CVE-2023-26689](https://cve.now/CVE-2023-26689.md): An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request. (CVSS 9.8)
- [CVE-2023-26690](https://cve.now/CVE-2023-26690.md): File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in t (CVSS 8.8)
- [CVE-2023-26691](https://cve.now/CVE-2023-26691.md): Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when inst (CVSS 7.2)
- [CVE-2024-42797](https://cve.now/CVE-2024-42797.md): An Incorrect Access Control vulnerability was found in /music/ajax.php?action=delete\_playlist in Kashipara Music Management System v1.0. (CVSS 9.8)
- [CVE-2024-46607](https://cve.now/CVE-2024-46607.md): Incorrect access control in IceCMS v3.4.7 and before allows attackers to authenticate by entering any arbitrary values as the username and p (CVSS 7.6)
- [CVE-2024-46609](https://cve.now/CVE-2024-46609.md): An access control issue in the CheckVip function in UserController.java of IceCMS v3.4.7 and before allows unauthenticated attackers to acce (CVSS 7.5)
- [CVE-2024-46610](https://cve.now/CVE-2024-46610.md): An access control issue in IceCMS v3.4.7 and before allows attackers to arbitrarily modify users' information, including username and passwo (CVSS 7.6)
- [CVE-2024-46612](https://cve.now/CVE-2024-46612.md): IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information. (CVSS 9.8)
- [CVE-2024-46934](https://cve.now/CVE-2024-46934.md): Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). (CVSS 6.1)
- [CVE-2024-46935](https://cve.now/CVE-2024-46935.md): Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). (CVSS 7.5, @rocket.chat/message-parser)
- [CVE-2024-46936](https://cve.now/CVE-2024-46936.md): Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue. (CVSS 7.5)
- [CVE-2024-46957](https://cve.now/CVE-2024-46957.md): Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is (CVSS 9.8, mellium.im/xmpp)
- [CVE-2024-47048](https://cve.now/CVE-2024-47048.md): Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketpla (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.