CVEs published September 25, 2024
101 CVEs were published on September 25, 2024: 9 critical, 38 high.
- Published
- 101
- Critical
- 9
- High
- 38
- Medium
- 52
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Cisco IOS XE Software
- 7
- Cisco IOS
- 3
- Progress Software Telerik UI for WPF
- 3
- Xen
- 3
- openslides
- 2
- TeamViewer Remote Full Client · TeamViewer Remote Host
- 2
- Themesflat Addons For Elementor
- 2
- Uncanny Owl Uncanny Groups for LearnDash
- 2
- xjb REST API TO MiniProgram
- 2
- @ifnotnowwhen/promptr
- 1
Critical 9
- CVE-2024-4657Strored XSS in Talent Software's BAP AutomationTalent Software BAP Automation
- CVE-2024-6593WatchGuard Firebox Single Sign-On Agent Management Interface Authentication BypassWatchGuard SSO Agent
- CVE-2024-6592WatchGuard Firebox Single Sign-On Agent Protocol Authorization BypassWatchGuard SSO Client · WatchGuard SSO Agent
- CVE-2024-8275The Events Calendar <= 6.6.4 - Unauthenticated SQL Injectionstellarwp The Events Calendar
- CVE-2024-7385WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injectionashishajani WP Simple HTML Sitemap
- CVE-2024-8514Prisna GWT - Google Website Translator <= 1.4.11 - Authenticated (Admin+) PHP Object InjectionPrisna GWT – Google Website Translator
- CVE-2024-8485REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeoverxjb REST API TO MiniProgram
- CVE-2024-8621Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injectionmmrs151 Daily Prayer Time
- CVE-2024-46488sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function.sqlite-vec
High 38
- CVE-2024-47083Power Platform Terraform Provider has Improper Masking of Secrets in Logsmicrosoft terraform-provider-power-platform
- CVE-2024-8996Grafana Agent Flow on Windows Unquoted service pathGrafana Agent Flow · github.com/grafana/agent
- CVE-2024-8975Grafana Alloy on Windows Unquoted service pathGrafana Alloy · github.com/grafana/alloy
- CVE-2024-20467A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an unauthenticated, remCisco IOS XE Software
- CVE-2024-20464A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software could allow an unauthenticated, remote attackerCisco IOS XE Software
- CVE-2024-20480A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edge nodes could allow aCisco IOS XE Software
- CVE-2024-20437A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a Cisco IOS XE Software
- CVE-2024-20436A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could allow an unauthenticCisco IOS XE Software
- CVE-2024-20433A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthentCisco IOS
- CVE-2024-20350Cisco Catalyst Center Static SSH Host Key VulnerabilityCisco Digital Network Architecture Center
- CVE-2024-20455A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense (UTD) component of Cisco IOS XE Software Cisco IOS XE Software · Cisco IOS XE Catalyst SD-WAN
- CVE-2024-47078Meshtastic firmware Authentication/Authorization Bypass via MQTTmeshtastic firmware
- CVE-2024-43959WordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityThemepoints Testimonials
- CVE-2024-30128An open proxy vulnerability affects HCL Nomad server on DominoHCL Software Nomad server on Domino
- CVE-2024-8316Progress UI for WPF format provider unsafe deserialization vulnerabilityProgress Software Telerik UI for WPF
- CVE-2024-7576Progress UI for WPF format provider unsafe deserialization vulnerabilityProgress Software Telerik UI for WPF
- CVE-2024-7575Improper neutralization special element in hyperlinksProgress Software Telerik UI for WPF
- CVE-2024-7679Improper neutralization special element in hyperlinksProgress Software Telerik UI for WinForms
- CVE-2024-6594WatchGuard Firebox Single Sign-On Client Denial-of-ServiceWatchGuard SSO Client
- CVE-2024-7479Improper signature verification of VPN driver installation in TeamViewer Remote ClientsTeamViewer Remote Full Client · TeamViewer Remote Host
- CVE-2024-7481Improper signature verification of Printer driver installation in TeamViewer Remote ClientsTeamViewer Remote Full Client · TeamViewer Remote Host
- CVE-2024-45817x86: Deadlock in vlapic_error()Xen
- CVE-2024-31146PCI device pass-through with shared resourcesXen
- CVE-2024-31145error handling in x86 IOMMU identity mappingXen
- CVE-2024-8175CODESYS: web server vulnerable to DoSCODESYS Control for BeagleBone SL · CODESYS Control for… +16
- CVE-2024-8290WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalationwclovers WCFM – Frontend Manager for WooCommerce
- CVE-2024-8349Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege EscalationUncanny Owl Uncanny Groups for LearnDash
- CVE-2024-8484REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injectionxjb REST API TO MiniProgram
- CVE-2024-7617Contact Form to Any API <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Formitpathsolutions Contact Form to Any API
- CVE-2024-8481Special Text Boxes <= 6.2.4 - Unauthenticated Arbitrary Shortcode Executionminimus Special Text Boxes
- CVE-2024-22892OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.openslides
- CVE-2024-22893OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime.openslides
- CVE-2024-41708An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String(
- CVE-2024-44678Gigastone TR1 Travel Router R101 v1.0.2 is vulnerable to Command Injection.
- CVE-2024-44825Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitr
- CVE-2024-45750An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterp
- CVE-2024-46461VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a malicious
- CVE-2024-46489A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL.@ifnotnowwhen/promptr
Medium, low and unrated 54
- CVE-2024-47082Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerabilitystrawberry-graphql strawberry · strawberry-graphql
- CVE-2024-47305WordPress Use Any Font plugin <= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerabilityDnesscarkey Use Any Font
- CVE-2024-47315WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerabilityStellarWP GiveWP
- CVE-2024-20434A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on tCisco IOS XE Software
- CVE-2024-20414A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conCisco IOS
- CVE-2024-20465A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet 4000, 4010, and 5000Cisco IOS
- CVE-2024-20510A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could allow an unauthenticCisco IOS XE Software
- CVE-2024-20496Cisco SD-WAN vEdge Routers Denial of Service VulnerabilityCisco SD-WAN vEdge Cloud · Cisco SD-WAN vEdge router
- CVE-2024-20475Cisco SD-WAN vManage Cross-Site Scripting VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2024-20508Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service VulnerabilityCisco UTD SNORT IPS Engine Software
- CVE-2024-7421An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to systeDevolutions Remote Desktop Manager
- CVE-2024-43237WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerabilitySteve Burge WordPress Tag Cloud Plugin – Tag Groups
- CVE-2024-43990WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerabilityStylemixThemes Masterstudy LMS Starter
- CVE-2024-6512Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users witDevolutions Server
- CVE-2024-45613CKEditor 5 has Cross-site Scripting vulnerability in the clipboard packageckeditor5 · @ckeditor/ckeditor5-clipboard
- CVE-2024-8546ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widgetroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2024-8858Elementor Addons by Livemesh <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings ParameterLivemesh Addons by Elementor
- CVE-2024-9169litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scriptinglitespeedtech LiteSpeed Cache
- CVE-2024-47303WordPress Elementor Addons by Livemesh plugin <= 8.5 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for Elementor
- CVE-2024-23454Apache Hadoop: Temporary File Local Information DisclosureApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2024-40761Apache Answer: Avatar URL leaked user email addressesApache Software Foundation Apache Answer · github.com/apach…
- CVE-2024-3866Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Refererkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2024-8678Revolut Gateway for WooCommerce <= 4.17.3 - Missing Authorization to Unauthenticated Order Status Updaterevolutbusiness Revolut Gateway for WooCommerce
- CVE-2024-8910HT Mega – Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_iddevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-7892adstxt Plugin <= 1.0.0 - Settings Update via CSRFadstxt Plugin
- CVE-2024-7878WP ULike < 4.7.4 - Admin+ Stored XSSWP ULike
- CVE-2024-6845SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key DisclosureChatbot with ChatGPT WordPress
- CVE-2024-8658myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgradesaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2024-8668ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingdevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2024-8516Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Information ExposureThemesflat Addons For Elementor
- CVE-2024-8515Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingThemesflat Addons For Elementor
- CVE-2024-8350Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group AddUncanny Owl Uncanny Groups for LearnDash
- CVE-2024-9073GutenGeek Free Gutenberg Blocks for WordPress <= 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpopal GutenGeek Free Gutenberg Blocks for WordPress
- CVE-2024-7491HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscriberealmag777 HUSKY – Products Filter Professional for WooComm…
- CVE-2024-6590Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table. <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Settings Updatejavmah WPGSI: Spreadsheet Integration
- CVE-2024-8434Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings UpdatesEasy Mega Menu for WordPress – ThemeHunk
- CVE-2024-9024Material Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcodebraginteractive Material Design Icons
- CVE-2024-9028WP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcodebastianonm WP GPX Maps
- CVE-2024-8483MAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosuremadrasthemes MAS Static Content
- CVE-2024-8476Easy PayPal Events <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletionscottpaterson Easy PayPal Events & Tickets
- CVE-2024-8713Kodex Posts likes <= 2.5.0 - Reflected Cross-Site Scriptingpierre-lebedel Kodex Posts likes
- CVE-2024-9068OneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadthemexclub OneElements – Best Elementor Addons
- CVE-2024-9069Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadbesnikac Graphicsly – The ultimate graphics plugin for Word…
- CVE-2024-8741Beam me up Scotty – Back to Top Button <= 1.0.21 - Reflected Cross-Site Scriptingouttheboxthemes Beam me up Scotty – Back to Top Button
- CVE-2024-7426Community by PeepSo – Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path DisclosureCommunity by PeepSo – Download from PeepSo.com
- CVE-2024-9027WPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box ShortcodeWPZOOM Shortcodes
- CVE-2024-8549Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scriptingsimplecalendar Simple Calendar – Google Calendar Plugin
- CVE-2024-7386Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgerycodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2023-25189BTS is affected by information disclosure vulnerability where mobile network operator personnel connected over BTS Web Element Manager, rega
- CVE-2023-51157Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute arbitrary code and obtain sensitive inform
- CVE-2024-41445Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the ReadData function
- CVE-2024-46485dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate
- CVE-2024-46600dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/doAdminAction.php?act=delCate&id=31
- CVE-2024-46655A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a us