# CVEs published 2024-09-26

119 CVEs were published on September 26, 2024: 4 critical, 37 high. Days are UTC.

- [CVE-2024-4099](https://cve.now/CVE-2024-4099.md): Improper Encoding or Escaping of Output in GitLab (CVSS 3.1, GitLab)
- [CVE-2024-8974](https://cve.now/CVE-2024-8974.md): Incorrect Provision of Specified Functionality in GitLab (CVSS 2.6, GitLab)
- [CVE-2024-47175](https://cve.now/CVE-2024-47175.md): libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer (CVSS 8.6, OpenPrinting libppd)
- [CVE-2024-47076](https://cve.now/CVE-2024-47076.md): libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server (CVSS 8.6, OpenPrinting libcupsfilters)
- [CVE-2024-47176](https://cve.now/CVE-2024-47176.md): cups-browsed binds to \`INADDR\_ANY:631\`, trusting any packet from any source (CVSS 5.3, OpenPrinting cups-browsed)
- [CVE-2024-6769](https://cve.now/CVE-2024-6769.md): Medium to High Integrity Privilege Escalation in Microsoft Windows (CVSS 8.4, Microsoft Windows)
- [CVE-2024-7594](https://cve.now/CVE-2024-7594.md): Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default (CVSS 7.5, HashiCorp Vault · github.com/hashicorp/vault +1)
- [CVE-2024-47180](https://cve.now/CVE-2024-47180.md): Shields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badges (CVSS 8.8, badges shields)
- [CVE-2024-47179](https://cve.now/CVE-2024-47179.md): RSSHub's \`docker-test-cont.yml\` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover. (CVSS 8.8, DIYgod RSSHub)
- [CVE-2024-8118](https://cve.now/CVE-2024-8118.md): Grafana alerting wrong permission on datasource rule write endpoint (CVSS 5.1, Grafana)
- [CVE-2024-43814](https://cve.now/CVE-2024-43814.md): goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data (CVSS 4.3, goTenna Pro ATAK Plugin)
- [CVE-2024-41715](https://cve.now/CVE-2024-41715.md): goTenna Pro ATAK Plugin Observable Response Discrepancy (CVSS 4.3, goTenna Pro ATAK Plugin)
- [CVE-2024-41931](https://cve.now/CVE-2024-41931.md): goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data (CVSS 4.3, goTenna Pro ATAK Plugin)
- [CVE-2024-41722](https://cve.now/CVE-2024-41722.md): goTenna Pro ATAK Plugin Weak Authentication (CVSS 6.5, goTenna Pro ATAK Plugin)
- [CVE-2024-45723](https://cve.now/CVE-2024-45723.md): goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator (CVSS 6.5, goTenna Pro ATAK Plugin)
- [CVE-2024-45838](https://cve.now/CVE-2024-45838.md): goTenna Pro ATAK Plugin Cleartext Transmission of Sensitive Information (CVSS 4.3, goTenna Pro ATAK Plugin)
- [CVE-2024-47130](https://cve.now/CVE-2024-47130.md): Missing Authentication for Critical Function in goTenna Pro (CVSS 8.7, goTenna Pro)
- [CVE-2024-47129](https://cve.now/CVE-2024-47129.md): Observable Response Discrepancy in goTenna Pro (CVSS 5.3, goTenna Pro)
- [CVE-2024-47128](https://cve.now/CVE-2024-47128.md): Insertion of Sensitive Information Into Sent Data in goTenna Pro (CVSS 5.3, goTenna Pro)
- [CVE-2024-43108](https://cve.now/CVE-2024-43108.md): goTenna Pro ATAK Plugin Missing Support for Integrity Check (CVSS 5.3, goTenna Pro ATAK Plugin)
- [CVE-2024-47174](https://cve.now/CVE-2024-47174.md): Credential leak when credentials are used with \`\<nix/fetchurl.nix\>\` (CVSS 5.9, NixOS nix)
- [CVE-2024-47127](https://cve.now/CVE-2024-47127.md): Weak Authentication in goTenna Pro (CVSS 6.0, goTenna Pro)
- [CVE-2024-47126](https://cve.now/CVE-2024-47126.md): Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro (CVSS 7.1, goTenna Pro)
- [CVE-2024-43694](https://cve.now/CVE-2024-43694.md): goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information (CVSS 4.3, goTenna Pro ATAK Plugin)
- [CVE-2024-47125](https://cve.now/CVE-2024-47125.md): Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro (CVSS 7.6, goTenna Pro)
- [CVE-2024-47171](https://cve.now/CVE-2024-47171.md): Agnai vulnerable to Relative Path Traversal in Image Upload (CVSS 4.3, agnaistic agnai · agnai)
- [CVE-2024-47124](https://cve.now/CVE-2024-47124.md): Cleartext Transmission of Sensitive Information in goTenna Pro (CVSS 2.3, goTenna Pro)
- [CVE-2024-47123](https://cve.now/CVE-2024-47123.md): Missing Support for Integrity Check in goTenna Pro (CVSS 6.0, goTenna Pro)
- [CVE-2024-47122](https://cve.now/CVE-2024-47122.md): Insecure Storage of Sensitive Information in goTenna Pro (CVSS 5.1, goTenna Pro)
- [CVE-2024-47121](https://cve.now/CVE-2024-47121.md): Weak Passwords Requirements in goTenna Pro (CVSS 6.0, goTenna Pro)
- [CVE-2024-47170](https://cve.now/CVE-2024-47170.md): Agnai File Disclosure Vulnerability: JSON via Path Traversal (CVSS 4.3, agnaistic agnai · agnai)
- [CVE-2024-47169](https://cve.now/CVE-2024-47169.md): Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal (CVSS 8.8, agnaistic agnai · agnai)
- [CVE-2024-47075](https://cve.now/CVE-2024-47075.md): DOM Clobbering gadgets found in layui that lead to Cross-site Scripting (CVSS 6.4, layui)
- [CVE-2024-45374](https://cve.now/CVE-2024-45374.md): goTenna Pro ATAK Plugin Weak Password Requirements (CVSS 5.3, goTenna Pro ATAK Plugin)
- [CVE-2024-39577](https://cve.now/CVE-2024-39577.md): Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contains an Improper Neutralization of Special Elements use (CVSS 7.1, Dell SmartFabric OS10 Software)
- [CVE-2024-45042](https://cve.now/CVE-2024-45042.md): Ory Kratos's \`highest\_available\` setting does not properly respect code + mfa credentials (CVSS 4.4, ory kratos · github.com/ory/kratos)
- [CVE-2024-37125](https://cve.now/CVE-2024-37125.md): Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x,10.5.3.x, contains an Uncontrolled Resource Consumption vulnerability. (CVSS 7.5, Dell SmartFabric OS10 Software)
- [CVE-2024-9203](https://cve.now/CVE-2024-9203.md): Enpass Password Manager sensitive information in memory (CVSS 2.0, Enpass Password Manager)
- [CVE-2024-9166](https://cve.now/CVE-2024-9166.md): OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver (CVSS 9.3, Atelmo Atemio AM 520 HD Full HD Satellite Receiver)
- [CVE-2024-39319](https://cve.now/CVE-2024-39319.md): aimeos/ai-controller-frontend has IDOR vulnerability in account profile page (CVSS 5.3, aimeos ai-controller-frontend · aimeos/ai-controller-fronte…)
- [CVE-2024-8771](https://cve.now/CVE-2024-8771.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-7259](https://cve.now/CVE-2024-7259.md): Ovirt-engine: potential exposure of cleartext provider passwords via web ui (CVSS 4.9, ovirt-engine · Red Hat Virtualization)
- [CVE-2024-43191](https://cve.now/CVE-2024-43191.md): IBM ManageIQ command execution (CVSS 7.2, IBM Cloud Pak for Multicloud Management)
- [CVE-2024-9155](https://cve.now/CVE-2024-9155.md): Insufficient Authorization On Unlinked Channel Files (CVSS 4.3, Mattermost)
- [CVE-2024-30134](https://cve.now/CVE-2024-30134.md): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability (CVSS 6.7, HCL Software HCL Traveler for Microsoft Outlook)
- [CVE-2024-9177](https://cve.now/CVE-2024-9177.md): Themedy Toolbox \<= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, mahodder Themedy Toolbox)
- [CVE-2024-31899](https://cve.now/CVE-2024-31899.md): IBM Cognos Command Center information disclosure (CVSS 4.3, IBM Cognos Command Center)
- [CVE-2023-46175](https://cve.now/CVE-2023-46175.md): IBM Cloud Pak for Multicloud Management information disclosure (CVSS 4.4, IBM Cloud Pak for Multicloud Management)
- [CVE-2024-7108](https://cve.now/CVE-2024-7108.md): Incorrect Authorization in National Keep's CyberMath (CVSS 8.2, National Keep Cyber Security Services CyberMath)
- [CVE-2024-7107](https://cve.now/CVE-2024-7107.md): Directory Traversal in National Keep's CyberMath (CVSS 6.8, National Keep Cyber Security Services CyberMath)
- [CVE-2024-8633](https://cve.now/CVE-2024-8633.md): Form Maker \<= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2024-8725](https://cve.now/CVE-2024-8725.md): Advanced File Manager \<= 5.2.8 - Authenticated (Subscriber+) Limited File Upload (CVSS 6.8, saadiqbal Advanced File Manager – Ultimate File Manager for…)
- [CVE-2024-8126](https://cve.now/CVE-2024-8126.md): Advanced File Manager \<= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, saadiqbal Advanced File Manager – Ultimate File Manager for…)
- [CVE-2024-8704](https://cve.now/CVE-2024-8704.md): Advanced File Manager \<= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma\_locale (CVSS 7.2, saadiqbal Advanced File Manager – Ultimate File Manager for…)
- [CVE-2024-9199](https://cve.now/CVE-2024-9199.md): Rate limit vulnerability in Clibo Manager (CVSS 5.8, Clibo Manager)
- [CVE-2024-9198](https://cve.now/CVE-2024-9198.md): Stored Cross-Site Scripting vulnerability in Clibo Manager (CVSS 7.6, Clibo Manager)
- [CVE-2022-4541](https://cve.now/CVE-2022-4541.md): WordPress Visitors \<= 1.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Header (CVSS 7.2, nitinmaurya12 WordPress Visitors)
- [CVE-2024-9115](https://cve.now/CVE-2024-9115.md): Common Tools for Site \<= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, thechetanvaghela Common Tools for Site)
- [CVE-2024-9117](https://cve.now/CVE-2024-9117.md): Mapplic Lite \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, sekler Mapplic Lite)
- [CVE-2024-9173](https://cve.now/CVE-2024-9173.md): GF Custom Style \<= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, alefypf GF Custom Style)
- [CVE-2024-9127](https://cve.now/CVE-2024-9127.md): Super Testimonials \<= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter (CVSS 6.4, solaplugins Super Testimonials)
- [CVE-2024-9125](https://cve.now/CVE-2024-9125.md): king\_IE \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, mohsensd1373 king\_IE)
- [CVE-2024-47337](https://cve.now/CVE-2024-47337.md): WordPress Joy Of Text Lite plugin \<= 2.3.1 - Broken Access Control vulnerability (CVSS 4.3, Phillip Dane Joy Of Text Lite)
- [CVE-2024-47044](https://cve.now/CVE-2024-47044.md): Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access (CVSS 5.3, NIPPON TELEGRAPH AND TELEPHONE EAST Hikari Denwa router… +3)
- [CVE-2024-9025](https://cve.now/CVE-2024-9025.md): Sight – Professional Image Gallery and Portfolio \<= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler\_post\_title (CVSS 5.3, codesupplyco Sight – Professional Image Gallery and Portfol…)
- [CVE-2024-8872](https://cve.now/CVE-2024-8872.md): Store Hours for WooCommerce \<= 4.3.20 - Reflected Cross-Site Scripting (CVSS 6.1, bizswoop Store Hours for WooCommerce)
- [CVE-2024-47003](https://cve.now/CVE-2024-47003.md): DoS via non-string message using permalink embed (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-42406](https://cve.now/CVE-2024-42406.md): Unauthorized access on archived channels (CVSS 5.4, Mattermost)
- [CVE-2024-45843](https://cve.now/CVE-2024-45843.md): Weak SSRF Filtering (CVSS 3.1, Mattermost)
- [CVE-2024-47145](https://cve.now/CVE-2024-47145.md): Unauthorized access on archived channels via file links (CVSS 3.1, Mattermost)
- [CVE-2024-47197](https://cve.now/CVE-2024-47197.md): Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials (CVSS 7.5, Apache Software Foundation Maven Archetype Plugin · org.apa…)
- [CVE-2024-8861](https://cve.now/CVE-2024-8861.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-4278](https://cve.now/CVE-2024-4278.md): Incorrect Synchronization in GitLab (CVSS 5.5, GitLab)
- [CVE-2024-6517](https://cve.now/CVE-2024-6517.md): Contact Form 7 Math Captcha \<= 2.0.1 - Reflected XSS (CVSS 6.1, Contact Form 7 Math Captcha)
- [CVE-2024-0133](https://cve.now/CVE-2024-0133.md): NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container (CVSS 4.1, NVIDIA Container Toolkit · NVIDIA GPU Operator +1)
- [CVE-2024-0132](https://cve.now/CVE-2024-0132.md): NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration (CVSS 9.0, NVIDIA Container Toolkit · NVIDIA GPU Operator +1)
- [CVE-2024-7781](https://cve.now/CVE-2024-7781.md): Jupiter X Core \<= 4.7.5 - Limited Unauthenticated Authentication Bypass to Account Takeover (CVSS 8.1, artbees Jupiter X Core)
- [CVE-2024-7772](https://cve.now/CVE-2024-7772.md): Jupiter X Core \<= 4.6.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, artbees Jupiter X Core)
- [CVE-2024-45836](https://cve.now/CVE-2024-45836.md): Cross-site scripting vulnerability exists in the web management page of PLANEX COMMUNICATIONS network cameras. (CVSS 6.1, PLANEX COMMUNICATIONS CS-QR10 · PLANEX COMMUNICATIONS CS… +3)
- [CVE-2024-45372](https://cve.now/CVE-2024-45372.md): MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. (CVSS 6.5, PLANEX COMMUNICATIONS MZK-DP300N)
- [CVE-2023-52949](https://cve.now/CVE-2023-52949.md): Missing authentication for critical function vulnerability in proxy settings functionality in Synology Active Backup for Business Agent befo (CVSS 5.5, Synology Active Backup for Business Agent)
- [CVE-2023-52948](https://cve.now/CVE-2023-52948.md): Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 (CVSS 5.0, Synology Active Backup for Business Agent)
- [CVE-2023-52947](https://cve.now/CVE-2023-52947.md): Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3 (CVSS 4.0, Synology Active Backup for Business Agent)
- [CVE-2023-52950](https://cve.now/CVE-2023-52950.md): Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows (CVSS 5.3, Synology Active Backup for Business Agent)
- [CVE-2022-49041](https://cve.now/CVE-2022-49041.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in backup task management functionality in Synology Dri (CVSS 4.4, Synology Drive Client)
- [CVE-2022-49040](https://cve.now/CVE-2022-49040.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in connection management functionality in Synology Driv (CVSS 4.4, Synology Drive Client)
- [CVE-2024-47045](https://cve.now/CVE-2024-47045.md): Privilege chaining issue exists in the installer of e-Tax software(common program). (CVSS 7.8, National Tax Agency The installer of e-Tax software)
- [CVE-2022-49039](https://cve.now/CVE-2022-49039.md): Out-of-bounds write vulnerability in backup task management functionality in Synology Drive Client before 3.4.0-15721 allows local users wit (CVSS 6.7, Synology Drive Client)
- [CVE-2022-49038](https://cve.now/CVE-2022-49038.md): Inclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component in Synology Drive Client before 3.3.0-15082 (CVSS 7.8, Synology Drive Client)
- [CVE-2022-49037](https://cve.now/CVE-2022-49037.md): Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allow (CVSS 6.5, Synology Drive Client)
- [CVE-2023-52946](https://cve.now/CVE-2023-52946.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in vss service component in Synology Drive Client befor (CVSS 8.2, Synology Drive Client)
- [CVE-2024-47330](https://cve.now/CVE-2024-47330.md): Broken Access Control vulnerability on multiple WordPress plugins by Supsystic (CVSS 4.3, Slider by Supsystic · Social Share Buttons by Supsystic)
- [CVE-2024-8803](https://cve.now/CVE-2024-8803.md): Bulk NoIndex & NoFollow Toolkit \<= 2.15 - Reflected Cross-Site Scripting (CVSS 6.1, madfishdigital Bulk NoIndex & NoFollow Toolkit)
- [CVE-2024-8552](https://cve.now/CVE-2024-8552.md): Download Monitor \<= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable (CVSS 4.3, wpchill Download Monitor)
- [CVE-2024-8723](https://cve.now/CVE-2024-8723.md): 012 PS Multi Languages \<= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ouhinit 012 Ps Multi Languages)
- [CVE-2024-8404](https://cve.now/CVE-2024-8404.md): Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder (CVSS 7.8, PaperCut NG, PaperCut MF)
- [CVE-2024-8405](https://cve.now/CVE-2024-8405.md): Arbitrary File Creation in PaperCut NG/MF Web Print leading to a Denial of Service attack (CVSS 6.1, PaperCut NG, PaperCut MF)
- [CVE-2024-40506](https://cve.now/CVE-2024-40506.md): Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMHospitalit (CVSS 7.3)
- [CVE-2024-40507](https://cve.now/CVE-2024-40507.md): Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMPersonnel. (CVSS 7.3)
- [CVE-2024-40508](https://cve.now/CVE-2024-40508.md): Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMConference (CVSS 7.3)
- [CVE-2024-41605](https://cve.now/CVE-2024-41605.md): In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan (CVSS 8.4)
- [CVE-2024-44860](https://cve.now/CVE-2024-44860.md): An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a (CVSS 7.5)
- [CVE-2024-45979](https://cve.now/CVE-2024-45979.md): A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with (CVSS 8.8)
- [CVE-2024-45980](https://cve.now/CVE-2024-45980.md): A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a craft (CVSS 8.8)
- [CVE-2024-45981](https://cve.now/CVE-2024-45981.md): A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with (CVSS 8.8)
- [CVE-2024-45982](https://cve.now/CVE-2024-45982.md): A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a c (CVSS 8.8)
- [CVE-2024-45983](https://cve.now/CVE-2024-45983.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. (CVSS 6.3)
- [CVE-2024-45984](https://cve.now/CVE-2024-45984.md): A Cross Site Scripting (XSS) vulnerability in add\_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject ma (CVSS 4.7)
- [CVE-2024-45985](https://cve.now/CVE-2024-45985.md): A Cross Site Scripting (XSS) vulnerability in update\_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inj (CVSS 4.7)
- [CVE-2024-45986](https://cve.now/CVE-2024-45986.md): A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is reg (CVSS 5.4)
- [CVE-2024-45987](https://cve.now/CVE-2024-45987.md): Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. (CVSS 6.5)
- [CVE-2024-45989](https://cve.now/CVE-2024-45989.md): Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. (CVSS 4.0)
- [CVE-2024-46327](https://cve.now/CVE-2024-46327.md): An issue in the Http\_handle object of VONETS VAP11G-300 v3.3.23.6.9 allows attackers to access sensitive files via a directory traversal. (CVSS 5.7)
- [CVE-2024-46328](https://cve.now/CVE-2024-46328.md): VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root. (CVSS 8.0)
- [CVE-2024-46329](https://cve.now/CVE-2024-46329.md): VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the SystemCommand object. (CVSS 8.0)
- [CVE-2024-46330](https://cve.now/CVE-2024-46330.md): VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the iptablesWebsFilterRun object. (CVSS 7.4)
- [CVE-2024-46627](https://cve.now/CVE-2024-46627.md): Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. (CVSS 9.1)
- [CVE-2024-46628](https://cve.now/CVE-2024-46628.md): Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName paramet (CVSS 8.0)
- [CVE-2024-46632](https://cve.now/CVE-2024-46632.md): Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function. (CVSS 4.3, pyassimp)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.