# CVEs published 2024-09-27

162 CVEs were published on September 27, 2024: 11 critical, 60 high. Days are UTC.

- [CVE-2024-38796](https://cve.now/CVE-2024-38796.md): Integer overflow in PeCoffLoaderRelocateImage (CVSS 5.9, TianoCore EDK2)
- [CVE-2024-9294](https://cve.now/CVE-2024-9294.md): dingfanzu CMS saveNewPwd.php sql injection (CVSS 5.3, dingfanzu CMS)
- [CVE-2024-23586](https://cve.now/CVE-2024-23586.md): An insufficient session timeout vulnerability affects HCL Nomad server on Domino (CVSS 5.3, HCL Software Nomad server on Domino)
- [CVE-2024-47186](https://cve.now/CVE-2024-47186.md): Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting (CVSS 6.1, filamentphp filament · filament/tables +1)
- [CVE-2024-9293](https://cve.now/CVE-2024-9293.md): skyselang yylAdmin Backend File.php list sql injection (CVSS 5.3, skyselang yylAdmin)
- [CVE-2024-9291](https://cve.now/CVE-2024-9291.md): kalvinGit kvf-admin XML File cross site scripting (CVSS 5.3, kalvinGit kvf-admin)
- [CVE-2024-6436](https://cve.now/CVE-2024-6436.md): Rockwell Automation Input Validation Vulnerability exists in the SequenceManager™ Server (CVSS 8.7, Rockwell Automation SequenceManager™)
- [CVE-2024-9160](https://cve.now/CVE-2024-9160.md): Security Misconfiguration in Forge module PEADM (CVSS 5.4, Puppet PEADM Forge Module)
- [CVE-2024-39364](https://cve.now/CVE-2024-39364.md): Advantech ADAM-5630 Missing Authentication for Critical Function (CVSS 6.3, Advantech ADAM-5630)
- [CVE-2024-34542](https://cve.now/CVE-2024-34542.md): Advantech ADAM-5630 Weak Encoding for Password (CVSS 5.7, Advantech ADAM-5630)
- [CVE-2024-9301](https://cve.now/CVE-2024-9301.md): A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a (CVSS 8.7, Netflix E2Nest)
- [CVE-2024-28948](https://cve.now/CVE-2024-28948.md): Advantech ADAM-5630 Cross-Site Request Forgery (CVSS 8.0, Advantech ADAM-5630)
- [CVE-2024-39275](https://cve.now/CVE-2024-39275.md): Advantech ADAM-5630 Use of Persistent Cookies Containing Sensitive Information (CVSS 8.0, Advantech ADAM-5630)
- [CVE-2024-38308](https://cve.now/CVE-2024-38308.md): Advantech ADAM-5550 Cross-site Scripting (CVSS 8.8, Advantech ADAM)
- [CVE-2024-37187](https://cve.now/CVE-2024-37187.md): Advantech ADAM-5550 Weak Encoding for Password (CVSS 5.7, Advantech ADAM)
- [CVE-2024-22170](https://cve.now/CVE-2024-22170.md): Unchecked buffer in Dynamic DNS client (CVSS 9.2, Western Digital My Cloud)
- [CVE-2024-38809](https://cve.now/CVE-2024-38809.md): Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. (CVSS 5.3, Spring Framework · org.springframework:spring-web)
- [CVE-2024-8310](https://cve.now/CVE-2024-8310.md): OPW Fuel Management Systems SiteSentinel Missing Authentication for Critical Function (CVSS 9.8, OPW Fuel Managements Systems SiteSentinel)
- [CVE-2024-9284](https://cve.now/CVE-2024-9284.md): TP-LINK TL-WR841ND popupSiteSurveyRpm.htm stack-based overflow (CVSS 7.1, TP-LINK TL-WR841ND)
- [CVE-2024-8630](https://cve.now/CVE-2024-8630.md): Alisonic Sibylla SQL Injection (CVSS 9.4, Alisonic Sibylla)
- [CVE-2024-6981](https://cve.now/CVE-2024-6981.md): OMNTEC Proteus Tank Monitoring Missing Authentication for Critical Function (CVSS 9.8, OMNTEC Proteus Tank Monitoring)
- [CVE-2024-45745](https://cve.now/CVE-2024-45745.md): TopQuadrant TopBraid EDG JavaScript console XXE (CVSS 5.0, TopQuadrant TopBraid EDG)
- [CVE-2024-45744](https://cve.now/CVE-2024-45744.md): TopQuadrant TopBraid EDG password manager stores external credentials insecurely (CVSS 3.0, TopQuadrant TopBraid EDG)
- [CVE-2024-6983](https://cve.now/CVE-2024-6983.md): Remote Code Execution in mudler/localai (CVSS 8.8, mudler/localai)
- [CVE-2024-47077](https://cve.now/CVE-2024-47077.md): authentik cross-provider token validation problems (CVSS 6.5, goauthentik authentik)
- [CVE-2024-47070](https://cve.now/CVE-2024-47070.md): authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header (CVSS 9.1, goauthentik authentik)
- [CVE-2024-3373](https://cve.now/CVE-2024-3373.md): SQLi in RSM Design's Website Template (CVSS 9.2, RSM Design Website Template)
- [CVE-2024-47184](https://cve.now/CVE-2024-47184.md): Ampache vulnerable to Stored XSS via Democratic Playlist Name (CVSS 6.1, ampache)
- [CVE-2024-9283](https://cve.now/CVE-2024-9283.md): RelaxedJS ReLaXed Pug to PDF Converter cross site scripting (CVSS 4.8, RelaxedJS ReLaXed · relaxedjs)
- [CVE-2024-47182](https://cve.now/CVE-2024-47182.md): Dozzle uses unsafe hash for passwords (CVSS 4.8, amir20 dozzle · github.com/amir20/dozzle)
- [CVE-2024-7149](https://cve.now/CVE-2024-7149.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.8 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2024-45863](https://cve.now/CVE-2024-45863.md): A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially r (CVSS 5.3, Facebook Thrift)
- [CVE-2024-45773](https://cve.now/CVE-2024-45773.md): A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution (CVSS 7.5, Facebook Thrift)
- [CVE-2024-9282](https://cve.now/CVE-2024-9282.md): bg5sbk MiniCMS page-edit.php cross-site request forgery (CVSS 6.9, bg5sbk MiniCMS)
- [CVE-2024-46868](https://cve.now/CVE-2024-46868.md): firmware: qcom: uefisecapp: Fix deadlock in qcuefi\_acquire() (no CVSS, Linux)
- [CVE-2024-46867](https://cve.now/CVE-2024-46867.md): drm/xe/client: fix deadlock in show\_meminfo() (no CVSS, Linux)
- [CVE-2024-46866](https://cve.now/CVE-2024-46866.md): drm/xe/client: add missing bo locking in show\_meminfo() (CVSS 7.8, Linux)
- [CVE-2024-46865](https://cve.now/CVE-2024-46865.md): fou: fix initialization of grc (CVSS 9.8, Linux)
- [CVE-2024-46864](https://cve.now/CVE-2024-46864.md): x86/hyperv: fix kexec crash due to VP assist page corruption (no CVSS, Linux)
- [CVE-2024-46863](https://cve.now/CVE-2024-46863.md): ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item (CVSS 7.3, Linux)
- [CVE-2024-46862](https://cve.now/CVE-2024-46862.md): ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item (CVSS 8.0, Linux)
- [CVE-2024-46861](https://cve.now/CVE-2024-46861.md): usbnet: ipheth: do not stop RX on failing RX callback (no CVSS, Linux)
- [CVE-2024-46860](https://cve.now/CVE-2024-46860.md): wifi: mt76: mt7921: fix NULL pointer access in mt7921\_ipv6\_addr\_change (no CVSS, Linux)
- [CVE-2024-46859](https://cve.now/CVE-2024-46859.md): platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses (CVSS 7.8, Linux)
- [CVE-2024-46858](https://cve.now/CVE-2024-46858.md): mptcp: pm: Fix uaf in \_\_timer\_delete\_sync (CVSS 8.1, Linux)
- [CVE-2024-46857](https://cve.now/CVE-2024-46857.md): net/mlx5: Fix bridge mode operations when there are no VFs (no CVSS, Linux)
- [CVE-2024-46856](https://cve.now/CVE-2024-46856.md): net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices (no CVSS, Linux)
- [CVE-2024-46855](https://cve.now/CVE-2024-46855.md): netfilter: nft\_socket: fix sk refcount leaks (CVSS 7.5, Linux)
- [CVE-2024-46854](https://cve.now/CVE-2024-46854.md): net: dpaa: Pad packets to ETH\_ZLEN (no CVSS, Linux)
- [CVE-2024-46853](https://cve.now/CVE-2024-46853.md): spi: nxp-fspi: fix the KASAN report out-of-bounds bug (no CVSS, Linux)
- [CVE-2024-46852](https://cve.now/CVE-2024-46852.md): dma-buf: heaps: Fix off-by-one in CMA heap fault handler (CVSS 7.8, Linux)
- [CVE-2024-46851](https://cve.now/CVE-2024-46851.md): drm/amd/display: Avoid race between dcn10\_set\_drr() and dc\_state\_destruct() (no CVSS, Linux)
- [CVE-2024-46850](https://cve.now/CVE-2024-46850.md): drm/amd/display: Avoid race between dcn35\_set\_drr() and dc\_state\_destruct() (CVSS 7.8, Linux)
- [CVE-2024-46849](https://cve.now/CVE-2024-46849.md): ASoC: meson: axg-card: fix 'use-after-free' (no CVSS, Linux)
- [CVE-2024-46848](https://cve.now/CVE-2024-46848.md): perf/x86/intel: Limit the period on Haswell (no CVSS, Linux)
- [CVE-2024-46847](https://cve.now/CVE-2024-46847.md): mm: vmalloc: ensure vmap\_block is initialised before adding to queue (CVSS 7.8, Linux)
- [CVE-2024-46846](https://cve.now/CVE-2024-46846.md): spi: rockchip: Resolve unbalanced runtime PM / system PM handling (no CVSS, Linux)
- [CVE-2024-46845](https://cve.now/CVE-2024-46845.md): tracing/timerlat: Only clear timer if a kthread exists (CVSS 7.8, Linux)
- [CVE-2024-46844](https://cve.now/CVE-2024-46844.md): um: line: always fill \*error\_out in setup\_one\_line() (CVSS 7.1, Linux)
- [CVE-2024-46843](https://cve.now/CVE-2024-46843.md): scsi: ufs: core: Remove SCSI host only if added (no CVSS, Linux)
- [CVE-2024-46842](https://cve.now/CVE-2024-46842.md): scsi: lpfc: Handle mailbox timeouts in lpfc\_get\_sfp\_info (CVSS 7.8, Linux)
- [CVE-2024-46841](https://cve.now/CVE-2024-46841.md): btrfs: don't BUG\_ON on ENOMEM from btrfs\_lookup\_extent\_info() in walk\_down\_proc() (no CVSS, Linux)
- [CVE-2024-46840](https://cve.now/CVE-2024-46840.md): btrfs: clean up our handling of refs == 0 in snapshot delete (no CVSS, Linux)
- [CVE-2024-46838](https://cve.now/CVE-2024-46838.md): userfaultfd: don't BUG\_ON() if khugepaged yanks our page table (no CVSS, Linux)
- [CVE-2024-46837](https://cve.now/CVE-2024-46837.md): drm/panthor: Restrict high priorities on group\_create (no CVSS, Linux)
- [CVE-2024-46836](https://cve.now/CVE-2024-46836.md): usb: gadget: aspeed\_udc: validate endpoint index for ast udc (no CVSS, Linux)
- [CVE-2024-46835](https://cve.now/CVE-2024-46835.md): drm/amdgpu: Fix smatch static checker warning (no CVSS, Linux)
- [CVE-2024-46834](https://cve.now/CVE-2024-46834.md): ethtool: fail closed if we can't get max channel used in indirection tables (CVSS 7.8, Linux)
- [CVE-2024-46833](https://cve.now/CVE-2024-46833.md): net: hns3: void array out of bound when loop tnl\_num (no CVSS, Linux)
- [CVE-2024-46832](https://cve.now/CVE-2024-46832.md): MIPS: cevt-r4k: Don't call get\_c0\_compare\_int if timer irq is installed (no CVSS, Linux)
- [CVE-2024-46831](https://cve.now/CVE-2024-46831.md): net: microchip: vcap: Fix use-after-free error in kunit test (CVSS 8.4, Linux)
- [CVE-2024-46830](https://cve.now/CVE-2024-46830.md): KVM: x86: Acquire kvm-\>srcu when handling KVM\_SET\_VCPU\_EVENTS (CVSS 7.8, Linux)
- [CVE-2024-46829](https://cve.now/CVE-2024-46829.md): rtmutex: Drop rt\_mutex::wait\_lock before scheduling (no CVSS, Linux)
- [CVE-2024-46828](https://cve.now/CVE-2024-46828.md): sched: sch\_cake: fix bulk flow accounting logic for host fairness (CVSS 7.1, Linux)
- [CVE-2024-46827](https://cve.now/CVE-2024-46827.md): wifi: ath12k: fix firmware crash due to invalid peer nss (no CVSS, Linux)
- [CVE-2024-46826](https://cve.now/CVE-2024-46826.md): ELF: fix kernel.randomize\_va\_space double read (no CVSS, Linux)
- [CVE-2024-46825](https://cve.now/CVE-2024-46825.md): wifi: iwlwifi: mvm: use IWL\_FW\_CHECK for link ID check (no CVSS, Linux)
- [CVE-2024-46824](https://cve.now/CVE-2024-46824.md): iommufd: Require drivers to supply the cache\_invalidate\_user ops (no CVSS, Linux)
- [CVE-2024-46823](https://cve.now/CVE-2024-46823.md): kunit/overflow: Fix UB in overflow\_allocation\_test (CVSS 8.4, Linux)
- [CVE-2024-46822](https://cve.now/CVE-2024-46822.md): arm64: acpi: Harden get\_cpu\_for\_acpi\_id() against missing CPU entry (no CVSS, Linux)
- [CVE-2024-46821](https://cve.now/CVE-2024-46821.md): drm/amd/pm: Fix negative array index read (no CVSS, Linux)
- [CVE-2024-46820](https://cve.now/CVE-2024-46820.md): drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend (no CVSS, Linux)
- [CVE-2024-46819](https://cve.now/CVE-2024-46819.md): drm/amdgpu: the warning dereferencing obj for nbio\_v7\_4 (no CVSS, Linux)
- [CVE-2024-46818](https://cve.now/CVE-2024-46818.md): drm/amd/display: Check gpio\_id before used as array index (CVSS 7.8, Linux)
- [CVE-2024-46817](https://cve.now/CVE-2024-46817.md): drm/amd/display: Stop amdgpu\_dm initialize when stream nums greater than 6 (CVSS 7.4, Linux)
- [CVE-2024-46816](https://cve.now/CVE-2024-46816.md): drm/amd/display: Stop amdgpu\_dm initialize when link nums greater than max\_links (CVSS 7.8, Linux)
- [CVE-2024-46815](https://cve.now/CVE-2024-46815.md): drm/amd/display: Check num\_valid\_sets before accessing reader\_wm\_sets\[\] (CVSS 7.1, Linux)
- [CVE-2024-46814](https://cve.now/CVE-2024-46814.md): drm/amd/display: Check msg\_id before processing transcation (no CVSS, Linux)
- [CVE-2024-46813](https://cve.now/CVE-2024-46813.md): drm/amd/display: Check link\_index before accessing dc-\>links\[\] (CVSS 7.8, Linux)
- [CVE-2024-46812](https://cve.now/CVE-2024-46812.md): drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration (CVSS 7.8, Linux)
- [CVE-2024-46811](https://cve.now/CVE-2024-46811.md): drm/amd/display: Fix index may exceed array range within fpu\_update\_bw\_bounding\_box (CVSS 7.3, Linux)
- [CVE-2024-46810](https://cve.now/CVE-2024-46810.md): drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ (no CVSS, Linux)
- [CVE-2024-46809](https://cve.now/CVE-2024-46809.md): drm/amd/display: Check BIOS images before it is used (no CVSS, Linux)
- [CVE-2024-46808](https://cve.now/CVE-2024-46808.md): drm/amd/display: Add missing NULL pointer check within dpcd\_extend\_address\_range (no CVSS, Linux)
- [CVE-2024-46807](https://cve.now/CVE-2024-46807.md): drm/amd/amdgpu: Check tbo resource pointer (no CVSS, Linux)
- [CVE-2024-46806](https://cve.now/CVE-2024-46806.md): drm/amdgpu: Fix the warning division or modulo by zero (no CVSS, Linux)
- [CVE-2024-46805](https://cve.now/CVE-2024-46805.md): drm/amdgpu: fix the waring dereferencing hive (no CVSS, Linux)
- [CVE-2024-46804](https://cve.now/CVE-2024-46804.md): drm/amd/display: Add array index check for hdcp ddc access (no CVSS, Linux)
- [CVE-2024-46803](https://cve.now/CVE-2024-46803.md): drm/amdkfd: Check debug trap enable before write dbg\_ev\_file (CVSS 7.8, Linux)
- [CVE-2024-46802](https://cve.now/CVE-2024-46802.md): drm/amd/display: added NULL check at start of dc\_validate\_stream (no CVSS, Linux)
- [CVE-2024-9281](https://cve.now/CVE-2024-9281.md): bg5sbk MiniCMS post-edit.php cross-site request forgery (CVSS 6.9, bg5sbk MiniCMS)
- [CVE-2024-8607](https://cve.now/CVE-2024-8607.md): SQLi in Oceanic Software's ValeApp (CVSS 8.7, Oceanic Software ValeApp)
- [CVE-2024-8608](https://cve.now/CVE-2024-8608.md): Stored XSS in Oceanic Software's ValeApp (CVSS 7.2, Oceanic Software ValeApp)
- [CVE-2024-9280](https://cve.now/CVE-2024-9280.md): kalvinGit kvf-admin FileUploadKit.java fileUpload unrestricted upload (CVSS 5.1, kalvinGit kvf-admin)
- [CVE-2024-8609](https://cve.now/CVE-2024-8609.md): Improper Access Control in Oceanic Software's ValeApp (CVSS 8.8, Oceanic Software ValeApp)
- [CVE-2024-8643](https://cve.now/CVE-2024-8643.md): Session Hijacking in Oceanic Software's ValeApp (CVSS 9.3, Oceanic Software ValeApp)
- [CVE-2024-8644](https://cve.now/CVE-2024-8644.md): Cleartext Storage of Sensitive Information in Oceanic Software's ValeApp (CVSS 9.3, Oceanic Software ValeApp)
- [CVE-2024-9279](https://cve.now/CVE-2024-9279.md): funnyzpc Mee-Admin User Center index cross site scripting (CVSS 5.1, funnyzpc Mee-Admin)
- [CVE-2024-9278](https://cve.now/CVE-2024-9278.md): HuankeMao SCRM Administrator Backend WxkConfig.php upload\_domain\_verification\_file unrestricted upload (CVSS 5.1, HuankeMao SCRM)
- [CVE-2024-9277](https://cve.now/CVE-2024-9277.md): Langflow HTTP POST Request utils.py redos (CVSS 5.1, Langflow)
- [CVE-2024-9276](https://cve.now/CVE-2024-9276.md): TMsoft MyAuth Gateway index.php cross site scripting (CVSS 5.3, TMsoft MyAuth Gateway)
- [CVE-2024-9275](https://cve.now/CVE-2024-9275.md): jeanmarc77 123solar admin\_invt2.php file inclusion (CVSS 5.3, jeanmarc77 123solar)
- [CVE-2024-9136](https://cve.now/CVE-2024-9136.md): Access permission verification vulnerability in the App Multiplier module Impact: Successful exploitation of this vulnerability may affect s (CVSS 6.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-47294](https://cve.now/CVE-2024-47294.md): Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may (CVSS 4.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-47293](https://cve.now/CVE-2024-47293.md): Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 4.7, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-47292](https://cve.now/CVE-2024-47292.md): Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentialit (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-47291](https://cve.now/CVE-2024-47291.md): Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availab (CVSS 5.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-47290](https://cve.now/CVE-2024-47290.md): Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 5.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-9202](https://cve.now/CVE-2024-9202.md): EDC DataSetResolver policy filtering missing (CVSS 5.3, Eclipse Foundation Eclipse Dataspace Components)
- [CVE-2024-41930](https://cve.now/CVE-2024-41930.md): Cross-site scripting vulnerability exists in MF Teacher Performance Management System version 6. (CVSS 6.1, Media Fusion Co. MF Teacher Performance Management System)
- [CVE-2024-6654](https://cve.now/CVE-2024-6654.md): Denial of Service vulnerability in ESET products for macOS (CVSS 6.8, ESET, spol. s r.o. ESET Cyber Security · ESET, spol. s r.o.…)
- [CVE-2024-6931](https://cve.now/CVE-2024-6931.md): The Events Calendar \<= 6.6.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, stellarwp The Events Calendar)
- [CVE-2024-38861](https://cve.now/CVE-2024-38861.md): Lack of TLS validation in plugin MikroTik on Checkmk Exchange (CVSS 4.9, MikroTik)
- [CVE-2024-39435](https://cve.now/CVE-2024-39435.md): In Logmanager service, there is a possible missing verification incorrect input. (CVSS 6.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-39434](https://cve.now/CVE-2024-39434.md): In drm service, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.2, Unisoc (Shanghai) Technologies Co. T606/T612/T616/T610/T618…)
- [CVE-2024-39433](https://cve.now/CVE-2024-39433.md): In drm service, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.2, Unisoc (Shanghai) Technologies Co. T606/T612/T616/T610/T618…)
- [CVE-2024-39432](https://cve.now/CVE-2024-39432.md): In UMTS RLC driver, there is a possible out of bounds read due to a missing bounds check. (CVSS 8.3, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-39431](https://cve.now/CVE-2024-39431.md): In UMTS RLC driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.3, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-7400](https://cve.now/CVE-2024-7400.md): Local privilege escalation in ESET products for Windows (CVSS 8.5, ESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +11)
- [CVE-2024-8681](https://cve.now/CVE-2024-8681.md): Premium Addons for Elementor \<= 4.10.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-8991](https://cve.now/CVE-2024-8991.md): OSM \<= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm\_map and osm\_map\_v3 Shortcodes (CVSS 6.4, photoweblog OSM – OpenStreetMap)
- [CVE-2024-9049](https://cve.now/CVE-2024-9049.md): Beaver Builder – WordPress Page Builder \<= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-9029](https://cve.now/CVE-2024-9029.md): Freeimage: heap buffer overflow in tiff\_read\_iptc\_profile (CVSS 7.5, freeimage)
- [CVE-2024-7714](https://cve.now/CVE-2024-7714.md): AI Assistant with ChatGPT by AYS \<= 2.0.9 - Unauthenticated AJAX Calls (CVSS 6.5, AI ChatBot with ChatGPT and Content Generator by AYS)
- [CVE-2024-7713](https://cve.now/CVE-2024-7713.md): AI Chatbot with ChatGPT by AYS \<= 2.0.9 - Unauthenticated OpenAI Key Disclosure (CVSS 7.5, AI ChatBot with ChatGPT and Content Generator by AYS)
- [CVE-2024-8922](https://cve.now/CVE-2024-8922.md): Product Enquiry for WooCommerce \<= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry\_detail.php (CVSS 8.8, rajeshsingh520 PiWeb Product Enquiry or product catalog for…)
- [CVE-2024-9130](https://cve.now/CVE-2024-9130.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter (CVSS 7.2, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-8965](https://cve.now/CVE-2024-8965.md): Absolute Reviews \<= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name (CVSS 6.4, Code Supply Absolute Reviews)
- [CVE-2024-7011](https://cve.now/CVE-2024-7011.md): Sharp NEC Projectors (NP-CB4500UL, NP-CB4500WL, NP-CB4700UL, NP-P525UL, NP-P525UL+, NP-P525ULG, NP-P525ULJL, NP-P525WL, NP-P525WL+, NP-P525W (CVSS 6.5, Sharp Display Solutions NP-CB4500UL · Sharp Display So… +147)
- [CVE-2024-25411](https://cve.now/CVE-2024-25411.md): A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-25412](https://cve.now/CVE-2024-25412.md): A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 4.6)
- [CVE-2024-33368](https://cve.now/CVE-2024-33368.md): An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptSc (CVSS 8.8)
- [CVE-2024-33369](https://cve.now/CVE-2024-33369.md): Directory Traversal vulnerability in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the getFile (CVSS 8.8)
- [CVE-2024-40509](https://cve.now/CVE-2024-40509.md): Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asm (CVSS 7.3)
- [CVE-2024-40510](https://cve.now/CVE-2024-40510.md): Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMCommon.asm (CVSS 8.2)
- [CVE-2024-40511](https://cve.now/CVE-2024-40511.md): Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMServerAdmi (CVSS 7.3)
- [CVE-2024-40512](https://cve.now/CVE-2024-40512.md): Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMReporting. (CVSS 7.3)
- [CVE-2024-44910](https://cve.now/CVE-2024-44910.md): NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the AOS subsystem (crypto\_aos.c). (CVSS 7.5)
- [CVE-2024-44911](https://cve.now/CVE-2024-44911.md): NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TC subsystem (crypto\_tc.c). (CVSS 7.5)
- [CVE-2024-44912](https://cve.now/CVE-2024-44912.md): NASA CryptoLib v1.3.0 was discovered to contain an Out-of-Bounds read via the TM subsystem (crypto\_tm.c). (CVSS 7.5)
- [CVE-2024-46097](https://cve.now/CVE-2024-46097.md): TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. (CVSS 8.1)
- [CVE-2024-46256](https://cve.now/CVE-2024-46256.md): A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certi (CVSS 9.8)
- [CVE-2024-46257](https://cve.now/CVE-2024-46257.md): A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows an attacker to achieve remote (CVSS 6.3)
- [CVE-2024-46331](https://cve.now/CVE-2024-46331.md): ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. (CVSS 7.2)
- [CVE-2024-46333](https://cve.now/CVE-2024-46333.md): An authenticated cross-site scripting (XSS) vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a (CVSS 4.8)
- [CVE-2024-46366](https://cve.now/CVE-2024-46366.md): A Client-side Template Injection (CSTI) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to execute arbitrary client-side te (CVSS 8.8)
- [CVE-2024-46367](https://cve.now/CVE-2024-46367.md): A Stored Cross-Site Scripting (XSS) vulnerability in Webkul Krayin CRM 1.3.0 allows remote attackers to inject arbitrary JavaScript code by (CVSS 9.6)
- [CVE-2024-46441](https://cve.now/CVE-2024-46441.md): An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/com (CVSS 8.8)
- [CVE-2024-46453](https://cve.now/CVE-2024-46453.md): A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scri (CVSS 6.1)
- [CVE-2024-46470](https://cve.now/CVE-2024-46470.md): Cross Site Scripting vulnerability in CodeAstro Membership Management System 1.0 allows attackers to run malicious JavaScript via the member (CVSS 6.1)
- [CVE-2024-46471](https://cve.now/CVE-2024-46471.md): The Directory Listing in /uploads/ Folder in CodeAstro Membership Management System 1.0 exposes the structure and contents of directories, p (CVSS 7.5)
- [CVE-2024-46472](https://cve.now/CVE-2024-46472.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection via the parameter 'email' in the Login Page. (CVSS 8.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.