Skip to content
OpenAdvisories

Archive

9 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /9 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 8.2
    CVE-2024-6796

    Vulnerability in Baxter Connex Health Portal

    In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.

    Baxter Connex Health Portal
  • High 7.5
    CVE-2024-45296

    path-to-regexp outputs backtracking regular expressions

    path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, …

    pillarjs path-to-regexp thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Azure Linux Wolfi npm
  • High 7.1
    CVE-2024-7341

    Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

    A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks t…

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform 8 Red Hat Build of Keycloak Maven
  • High 8.6
    CVE-2024-45411

    Twig has a possible sandbox bypass

    Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

    twigphp Twig php-twig php-twig Debian Ubuntu Packagist
  • High 7.4
    GHSA-gcfg-hmwx-wq5h

    Httpful is Missing Certificate Validation

    Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation

    nategood/httpful Packagist
  • High 8.3
    CVE-2024-45041

    External Secrets Operator vulnerable to privilege escalation

    External Secrets Operator is a Kubernetes operator that integrates external secret management systems. The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has "ge…

    external-secrets external-secrets github.com/external-secrets/external-secrets Go
  • High 7.1
    CVE-2024-7015

    Improper Authentication in Profelis Informatics and Consulting's PassBOX

    Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication Abuse. This issue affects PassBox: before v1.2.

    Profelis Informatics and Consulting PassBox
  • High 8.7
    CVE-2024-8601

    Improper Access Control Vulnerability in TechExcel Back Office Software

    This vulnerability exists in TechExcel Back Office Software versions prior to 1.0.0 due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL…

    TechExcel Software Solutions Back Office Software
  • High 7.5
    CVE-2024-44375

    D-Link DI-8100 v16.07.26A1 has a stack overflow vulnerability in the dbsrv_asp function.

  • High 7.2
    CVE-2024-44725

    AutoCMS v5.4 was discovered to contain a SQL injection vulnerability via the sidebar parameter at /admin/robot.php.

  • High 8.8
    CVE-2024-44335 EPSS 12%

    D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04…

  • High 7.2
    CVE-2024-44724

    AutoCMS v5.4 was discovered to contain a PHP code injection vulnerability via the txtsite_url parameter at /admin/site_…

  • High 7.5
    CVE-2024-44720

    SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.

  • High 8.8
    CVE-2024-44334 EPSS 32%

    D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24…

  • High 8.8
    CVE-2024-44333 EPSS 12%

    D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24…