Skip to content
OpenAdvisories

Archive

12 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /12 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Critical 9.9
    CVE-2024-6678 Public exploit

    Authentication Bypass by Spoofing in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain ci…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Critical 9.0
    CVE-2024-8695

    A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.

    A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.

    Docker Docker Desktop
  • Critical 9.8
    CVE-2024-45824

    FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation

    CVE-2024-45824 IMPACT A remote code vulnerability exists in the affected products. The vulnerability occurs when chained with Path Traversal, Command Injection, and XSS Vulnerabilities and allows for full unauthenticated remote code execution. The link in the…

    Rockwell Automation FactoryTalk® View Site Edition ICS / OT
  • Critical 9.0
    CVE-2024-28991

    SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

    SolarWinds Access Rights Manager (ARM) was found to be susceptible to a remote code execution vulnerability. If exploited, this vulnerability would allow an authenticated user to abuse the service, resulting in remote code execution.

    SolarWinds Access Rights Manager
  • Critical 9.0
    CVE-2024-45856

    MindsDB Cross-site Scripting vulnerability

    A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the we…

    MindsDB MindsDB mindsdb PyPI
  • Critical 10.0
    CVE-2024-8522 Public exploit Scanner template EPSS 63%

    LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'

    The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the…

    ThimPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Web / CMS
  • Critical 10.0
    CVE-2024-8529 Public exploit Scanner template EPSS 12%

    LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

    The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on t…

    ThimPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Web / CMS
  • Critical 9.1
    CVE-2024-34783 EPSS 43%

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-34779 EPSS 24%

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-34785 EPSS 25%

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-32848 EPSS 43%

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-32842

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-32840 EPSS 25%

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-32843

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-32845 EPSS 24%

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 9.1
    CVE-2024-32846

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated …

    ivanti EPM Network devices
  • Critical 10.0
    CVE-2024-29847 Public exploit EPSS 52%

    Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allow…

    ivanti EPM Network devices
  • Critical 9.3
    CVE-2024-34334

    ORDAT FOSS-Online before v2.24.01 was discovered to contain a SQL injection vulnerability via the forgot password funct…

  • Critical 9.1
    CVE-2024-40457 Public exploit

    No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: …