Skip to content
OpenAdvisories

Archive

19 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /19 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-27584 Scanner template EPSS 34%

    Dragonfly2 vulnerable to hard coded cyptographic key

    Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key…

    dragonflyoss Dragonfly2 d7y.io/dragonfly/v2 Go
  • Critical 9.8
    CVE-2024-45410 Public exploit

    HTTP client can remove the X-Forwarded headers in Traefik

    Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it sho…

    traefik traefik github.com/traefik/traefik github.com/traefik/traefik/v2 Alpine Go
  • Critical 9.8
    CVE-2024-46983

    Remote Command Execution(RCE) Vulnerbility in sofa-hessian

    sofa-hessian is an internal improved version of Hessian3/4 powered by Ant Group CO., Ltd. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain th…

    sofastack sofa-hessian com.alipay.sofa:hessian Maven
  • Critical 9.4
    CVE-2024-8963 Exploited Public exploit Scanner template EPSS 99%

    Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted fun…

    ivanti CSA (Cloud Services Appliance) Network devices
    KEV Sep 19, 2024
  • Critical 9.2
    CVE-2024-45861

    Use of Hard-coded Credentials in Kastle Systems Access Control System

    Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker to access sensitive information.

    Kastle Systems Access Control System
  • Critical 9.3
    CVE-2024-7785

    Reflected XSS in Ece Software's Electronic Ticket System

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS). This issue affects Electronic Ticket System: before 2024.08.

    Ece Software Electronic Ticket System
  • Critical 9.1
    CVE-2024-8986

    Information Leakage in grafana-plugin-sdk-go

    The grafana plugin SDK bundles build metadata into the binaries it compiles; this metadata includes the repository URI for the plugin being built, as retrieved by running `git remote get-url origin`. If credentials are included in the repository URI (for inst…

    grafana-plugin-sdk-go Grafana Plugin SDK github.com/grafana/grafana-plugin-sdk-go Web / CMS Go
  • Critical 9.3
    CVE-2024-47088

    User Enumeration vulnerability

    This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could …

    Apex Softcell LD Geo
  • Critical 9.9
    CVE-2024-33109

    Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to over…

  • Critical 9.8
    CVE-2024-31570

    libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via…

    freeimage freeimage Debian Ubuntu
  • Critical 9.8
    CVE-2024-46946

    LangChain Experimental Eval Injection vulnerability

    langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcb…

    langchain-experimental PyPI
  • Critical 9.8
    CVE-2024-40125

    An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allo…