Skip to content
OpenAdvisories

Archive

23 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /23 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.3
    CVE-2024-7024

    Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially per…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Critical 9.1
    CVE-2024-0005

    A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remote…

    Pure Storage FlashArray FlashBlade
  • Critical 9.1
    CVE-2024-0004

    A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely t…

    Pure Storage FlashArray
  • Critical 9.1
    CVE-2024-0003

    A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an…

    Pure Storage FlashArray
  • Critical 10.0
    CVE-2024-0002

    A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to t…

    Pure Storage FlashArray
  • Critical 10.0
    CVE-2024-0001

    A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active…

    Pure Storage FlashArray
  • Critical 9.9
    CVE-2024-9014 Public exploit Scanner template

    OAuth2 client id and secret exposed through the web browser in pgAdmin 4

    pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

    pgadmin.org pgAdmin 4 pgadmin4 PyPI
  • Critical 9.0
    CVE-2024-47066 Public exploit EPSS 12%

    Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

    Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an externa…

    lobehub lobe-chat @lobehub/chat npm
  • Critical 9.8
    CVE-2024-46997

    DataEase's H2 datasource has a remote command execution risk

    DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, an attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string. The vulnerability has been fixed in v2.10.1.

    dataease dataease io.dataease:common Maven
  • Critical 9.3
    CVE-2024-7735

    SQLi in Exnet Informatics Software's Ferry Reservation System

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry Reservation System allows SQL Injection. This issue affects Ferry Reservation System: before 240805-002.

    Exnet Informatics Software Ferry Reservation System
  • Critical 9.2
    CVE-2024-8606

    Fix 2FA bypass via RestAPI

    Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass two factor authentication

    Checkmk Checkmk check-mk Ubuntu
  • Critical 9.8
    CVE-2024-34331

    A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privi…

  • Critical 9.8
    CVE-2024-47222

    New Cloud MyOffice SDK Collaborative Editing Server 2.2.2 through 2.8 allows SSRF via manipulation of requests from ext…