Skip to content
OpenAdvisories

Archive

September 2024

Vulnerabilities first published in this month (UTC), newest first.

← August 2024 2024 / September October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

97 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-44849 Public exploit Scanner template EPSS 46%

    Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

  • Critical 9.8
    CVE-2024-40711 Exploited · Ransomware Public exploit Scanner template EPSS 90%

    A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…

    Veeam Backup and Recovery
    KEV Oct 17, 2024
  • Critical 9.8
    CVE-2024-8517 Public exploit Scanner template EPSS 95%

    SPIP Bigup Multipart File Upload OS Command Injection

    SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

    SPIP SPIP spip spip Debian Ubuntu
  • Critical 10.0
    CVE-2024-7591 Public exploit Scanner template EPSS 39%

    Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection

    Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above

    Progress Software LoadMaster
  • Critical 9.8
    CVE-2024-8465 Public exploit

    SQL injection vulnerability in Job Portal

    SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and retrieve all the information stored in it.

    PHPGurukul Job Portal
  • High 8.1
    CVE-2024-7627 Public exploit

    Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

    The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes …

    bitpressadmin Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress Web / CMS
  • Medium 6.5
    CVE-2024-45589 Public exploit

    RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts a…

  • Critical 9.8
    CVE-2024-8289 Public exploit

    MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeover

    The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-escalation and account takeover due to an insufficient capability check on the update_item_permissions_check and create_…

    wcmp MultiVendorX – WooCommerce Multivendor Marketplace Solutions Web / CMS
  • Critical 9.8
    CVE-2024-45195 Exploited Public exploit Scanner template EPSS 100%

    Apache OFBiz: Confused controller-view authorization logic (forced browsing)

    Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Apache Software Foundation Apache OFBiz
    KEV Feb 4, 2025
  • High 8.8
    CVE-2024-45507 Public exploit Scanner template EPSS 96%

    Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

    Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.

    Apache Software Foundation Apache OFBiz
  • Medium 6.7
    CVE-2024-42642 Public exploit

    Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by send…

  • Critical 9.8
    CVE-2024-8381 Public exploit

    A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as …

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  • High 7.5
    CVE-2024-6232 Public exploit

    Regular-expression DoS when parsing TarFile headers

    There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

    Python Software Foundation CPython python3.4 tensorflow Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.4
    CVE-2024-6473 Public exploit

    DLL Hijacking in Yandex Browser

    Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.

    Yandex Browser
  • Medium 5.1
    CVE-2024-34463 Public exploit

    BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The …

  • Unscored —
    CVE-2024-44947 Public exploit

    fuse: Initialize beyond-EOF page contents before setting uptodate

    In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2024-42471 Public exploit

    Arbitrary File Write via artifact extraction in actions/artifact

    actions/artifact is the GitHub ToolKit for developing GitHub Actions. Versions of `actions/artifact` on the 2.x branch before 2.1.2 are vulnerable to arbitrary file write when using `downloadArtifactInternal`, `downloadArtifactPublic`, or `streamExtractExtern…

    actions toolkit @actions/artifact npm