Skip to content
OpenAdvisories

Archive

September 2024

Vulnerabilities first published in this month (UTC), newest first.

← August 2024 2024 / September October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • Medium 5.9
    CVE-2024-46635 Public exploit

    An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access s…

  • Medium 6.3
    CVE-2024-45200 Public exploit

    In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to …

  • Medium 4.6
    CVE-2024-25412 Public exploit

    A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML …

  • Medium 6.1
    CVE-2024-25411 Public exploit

    A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML …

  • Medium 5.3
    CVE-2024-47176 Public exploit Scanner template EPSS 51%

    cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source

    CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trus…

    OpenPrinting cups-browsed cups-filters cups-filters Debian Ubuntu
  • Medium 6.7
    CVE-2024-6769 Public exploit

    Medium to High Integrity Privilege Escalation in Microsoft Windows

    A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medi…

    Microsoft Windows Server 2019 Windows Server 2022 Windows Server 2016 Windows
  • Medium 5.1
    CVE-2024-8118 Public exploit

    Grafana alerting wrong permission on datasource rule write endpoint

    In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.

    Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  • Medium 6.8
    CVE-2024-23922 Public exploit

    Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability

    Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required …

    Sony XAV-AX5500
  • Medium 5.4
    CVE-2023-46948 Public exploit

    A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote atta…

  • Medium 5.4
    CVE-2024-45614 Public exploit

    Header normalization allows for client to clobber proxy set headers in Puma

    Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy se…

    puma puma puma puma Debian Ubuntu Wolfi RubyGems
  • Medium 4.2
    CVE-2024-39081 Public exploit

    An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communica…

  • Medium 6.3
    CVE-2024-8949 Public exploit

    SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management

    A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php of the component Cart Content Handler. The manipulation of the argument cart_id/id leads to improper …

    SourceCodester Online Eyewear Shop
  • Medium 5.5
    CVE-2024-8945 Public exploit EPSS 16%

    CodeCanyon RISE Ultimate Project Manager save sql injection

    A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the file /index.php/dashboard/save. The manipulation of the argument id leads to sql injection. The attack …

    CodeCanyon RISE Ultimate Project Manager
  • Medium 5.5
    CVE-2024-44133 Public exploit

    This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15. On MDM managed devic…

    Apple macOS macOS
  • Medium 5.5
    CVE-2024-40842 Public exploit

    An issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15. An a…

    Apple macOS macOS
  • Medium 5.0
    CVE-2024-45383 Public exploit

    A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus…

    Microsoft HDAudBus.sys
  • Medium 6.1
    CVE-2024-34831 Public exploit

    cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the i…

  • Medium 6.5
    CVE-2024-45589 Public exploit

    RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts a…

  • Medium 6.7
    CVE-2024-42642 Public exploit

    Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by send…

  • Medium 5.1
    CVE-2024-34463 Public exploit

    BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The …