Skip to content
OpenAdvisories

Archive

September 2024

Vulnerabilities first published in this month (UTC), newest first.

← August 2024 2024 / September October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

2,542 results · Feed

  • Medium 6.4
    CVE-2024-8723

    012 PS Multi Languages <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The 012 Ps Multi Languages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via translated titles in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated a…

    ouhinit 012 Ps Multi Languages Web / CMS
  • High 7.8
    CVE-2024-8404

    Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder

    An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and …

    PaperCut PaperCut NG, PaperCut MF
  • Medium 6.1
    CVE-2024-8405

    Arbitrary File Creation in PaperCut NG/MF Web Print leading to a Denial of Service attack

    An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the web-print.exe process, which can incorrectly create files that don’t exist when a maliciously form…

    PaperCut PaperCut NG, PaperCut MF
  • Medium 4.3
    CVE-2024-46632

    Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function.

    assimp assimp pyassimp Debian Ubuntu PyPI
  • Critical 9.1
    CVE-2024-46627 Scanner template

    Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.

  • High 8.0
    CVE-2024-46329

    VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the SystemCommand object.

  • High 8.0
    CVE-2024-46328

    VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts…

  • High 8.0
    CVE-2024-46628 EPSS 12%

    Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usb…

  • High 7.4
    CVE-2024-46330

    VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the iptablesWebsFilterRun…

  • Medium 5.7
    CVE-2024-46327

    An issue in the Http_handle object of VONETS VAP11G-300 v3.3.23.6.9 allows attackers to access sensitive files via a di…

  • Medium 4.7
    CVE-2024-45985

    A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allo…

  • High 8.8
    CVE-2024-45982

    A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user…

  • Medium 5.4
    CVE-2024-45986

    A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs w…

  • Medium 6.3
    CVE-2024-45983

    A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The …

  • High 8.8
    CVE-2024-45981

    A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via …

  • High 8.8
    CVE-2024-45979

    A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via u…

  • Medium 4.0
    CVE-2024-45989

    Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Ac…

  • Medium 6.5
    CVE-2024-45987

    Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vu…

  • High 8.8
    CVE-2024-45980

    A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user int…

  • Medium 4.7
    CVE-2024-45984

    A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an …

  • High 7.3
    CVE-2024-40507 Public exploit

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via …

  • High 7.3
    CVE-2024-40508 Public exploit

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via …

  • High 7.3
    CVE-2024-40506 Public exploit

    Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via …

  • High 7.5
    CVE-2024-44860

    An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access …

  • High 8.4
    CVE-2024-41605

    In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an upda…

  • Medium 5.4
    GHSA-75j2-9gmc-m855

    Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

    A stored cross-site scripting has been found in the image upload functionality that can be used by normal registered users: It is possible to upload a SVG image containing JavaScript and it's also possible to upload a HTML document when the format parameter i…

    camaleon_cms RubyGems
  • High 8.8
    CVE-2024-47083

    Power Platform Terraform Provider has Improper Masking of Secrets in Logs

    Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the `client_secret` used in the …

    Microsoft terraform-provider-power-platform
  • Medium 4.6
    CVE-2024-47082

    Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability

    Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawbe…

    strawberry-graphql strawberry strawberry-graphql PyPI
  • Medium 4.3
    CVE-2024-47305

    WordPress Use Any Font plugin <= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dnesscarkey Use Any Font use-any-font allows Cross Site Request Forgery.This issue affects Use Any Font: from n/a through <= 6.3.08.

    Dnesscarkey Use Any Font
  • Medium 5.4
    CVE-2024-47315

    WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1.

    stellarwp GiveWP
  • High 7.3
    CVE-2024-8996

    Grafana Agent Flow on Windows Unquoted service path

    Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2

    Grafana Agent Flow github.com/grafana/agent Go
  • High 7.3
    CVE-2024-8975

    Grafana Alloy on Windows Unquoted service path

    Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.

    Grafana Alloy github.com/grafana/alloy Go
  • Medium 4.3
    CVE-2024-20434

    A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.5
    CVE-2024-20414

    A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, r…

    Cisco Cisco IOS XE Software IOS iOS Network devices
  • Medium 5.8
    CVE-2024-20465

    A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet…

    Cisco IOS iOS Network devices
  • Medium 4.7
    CVE-2024-20510

    A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20467 Public exploit

    A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20464

    A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software could allow an unauthentic…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20480

    A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edg…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.1
    CVE-2024-20437

    A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote a…

    Cisco Cisco IOS XE Software iOS Network devices