September 2024
2,594 CVEs published, −14% on August 2024 and −9% on September 2023. CISA added 25 to KEV.
2024 month by month
- Critical
- 24110% of the 2,532 with a CVSS score
- Added to CISA KEV
- 2513 of this month's CVEs are in KEV, listed a median 40 days after publication
- Vendors
- 1,1604,539 products
- Top weakness
- XSSCWE-79 · 414 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Mindsdb3668none—
- 2LinuxLinux, Linux Kernel2770none+1
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»2437none+1
- 4Ао "нппкт"Осон Основа Оnyx2405none+1
- 5Ооо «ред Софт»Ред Ос, Ред База Данных2234none−3
- 6Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 91708none+2
- 7CanonicalUbuntu, Anbox Cloud1300none−1
- 8MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022, Windows Server 2022 23h210734−1
- 9ApplemacOS, iPhone OS, iOS and iPadOS912nonenew
- 10UnknownWp Multitasking, Music Request Manager, Starbox783none+9
- 11Ао «ивк»Альт Сп 10, Альт 8 Сп672none+4
- 12GoogleAndroid, Chrome, Google Chrome601none—
- 13PyPIMindsdb, Micropython-copy, Micropython-io538none+9
- 14SourcecodesterFood Ordering Management System, Best House Rental Management System, Online Railway Reservation System500none−5
- 15npmLunary, Mattermost-desktop, Agnai472none+13
- 16GoGithub.com/nvidia/nvidia-container-toolkit, Github.com/zitadel/zitadel/v2, Github.com/hashicorp/vault406none−3
- 17DraytekVigor3910 Firmware, Vigor 3910, Vigor 2766380nonenew
- 18MavenOrg.keycloak:keycloak-services, Org.keycloak:keycloak-core, Org.xwiki.platform:xwiki-platform-notifications-ui384none+16
- 19OpennetworkingLibfluid Msg370nonenew
- 20Open Networking Foundation (Onf)Libfluid370nonenew
- 21PackagistMautic/core, Mautic/core-lib, Concrete5/concrete5361none−4
- 22SamsungAndroid, Exynos 1380 Firmware, Exynos 850 Firmware360none+3
- 23CiscoCisco IOS XE Software, IOS XE, Cisco IOS XR Software3211+16
- 24AdobeIllustrator 2023, Illustrator, Media Encoder291none−14
- 25QnapQuts Hero, Qts, Qutscloud260nonenew
Severity
How this month's CVEs score on CVSS; 62 have no score yet. Severity is not exploitation.
- Critical241
- High882
- Medium1,301
- Low108
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS414
- CWE-89SQL Injection146
- CWE-787Out-of-bounds Write106
- CWE-476NULL Pointer Dereference89
- CWE-125Out-of-bounds Read87
- CWE-22Path Traversal80
- CWE-120Buffer Overflow70
- CWE-200Information Exposure69
- CWE-416Use After Free69
- CWE-862Missing Authorization65
- CWE-352CSRF61
- CWE-94Code Injection61
- CWE-78OS Command Injection58
- CWE-284Improper Access Control55
- CWE-20Improper Input Validation43
- CWE-77Command Injection43
- CWE-269Improper Privilege Mgmt38
- CWE-863Incorrect Authorization37
- CWE-12134
- CWE-122Heap Buffer Overflow33
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems65020% of sector-tagged CVEs
- Web & CMS Plugins53917% of sector-tagged CVEs
- OSS Libraries36111% of sector-tagged CVEs
- Enterprise Software32110% of sector-tagged CVEs
- Networking Infrastructure2558% of sector-tagged CVEs
- Mobile Apps2096% of sector-tagged CVEs
- Hardware Firmware1444% of sector-tagged CVEs
- 8 smaller sectors602
- Not yet classified183
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 476NULL Pointer Dereference | 125Out-of-bounds Read | 22Path Traversal | 120Buffer Overflow | 416Use After Free | 200Information Exposure | 862Missing Authorization |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 1 | 1 | 26 | 64 | 8 | 1 | 2 | 34 | 2 | 1 |
| Linux | 16 | 64 | 8 | 30 | ||||||
| Ооо «русбитех-астра» | 22 | 44 | 6 | 2 | 26 | 2 | ||||
| Ао «нппкт» | 1 | 18 | 49 | 6 | 32 | 1 | ||||
| Ооо «ред Софт» | 1 | 17 | 36 | 6 | 2 | 24 | 1 | 1 | ||
| Red Hat Inc. | 14 | 28 | 4 | 2 | 15 | 1 | 1 | |||
| Canonical Ltd. | 10 | 34 | 4 | 8 | 1 | |||||
| Microsoft Corp | 3 | 5 | 2 | 4 | 17 | |||||
| Apple | 3 | 2 | 5 | 3 | 1 | 15 | 1 | |||
| Microsoft | 2 | 1 | 2 | 4 | 11 | |||||
| Ао «ивк» | 5 | 4 | 7 | 2 | 13 | |||||
| 1 | 17 | 5 | 1 | 1 | 9 | 2 |
CVEs published in September 2024
45 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2024-20439A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. This vulnerabi...KEV9.8
- CVE-2024-38812Heap-overflow vulnerabilityKEV9.8
- CVE-2024-40711A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).KEV9.8
- CVE-2024-8963Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.KEV9.4
- CVE-2024-8956PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient AuthenticationKEV9.1
- CVE-2024-43461Windows MSHTML Platform Spoofing VulnerabilityKEV8.8
- CVE-2024-38014Windows Installer Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-38813Privilege escalation vulnerabilityKEV7.5
- CVE-2024-45195Apache OFBiz: Confused controller-view authorization logic (forced browsing)KEV7.5
- CVE-2024-38226Microsoft Publisher Security Feature Bypass VulnerabilityKEV7.3
- CVE-2024-8190An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must ...KEV7.2
- CVE-2024-8957PTZOptics NDI and SDI Cameras Command Injection via NTP Address ConfigurationKEV7.2
- CVE-2024-38217Windows Mark of the Web Security Feature Bypass VulnerabilityKEV5.4
- CVE-2024-8463File upload restriction bypass vulnerability in Job Portal9.9
- CVE-2024-22399Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server9.8
- CVE-2024-44541evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."9.8
- CVE-2024-44902A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.9.8
- CVE-2024-46983Remote Command Execution(RCE) Vulnerbility in sofa-hessian9.8
- CVE-2024-34026A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3 b4702061dc14d1024856f71b4543298d77007b88. A specially crafted EtherNet/IP r...9.0
- CVE-2024-8579TOTOLINK AC1200 T8 cstecgi.cgi setWiFiRepeaterCfg buffer overflow8.8
- CVE-2024-9122Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)8.8
- CVE-2024-43989WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability7.5
- CVE-2024-45311Denial of service in quinn-proto when using `Endpoint::retry()`7.5
- CVE-2024-45601Local file Inclusion via static file serving functionality in Mesop7.5
- CVE-2024-46935Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to a...7.5
- CVE-2024-46943An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a cluster to impersonate an offline peer, even if this rogue c...7.5
- CVE-2024-8752WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability7.5
- CVE-2024-45596Directus's session is cached for OpenID and OAuth2 if `redirect` is not used7.4
- CVE-2024-46331ModStartCMS v8.8.0 was discovered to contain an open redirect vulnerability in the redirect parameter at /admin/login. This vulnerability allows attackers to redirect users to an arbitrary website ...7.2
- CVE-2022-25768Improper Access Control in UI upgrade process7.0
- CVE-2024-40441An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote a...6.6
- CVE-2024-43938WordPress Name Directory plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability6.5
- CVE-2024-44124This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A malicious Bluetooth input device may bypass pairing.6.5
- CVE-2024-45407Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client6.5
- CVE-2024-34335ORDAT FOSS-Online before version 2.24.01 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login page.6.1
- CVE-2024-8653Netcat CMS: multiple reflected cross-site scripting vulnerabilities in netshop module6.1
- CVE-2024-8663WP Simple Booking Calendar <= 2.0.10 - Reflected Cross-Site Scripting6.1
- CVE-2024-44153The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access user-sensitive data.5.5
- CVE-2024-44190A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to read arbitrary files.5.5
- CVE-2024-45614Header normalization allows for client to clobber proxy set headers in Puma5.4
- CVE-2024-45384Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack5.3
- CVE-2024-45811server.fs.deny bypassed when using ?import&raw in vite4.8
- CVE-2024-7019Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML...4.3
- CVE-2024-8612Qemu-kvm: information leak in virtio devices3.8
- CVE-2024-8443Libopensc: heap buffer overflow in openpgp driver when generating key2.9