- GeneralExpand or Collapse  - NVD Dashboard
- News and Status Updates
- FAQ
- Visualizations
- Legal Disclaimer

-  Vulnerabilities Expand or Collapse  - Search & Statistics
- Weakness Types
- Legacy Data Feeds
- Vendor Comments
- CVMAP

-  Vulnerability Metrics Expand or Collapse  - CVSS v4.0							Calculator
- CVSS v3.x								Calculators
- CVSS v2.0								Calculator

-  Products Expand or Collapse  - CPE Dictionary
- CPE Search
- CPE Statistics
- SWID

-  DevelopersExpand or Collapse  - Start Here
- Request an API Key
- Vulnerabilities
- Products
- Data Sources
- Terms of Use
 
-  Contact NVD 
-  Other Sites Expand or Collapse  - Checklist (NCP)								Repository
- Configurations (CCE)
- 800-53 Controls
- SCAP								Validated Tools
- SCAP
- USGCB

-  Search Expand or Collapse  - Vulnerability Search
- CPE Search

**New Communications Page**

**CVSS v4.0 Support**

**2.0 APIs**

The NVD is the U.S. government repository			of standards based vulnerability management data represented using			the Security Content Automation Protocol (SCAP). This data enables			automation of vulnerability management, security measurement, and			compliance. The NVD includes databases of security checklist			references, security-related software flaws, product names, and 			impact metrics.For information on how to cite the NVD, including the			database's Digital Object Identifier (DOI), please consult  			NIST's Public Data Repository.

#### Legal Disclaimer:

				Here is where you can read the NVD legal disclaimer.			

**Last									20 Scored Vulnerability IDs & Summaries****CVSS									Severity**
                      -  
**CVE-2024-47221**  - CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.										**Published:**										September 21, 2024; 9:15:12 PM -0400									
  
*V3.1:*7.5 HIGH
 
                      -  
**CVE-2022-39068**  - There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack.										**Published:**										September 17, 2024; 10:15:09 PM -0400									
  
*V3.1:*6.5 MEDIUM
 
                      -  
**CVE-2024-39910**  - decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before bein...										read CVE-2024-39910**Published:**										September 16, 2024; 3:16:10 PM -0400									
  
*V3.1:*4.8 MEDIUM
 
                      -  
**CVE-2024-43024**  - Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary web scripts or HTML via a crafted payload.										**Published:**										September 18, 2024; 4:15:03 PM -0400									
  
*V3.1:*6.1 MEDIUM
 
                      -  
**CVE-2024-37985**  - Windows Kernel Information Disclosure Vulnerability										**Published:**										September 17, 2024; 7:15:14 PM -0400									
  
*V3.1:*5.6 MEDIUM
 
                      -  
**CVE-2024-43188**  - IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0could allow a privileged user to perform unauthorized activities due to improper client side validation.										**Published:**										September 18, 2024; 8:15:02 AM -0400									
  
*V3.1:*4.9 MEDIUM
 
                      -  
**CVE-2021-27915**  - Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permissions.This could lead to the user having elevat...										read CVE-2021-27915**Published:**										September 17, 2024; 10:15:14 AM -0400									
  
*V3.1:*9.0 CRITICAL
 
                      -  
**CVE-2024-44162**  - This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.										**Published:**										September 16, 2024; 8:15:51 PM -0400									
  
*V3.1:*7.8 HIGH
 
                      -  
**CVE-2024-32034**  - decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a propo...										read CVE-2024-32034**Published:**										September 16, 2024; 3:16:10 PM -0400									
  
*V3.1:*4.8 MEDIUM
 
                      -  
**CVE-2024-45300**  - alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multipl...										read CVE-2024-45300**Published:**										September 06, 2024; 9:15:05 AM -0400									
  
*V3.1:*5.9 MEDIUM
 
                      -  
**CVE-2024-7734**  - An unauthenticated remote attacker can exploit the behavior of the pathfinder TCP encapsulation service by establishing a high number of TCP connections to the pathfinder TCP encapsulation service. The impact is limited to blocking of valid IPsec ...										read CVE-2024-7734**Published:**										September 10, 2024; 4:15:04 AM -0400									
  
*V3.1:*5.3 MEDIUM
 
                      -  
**CVE-2023-45038**  - An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network.We have already fixed the vulnerability in the following...										read CVE-2023-45038**Published:**										September 06, 2024; 1:15:12 PM -0400									
  
*V3.1:*8.8 HIGH
 
                      -  
**CVE-2023-47563**  - An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network.We have already fixed the vulnerability in the following version:...										read CVE-2023-47563**Published:**										September 06, 2024; 1:15:12 PM -0400									
  
*V3.1:*8.8 HIGH
 
                      -  
**CVE-2023-50360**  - A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.We have already fixed the vulnerability in the following version:Vid...										read CVE-2023-50360**Published:**										September 06, 2024; 1:15:12 PM -0400									
  
*V3.1:*8.8 HIGH
 
                      -  
**CVE-2024-8054**  - The MM-Breaking News WordPress plugin through 0.7.9 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.										**Published:**										September 12, 2024; 2:15:25 AM -0400									
  
*V3.1:*6.1 MEDIUM
 
                      -  
**CVE-2024-8056**  - The MM-Breaking News WordPress plugin through 0.7.9 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers										**Published:**										September 12, 2024; 2:15:25 AM -0400									
  
*V3.1:*6.1 MEDIUM
 
                      -  
**CVE-2024-6493**  - The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_htm...										read CVE-2024-6493**Published:**										September 13, 2024; 2:15:15 AM -0400									
  
*V3.1:*4.8 MEDIUM
 
                      -  
**CVE-2024-6617**  - The NinjaTeam Header Footer Custom Code WordPress plugin before 1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_htm...										read CVE-2024-6617**Published:**										September 13, 2024; 2:15:15 AM -0400									
  
*V3.1:*4.8 MEDIUM
 
                      -  
**CVE-2024-7133**  - The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any   WordPress plugin before 2.7.3 does not validate and escape some of its settings before outputting them back in the page, which could allow users...										read CVE-2024-7133**Published:**										September 13, 2024; 2:15:15 AM -0400									
  
*V3.1:*4.8 MEDIUM
 
                      -  
**CVE-2024-7863**  - The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server										**Published:**										September 13, 2024; 2:15:15 AM -0400									
  
*V3.1:*6.8 MEDIUM
 

				Created 				September 20, 2022, 			August 27, 2024