# CVEs published 2024-08-29

135 CVEs were published on August 29, 2024: 32 critical, 26 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-2881](https://cve.now/CVE-2024-2881.md): Fault Injection of EdDSA signature in WolfCrypt (CVSS 6.7, WolfSSL wolfCrypt)
- [CVE-2024-1545](https://cve.now/CVE-2024-1545.md): Fault Injection of RSA encryption in WolfCrypt (CVSS 5.9, WolfSSL wolfCrypt)
- [CVE-2024-1543](https://cve.now/CVE-2024-1543.md): AES T-Table sub-cache-line leakage (CVSS 4.1, wolfSSL)
- [CVE-2024-6672](https://cve.now/CVE-2024-6672.md): WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2024-2502](https://cve.now/CVE-2024-2502.md): Failure to update the tamper reset cause register when a tamper event occurs (CVSS 2.0, silabs.com SE Firmware)
- [CVE-2024-6671](https://cve.now/CVE-2024-6671.md): WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability (CVSS 9.8, Progress Software WhatsUp Gold)
- [CVE-2024-6670](https://cve.now/CVE-2024-6670.md): WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability (CVSS 9.8, KEV, Progress Software WhatsUp Gold)
- [CVE-2024-45302](https://cve.now/CVE-2024-45302.md): CRLF Injection in RestSharp's \`RestRequest.AddHeader\` method (CVSS 6.1, RestSharp)
- [CVE-2024-34018](https://cve.now/CVE-2024-34018.md): Sensitive information disclosure due to insecure folder permissions. (CVSS 5.5, Acronis Snap Deploy)
- [CVE-2024-34017](https://cve.now/CVE-2024-34017.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis Snap Deploy)
- [CVE-2024-34019](https://cve.now/CVE-2024-34019.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis Snap Deploy)
- [CVE-2024-43947](https://cve.now/CVE-2024-43947.md): WordPress WP Armour Extended plugin \<= 1.26 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Dinesh Karki WP Armour Extended)
- [CVE-2024-43920](https://cve.now/CVE-2024-43920.md): WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin \<= 1.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jegstudio Gutenverse)
- [CVE-2024-43921](https://cve.now/CVE-2024-43921.md): WordPress Generate Images – Magic Post Thumbnail plugin \<= 5.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Magic Post Thumbnail)
- [CVE-2024-43926](https://cve.now/CVE-2024-43926.md): WordPress Beaver Builder plugin \<= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, The Beaver Builder Team Beaver Builder)
- [CVE-2024-43934](https://cve.now/CVE-2024-43934.md): WordPress Collapsing Archives plugin \<= 3.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Robert Felty Collapsing Archives)
- [CVE-2024-43935](https://cve.now/CVE-2024-43935.md): WordPress WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin \<= 1.6.7 - Cross Site Scripting (XSS)… (CVSS 6.5, WP Delicious Delicious Recipes – WordPress Recipe Plugin)
- [CVE-2024-43936](https://cve.now/CVE-2024-43936.md): WordPress EmbedPress plugin \<= 4.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper EmbedPress)
- [CVE-2024-43946](https://cve.now/CVE-2024-43946.md): WordPress SKT Blocks plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SKT Themes SKT Blocks – Gutenberg based Page Builder)
- [CVE-2024-43948](https://cve.now/CVE-2024-43948.md): WordPress WP Armour Extended plugin \<= 1.26 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dinesh Karki WP Armour Extended)
- [CVE-2024-43949](https://cve.now/CVE-2024-43949.md): WordPress GHActivity plugin \<= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic GHActivity)
- [CVE-2024-43950](https://cve.now/CVE-2024-43950.md): WordPress Brickscore plugin \<= 1.4.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nextbricks Brickscore)
- [CVE-2024-43951](https://cve.now/CVE-2024-43951.md): WordPress Tempera theme \<= 1.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Tempera)
- [CVE-2024-43952](https://cve.now/CVE-2024-43952.md): WordPress Esotera theme \<= 1.2.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Esotera)
- [CVE-2024-43953](https://cve.now/CVE-2024-43953.md): WordPress Classic Addons – WPBakery Page Builder plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webcodingplace Classic Addons – WPBakery Page Builder)
- [CVE-2024-43958](https://cve.now/CVE-2024-43958.md): WordPress Into The Dark theme \<= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Gianni Porto IntoTheDark)
- [CVE-2024-43960](https://cve.now/CVE-2024-43960.md): WordPress Web and WooCommerce Addons for WPBakery Builder plugin \<= 1.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Page Builder Addons Web and WooCommerce Addons for WPBakery…)
- [CVE-2024-43961](https://cve.now/CVE-2024-43961.md): WordPress azurecurve Toggle Show/Hide plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, azurecurve Toggle Show/Hide)
- [CVE-2024-43963](https://cve.now/CVE-2024-43963.md): WordPress Visual CSS Style Editor plugin \<= 7.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WaspThemes YellowPencil Visual CSS Style Editor)
- [CVE-2024-43964](https://cve.now/CVE-2024-43964.md): WordPress DSGVO All in one for WP plugin \<= 4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Michael Leithold DSGVO All in one for WP)
- [CVE-2024-45056](https://cve.now/CVE-2024-45056.md): \`fold (xor (shl 1, x), -1) -\> (rotl ~1, x)\` misoptimization in zksolc (CVSS 5.9, matter-labs era-compiler-solidity)
- [CVE-2024-45045](https://cve.now/CVE-2024-45045.md): JavaScript Injection via url encoded values in links in Collabora Office Android (CVSS 6.3, CollaboraOnline online)
- [CVE-2024-43804](https://cve.now/CVE-2024-43804.md): OS Command Injection via Port Scan Functionality in Roxy-WI (CVSS 8.8, roxy-wi)
- [CVE-2024-35133](https://cve.now/CVE-2024-35133.md): IBM Security Verify Access HTTP open redirect (CVSS 6.8, IBM Security Verify Access)
- [CVE-2024-41964](https://cve.now/CVE-2024-41964.md): Insufficient permission checks in the language settings in Kirby CMS (CVSS 8.1, getkirby kirby · getkirby/cms)
- [CVE-2024-43965](https://cve.now/CVE-2024-43965.md): WordPress SendGrid for WordPress plugin \<= 1.4 - SQL Injection vulnerability (CVSS 8.2, Smackcoders SendGrid for WordPress)
- [CVE-2024-43957](https://cve.now/CVE-2024-43957.md): WordPress Animated Number Counters plugin \<= 1.9 - Editor+ Limited Local File Inclusion vulnerability (CVSS 6.5, Sk. Abul Hasan Animated Number Counters)
- [CVE-2024-35118](https://cve.now/CVE-2024-35118.md): IBM MaaS360 information disclosure (CVSS 4.6, IBM MaaS360)
- [CVE-2024-43955](https://cve.now/CVE-2024-43955.md): WordPress Droip plugin \<= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability (CVSS 10.0, Themeum Droip)
- [CVE-2024-8255](https://cve.now/CVE-2024-8255.md): Path Traversal in Ocean Data Systems Dream Report (CVSS 8.4, Delta Electronics DTN Soft)
- [CVE-2024-43954](https://cve.now/CVE-2024-43954.md): WordPress Droip plugin \<= 1.1.1 - Subscriber+ Settings Change/Data Exposure Vulnerability (CVSS 6.3, Themeum Droip)
- [CVE-2024-43944](https://cve.now/CVE-2024-43944.md): WordPress Maintenance & Coming Soon Redirect Animation plugin \<= 2.3.3 - Bypass Vulnerability vulnerability (CVSS 3.7, ilyasine Maintenance & Coming Soon Redirect Animation)
- [CVE-2024-43943](https://cve.now/CVE-2024-43943.md): WordPress Greenshift Woocommerce Addon plugin \< 1.9.8 - Subscriber+ SQL Injection vulnerability (CVSS 8.5, Wpsoul Greenshift Woocommerce Addon)
- [CVE-2024-43942](https://cve.now/CVE-2024-43942.md): WordPress Greenshift Query and Meta Addon plugin \< 3.9.2 - Subscriber+ SQL Injection vulnerability (CVSS 8.5, Wpsoul Greenshift Query and Meta Addon)
- [CVE-2024-43941](https://cve.now/CVE-2024-43941.md): WordPress Propovoice Pro plugin \<= 1.7.0.3 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, Propovoice Pro)
- [CVE-2024-43940](https://cve.now/CVE-2024-43940.md): WordPress Z Y N I T H plugin \<= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability (CVSS 6.5, VIICTORY MEDIA Z Y N I T H)
- [CVE-2024-43939](https://cve.now/CVE-2024-43939.md): WordPress Z Y N I T H plugin \<= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerability (CVSS 6.5, VIICTORY MEDIA Z Y N I T H)
- [CVE-2024-43931](https://cve.now/CVE-2024-43931.md): WordPress JobSearch WP Job Board WordPress Plugin plugin \<= 2.5.3 - PHP Object Injection vulnerability (CVSS 9.8, eyecix JobSearch)
- [CVE-2024-43922](https://cve.now/CVE-2024-43922.md): WordPress NitroPack plugin \<= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability (CVSS 4.8, NitroPack)
- [CVE-2024-43918](https://cve.now/CVE-2024-43918.md): WordPress WBW Product Table PRO plugin \<= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability (CVSS 10.0, WBW Product Table PRO)
- [CVE-2024-43917](https://cve.now/CVE-2024-43917.md): WordPress TI WooCommerce Wishlist plugin \<= 2.8.2 - SQL Injection vulnerability (CVSS 9.3, TemplateInvaders TI WooCommerce Wishlist)
- [CVE-2024-43144](https://cve.now/CVE-2024-43144.md): WordPress Cost Calculator Builder plugin \<= 3.2.15 - SQL Injection vulnerability (CVSS 9.3, StylemixThemes Cost Calculator Builder)
- [CVE-2024-43132](https://cve.now/CVE-2024-43132.md): WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin \< 1.7.0 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, WPWeb Elite Docket)
- [CVE-2024-39658](https://cve.now/CVE-2024-39658.md): WordPress Salon Booking System plugin \<= 10.7 - Authenticated SQL Injection vulnerability (CVSS 7.6, Salon booking system)
- [CVE-2024-8304](https://cve.now/CVE-2024-8304.md): jpress Template Module edit path traversal (CVSS 5.1, jpress)
- [CVE-2024-8303](https://cve.now/CVE-2024-8303.md): dingfanzu CMS getBasicInfo.php sql injection (CVSS 5.3, dingfanzu CMS)
- [CVE-2024-39653](https://cve.now/CVE-2024-39653.md): WordPress VikRentCar Car Rental Management System plugin \<= 1.4.0 - SQL Injection vulnerability (CVSS 9.3, E4J s.r.l. VikRentCar)
- [CVE-2024-39638](https://cve.now/CVE-2024-39638.md): WordPress Registrations for the Events Calendar plugin \<= 2.12.2 - SQL Injection vulnerability (CVSS 8.5, Roundup WP Registrations for the Events Calendar)
- [CVE-2024-39622](https://cve.now/CVE-2024-39622.md): WordPress ListingPro theme \<= 2.9.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, CridioStudio ListingPro)
- [CVE-2024-39620](https://cve.now/CVE-2024-39620.md): WordPress ListingPro plugin \<= 2.9.4 - SQL Injection vulnerability (CVSS 8.5, CridioStudio ListingPro)
- [CVE-2024-38795](https://cve.now/CVE-2024-38795.md): WordPress ListingPro plugin \<= 2.9.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, CridioStudio ListingPro)
- [CVE-2024-38793](https://cve.now/CVE-2024-38793.md): WordPress Best Restaurant Menu by Pricelisto plugin \<= 1.4.1 - SQL Injection vulnerability (CVSS 8.5, Best Restaurant Menu by PriceListo)
- [CVE-2024-38693](https://cve.now/CVE-2024-38693.md): WordPress WP User Frontend plugin \<= 4.0.7 - SQL Injection vulnerability (CVSS 7.6, weDevs WP User Frontend)
- [CVE-2024-5057](https://cve.now/CVE-2024-5057.md): WordPress Easy Digital Downloads plugin \<= 3.2.12 - SQL Injection vulnerability (CVSS 9.3, Easy Digital Downloads)
- [CVE-2024-8302](https://cve.now/CVE-2024-8302.md): dingfanzu CMS chpwd.php sql injection (CVSS 5.3, dingfanzu CMS)
- [CVE-2024-1056](https://cve.now/CVE-2024-1056.md): Funnel Kit Funnel Builder PRO \<= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow\_iframe\_tag\_in\_post (CVSS 6.4, FunnelKit Funnel Builder Pro)
- [CVE-2024-8301](https://cve.now/CVE-2024-8301.md): dingfanzu CMS checkin.php sql injection (CVSS 6.9, dingfanzu CMS)
- [CVE-2024-8297](https://cve.now/CVE-2024-8297.md): kitsada8621 Digital Library Management System jwt\_refresh\_token\_middleware.go JwtRefreshAuth neutralization for logs (CVSS 6.9, kitsada8621 Digital Library Management System)
- [CVE-2024-3679](https://cve.now/CVE-2024-3679.md): Premium SEO Pack – WP SEO Plugin \<= 1.6.002 - Unauthenticated Information Exposure (CVSS 5.3, calinvingan Premium SEO Pack – WP SEO Plugin)
- [CVE-2024-1384](https://cve.now/CVE-2024-1384.md): Premium Portfolio Features for Phlox theme \<= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, averta Premium Portfolio Features for Phlox theme)
- [CVE-2024-8296](https://cve.now/CVE-2024-8296.md): FeehiCMS index.php insert unrestricted upload (CVSS 5.3, FeehiCMS · feehi/cms)
- [CVE-2024-2541](https://cve.now/CVE-2024-2541.md): Popup Builder \<= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File (CVSS 5.3, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2024-8295](https://cve.now/CVE-2024-8295.md): FeehiCMS index.php createBanner unrestricted upload (CVSS 5.3, FeehiCMS · feehi/cms)
- [CVE-2024-8294](https://cve.now/CVE-2024-8294.md): FeehiCMS index.php update unrestricted upload (CVSS 5.3, FeehiCMS · feehi/cms)
- [CVE-2024-7895](https://cve.now/CVE-2024-7895.md): Beaver Builder (Lite Version) \<= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-6551](https://cve.now/CVE-2024-6551.md): GiveWP \<= 3.15.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-29723](https://cve.now/CVE-2024-29723.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29724](https://cve.now/CVE-2024-29724.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29725](https://cve.now/CVE-2024-29725.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29726](https://cve.now/CVE-2024-29726.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29727](https://cve.now/CVE-2024-29727.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29728](https://cve.now/CVE-2024-29728.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29729](https://cve.now/CVE-2024-29729.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29730](https://cve.now/CVE-2024-29730.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29731](https://cve.now/CVE-2024-29731.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2021-4442](https://cve.now/CVE-2021-4442.md): tcp: add sanity tests to TCP\_QUEUE\_SEQ (no CVSS, Linux)
- [CVE-2024-43986](https://cve.now/CVE-2024-43986.md): WordPress E-cab taxi booking manager plugin \<=1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, MagePeople Team Taxi Booking Manager for WooCommerce)
- [CVE-2024-5624](https://cve.now/CVE-2024-5624.md): Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL (CVSS 5.1, B&R Industrial Automation B&R APROL)
- [CVE-2024-5623](https://cve.now/CVE-2024-5623.md): Untrusted search path vulnerability in B&R APROL (CVSS 5.4, B&R Industrial Automation B&R APROL)
- [CVE-2024-5622](https://cve.now/CVE-2024-5622.md): Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL (CVSS 7.3, B&R Industrial Automation B&R APROL)
- [CVE-2024-38304](https://cve.now/CVE-2024-38304.md): Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. (CVSS 3.8, Dell PowerEdge Platform)
- [CVE-2024-4428](https://cve.now/CVE-2024-4428.md): Sensetive Data Exposure in Menulux Managment Portal (CVSS 6.9, Menulux Information Technologies Managment Portal)
- [CVE-2024-43700](https://cve.now/CVE-2024-43700.md): xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer… (CVSS 7.0, Philip Hazel xfpt)
- [CVE-2024-7132](https://cve.now/CVE-2024-7132.md): CoBlocks \< 3.1.13 - Editor+ Stored XSS (CVSS 4.8, Page Builder Gutenberg Blocks)
- [CVE-2024-6927](https://cve.now/CVE-2024-6927.md): Viral Signup \<= 2.1 - Admin+ Stored XSS (CVSS 4.8, Viral Signup)
- [CVE-2024-5417](https://cve.now/CVE-2024-5417.md): Gutentor \< 3.3.6 - Contributor+ Stored XSS (CVSS 5.4, Gutentor)
- [CVE-2024-7607](https://cve.now/CVE-2024-7607.md): Front End Users \<= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection (CVSS 8.8, rustaurius Front End Users)
- [CVE-2024-5987](https://cve.now/CVE-2024-5987.md): WP Accessibility Helper \<= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 5.4, vol4ikman WP Accessibility Helper)
- [CVE-2024-3944](https://cve.now/CVE-2024-3944.md): WP To Do \<= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments (CVSS 4.4, delower186 WP To Do)
- [CVE-2024-7606](https://cve.now/CVE-2024-7606.md): Front End Users \<= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, rustaurius Front End Users)
- [CVE-2024-38303](https://cve.now/CVE-2024-38303.md): Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. (CVSS 5.3, Dell PowerEdge Platform)
- [CVE-2024-7418](https://cve.now/CVE-2024-7418.md): The Post Grid \<= 7.7.11 - Authenticated (Contributor+) Information Disclosure (CVSS 4.3, techlabpro1 The Post Grid – Shortcode, Gutenberg Blocks and…)
- [CVE-2024-7856](https://cve.now/CVE-2024-7856.md): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar \<= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+)… (CVSS 8.1, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2022-2440](https://cve.now/CVE-2022-2440.md): Theme Editor \<= 2.8 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2, mndpsingh287 Theme Editor)
- [CVE-2024-5857](https://cve.now/CVE-2024-5857.md): Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free \<= 3.7.3.2 - Missing Authorization to… (CVSS 5.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2024-41918](https://cve.now/CVE-2024-41918.md): 'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper… (CVSS 3.1, Rakuten Group 'Rakuten Ichiba App' for Android · Rakuten Gr…)
- [CVE-2024-7857](https://cve.now/CVE-2024-7857.md): Media Library Folders \<= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection (CVSS 6.5, maxfoundry Media Library Folders)
- [CVE-2024-41345](https://cve.now/CVE-2024-41345.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php (CVSS 6.1)
- [CVE-2024-41346](https://cve.now/CVE-2024-41346.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php (CVSS 6.1)
- [CVE-2024-41347](https://cve.now/CVE-2024-41347.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php (CVSS 6.1)
- [CVE-2024-41348](https://cve.now/CVE-2024-41348.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php (CVSS 6.1)
- [CVE-2024-41349](https://cve.now/CVE-2024-41349.md): unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add\_by\_url.php. (CVSS 6.1)
- [CVE-2024-41350](https://cve.now/CVE-2024-41350.md): bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1\_2\_3/php/imageUp.php (CVSS 6.1)
- [CVE-2024-41351](https://cve.now/CVE-2024-41351.md): bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1\_2\_3/php/getContent.php (CVSS 6.1)
- [CVE-2024-41358](https://cve.now/CVE-2024-41358.md): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\\admin\\import-export\\import-load-data.php. (CVSS 6.1)
- [CVE-2024-41361](https://cve.now/CVE-2024-41361.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\manageFilesFolders.php (CVSS 9.8)
- [CVE-2024-41364](https://cve.now/CVE-2024-41364.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\trackEdit.php (CVSS 9.8)
- [CVE-2024-41366](https://cve.now/CVE-2024-41366.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\userScripts.php (CVSS 9.8)
- [CVE-2024-41367](https://cve.now/CVE-2024-41367.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via… (CVSS 9.8)
- [CVE-2024-41368](https://cve.now/CVE-2024-41368.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\inc.setWlanIpMail.php (CVSS 9.8)
- [CVE-2024-41369](https://cve.now/CVE-2024-41369.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\inc.setWifi.php (CVSS 9.8)
- [CVE-2024-41370](https://cve.now/CVE-2024-41370.md): Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php. (CVSS 9.8)
- [CVE-2024-41371](https://cve.now/CVE-2024-41371.md): Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php. (CVSS 6.1)
- [CVE-2024-41372](https://cve.now/CVE-2024-41372.md): Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php. (CVSS 9.8)
- [CVE-2024-44716](https://cve.now/CVE-2024-44716.md): A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted… (CVSS 6.1)
- [CVE-2024-44717](https://cve.now/CVE-2024-44717.md): A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted… (CVSS 6.1)
- [CVE-2024-44776](https://cve.now/CVE-2024-44776.md): An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a… (CVSS 6.1)
- [CVE-2024-44777](https://cve.now/CVE-2024-44777.md): A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to… (CVSS 7.4)
- [CVE-2024-44778](https://cve.now/CVE-2024-44778.md): A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to… (CVSS 7.4)
- [CVE-2024-44779](https://cve.now/CVE-2024-44779.md): A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to… (CVSS 7.4)
- [CVE-2024-44919](https://cve.now/CVE-2024-44919.md): A cross-site scripting (XSS) vulnerability in the component admin\_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web… (CVSS 5.4)
- [CVE-2024-44930](https://cve.now/CVE-2024-44930.md): Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses… (CVSS 6.5, Serilog.Enrichers.ClientInfo)
- [CVE-2024-45435](https://cve.now/CVE-2024-45435.md): Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. (CVSS 9.8)
- [CVE-2024-45436](https://cve.now/CVE-2024-45436.md): extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory. (CVSS 9.1, github.com/ollama/ollama)
- [CVE-2024-45440](https://cve.now/CVE-2024-45440.md): core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash\_salt is… (CVSS 5.3, Drupal core · drupal/drupal +2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.