CVEs published August 1, 2024
129 CVEs were published on August 1, 2024: 7 critical, 38 high.
- Published
- 129
- Critical
- 7
- High
- 38
- Medium
- 77
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- SourceCodester Tracking Monitoring Management System
- 8
- Johnson Controls exacqVision
- 6
- SourceCodester Simple Realtime Quiz System
- 6
- Dell iDRAC Service Module
- 5
- Mattermost · github.com/mattermost/mattermost-server +3
- 5
- CridioStudio ListingPro
- 3
- Google Chrome
- 3
- TOTOLINK EX1200L
- 3
- WooCommerce Customers Manager
- 3
- Baidu UEditor
- 2
Critical 7
- CVE-2024-32758exacqVision - Key exchangesJohnson Controls exacqVision
- CVE-2024-7093Server-Side Template Injection in Dispatch Message TemplatesNetflix Dispatch
- CVE-2024-38770WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.20 - Authentication Bypass and Privilege Escalation VulnerabilityRevmakx Backup and Staging by WP Time Capsule
- CVE-2024-39619WordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerabilityCridioStudio ListingPro
- CVE-2024-41961Elektra vulnerable to remote code execution in universal searchsapcc elektra
- CVE-2024-7332TOTOLINK CP450 Telnet Service product.ini hard-coded passwordTOTOLINK CP450
- CVE-2024-41259Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account informationgithub.com/navidrome/navidrome
High 38
- CVE-2024-39631WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2024-39646WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityKunal Custom 404 Pro
- CVE-2024-39647WordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerabilityKofi Mokome Message Filter for Contact Form
- CVE-2024-41956Soft Serve allows arbitrary code execution by crafting git-lfs requestscharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2024-39652WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerabilityWPWeb Elite WooCommerce PDF Vouchers
- CVE-2024-39656WordPress Tin Canny Reporting for LearnDash plugin <= 4.3.0.7 - Reflected Cross Site Scripting (XSS) vulnerabilityUncanny Owl Tin Canny Reporting for LearnDash
- CVE-2024-39663WordPress WP Fast Total Search plugin <= 1.68.232 - Cross Site Scripting (XSS) vulnerabilityEpsiloncool WP Fast Total Search
- CVE-2024-38761WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerabilityDylan James Zephyr Project Manager
- CVE-2024-39636WordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerabilityCodeSolz Better Find and Replace
- CVE-2023-52209WordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerabilityWPForms, LLC. WPForms User Registration
- CVE-2024-38746WordPress MakeStories (for Google Web Stories) plugin <= 3.0.3 - Arbitrary File Download and SSRF vulnerabilityMakeStories Team MakeStories
- CVE-2024-38775WordPress CTX Feed plugin <= 6.5.6 - Arbitrary Options Update vulnerabilityWebAppick CTX Feed
- CVE-2024-39621WordPress ListingPro plugin <= 2.9.4 - Local File Inclusion vulnerabilityCridioStudio ListingPro
- CVE-2024-39624WordPress ListingPro theme <= 2.9.4 - Local File Inclusion vulnerabilityCridioStudio ListingPro
- CVE-2024-39633WordPress PowerPack for Beaver Builder plugin <= 2.33.0 - Contributor+ Privilege Escalation vulnerabilityIdeaBox PowerPack for Beaver Builder
- CVE-2024-39634WordPress PowerPack Pro for Elementor plugin <= 2.10.14 - Contributor+ Privilege Escalation vulnerabilityIdeaBox PowerPack Pro for Elementor
- CVE-2024-7256Insufficient data validation in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to execute arbitrary code Google Chrome
- CVE-2024-7255Out of bounds read in WebTransport in Google Chrome prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds meGoogle Chrome
- CVE-2024-6990Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds Google Chrome
- CVE-2024-6873Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution.ClickHouse
- CVE-2024-6242Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix DevicesRockwell Automation ControlLogix® · Rockwell Automation… +6
- CVE-2024-39777Malicious remote can invite itself to an arbitrary local channelMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-39274Malicious remote can add users to arbitrary teams and channelsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-36492Existing local user overwritten by malicious remoteMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-7358Point B Ltd Getscreen Agent Installation getscreen.msi temp filePoint B Getscreen Agent
- CVE-2024-6529Ultimate Classified Listings < 1.4 - Reflected XSSUltimate Classified Listings
- CVE-2024-3983WooCommerce Customers Manager < 30.1 - Bulk Action via CSRFWooCommerce Customers Manager
- CVE-2024-7338TOTOLINK EX1200L cstecgi.cgi setParentalRules buffer overflowTOTOLINK EX1200L
- CVE-2024-6698FundEngine – Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalationroxnor FundEngine – Donation and Crowdfunding Platform
- CVE-2024-7337TOTOLINK EX1200L cstecgi.cgi loginauth buffer overflowTOTOLINK EX1200L
- CVE-2024-7336TOTOLINK EX200 cstecgi.cgi loginauth buffer overflowTOTOLINK EX200
- CVE-2024-7335TOTOLINK EX200 getSaveConfig buffer overflowTOTOLINK EX200
- CVE-2024-7334TOTOLINK EX1200L cstecgi.cgi UploadCustomModule buffer overflowTOTOLINK EX1200L
- CVE-2024-7333TOTOLINK N350RT cstecgi.cgi setParentalRules buffer overflowTOTOLINK N350RT
- CVE-2024-7331TOTOLINK A3300R cstecgi.cgi UploadCustomModule buffer overflowTOTOLINK A3300R
- CVE-2024-41260A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtagithub.com/netbirdio/netbird
- CVE-2024-41264An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.github.com/casdoor/casdoor
- CVE-2024-41265A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequegithub.com/cortexproject/cortex · github.com/cortexlabs/cor…
Medium, low and unrated 84
- CVE-2024-7372SourceCodester Simple Realtime Quiz System quiz_board.php sql injectionSourceCodester Simple Realtime Quiz System
- CVE-2024-7371SourceCodester Simple Realtime Quiz System quiz_view.php sql injectionSourceCodester Simple Realtime Quiz System
- CVE-2024-39626WordPress Pretty Simple Popup Builder plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilityRob @ 5 Star Plugins Pretty Simple Popup Builder
- CVE-2024-7370SourceCodester Simple Realtime Quiz System manage_quiz.php sql injectionSourceCodester Simple Realtime Quiz System
- CVE-2024-39627WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) vulnerabilityImagely NextGEN Gallery
- CVE-2024-39629WordPress Himalayas theme <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityThemeGrill Himalayas
- CVE-2024-39643WordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerabilityRegistrationMagic Forms RegistrationMagic
- CVE-2024-39644WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityModernaweb Studio Black Widgets For Elementor
- CVE-2024-41948biscuit-java vulnerable to public key confusion in third party blockbiscuit-auth biscuit-java · org.biscuitsec:biscuit
- CVE-2024-41949biscuit-rust vulnerable to public key confusion in third party blockbiscuit-auth biscuit-rust · biscuit-auth
- CVE-2024-7369SourceCodester Simple Realtime Quiz System Login ajax.php sql injectionSourceCodester Simple Realtime Quiz System
- CVE-2024-32862exacqVision CORSJohnson Controls exacqVision
- CVE-2024-39648WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityThemewinter Eventin
- CVE-2024-39649WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2024-39655WordPress LiquidPoll plugin <= 3.3.77 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityLiquidPoll – Advanced Polls for Creators and Brands
- CVE-2024-39659WordPress WP-PostRatings plugin <= 1.91.1 - Cross Site Scripting (XSS) vulnerabilityLester ‘GaMerZ’ Chan WP-PostRatings
- CVE-2024-41965Vim < v9.1.0648 has a double-free in dialog_changed()vim
- CVE-2024-39660WordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.3.1 - Cross Site Scripting (XSS) vulnerabilityJordy Meow Photo Engine
- CVE-2024-41957Vim double free in src/alloc.c:616vim
- CVE-2024-39661WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerabilityExtendThemes Kubio AI Page Builder
- CVE-2024-39662WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityModernaweb Studio Black Widgets For Elementor
- CVE-2024-39665WordPress Filter & Grids plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerabilityYMC Filter & Grids
- CVE-2024-39667WordPress Element Pack Elementor Addons plugin <= 5.6.11 - Cross Site Scripting (XSS) vulnerabilityBdThemes Element Pack Elementor Addons
- CVE-2024-39668WordPress Extensions for Elementor plugin <= 2.0.31 - Cross Site Scripting (XSS) vulnerabilitypetesheppard84 Extensions for Elementor
- CVE-2024-7368SourceCodester Simple Realtime Quiz System ajax.php cross site scriptingSourceCodester Simple Realtime Quiz System
- CVE-2024-39637WordPress Edubin theme <= 9.2.0 - Server Side Request Forgery (SSRF) vulnerabilitypixelcurve Edubin
- CVE-2024-32931exacqVison - Token Disclosed in URLJohnson Controls exacqVision
- CVE-2024-32865exacqVison - TLS certificate validationJohnson Controls exacqVision
- CVE-2024-32864exacqVison - HTTPS Session EstablishmentJohnson Controls exacqVision
- CVE-2024-7367SourceCodester Simple Realtime Quiz System ajax.php cross-site request forgerySourceCodester Simple Realtime Quiz System
- CVE-2024-32863exacqVison - CSRF issues with Web ServiceJohnson Controls exacqVision
- CVE-2024-38768WordPress The Pack Elementor addons plugin <= 2.0.8.6 - Local File Inclusion vulnerabilityWebangon The Pack Elementor addons
- CVE-2024-38772WordPress JetWidgets for Elementor and WooCommerce plugin <= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerabilityCrocoblock JetWidgets for Elementor and WooCommerce
- CVE-2024-38791WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerabilityJordy Meow AI Engine: ChatGPT Chatbot
- CVE-2024-39630WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerabilityMotoPress Timetable and Event Schedule
- CVE-2024-7366SourceCodester Tracking Monitoring Management System Login ajax.php sql injectionSourceCodester Tracking Monitoring Management System
- CVE-2024-7365SourceCodester Tracking Monitoring Management System manage_establishment.php sql injectionSourceCodester Tracking Monitoring Management System
- CVE-2024-7364SourceCodester Tracking Monitoring Management System manage_records.php sql injectionSourceCodester Tracking Monitoring Management System
- CVE-2024-7363SourceCodester Tracking Monitoring Management System manage_person.php sql injectionSourceCodester Tracking Monitoring Management System
- CVE-2024-7362SourceCodester Tracking Monitoring Management System manage_user.php sql injectionSourceCodester Tracking Monitoring Management System
- CVE-2024-4353Stored XSS in Generate Board Name Input FieldConcrete CMS · concrete5/concrete5
- CVE-2024-7361SourceCodester Tracking Monitoring Management System ajax.php sql injectionSourceCodester Tracking Monitoring Management System
- CVE-2024-7360SourceCodester Tracking Monitoring Management System ajax.php cross-site request forgerySourceCodester Tracking Monitoring Management System
- CVE-2024-23600PingIDM Query Filter VulnerabilityPing Identity PingIDM
- CVE-2024-7211The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites.1E Platform
- CVE-2024-7359SourceCodester Tracking Monitoring Management System ajax.php cross site scriptingSourceCodester Tracking Monitoring Management System
- CVE-2024-41962Bostr Improper AuthorizationYonle bostr · bostr
- CVE-2024-6040Missing client_id in parisneo/lollms-webuiparisneo/lollms
- CVE-2024-41946REXML DoS vulnerabilityruby rexml · rexml
- CVE-2024-41123REXML DoS vulnerabilityruby rexml · rexml
- CVE-2024-41926Malicious remote can claim that a user was synced from another remoteMattermost · github.com/mattermost/mattermost-server +4
- CVE-2024-41162Malicious remote can make an arbitrary local channel read-onlyMattermost · github.com/mattermost/mattermost/server/v8 +4
- CVE-2024-41144Malicious remote can create/update/delete arbitrary posts in arbitrary channelsMattermost · github.com/mattermost/mattermost/server/v8 +4
- CVE-2024-39839Remote username set to an arbitrary string by remote userMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-39837Malicious remote can create arbitrary channelsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-39832Permanently local data deletion by malicious remoteMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-29977Malicious remote can create arbitrary reactions on arbitrary postsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-6923Email header injection due to unquoted newlinesPython Software Foundation CPython
- CVE-2024-7357D-Link DIR-600 soap.cgi soapcgi_main os command injectionD-Link DIR-600
- CVE-2024-2455Element Pack - Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URLBDThemes Element Pack Pro - Addon for Elementor Page Builde…
- CVE-2024-6346Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widgetpickplugins Post Grid
- CVE-2024-28972Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability.Dell InsightIQ
- CVE-2024-38481Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability.Dell iDRAC Service Module
- CVE-2024-38490Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability.Dell iDRAC Service Module
- CVE-2024-38489Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability.Dell iDRAC Service Module
- CVE-2024-25948Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability.Dell iDRAC Service Module
- CVE-2024-25947Dell iDRAC Service Module version 5.3.0.0 and prior, contain an Out of bound Read Vulnerability.Dell iDRAC Service Module
- CVE-2024-5678SQL InjectionManageEngine Applications Manager
- CVE-2024-5331Breakdance <= 1.7.2 - Missing AuthorizationBreakdance
- CVE-2024-5330Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingBreakdance
- CVE-2024-7302Blog2Social: Social Media Auto Post & Scheduler <= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Uploadpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2024-6496Light Poll <= 1.0.0 - Polls Deletion via CSRFLight Poll
- CVE-2024-4090My Sticky Bar < 2.7.2 - Admin+ Stored XSSFloating Notification Bar, Sticky Menu on Scroll, Announcem…
- CVE-2024-2872Swift Framework < 2024.04.30 - Contributor+ Stored XSSsocialdriver-framework
- CVE-2024-2843WooCommerce Customers Manager < 30.1 - User Deletion via CSRFWooCommerce Customers Manager
- CVE-2024-1747WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSSWooCommerce Customers Manager
- CVE-2024-7343Baidu UEditor cross site scriptingBaidu UEditor
- CVE-2024-7342Baidu UEditor unrestricted uploadBaidu UEditor
- CVE-2024-2090Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Server-Side Request Forgerydoublesharp Remote Content Shortcode
- CVE-2024-7339TVT DVR TD-2104TS-CL queryDevInfo information disclosureTVT DVR TD-2104TS-CL · TVT DVR TD-2108TS-HP +2
- CVE-2024-6687CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directorylimpinho CTT Expresso para WooCommerce
- CVE-2024-40883Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers.ELECOM CO. WRC-X1500GS-B · ELECOM CO. WRC-X1500GSA-B +13
- CVE-2024-39607OS command injection vulnerability exists in ELECOM wireless LAN routers.ELECOM CO. WRC-X1500GS-B · ELECOM CO. WRC-X1500GSA-B +13
- CVE-2024-34021Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers.ELECOM CO. WRC-1167GST2 · ELECOM CO. WRC-2533GS2V-B +9