# CVEs published 2024-08-01

129 CVEs were published on August 1, 2024: 7 critical, 38 high. Days are UTC.

- [CVE-2024-7372](https://cve.now/CVE-2024-7372.md): SourceCodester Simple Realtime Quiz System quiz\_board.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-7371](https://cve.now/CVE-2024-7371.md): SourceCodester Simple Realtime Quiz System quiz\_view.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-39626](https://cve.now/CVE-2024-39626.md): WordPress Pretty Simple Popup Builder plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Rob @ 5 Star Plugins Pretty Simple Popup Builder)
- [CVE-2024-7370](https://cve.now/CVE-2024-7370.md): SourceCodester Simple Realtime Quiz System manage\_quiz.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-39627](https://cve.now/CVE-2024-39627.md): WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin \<= 3.59.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Imagely NextGEN Gallery)
- [CVE-2024-39629](https://cve.now/CVE-2024-39629.md): WordPress Himalayas theme \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ThemeGrill Himalayas)
- [CVE-2024-39631](https://cve.now/CVE-2024-39631.md): WordPress Contest Gallery plugin \<= 23.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2024-39643](https://cve.now/CVE-2024-39643.md): WordPress RegistrationMagic plugin \<= 6.0.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.8, RegistrationMagic Forms RegistrationMagic)
- [CVE-2024-39644](https://cve.now/CVE-2024-39644.md): WordPress Black Widgets For Elementor plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Modernaweb Studio Black Widgets For Elementor)
- [CVE-2024-39646](https://cve.now/CVE-2024-39646.md): WordPress Custom 404 Pro plugin \<= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kunal Custom 404 Pro)
- [CVE-2024-39647](https://cve.now/CVE-2024-39647.md): WordPress Message Filter for Contact Form 7 plugin \<= 1.6.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kofi Mokome Message Filter for Contact Form)
- [CVE-2024-41956](https://cve.now/CVE-2024-41956.md): Soft Serve allows arbitrary code execution by crafting git-lfs requests (CVSS 8.1, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2024-41948](https://cve.now/CVE-2024-41948.md): biscuit-java vulnerable to public key confusion in third party block (CVSS 3.0, biscuit-auth biscuit-java · org.biscuitsec:biscuit)
- [CVE-2024-41949](https://cve.now/CVE-2024-41949.md): biscuit-rust vulnerable to public key confusion in third party block (CVSS 3.0, biscuit-auth biscuit-rust · biscuit-auth)
- [CVE-2024-7369](https://cve.now/CVE-2024-7369.md): SourceCodester Simple Realtime Quiz System Login ajax.php sql injection (CVSS 6.9, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-32862](https://cve.now/CVE-2024-32862.md): exacqVision CORS (CVSS 6.8, Johnson Controls exacqVision)
- [CVE-2024-39648](https://cve.now/CVE-2024-39648.md): WordPress Eventin plugin \<= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Themewinter Eventin)
- [CVE-2024-39649](https://cve.now/CVE-2024-39649.md): WordPress Essential Addons for Elementor plugin \<= 5.9.26 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper Essential Addons for Elementor)
- [CVE-2024-39652](https://cve.now/CVE-2024-39652.md): WordPress WooCommerce PDF Vouchers plugin \< 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPWeb Elite WooCommerce PDF Vouchers)
- [CVE-2024-32758](https://cve.now/CVE-2024-32758.md): exacqVision - Key exchanges (CVSS 9.0, Johnson Controls exacqVision)
- [CVE-2024-39655](https://cve.now/CVE-2024-39655.md): WordPress LiquidPoll plugin \<= 3.3.77 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LiquidPoll – Advanced Polls for Creators and Brands)
- [CVE-2024-39656](https://cve.now/CVE-2024-39656.md): WordPress Tin Canny Reporting for LearnDash plugin \<= 4.3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Uncanny Owl Tin Canny Reporting for LearnDash)
- [CVE-2024-39659](https://cve.now/CVE-2024-39659.md): WordPress WP-PostRatings plugin \<= 1.91.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Lester ‘GaMerZ’ Chan WP-PostRatings)
- [CVE-2024-41965](https://cve.now/CVE-2024-41965.md): Vim \< v9.1.0648 has a double-free in dialog\_changed() (CVSS 4.2, vim)
- [CVE-2024-39660](https://cve.now/CVE-2024-39660.md): WordPress Photo Engine (Media Organizer & Lightroom) plugin \<= 6.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Jordy Meow Photo Engine)
- [CVE-2024-41957](https://cve.now/CVE-2024-41957.md): Vim double free in src/alloc.c:616 (CVSS 4.5, vim)
- [CVE-2024-39661](https://cve.now/CVE-2024-39661.md): WordPress Kubio AI Page Builder plugin \<= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ExtendThemes Kubio AI Page Builder)
- [CVE-2024-39662](https://cve.now/CVE-2024-39662.md): WordPress Black Widgets For Elementor plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Modernaweb Studio Black Widgets For Elementor)
- [CVE-2024-39663](https://cve.now/CVE-2024-39663.md): WordPress WP Fast Total Search plugin \<= 1.68.232 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Epsiloncool WP Fast Total Search)
- [CVE-2024-39665](https://cve.now/CVE-2024-39665.md): WordPress Filter & Grids plugin \<= 2.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, YMC Filter & Grids)
- [CVE-2024-39667](https://cve.now/CVE-2024-39667.md): WordPress Element Pack Elementor Addons plugin \<= 5.6.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Element Pack Elementor Addons)
- [CVE-2024-39668](https://cve.now/CVE-2024-39668.md): WordPress Extensions for Elementor plugin \<= 2.0.31 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, petesheppard84 Extensions for Elementor)
- [CVE-2024-7368](https://cve.now/CVE-2024-7368.md): SourceCodester Simple Realtime Quiz System ajax.php cross site scripting (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-38761](https://cve.now/CVE-2024-38761.md): WordPress Zephyr Project Manager plugin \<= 3.3.99 - Sensitive Data Exposure via Export File vulnerability (CVSS 7.5, Dylan James Zephyr Project Manager)
- [CVE-2024-39636](https://cve.now/CVE-2024-39636.md): WordPress Better Find and Replace plugin \<= 1.6.1 - PHP Object Injection vulnerability (CVSS 8.3, CodeSolz Better Find and Replace)
- [CVE-2024-39637](https://cve.now/CVE-2024-39637.md): WordPress Edubin theme \<= 9.2.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, pixelcurve Edubin)
- [CVE-2024-32931](https://cve.now/CVE-2024-32931.md): exacqVison - Token Disclosed in URL (CVSS 5.7, Johnson Controls exacqVision)
- [CVE-2024-32865](https://cve.now/CVE-2024-32865.md): exacqVison - TLS certificate validation (CVSS 6.4, Johnson Controls exacqVision)
- [CVE-2024-32864](https://cve.now/CVE-2024-32864.md): exacqVison - HTTPS Session Establishment (CVSS 6.4, Johnson Controls exacqVision)
- [CVE-2024-7093](https://cve.now/CVE-2024-7093.md): Server-Side Template Injection in Dispatch Message Templates (CVSS 9.4, Netflix Dispatch)
- [CVE-2023-52209](https://cve.now/CVE-2023-52209.md): WordPress WPForms User Registration plugin \<= 2.1.0 - Authenticated Privilege Escalation vulnerability (CVSS 8.0, WPForms, LLC. WPForms User Registration)
- [CVE-2024-38746](https://cve.now/CVE-2024-38746.md): WordPress MakeStories (for Google Web Stories) plugin \<= 3.0.3 - Arbitrary File Download and SSRF vulnerability (CVSS 7.1, MakeStories Team MakeStories)
- [CVE-2024-7367](https://cve.now/CVE-2024-7367.md): SourceCodester Simple Realtime Quiz System ajax.php cross-site request forgery (CVSS 6.9, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-32863](https://cve.now/CVE-2024-32863.md): exacqVison - CSRF issues with Web Service (CVSS 6.8, Johnson Controls exacqVision)
- [CVE-2024-38768](https://cve.now/CVE-2024-38768.md): WordPress The Pack Elementor addons plugin \<= 2.0.8.6 - Local File Inclusion vulnerability (CVSS 4.3, Webangon The Pack Elementor addons)
- [CVE-2024-38770](https://cve.now/CVE-2024-38770.md): WordPress Backup and Staging by WP Time Capsule plugin \<= 1.22.20 - Authentication Bypass and Privilege Escalation Vulnerability (CVSS 9.8, Revmakx Backup and Staging by WP Time Capsule)
- [CVE-2024-38772](https://cve.now/CVE-2024-38772.md): WordPress JetWidgets for Elementor and WooCommerce plugin \<= 1.1.7 - Contributor+ Limited Local File Inclusion vulnerability (CVSS 6.5, Crocoblock JetWidgets for Elementor and WooCommerce)
- [CVE-2024-38775](https://cve.now/CVE-2024-38775.md): WordPress CTX Feed plugin \<= 6.5.6 - Arbitrary Options Update vulnerability (CVSS 7.2, WebAppick CTX Feed)
- [CVE-2024-38791](https://cve.now/CVE-2024-38791.md): WordPress AI ENGINE plugin \<= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Jordy Meow AI Engine: ChatGPT Chatbot)
- [CVE-2024-39619](https://cve.now/CVE-2024-39619.md): WordPress ListingPro plugin \<= 2.9.4 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, CridioStudio ListingPro)
- [CVE-2024-39621](https://cve.now/CVE-2024-39621.md): WordPress ListingPro plugin \<= 2.9.4 - Local File Inclusion vulnerability (CVSS 8.0, CridioStudio ListingPro)
- [CVE-2024-39624](https://cve.now/CVE-2024-39624.md): WordPress ListingPro theme \<= 2.9.4 - Local File Inclusion vulnerability (CVSS 8.5, CridioStudio ListingPro)
- [CVE-2024-39630](https://cve.now/CVE-2024-39630.md): WordPress Timetable and Event Schedule by MotoPress plugin \<= 2.4.13 - PHP Object Injection vulnerability (CVSS 5.5, MotoPress Timetable and Event Schedule)
- [CVE-2024-39633](https://cve.now/CVE-2024-39633.md): WordPress PowerPack for Beaver Builder plugin \<= 2.33.0 - Contributor+ Privilege Escalation vulnerability (CVSS 8.8, IdeaBox PowerPack for Beaver Builder)
- [CVE-2024-39634](https://cve.now/CVE-2024-39634.md): WordPress PowerPack Pro for Elementor plugin \<= 2.10.14 - Contributor+ Privilege Escalation vulnerability (CVSS 8.8, IdeaBox PowerPack Pro for Elementor)
- [CVE-2024-7366](https://cve.now/CVE-2024-7366.md): SourceCodester Tracking Monitoring Management System Login ajax.php sql injection (CVSS 6.9, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-7365](https://cve.now/CVE-2024-7365.md): SourceCodester Tracking Monitoring Management System manage\_establishment.php sql injection (CVSS 5.3, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-7364](https://cve.now/CVE-2024-7364.md): SourceCodester Tracking Monitoring Management System manage\_records.php sql injection (CVSS 5.3, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-7363](https://cve.now/CVE-2024-7363.md): SourceCodester Tracking Monitoring Management System manage\_person.php sql injection (CVSS 5.3, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-7362](https://cve.now/CVE-2024-7362.md): SourceCodester Tracking Monitoring Management System manage\_user.php sql injection (CVSS 5.3, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-4353](https://cve.now/CVE-2024-4353.md): Stored XSS in Generate Board Name Input Field (CVSS 4.6, Concrete CMS · concrete5/concrete5)
- [CVE-2024-7256](https://cve.now/CVE-2024-7256.md): Insufficient data validation in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to execute arbitrary code (CVSS 8.8, Google Chrome)
- [CVE-2024-7255](https://cve.now/CVE-2024-7255.md): Out of bounds read in WebTransport in Google Chrome prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds me (CVSS 8.8, Google Chrome)
- [CVE-2024-6990](https://cve.now/CVE-2024-6990.md): Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds (CVSS 8.8, Google Chrome)
- [CVE-2024-7361](https://cve.now/CVE-2024-7361.md): SourceCodester Tracking Monitoring Management System ajax.php sql injection (CVSS 5.3, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-7360](https://cve.now/CVE-2024-7360.md): SourceCodester Tracking Monitoring Management System ajax.php cross-site request forgery (CVSS 6.9, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-23600](https://cve.now/CVE-2024-23600.md): PingIDM Query Filter Vulnerability (CVSS 2.7, Ping Identity PingIDM)
- [CVE-2024-7211](https://cve.now/CVE-2024-7211.md): The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites. (CVSS 4.7, 1E Platform)
- [CVE-2024-7359](https://cve.now/CVE-2024-7359.md): SourceCodester Tracking Monitoring Management System ajax.php cross site scripting (CVSS 5.3, SourceCodester Tracking Monitoring Management System)
- [CVE-2024-41962](https://cve.now/CVE-2024-41962.md): Bostr Improper Authorization (CVSS 4.6, Yonle bostr · bostr)
- [CVE-2024-6873](https://cve.now/CVE-2024-6873.md): Specially crafted request could caused undefined behaviour which may lead to Remote Code Execution. (CVSS 8.1, ClickHouse)
- [CVE-2024-6040](https://cve.now/CVE-2024-6040.md): Missing client\_id in parisneo/lollms-webui (CVSS 4.4, parisneo/lollms)
- [CVE-2024-6242](https://cve.now/CVE-2024-6242.md): Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices (CVSS 7.3, Rockwell Automation ControlLogix® · Rockwell Automation… +6)
- [CVE-2024-41961](https://cve.now/CVE-2024-41961.md): Elektra vulnerable to remote code execution in universal search (CVSS 9.2, sapcc elektra)
- [CVE-2024-41946](https://cve.now/CVE-2024-41946.md): REXML DoS vulnerability (CVSS 5.3, ruby rexml · rexml)
- [CVE-2024-41123](https://cve.now/CVE-2024-41123.md): REXML DoS vulnerability (CVSS 5.3, ruby rexml · rexml)
- [CVE-2024-41926](https://cve.now/CVE-2024-41926.md): Malicious remote can claim that a user was synced from another remote (CVSS 2.7, Mattermost · github.com/mattermost/mattermost-server +4)
- [CVE-2024-41162](https://cve.now/CVE-2024-41162.md): Malicious remote can make an arbitrary local channel read-only (CVSS 4.1, Mattermost · github.com/mattermost/mattermost/server/v8 +4)
- [CVE-2024-41144](https://cve.now/CVE-2024-41144.md): Malicious remote can create/update/delete arbitrary posts in arbitrary channels (CVSS 5.5, Mattermost · github.com/mattermost/mattermost/server/v8 +4)
- [CVE-2024-39839](https://cve.now/CVE-2024-39839.md): Remote username set to an arbitrary string by remote user (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-39837](https://cve.now/CVE-2024-39837.md): Malicious remote can create arbitrary channels (CVSS 3.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-39832](https://cve.now/CVE-2024-39832.md): Permanently local data deletion by malicious remote (CVSS 6.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-39777](https://cve.now/CVE-2024-39777.md): Malicious remote can invite itself to an arbitrary local channel (CVSS 8.7, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-39274](https://cve.now/CVE-2024-39274.md): Malicious remote can add users to arbitrary teams and channels (CVSS 8.7, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-36492](https://cve.now/CVE-2024-36492.md): Existing local user overwritten by malicious remote (CVSS 7.4, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-29977](https://cve.now/CVE-2024-29977.md): Malicious remote can create arbitrary reactions on arbitrary posts (CVSS 2.7, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-6923](https://cve.now/CVE-2024-6923.md): Email header injection due to unquoted newlines (CVSS 5.5, Python Software Foundation CPython)
- [CVE-2024-7358](https://cve.now/CVE-2024-7358.md): Point B Ltd Getscreen Agent Installation getscreen.msi temp file (CVSS 8.5, Point B Getscreen Agent)
- [CVE-2024-7357](https://cve.now/CVE-2024-7357.md): D-Link DIR-600 soap.cgi soapcgi\_main os command injection (CVSS 5.3, D-Link DIR-600)
- [CVE-2024-2455](https://cve.now/CVE-2024-2455.md): Element Pack - Addon for Elementor Page Builder WordPress Plugin \<= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL (CVSS 6.4, BDThemes Element Pack Pro - Addon for Elementor Page Builde…)
- [CVE-2024-6346](https://cve.now/CVE-2024-6346.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \<= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget (CVSS 6.4, pickplugins Post Grid)
- [CVE-2024-28972](https://cve.now/CVE-2024-28972.md): Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. (CVSS 5.9, Dell InsightIQ)
- [CVE-2024-38481](https://cve.now/CVE-2024-38481.md): Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability. (CVSS 4.8, Dell iDRAC Service Module)
- [CVE-2024-38490](https://cve.now/CVE-2024-38490.md): Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. (CVSS 5.8, Dell iDRAC Service Module)
- [CVE-2024-38489](https://cve.now/CVE-2024-38489.md): Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. (CVSS 3.1, Dell iDRAC Service Module)
- [CVE-2024-25948](https://cve.now/CVE-2024-25948.md): Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. (CVSS 4.8, Dell iDRAC Service Module)
- [CVE-2024-25947](https://cve.now/CVE-2024-25947.md): Dell iDRAC Service Module version 5.3.0.0 and prior, contain an Out of bound Read Vulnerability. (CVSS 4.8, Dell iDRAC Service Module)
- [CVE-2024-5678](https://cve.now/CVE-2024-5678.md): SQL Injection (CVSS 4.7, ManageEngine Applications Manager)
- [CVE-2024-5331](https://cve.now/CVE-2024-5331.md): Breakdance \<= 1.7.2 - Missing Authorization (CVSS 4.3, Breakdance)
- [CVE-2024-5330](https://cve.now/CVE-2024-5330.md): Breakdance \<= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Breakdance)
- [CVE-2024-7302](https://cve.now/CVE-2024-7302.md): Blog2Social: Social Media Auto Post & Scheduler \<= 7.5.4 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload (CVSS 6.4, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2024-6529](https://cve.now/CVE-2024-6529.md): Ultimate Classified Listings \< 1.4 - Reflected XSS (CVSS 7.1, Ultimate Classified Listings)
- [CVE-2024-6496](https://cve.now/CVE-2024-6496.md): Light Poll \<= 1.0.0 - Polls Deletion via CSRF (CVSS 6.5, Light Poll)
- [CVE-2024-4090](https://cve.now/CVE-2024-4090.md): My Sticky Bar \< 2.7.2 - Admin+ Stored XSS (CVSS 4.8, Floating Notification Bar, Sticky Menu on Scroll, Announcem…)
- [CVE-2024-3983](https://cve.now/CVE-2024-3983.md): WooCommerce Customers Manager \< 30.1 - Bulk Action via CSRF (CVSS 8.1, WooCommerce Customers Manager)
- [CVE-2024-2872](https://cve.now/CVE-2024-2872.md): Swift Framework \< 2024.04.30 - Contributor+ Stored XSS (CVSS 4.8, socialdriver-framework)
- [CVE-2024-2843](https://cve.now/CVE-2024-2843.md): WooCommerce Customers Manager \< 30.1 - User Deletion via CSRF (CVSS 6.5, WooCommerce Customers Manager)
- [CVE-2024-1747](https://cve.now/CVE-2024-1747.md): WooCommerce Customers Manager \< 30.2 - Subscriber+ Stored XSS (CVSS 6.5, WooCommerce Customers Manager)
- [CVE-2024-7343](https://cve.now/CVE-2024-7343.md): Baidu UEditor cross site scripting (CVSS 5.3, Baidu UEditor)
- [CVE-2024-7342](https://cve.now/CVE-2024-7342.md): Baidu UEditor unrestricted upload (CVSS 5.3, Baidu UEditor)
- [CVE-2024-2090](https://cve.now/CVE-2024-2090.md): Remote Content Shortcode \<= 1.5 - Authenticated (Contributor+) Server-Side Request Forgery (CVSS 6.4, doublesharp Remote Content Shortcode)
- [CVE-2024-7339](https://cve.now/CVE-2024-7339.md): TVT DVR TD-2104TS-CL queryDevInfo information disclosure (CVSS 6.9, TVT DVR TD-2104TS-CL · TVT DVR TD-2108TS-HP +2)
- [CVE-2024-7338](https://cve.now/CVE-2024-7338.md): TOTOLINK EX1200L cstecgi.cgi setParentalRules buffer overflow (CVSS 8.7, TOTOLINK EX1200L)
- [CVE-2024-6698](https://cve.now/CVE-2024-6698.md): FundEngine – Donation and Crowdfunding Platform \<= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, roxnor FundEngine – Donation and Crowdfunding Platform)
- [CVE-2024-7337](https://cve.now/CVE-2024-7337.md): TOTOLINK EX1200L cstecgi.cgi loginauth buffer overflow (CVSS 8.7, TOTOLINK EX1200L)
- [CVE-2024-7336](https://cve.now/CVE-2024-7336.md): TOTOLINK EX200 cstecgi.cgi loginauth buffer overflow (CVSS 8.7, TOTOLINK EX200)
- [CVE-2024-7335](https://cve.now/CVE-2024-7335.md): TOTOLINK EX200 getSaveConfig buffer overflow (CVSS 8.7, TOTOLINK EX200)
- [CVE-2024-6687](https://cve.now/CVE-2024-6687.md): CTT Expresso para WooCommerce \<= 3.2.12 - Information Exposure via Unprotected Directory (CVSS 5.3, limpinho CTT Expresso para WooCommerce)
- [CVE-2024-7334](https://cve.now/CVE-2024-7334.md): TOTOLINK EX1200L cstecgi.cgi UploadCustomModule buffer overflow (CVSS 8.7, TOTOLINK EX1200L)
- [CVE-2024-40883](https://cve.now/CVE-2024-40883.md): Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. (CVSS 6.5, ELECOM CO. WRC-X1500GS-B · ELECOM CO. WRC-X1500GSA-B +13)
- [CVE-2024-39607](https://cve.now/CVE-2024-39607.md): OS command injection vulnerability exists in ELECOM wireless LAN routers. (CVSS 6.8, ELECOM CO. WRC-X1500GS-B · ELECOM CO. WRC-X1500GSA-B +13)
- [CVE-2024-34021](https://cve.now/CVE-2024-34021.md): Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. (CVSS 6.8, ELECOM CO. WRC-1167GST2 · ELECOM CO. WRC-2533GS2V-B +9)
- [CVE-2024-7333](https://cve.now/CVE-2024-7333.md): TOTOLINK N350RT cstecgi.cgi setParentalRules buffer overflow (CVSS 8.7, TOTOLINK N350RT)
- [CVE-2024-7332](https://cve.now/CVE-2024-7332.md): TOTOLINK CP450 Telnet Service product.ini hard-coded password (CVSS 9.3, TOTOLINK CP450)
- [CVE-2024-7331](https://cve.now/CVE-2024-7331.md): TOTOLINK A3300R cstecgi.cgi UploadCustomModule buffer overflow (CVSS 8.7, TOTOLINK A3300R)
- [CVE-2024-41259](https://cve.now/CVE-2024-41259.md): Use of insecure hashing algorithm in the Gravatar's service in Navidrome v0.52.3 allows attackers to manipulate a user's account information (CVSS 9.1, github.com/navidrome/navidrome)
- [CVE-2024-41260](https://cve.now/CVE-2024-41260.md): A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obta (CVSS 7.5, github.com/netbirdio/netbird)
- [CVE-2024-41264](https://cve.now/CVE-2024-41264.md): An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method. (CVSS 7.5, github.com/casdoor/casdoor)
- [CVE-2024-41265](https://cve.now/CVE-2024-41265.md): A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorReque (CVSS 7.5, github.com/cortexproject/cortex · github.com/cortexlabs/cor…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.