# CVEs published 2024-08-02

66 CVEs were published on August 2, 2024: 9 critical, 25 high. Days are UTC.

- [CVE-2024-3056](https://cve.now/CVE-2024-3056.md): Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack (CVSS 7.7, podman · Red Hat Enterprise Linux +6)
- [CVE-2024-7319](https://cve.now/CVE-2024-7319.md): Openstack-heat: incomplete fix for cve-2023-1625 (CVSS 5.0, openstack-heat · Red Hat OpenStack Platform)
- [CVE-2024-42349](https://cve.now/CVE-2024-42349.md): FOG has a Log Information Disclosure (CVSS 5.3, fogproject)
- [CVE-2024-42348](https://cve.now/CVE-2024-42348.md): FOG leaks sensitive information (AD domain, username and password) (CVSS 9.3, fogproject)
- [CVE-2024-22169](https://cve.now/CVE-2024-22169.md): Misconfiguration in node.js causing a code execution in WD Discovery (CVSS 7.1, Western Digital WD Discovery)
- [CVE-2024-7314](https://cve.now/CVE-2024-7314.md): anji-plus AJ-Report Authentication Bypass (CVSS 9.8, anji-plus AJ-Report)
- [CVE-2024-7029](https://cve.now/CVE-2024-7029.md): Command Injection in AVTech AVM1203 (IP Camera) (CVSS 8.8, AVTech AVM1203)
- [CVE-2024-41127](https://cve.now/CVE-2024-41127.md): Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its \`ci-failure-comment.yml\` GitHub Workflow, enabling attackers to gain \`pull-requests\` write access. (CVSS 8.4, monkeytypegame monkeytype)
- [CVE-2024-6704](https://cve.now/CVE-2024-6704.md): Comments – wpDiscuz \<= 7.6.21 - Unauthenticated HTML Injection (CVSS 5.3, advancedcoding Comments – wpDiscuz)
- [CVE-2024-7323](https://cve.now/CVE-2024-7323.md): Digiwin EasyFlow .NET - Arbitrary File Download (CVSS 6.5, Digiwin EasyFlow .NET)
- [CVE-2024-38879](https://cve.now/CVE-2024-38879.md): A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivi (CVSS 7.5, Siemens Omnivise T3000 Application Server R9.2 · Siemens… +1)
- [CVE-2024-38878](https://cve.now/CVE-2024-38878.md): A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivi (CVSS 7.2, Siemens Omnivise T3000 Application Server R9.2 · Siemens… +1)
- [CVE-2024-38877](https://cve.now/CVE-2024-38877.md): A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All ver (CVSS 8.2, Siemens Omnivise T3000 Application Server R9.2 · Siemens… +8)
- [CVE-2024-38876](https://cve.now/CVE-2024-38876.md): A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All ver (CVSS 7.8, Siemens Omnivise T3000 Application Server R9.2 · Siemens… +6)
- [CVE-2024-7204](https://cve.now/CVE-2024-7204.md): Ai3 QbiBot - Stored XSS (CVSS 6.1, Ai3 QbiBot)
- [CVE-2024-40723](https://cve.now/CVE-2024-40723.md): CHANGING Information Technology HWATAIServiSign Windows Version - Stack-based Buffer Overflow (CVSS 4.3, CHANGING Information Technology HWATAIServiSign Windows Ver…)
- [CVE-2024-40722](https://cve.now/CVE-2024-40722.md): CHANGING Information Technology TCBServiSign Windows Version - Stack-based Buffer Overflow (CVSS 4.3, CHANGING Information Technology TCBServiSign Windows Version)
- [CVE-2024-40721](https://cve.now/CVE-2024-40721.md): CHANGING Information Technology TCBServiSign Windows Version - Improper Input Validation (CVSS 8.8, CHANGING Information Technology TCBServiSign Windows Version)
- [CVE-2024-40720](https://cve.now/CVE-2024-40720.md): CHANGING Information Technology TCBServiSign Windows Version - Improper Input Validation (CVSS 8.8, CHANGING Information Technology TCBServiSign Windows Version)
- [CVE-2024-40719](https://cve.now/CVE-2024-40719.md): CHANGING Information Technology TCBServiSign Windows Version - Inadequate Encryption Strength (CVSS 6.5, CHANGING Information Technology TCBServiSign Windows Version)
- [CVE-2024-36268](https://cve.now/CVE-2024-36268.md): Apache InLong TubeMQ Client: Remote Code Execution vulnerability (CVSS 7.6, Apache Software Foundation Apache InLong TubeMQ Client · or…)
- [CVE-2024-4643](https://cve.now/CVE-2024-4643.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-27182](https://cve.now/CVE-2024-27182.md): Apache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerability (CVSS 4.9, Apache Software Foundation Apache Linkis Basic management…)
- [CVE-2024-27181](https://cve.now/CVE-2024-27181.md): Apache Linkis Basic management services: Privilege Escalation Attack vulnerability (CVSS 8.8, Apache Software Foundation Apache Linkis Basic management s…)
- [CVE-2024-38776](https://cve.now/CVE-2024-38776.md): WordPress WP GoToWebinar plugin \<= 15.7 - CSRF to XSS vulnerability (CVSS 7.1, Martin Gibson WP GoToWebinar)
- [CVE-2024-39392](https://cve.now/CVE-2024-39392.md): Adobe Indesign 2024 EPS File Parsing Heap Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-39396](https://cve.now/CVE-2024-39396.md): Adobe Indesign 2024 PCX File Parsing Out Of Bound Read (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-3238](https://cve.now/CVE-2024-3238.md): WordPress Menu Plugin — Superfly Responsive Menu \<= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.8, looks\_awesome WordPress Menu Plugin — Superfly Responsive M…)
- [CVE-2024-5595](https://cve.now/CVE-2024-5595.md): Essential Blocks \< 4.7.0 - Contributor+ Stored XSS (CVSS 5.4, Essential Blocks)
- [CVE-2024-3827](https://cve.now/CVE-2024-3827.md): Spectra Pro \<= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs (CVSS 6.4, Brainstorm Force Spectra Pro)
- [CVE-2024-7389](https://cve.now/CVE-2024-7389.md): Forminator \<= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure (CVSS 7.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-38482](https://cve.now/CVE-2024-38482.md): CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. (CVSS 6.6, Dell CloudLink)
- [CVE-2024-7378](https://cve.now/CVE-2024-7378.md): SourceCodester Simple Realtime Quiz System manage\_question.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-7377](https://cve.now/CVE-2024-7377.md): SourceCodester Simple Realtime Quiz System view\_result.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-6567](https://cve.now/CVE-2024-6567.md): Ebook Store \<= 5.8001 - Unauthenticated Full Path Disclosure (CVSS 5.3, motovnet Ebook Store)
- [CVE-2024-7376](https://cve.now/CVE-2024-7376.md): SourceCodester Simple Realtime Quiz System print\_quiz\_records.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-7375](https://cve.now/CVE-2024-7375.md): SourceCodester Simple Realtime Quiz System my\_quiz\_result.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-22278](https://cve.now/CVE-2024-22278.md): Harbor fails to validate the user permissions when updating project configurations (CVSS 6.4, harbor · github.com/goharbor/harbor)
- [CVE-2024-7374](https://cve.now/CVE-2024-7374.md): SourceCodester Simple Realtime Quiz System manage\_user.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-7373](https://cve.now/CVE-2024-7373.md): SourceCodester Simple Realtime Quiz System ajax.php sql injection (CVSS 5.3, SourceCodester Simple Realtime Quiz System)
- [CVE-2024-28297](https://cve.now/CVE-2024-28297.md): SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors. (CVSS 7.5)
- [CVE-2024-28298](https://cve.now/CVE-2024-28298.md): SQL injection vulnerability in BM SOFT BMPlanning 1.0.0.1 allows authenticated users to execute arbitrary SQL commands via the SEC\_IDF, LIE\_ (CVSS 6.0)
- [CVE-2024-33892](https://cve.now/CVE-2024-33892.md): Insecure Permissions vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are susceptible to (CVSS 5.3)
- [CVE-2024-33893](https://cve.now/CVE-2024-33893.md): Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to im (CVSS 6.1)
- [CVE-2024-33894](https://cve.now/CVE-2024-33894.md): Insecure Permission vulnerability in Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are executing sever (CVSS 8.8)
- [CVE-2024-33895](https://cve.now/CVE-2024-33895.md): Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters (CVSS 6.6)
- [CVE-2024-33896](https://cve.now/CVE-2024-33896.md): Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper paramet (CVSS 7.2)
- [CVE-2024-38881](https://cve.now/CVE-2024-38881.md): An issue in Horizon Business Services Inc. (CVSS 7.5)
- [CVE-2024-38882](https://cve.now/CVE-2024-38882.md): An issue in Horizon Business Services Inc. (CVSS 9.8)
- [CVE-2024-38883](https://cve.now/CVE-2024-38883.md): An issue in Horizon Business Services Inc. (CVSS 9.1)
- [CVE-2024-38884](https://cve.now/CVE-2024-38884.md): An issue in Horizon Business Services Inc. (CVSS 7.8)
- [CVE-2024-38885](https://cve.now/CVE-2024-38885.md): An issue in Horizon Business Services Inc. (CVSS 7.5)
- [CVE-2024-38886](https://cve.now/CVE-2024-38886.md): An issue in Horizon Business Services Inc. (CVSS 9.8)
- [CVE-2024-38887](https://cve.now/CVE-2024-38887.md): An issue in Horizon Business Services Inc. (CVSS 9.8)
- [CVE-2024-38888](https://cve.now/CVE-2024-38888.md): An issue in Horizon Business Services Inc. (CVSS 6.8)
- [CVE-2024-38889](https://cve.now/CVE-2024-38889.md): An issue in Horizon Business Services Inc. (CVSS 9.6)
- [CVE-2024-38890](https://cve.now/CVE-2024-38890.md): An issue in Horizon Business Services Inc. (CVSS 8.4)
- [CVE-2024-38891](https://cve.now/CVE-2024-38891.md): An issue in Horizon Business Services Inc. (CVSS 9.1)
- [CVE-2024-41310](https://cve.now/CVE-2024-41310.md): AndServer 2.1.12 is vulnerable to Directory Traversal. (CVSS 7.5)
- [CVE-2024-41517](https://cve.now/CVE-2024-41517.md): An Incorrect Access Control vulnerability in "/admin/benutzer/institution/rechteverwaltung/uebersicht" in Feripro \<= v2.2.3 allows remote at (CVSS 5.3)
- [CVE-2024-41518](https://cve.now/CVE-2024-41518.md): An Incorrect Access Control vulnerability in "/admin/programm/\<program\_id\>/export/statistics" in Feripro \<= v2.2.3 allows remote attackers t (CVSS 7.5)
- [CVE-2024-41519](https://cve.now/CVE-2024-41519.md): Feripro \<= v2.2.3 is vulnerable to Cross Site Scripting (XSS) via "/admin/programm/\<program\_id\>/zuordnung/veranstaltungen/\<event\_id\>" throug (CVSS 5.4)
- [CVE-2024-42458](https://cve.now/CVE-2024-42458.md): server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369. (CVSS 9.8)
- [CVE-2024-42459](https://cve.now/CVE-2024-42459.md): In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus z (CVSS 5.3, elliptic)
- [CVE-2024-42460](https://cve.now/CVE-2024-42460.md): In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit (CVSS 5.3, elliptic)
- [CVE-2024-42461](https://cve.now/CVE-2024-42461.md): In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed. (CVSS 5.3, elliptic)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.