CVEs published August 5, 2024
103 CVEs were published on August 5, 2024: 9 critical, 61 high. 2 are now in CISA KEV.
- Published
- 103
- Critical
- 9
- High
- 61
- Medium
- 25
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 28
Most affected products
- Qualcomm Snapdragon
- 32
- oFono
- 11
- Raisecom MSG1200 · Raisecom MSG2100E +2
- 4
- 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1
- 3
- Korenix JetPort 5601v3
- 3
- mailcow-dockerized
- 3
- Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- 2
- Hamastar Technology MeetingHub Paperless Meetings
- 2
- microweber/microweber
- 2
- nuxt
- 2
Critical 9
- CVE-2024-6915JFrog Artifactory Cache PoisoningJFrog Artifactory
- CVE-2024-7397Unauthenticated Command InjectionKorenix JetPort 5601v3
- CVE-2024-7395Insufficient AuthenticationKorenix JetPort 5601v3
- CVE-2024-42447Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for AirflowApache Software Foundation Apache Airflow Providers FAB… +1
- CVE-2024-6118Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a PasswordHamastar Technology MeetingHub Paperless Meetings
- CVE-2024-6117Hamastar MeetingHub Paperless Meetings - Unrestricted Upload of File with Dangerous TypeHamastar Technology MeetingHub Paperless Meetings
- CVE-2024-40498SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the re
- CVE-2024-42008A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote att
- CVE-2024-42009A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of
High 61
- CVE-2024-7547oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation VulnerabilityoFono
- CVE-2024-7546oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation VulnerabilityoFono
- CVE-2024-7545oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation VulnerabilityoFono
- CVE-2024-7544oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation VulnerabilityoFono
- CVE-2024-7543oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation VulnerabilityoFono
- CVE-2024-7539oFono CUSD Stack-based Buffer Overflow Code Execution VulnerabilityoFono
- CVE-2024-7538oFono CUSD AT Command Stack-based Buffer Overflow Code Execution VulnerabilityoFono
- CVE-2024-42352Server-Side Request Forgery (SSRF) in nuxt-iconnuxt icon · @nuxt/icon
- CVE-2024-34344Remote code execution via the browser when running the test locally in nuxtnuxt
- CVE-2024-23657Path Traversal: '../filedir' in Nuxt Devtoolsnuxt · @nuxt/devtools
- CVE-2024-41959Cross-site Scripting (XSS) via API Logs in mailcow: dockerizedmailcow-dockerized
- CVE-2024-6361Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane product.OpenText™ ALM Octane.
- CVE-2024-21980Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1
- CVE-2024-33034Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-33028Use After Free in Automotive TelematicsQualcomm Snapdragon
- CVE-2024-33027Improper Access Control in Graphics LinuxQualcomm Snapdragon
- CVE-2024-33026Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33025Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33024Integer Overflow or Wraparound in WLAN HostQualcomm Snapdragon
- CVE-2024-33023Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-33022Integer Overflow or Wraparound in Automotive GPUQualcomm Snapdragon
- CVE-2024-33021Use of Uninitialized Variable in Automotive GPUQualcomm Snapdragon
- CVE-2024-33020Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2024-33019Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33018Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33015Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33014Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33013Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33012Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33011Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-33010Use After Free in WLAN HostQualcomm Snapdragon
- CVE-2024-23384Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-23383Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-23382Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-23381Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-23356Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOSQualcomm Snapdragon
- CVE-2024-23355Improper Restriction of Operations within the Bounds of a Memory Buffer in AutomotiveQualcomm Snapdragon
- CVE-2024-23353Buffer Over-read in Multi Mode Call ProcessorQualcomm Snapdragon
- CVE-2024-23352Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call ProcessorQualcomm Snapdragon
- CVE-2024-21481Improper Restriction of Operations within the Bounds of a Memory Buffer in HypervisorQualcomm Snapdragon
- CVE-2024-21479Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2024-7396Plaintext CommunicationKorenix JetPort 5601v3
- CVE-2024-7409Qemu: denial of service via improper synchronization in qemu nbd server during socket closureqemu · Red Hat Enterprise Linux +1
- CVE-2024-7383Libnbd: nbd server improper certificate validationlibnbd · Red Hat Enterprise Linux
- CVE-2024-6472Ability to trust not validated macro signatures removed in high security modeThe Document Foundation LibreOffice
- CVE-2024-4607Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2024-2937Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2024-36448Apache IoTDB Workbench: SSRF Vulnerability (EOL)Apache Software Foundation Apache IoTDB Workbench
- CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeApache Software Foundation Apache OFBiz
- CVE-2024-2232Himer - Social Questions and Answers < 2.1.3 - CSRF While Sending the InvitesHimer
- CVE-2024-41889Multiple Pimax products accept WebSocket connections from unintended endpoints.Pimax Play · Pimax PiTool
- CVE-2024-41720Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allowZEXELON CO. ZWX-2000CSW2-HN
- CVE-2024-39838ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an adminZEXELON CO. ZWX-2000CSW2-HN
- CVE-2024-39713A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.Rocket.Chat
- CVE-2024-7465TOTOLINK CP450 cstecgi.cgi loginauth buffer overflowTOTOLINK CP450
- CVE-2024-7463TOTOLINK CP900 cstecgi.cgi UploadCustomModule buffer overflowTOTOLINK CP900
- CVE-2024-7462TOTOLINK N350RT cstecgi.cgi setWizardCfg buffer overflowTOTOLINK N350RT
- CVE-2024-40530A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating
- CVE-2024-40531A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072.
- CVE-2024-41376dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.
- CVE-2024-42010mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in ren
Medium, low and unrated 33
- CVE-2024-7542oFono AT CMGR Command Uninitialized Variable Information Disclosure VulnerabilityoFono
- CVE-2024-7541oFono AT CMT Command Uninitialized Variable Information Disclosure VulnerabilityoFono
- CVE-2024-7540oFono AT CMGL Command Uninitialized Variable Information Disclosure VulnerabilityoFono
- CVE-2024-7537oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure VulnerabilityoFono
- CVE-2024-7494SourceCodester Clinics Patient Management System new_prescription.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2024-34343Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxtnuxt
- CVE-2024-41811ipl/web susceptible to Cross-Site Request Forgery (CSRF)Icinga ipl-web · ipl/web
- CVE-2024-41816WordPress Cooked Plugin Persistent Cross-Site Scripting via ShortcodeXjSv Cooked
- CVE-2024-41820Cluster-level privilege escalation in kubeankubean-io kubean · github.com/kubean-io/kubean
- CVE-2024-41960Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerizedmailcow-dockerized
- CVE-2024-41958Two-Factor Authentication (2FA) Bypass in mailcow: dockerizedmailcow-dockerized
- CVE-2024-42350Public key confusion in third party block in Biscuitbiscuit-auth biscuit · biscuit-auth
- CVE-2024-21978Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakag3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1
- CVE-2023-31355Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allo3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1
- CVE-2024-23357NULL Pointer Dereference in HLOSQualcomm Snapdragon
- CVE-2024-23350Reachable Assertion in Multi Mode Call ProcessorQualcomm Snapdragon
- CVE-2024-21467Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-21459Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2024-6710Ditty < 3.1.45 - Author+ Stored XSSDitty
- CVE-2024-6498CollectChat < 2.4.4 - Admin+ XSSChatbot for WordPress by Collect.chat ⚡️
- CVE-2024-6270Community Events < 1.5.1 - Admin+ Stored XSSCommunity Events
- CVE-2024-5081WP eMember <= v10.7.0 - Stored XSS via CSRFwp-eMember
- CVE-2024-3636Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSSPinpoint Booking System
- CVE-2024-7470Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface vpn_template_style.php sslvpn_config_mod os command injectionRaisecom MSG1200 · Raisecom MSG2100E +2
- CVE-2024-7469Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injectionRaisecom MSG1200 · Raisecom MSG2100E +2
- CVE-2024-7468Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injectionRaisecom MSG1200 · Raisecom MSG2100E +2
- CVE-2024-7467Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injectionRaisecom MSG1200 · Raisecom MSG2100E +2
- CVE-2024-7466PMWeb Web Application Firewall cross site scriptingPMWeb
- CVE-2024-7464TOTOLINK CP900 Telnet Service setTelnetCfg command injectionTOTOLINK CP900
- CVE-2024-40096The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log.
- CVE-2024-41200A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.
- CVE-2024-41380microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\tags\add_tagging_tagged.php.microweber/microweber
- CVE-2024-41381microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.microweber/microweber