# CVEs published 2024-08-05

103 CVEs were published on August 5, 2024: 9 critical, 61 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-7547](https://cve.now/CVE-2024-7547.md): oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability (CVSS 7.0, oFono)
- [CVE-2024-7546](https://cve.now/CVE-2024-7546.md): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVSS 7.8, oFono)
- [CVE-2024-7545](https://cve.now/CVE-2024-7545.md): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVSS 7.8, oFono)
- [CVE-2024-7544](https://cve.now/CVE-2024-7544.md): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVSS 7.8, oFono)
- [CVE-2024-7543](https://cve.now/CVE-2024-7543.md): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVSS 7.8, oFono)
- [CVE-2024-7542](https://cve.now/CVE-2024-7542.md): oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, oFono)
- [CVE-2024-7541](https://cve.now/CVE-2024-7541.md): oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, oFono)
- [CVE-2024-7540](https://cve.now/CVE-2024-7540.md): oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, oFono)
- [CVE-2024-7539](https://cve.now/CVE-2024-7539.md): oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability (CVSS 7.8, oFono)
- [CVE-2024-7538](https://cve.now/CVE-2024-7538.md): oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability (CVSS 7.8, oFono)
- [CVE-2024-7537](https://cve.now/CVE-2024-7537.md): oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, oFono)
- [CVE-2024-7494](https://cve.now/CVE-2024-7494.md): SourceCodester Clinics Patient Management System new\_prescription.php sql injection (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-42352](https://cve.now/CVE-2024-42352.md): Server-Side Request Forgery (SSRF) in nuxt-icon (CVSS 8.6, nuxt icon · @nuxt/icon)
- [CVE-2024-34344](https://cve.now/CVE-2024-34344.md): Remote code execution via the browser when running the test locally in nuxt (CVSS 8.8, nuxt)
- [CVE-2024-34343](https://cve.now/CVE-2024-34343.md): Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt (CVSS 6.3, nuxt)
- [CVE-2024-23657](https://cve.now/CVE-2024-23657.md): Path Traversal: '../filedir' in Nuxt Devtools (CVSS 8.8, nuxt · @nuxt/devtools)
- [CVE-2024-41811](https://cve.now/CVE-2024-41811.md): ipl/web susceptible to Cross-Site Request Forgery (CSRF) (CVSS 3.9, Icinga ipl-web · ipl/web)
- [CVE-2024-41816](https://cve.now/CVE-2024-41816.md): WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode (CVSS 5.4, XjSv Cooked)
- [CVE-2024-41820](https://cve.now/CVE-2024-41820.md): Cluster-level privilege escalation in kubean (CVSS 6.0, kubean-io kubean · github.com/kubean-io/kubean)
- [CVE-2024-41960](https://cve.now/CVE-2024-41960.md): Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized (CVSS 3.8, mailcow-dockerized)
- [CVE-2024-41959](https://cve.now/CVE-2024-41959.md): Cross-site Scripting (XSS) via API Logs in mailcow: dockerized (CVSS 7.6, mailcow-dockerized)
- [CVE-2024-41958](https://cve.now/CVE-2024-41958.md): Two-Factor Authentication (2FA) Bypass in mailcow: dockerized (CVSS 6.6, mailcow-dockerized)
- [CVE-2024-42350](https://cve.now/CVE-2024-42350.md): Public key confusion in third party block in Biscuit (CVSS 3.0, biscuit-auth biscuit · biscuit-auth)
- [CVE-2024-6915](https://cve.now/CVE-2024-6915.md): JFrog Artifactory Cache Poisoning (CVSS 9.3, JFrog Artifactory)
- [CVE-2024-6361](https://cve.now/CVE-2024-6361.md): Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane product. (CVSS 7.3, OpenText™ ALM Octane.)
- [CVE-2024-21980](https://cve.now/CVE-2024-21980.md): Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC (CVSS 7.9, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1)
- [CVE-2024-21978](https://cve.now/CVE-2024-21978.md): Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakag (CVSS 6.0, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1)
- [CVE-2023-31355](https://cve.now/CVE-2023-31355.md): Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allo (CVSS 6.0, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1)
- [CVE-2024-33034](https://cve.now/CVE-2024-33034.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33028](https://cve.now/CVE-2024-33028.md): Use After Free in Automotive Telematics (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33027](https://cve.now/CVE-2024-33027.md): Improper Access Control in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33026](https://cve.now/CVE-2024-33026.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33025](https://cve.now/CVE-2024-33025.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33024](https://cve.now/CVE-2024-33024.md): Integer Overflow or Wraparound in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33023](https://cve.now/CVE-2024-33023.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33022](https://cve.now/CVE-2024-33022.md): Integer Overflow or Wraparound in Automotive GPU (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33021](https://cve.now/CVE-2024-33021.md): Use of Uninitialized Variable in Automotive GPU (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-33020](https://cve.now/CVE-2024-33020.md): Buffer Over-read in WLAN HOST (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33019](https://cve.now/CVE-2024-33019.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33018](https://cve.now/CVE-2024-33018.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33015](https://cve.now/CVE-2024-33015.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33014](https://cve.now/CVE-2024-33014.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33013](https://cve.now/CVE-2024-33013.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33012](https://cve.now/CVE-2024-33012.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33011](https://cve.now/CVE-2024-33011.md): Buffer Over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-33010](https://cve.now/CVE-2024-33010.md): Use After Free in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-23384](https://cve.now/CVE-2024-23384.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23383](https://cve.now/CVE-2024-23383.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23382](https://cve.now/CVE-2024-23382.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23381](https://cve.now/CVE-2024-23381.md): Use After Free in Graphics Linux (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23357](https://cve.now/CVE-2024-23357.md): NULL Pointer Dereference in HLOS (CVSS 6.2, Qualcomm Snapdragon)
- [CVE-2024-23356](https://cve.now/CVE-2024-23356.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-23355](https://cve.now/CVE-2024-23355.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-23353](https://cve.now/CVE-2024-23353.md): Buffer Over-read in Multi Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-23352](https://cve.now/CVE-2024-23352.md): Loop with Unreachable Exit Condition (\`Infinite Loop\`) in Multi Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-23350](https://cve.now/CVE-2024-23350.md): Reachable Assertion in Multi Mode Call Processor (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-21481](https://cve.now/CVE-2024-21481.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Hypervisor (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-21479](https://cve.now/CVE-2024-21479.md): Buffer Over-read in Audio (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-21467](https://cve.now/CVE-2024-21467.md): Buffer Over-read in WLAN Host Communication (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-21459](https://cve.now/CVE-2024-21459.md): Buffer Over-read in WLAN HOST (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-7397](https://cve.now/CVE-2024-7397.md): Unauthenticated Command Injection (CVSS 9.3, Korenix JetPort 5601v3)
- [CVE-2024-7396](https://cve.now/CVE-2024-7396.md): Plaintext Communication (CVSS 7.1, Korenix JetPort 5601v3)
- [CVE-2024-7409](https://cve.now/CVE-2024-7409.md): Qemu: denial of service via improper synchronization in qemu nbd server during socket closure (CVSS 7.5, qemu · Red Hat Enterprise Linux +1)
- [CVE-2024-7383](https://cve.now/CVE-2024-7383.md): Libnbd: nbd server improper certificate validation (CVSS 7.4, libnbd · Red Hat Enterprise Linux)
- [CVE-2024-7395](https://cve.now/CVE-2024-7395.md): Insufficient Authentication (CVSS 9.3, Korenix JetPort 5601v3)
- [CVE-2024-6472](https://cve.now/CVE-2024-6472.md): Ability to trust not validated macro signatures removed in high security mode (CVSS 7.8, The Document Foundation LibreOffice)
- [CVE-2024-4607](https://cve.now/CVE-2024-4607.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 7.8, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1)
- [CVE-2024-2937](https://cve.now/CVE-2024-2937.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 7.8, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1)
- [CVE-2024-36448](https://cve.now/CVE-2024-36448.md): Apache IoTDB Workbench: SSRF Vulnerability (EOL) (CVSS 7.3, Apache Software Foundation Apache IoTDB Workbench)
- [CVE-2024-38856](https://cve.now/CVE-2024-38856.md): Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code (CVSS 8.1, KEV, Apache Software Foundation Apache OFBiz)
- [CVE-2024-42447](https://cve.now/CVE-2024-42447.md): Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow (CVSS 9.8, Apache Software Foundation Apache Airflow Providers FAB… +1)
- [CVE-2024-6710](https://cve.now/CVE-2024-6710.md): Ditty \< 3.1.45 - Author+ Stored XSS (CVSS 5.4, Ditty)
- [CVE-2024-6498](https://cve.now/CVE-2024-6498.md): CollectChat \< 2.4.4 - Admin+ XSS (CVSS 4.8, Chatbot for WordPress by Collect.chat ⚡️)
- [CVE-2024-6270](https://cve.now/CVE-2024-6270.md): Community Events \< 1.5.1 - Admin+ Stored XSS (CVSS 4.8, Community Events)
- [CVE-2024-5081](https://cve.now/CVE-2024-5081.md): WP eMember \<= v10.7.0 - Stored XSS via CSRF (CVSS 6.1, wp-eMember)
- [CVE-2024-3636](https://cve.now/CVE-2024-3636.md): Pinpoint Booking System \< 2.9.9.4.8 - Admin+ Stored XSS (CVSS 5.4, Pinpoint Booking System)
- [CVE-2024-2232](https://cve.now/CVE-2024-2232.md): Himer - Social Questions and Answers \< 2.1.3 - CSRF While Sending the Invites (CVSS 8.1, Himer)
- [CVE-2024-41889](https://cve.now/CVE-2024-41889.md): Multiple Pimax products accept WebSocket connections from unintended endpoints. (CVSS 8.8, Pimax Play · Pimax PiTool)
- [CVE-2024-41720](https://cve.now/CVE-2024-41720.md): Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow (CVSS 8.0, ZEXELON CO. ZWX-2000CSW2-HN)
- [CVE-2024-39838](https://cve.now/CVE-2024-39838.md): ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an admin (CVSS 8.8, ZEXELON CO. ZWX-2000CSW2-HN)
- [CVE-2024-39713](https://cve.now/CVE-2024-39713.md): A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. (CVSS 8.6, Rocket.Chat)
- [CVE-2024-6118](https://cve.now/CVE-2024-6118.md): Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password (CVSS 9.3, Hamastar Technology MeetingHub Paperless Meetings)
- [CVE-2024-6117](https://cve.now/CVE-2024-6117.md): Hamastar MeetingHub Paperless Meetings - Unrestricted Upload of File with Dangerous Type (CVSS 9.3, Hamastar Technology MeetingHub Paperless Meetings)
- [CVE-2024-7470](https://cve.now/CVE-2024-7470.md): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface vpn\_template\_style.php sslvpn\_config\_mod os command injection (CVSS 5.3, Raisecom MSG1200 · Raisecom MSG2100E +2)
- [CVE-2024-7469](https://cve.now/CVE-2024-7469.md): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list\_vpn\_web\_custom.php sslvpn\_config\_mod os command injection (CVSS 5.3, Raisecom MSG1200 · Raisecom MSG2100E +2)
- [CVE-2024-7468](https://cve.now/CVE-2024-7468.md): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list\_service\_manage.php sslvpn\_config\_mod os command injection (CVSS 5.3, Raisecom MSG1200 · Raisecom MSG2100E +2)
- [CVE-2024-7467](https://cve.now/CVE-2024-7467.md): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list\_ip\_network.php sslvpn\_config\_mod os command injection (CVSS 5.3, Raisecom MSG1200 · Raisecom MSG2100E +2)
- [CVE-2024-7466](https://cve.now/CVE-2024-7466.md): PMWeb Web Application Firewall cross site scripting (CVSS 5.1, PMWeb)
- [CVE-2024-7465](https://cve.now/CVE-2024-7465.md): TOTOLINK CP450 cstecgi.cgi loginauth buffer overflow (CVSS 8.7, TOTOLINK CP450)
- [CVE-2024-7464](https://cve.now/CVE-2024-7464.md): TOTOLINK CP900 Telnet Service setTelnetCfg command injection (CVSS 5.3, TOTOLINK CP900)
- [CVE-2024-7463](https://cve.now/CVE-2024-7463.md): TOTOLINK CP900 cstecgi.cgi UploadCustomModule buffer overflow (CVSS 8.7, TOTOLINK CP900)
- [CVE-2024-7462](https://cve.now/CVE-2024-7462.md): TOTOLINK N350RT cstecgi.cgi setWizardCfg buffer overflow (CVSS 8.7, TOTOLINK N350RT)
- [CVE-2024-40096](https://cve.now/CVE-2024-40096.md): The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log. (CVSS 3.3)
- [CVE-2024-40498](https://cve.now/CVE-2024-40498.md): SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the re (CVSS 9.8)
- [CVE-2024-40530](https://cve.now/CVE-2024-40530.md): A vulnerability in Pantera CRM versions 401.152 and 402.072 allows unauthorized attackers to bypass IP-based access controls by manipulating (CVSS 7.5)
- [CVE-2024-40531](https://cve.now/CVE-2024-40531.md): A mass assignment vulnerability exists in Pantera CRM versions 401.152 and 402.072. (CVSS 8.8)
- [CVE-2024-41200](https://cve.now/CVE-2024-41200.md): A segmentation fault in KMPlayer v4.2.2.65 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file. (CVSS 5.5)
- [CVE-2024-41376](https://cve.now/CVE-2024-41376.md): dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php. (CVSS 8.8)
- [CVE-2024-41380](https://cve.now/CVE-2024-41380.md): microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\\modules\\tags\\add\_tagging\_tagged.php. (CVSS 6.1, microweber/microweber)
- [CVE-2024-41381](https://cve.now/CVE-2024-41381.md): microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\\modules\\settings\\admin.php. (CVSS 6.1, microweber/microweber)
- [CVE-2024-42008](https://cve.now/CVE-2024-42008.md): A Cross-Site Scripting vulnerability in rcmail\_action\_mail\_get-\>run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote att (CVSS 9.3)
- [CVE-2024-42009](https://cve.now/CVE-2024-42009.md): A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of (CVSS 9.3, KEV)
- [CVE-2024-42010](https://cve.now/CVE-2024-42010.md): mod\_css\_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in ren (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.