CVEs published August 6, 2024
160 CVEs were published on August 6, 2024: 36 critical, 65 high.
- Published
- 160
- Critical
- 36
- High
- 65
- Medium
- 58
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 70
Most affected products
- Google Chrome
- 20
- Janobe PayPal · Janobe Credit Card +1
- 10
- Mozilla Firefox · Mozilla Thunderbird
- 10
- Janobe School Attendance Monitoring System · Janobe chool E…
- 8
- Janobe School Attendance Monitoring System · Janobe School…
- 7
- Janobe E-Negosyo System
- 6
- Janobe School Event Management System
- 6
- Zscaler Client Connector
- 6
- itsourcecode Airline Reservation System
- 5
- Calibre
- 4
Critical 36
- CVE-2024-42393Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Hpe Aruba Networking Insta…
- CVE-2024-42394Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…
- CVE-2024-42395Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the AP Certificate Management Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…
- CVE-2024-43111Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects FiMozilla Firefox for iOS
- CVE-2024-7530Incorrect garbage collection interaction could have led to a use-after-free.Mozilla Firefox
- CVE-2024-7528Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7525It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7522Editor code failed to check an attribute value.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7521Incomplete WebAssembly exception handing could have led to a use-after-free.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-33974SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33973SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33972SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33971SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33970SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33969SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33968SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33967SQL injection in Janobe productsJanobe School Attendance Monitoring System · Janobe chool E…
- CVE-2024-33966SQL injection in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33965SQL injection in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33964SQL injection in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33963SQL injection in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33962SQL injection in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33961SQL injection in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33960SQL injection in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33959SQL injection in Janobe productsJanobe PayPal · Janobe Janove Credit Card +1
- CVE-2024-33958SQL injection in Janobe E-Negosyo SystemJanobe E-Negosyo System
- CVE-2024-33957SQL injection in Janobe E-Negosyo SystemJanobe E-Negosyo System
- CVE-2024-6202HaloITSM - SAML XML Signature Wrapping (XSW)Halo Service Solutions HaloITSM
- CVE-2024-6782Calibre Remote Code ExecutionCalibre
- CVE-2024-6886Inproper Sanitation of field leading to stored XSSGitea Open Source Git Server · code.gitea.io/gitea
- CVE-2024-28739An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.
- CVE-2024-33897A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in
- CVE-2024-39225GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,
- CVE-2024-39227GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,
- CVE-2024-39228GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,
- CVE-2024-41270An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecatgithub.com/appleboy/gorush
High 65
- CVE-2024-38206Microsoft Copilot Studio Information Disclosure VulnerabilityMicrosoft Copilot Studio
- CVE-2024-38166Microsoft Dynamics 365 Cross-site Scripting VulnerabilityMicrosoft Dynamics CRM Service Portal Web Resource
- CVE-2024-7550Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-7536Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2024-7535Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2024-7534Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2024-7533Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2024-7532Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruptioGoogle Chrome
- CVE-2024-42347URL preview setting for a room is controllable by the homeserver in matrix-react-sdkmatrix-org matrix-react-sdk · matrix-react-sdk
- CVE-2024-7502Delta Electronics DIAScreen Stack-Based Buffer OverflowDelta Electronics DIAScreen
- CVE-2024-7005Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced Google Chrome
- CVE-2024-7000Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gesturGoogle Chrome
- CVE-2024-6998Use after free in User Education in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specifiGoogle Chrome
- CVE-2024-6997Use after free in Tabs in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestuGoogle Chrome
- CVE-2024-6995Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a userGoogle Chrome
- CVE-2024-6994Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2024-6991Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2024-6989Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2024-6988Use after free in Downloads in Google Chrome on iOS prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2024-23483Local Privilege Escalation via lack of input validationZscaler Client Connector
- CVE-2024-23464Zscaler bypass with administrative privileges on WindowsZscaler Client Connector
- CVE-2024-23458Local Privilege Escalation on Zscaler Client Connector on WindowsZscaler Client Connector
- CVE-2024-23456Signature validation issue leads to Anti-Tampering bypassZscaler Client Connector
- CVE-2024-41913Clariti Manager – Arbitrary File UploadHP Poly Clariti Manager
- CVE-2024-33994Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemJanobe School Event Management System
- CVE-2024-33993Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemJanobe School Event Management System
- CVE-2024-33992Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemJanobe School Event Management System
- CVE-2024-33991Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemJanobe School Event Management System
- CVE-2024-33990Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemJanobe School Event Management System
- CVE-2024-33989Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management SystemJanobe School Event Management System
- CVE-2024-33988Cross-Site Scripting (XSS) vulnerability in Janobe productsJanobe School Attendance Monitoring System · Janobe School…
- CVE-2024-33987Cross-Site Scripting (XSS) vulnerability in Janobe productsJanobe School Attendance Monitoring System · Janobe School…
- CVE-2024-33986Cross-Site Scripting (XSS) vulnerability in Janobe productsJanobe School Attendance Monitoring System · Janobe School…
- CVE-2024-33985Cross-Site Scripting (XSS) vulnerability in Janobe productsJanobe School Attendance Monitoring System · Janobe School…
- CVE-2024-33984Cross-Site Scripting (XSS) vulnerability in Janobe productsJanobe School Attendance Monitoring System · Janobe School…
- CVE-2024-33983Cross-Site Scripting (XSS) vulnerability in Janobe productsJanobe School Attendance Monitoring System · Janobe School…
- CVE-2024-33982Cross-Site Scripting (XSS) vulnerability in Janobe productsJanobe School Attendance Monitoring System · Janobe School…
- CVE-2024-43114In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissionsJetBrains TeamCity
- CVE-2024-7529The date picker could partially obscure security prompts.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7527Unexpected marking work at the start of sweeping could have led to a use-after-free.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7526ANGLE failed to initialize parameters which lead to reading from uninitialized memory.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7520A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7519Insufficient checks when processing graphics shared memory could have led to memory corruption.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-33981Cross-site Scripting in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33980Cross-site Scripting in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33979Cross-site Scripting in Janobe productsJanobe PayPal · Janobe Credit Card +1
- CVE-2024-33978Cross-site Scripting in Janobe E-Negosyo SystemJanobe E-Negosyo System
- CVE-2024-33977Cross-site Scripting in Janobe E-Negosyo SystemJanobe E-Negosyo System
- CVE-2024-33976Cross-site Scripting in Janobe E-Negosyo SystemJanobe E-Negosyo System
- CVE-2024-33975Cross-site Scripting in Janobe E-Negosyo SystemJanobe E-Negosyo System
- CVE-2024-41995Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier.Ricoh Company JavaTM Platform
- CVE-2024-6203HaloITSM - Password Reset PoisoningHalo Service Solutions HaloITSM
- CVE-2024-6200HaloITSM - Stored Cross-Site Scripting in TicketsHalo Service Solutions HaloITSM
- CVE-2024-5709WPBakery <= 7.7 - Authenticated (Author+) Local File InclusionWPBakery Page Builder
- CVE-2024-6781Calibre Arbitrary File ReadCalibre
- CVE-2024-5828EL Injection Vulnerability in Hitachi Tuning ManagerHitachi Tuning Manager
- CVE-2024-7485Traffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site Scriptingkaizencoders Traffic Manager
- CVE-2023-5000Horizontal scrolling announcements <= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcodegopiplus Horizontal scrolling announcements
- CVE-2024-6315Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Uploadunitecms Blox Page Builder
- CVE-2024-7484CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Uploadcrmperks CRM Perks Forms – WordPress Form Builder
- CVE-2024-30170PrivX before 34.0 allows data exfiltration and denial of service via the REST API.
- CVE-2024-40101A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote atmicroweber/microweber
- CVE-2024-41226A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted p
- CVE-2024-41616D-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.
- CVE-2024-422191Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is
Medium, low and unrated 59
- CVE-2024-42400Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI ProtocolHewlett Packard Enterprise HPE Aruba Networking InstantOS a…
- CVE-2024-42399Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI ProtocolHewlett Packard Enterprise HPE Aruba Networking InstantOS a…
- CVE-2024-42398Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI ProtocolHewlett Packard Enterprise HPE Aruba Networking InstantOS a…
- CVE-2024-42396Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…
- CVE-2024-42397Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…
- CVE-2024-41677Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwikQwikDev qwik · @builder.io/qwik
- CVE-2024-42358Loop with Unreachable Exit Condition ('Infinite Loop') in pdfiomichaelrsweet pdfio
- CVE-2024-43113The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129Mozilla Firefox for iOS
- CVE-2024-43112Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129Mozilla Firefox for iOS
- CVE-2024-7564Logsign Unified SecOps Platform Directory Traversal Information Disclosure VulnerabilityLogsign Unified SecOps Platform
- CVE-2023-28806Signature validation error in DLL allows disabling anti-tampering protectionZscaler Client Connector
- CVE-2024-7004Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced Google Chrome
- CVE-2024-7003Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in spGoogle Chrome
- CVE-2024-7001Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in speGoogle Chrome
- CVE-2024-6999Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in spGoogle Chrome
- CVE-2024-6996Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to pGoogle Chrome
- CVE-2024-23460Incorrect signature validation of packageZscaler Client Connector
- CVE-2024-6720Light Poll <= 1.0.0 - Poll Answers Deletion via CSRFLight Poll
- CVE-2024-39751IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-7552DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injectionDataGear
- CVE-2024-41911A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.HP Poly Clariti Manager
- CVE-2024-41910A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.HP Poly Clariti Manager
- CVE-2024-6357Insecure Direct Object Reference vulnerabilityOpenText ArcSight Intelligence
- CVE-2024-6359Privilege escalation vulnerabilityOpenText ArcSight Intelligence
- CVE-2024-6358Incorrect Authorization vulnerabilityOpenText ArcSight Intelligence
- CVE-2024-7523A select option could partially obscure security prompts.Mozilla Firefox
- CVE-2024-7531Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy BridgeMozilla Firefox
- CVE-2024-7524Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection.Mozilla Firefox
- CVE-2024-7518Select options could obscure the fullscreen notification dialog.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-7551juzaweb CMS Theme Editor default path traversaljuzaweb CMS
- CVE-2024-7317Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Uploadpremio Folders – Unlimited Folders to Organize Media Librar…
- CVE-2024-7246HPACK table poisoning in gRPC C++, Python & RubyGoogle gRPC
- CVE-2024-7055FFmpeg pnmdec.c pnm_decode_frame heap-based overflowFFmpeg
- CVE-2024-7084Ajax Search Lite < 4.12.1 - Admin+ Stored XSSAjax Search Lite
- CVE-2024-7082easy-table-of-contents < 2.0.68 - Editor+ Stored XSSEasy Table of Contents
- CVE-2024-6766Shortcodes Ultimate Pro < 7.2.1 - Contributor+ Stored XSSshortcodes-ultimate-pro
- CVE-2024-6651WordPress File Upload < 4.24.8 - Reflected XSSWordPress File Upload
- CVE-2024-6201HaloITSM - Emailing Template InjectionHalo Service Solutions HaloITSM
- CVE-2024-5708WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site ScriptingWPBakery Page Builder
- CVE-2024-39817Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to thCybozu Office
- CVE-2024-7506itsourcecode Tailoring Management System setlogo.php unrestricted uploaditsourcecode Tailoring Management System
- CVE-2024-7505itsourcecode Bike Delivery System contact_us_action.php sql injectionitsourcecode Bike Delivery System
- CVE-2024-28962Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulneraDell Update
- CVE-2024-7009Calibre SQL InjectionCalibre
- CVE-2024-7008Calibre Reflected Cross-Site Scripting (XSS)Calibre
- CVE-2024-7500itsourcecode Airline Reservation System admin_class.php save_settings unrestricted uploaditsourcecode Airline Reservation System
- CVE-2024-7499itsourcecode Airline Reservation System flights.php sql injectionitsourcecode Airline Reservation System
- CVE-2024-7498itsourcecode Airline Reservation System Admin Login Page login.php login2 sql injectionitsourcecode Airline Reservation System
- CVE-2024-5963An unquoted executable path exists in Hitachi Device ManagerHitachi Device Manager
- CVE-2024-7497itsourcecode Airline Reservation System index.php file inclusionitsourcecode Airline Reservation System
- CVE-2024-7496itsourcecode Airline Reservation System index.php file inclusionitsourcecode Airline Reservation System
- CVE-2024-7495itsourcecode Laravel Accounting System HomeController.php unrestricted uploaditsourcecode Laravel Accounting System
- CVE-2023-40819ID4Portais in version < V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability.
- CVE-2024-28740Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-content
- CVE-2024-36424K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer deref
- CVE-2024-39226GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,
- CVE-2024-39229An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X3
- CVE-2024-41333A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code
- CVE-2024-422181Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms.