# CVEs published 2024-08-06

160 CVEs were published on August 6, 2024: 36 critical, 65 high. Days are UTC.

- [CVE-2024-38206](https://cve.now/CVE-2024-38206.md): Microsoft Copilot Studio Information Disclosure Vulnerability (CVSS 8.5, Microsoft Copilot Studio)
- [CVE-2024-38166](https://cve.now/CVE-2024-38166.md): Microsoft Dynamics 365 Cross-site Scripting Vulnerability (CVSS 8.2, Microsoft Dynamics CRM Service Portal Web Resource)
- [CVE-2024-7550](https://cve.now/CVE-2024-7550.md): Type Confusion in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-7536](https://cve.now/CVE-2024-7536.md): Use after free in WebAudio in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2024-7535](https://cve.now/CVE-2024-7535.md): Inappropriate implementation in V8 in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2024-7534](https://cve.now/CVE-2024-7534.md): Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2024-7533](https://cve.now/CVE-2024-7533.md): Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption vi (CVSS 8.8, Google Chrome)
- [CVE-2024-7532](https://cve.now/CVE-2024-7532.md): Out of bounds memory access in ANGLE in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruptio (CVSS 8.8, Google Chrome)
- [CVE-2024-42400](https://cve.now/CVE-2024-42400.md): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol (CVSS 5.3, Hewlett Packard Enterprise HPE Aruba Networking InstantOS a…)
- [CVE-2024-42399](https://cve.now/CVE-2024-42399.md): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol (CVSS 5.3, Hewlett Packard Enterprise HPE Aruba Networking InstantOS a…)
- [CVE-2024-42398](https://cve.now/CVE-2024-42398.md): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol (CVSS 5.3, Hewlett Packard Enterprise HPE Aruba Networking InstantOS a…)
- [CVE-2024-42393](https://cve.now/CVE-2024-42393.md): Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Hpe Aruba Networking Insta…)
- [CVE-2024-42394](https://cve.now/CVE-2024-42394.md): Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the Soft AP Daemon Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…)
- [CVE-2024-42395](https://cve.now/CVE-2024-42395.md): Unauthenticated Stack-Based Buffer Overflow Remote Command Execution (RCE) in the AP Certificate Management Service Accessed by the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…)
- [CVE-2024-42396](https://cve.now/CVE-2024-42396.md): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI Protocol (CVSS 5.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…)
- [CVE-2024-42397](https://cve.now/CVE-2024-42397.md): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the AP Certificate Management Service Accessed by the PAPI Protocol (CVSS 5.3, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Insta…)
- [CVE-2024-41677](https://cve.now/CVE-2024-41677.md): Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik (CVSS 6.3, QwikDev qwik · @builder.io/qwik)
- [CVE-2024-42347](https://cve.now/CVE-2024-42347.md): URL preview setting for a room is controllable by the homeserver in matrix-react-sdk (CVSS 7.7, matrix-org matrix-react-sdk · matrix-react-sdk)
- [CVE-2024-42358](https://cve.now/CVE-2024-42358.md): Loop with Unreachable Exit Condition ('Infinite Loop') in pdfio (CVSS 6.2, michaelrsweet pdfio)
- [CVE-2024-7502](https://cve.now/CVE-2024-7502.md): Delta Electronics DIAScreen Stack-Based Buffer Overflow (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2024-43111](https://cve.now/CVE-2024-43111.md): Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Fi (CVSS 9.8, Mozilla Firefox for iOS)
- [CVE-2024-43113](https://cve.now/CVE-2024-43113.md): The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS \< 129 (CVSS 6.1, Mozilla Firefox for iOS)
- [CVE-2024-43112](https://cve.now/CVE-2024-43112.md): Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS \< 129 (CVSS 6.1, Mozilla Firefox for iOS)
- [CVE-2024-7564](https://cve.now/CVE-2024-7564.md): Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability (CVSS 4.3, Logsign Unified SecOps Platform)
- [CVE-2023-28806](https://cve.now/CVE-2023-28806.md): Signature validation error in DLL allows disabling anti-tampering protection (CVSS 5.7, Zscaler Client Connector)
- [CVE-2024-7005](https://cve.now/CVE-2024-7005.md): Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced (CVSS 8.8, Google Chrome)
- [CVE-2024-7004](https://cve.now/CVE-2024-7004.md): Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced (CVSS 4.3, Google Chrome)
- [CVE-2024-7003](https://cve.now/CVE-2024-7003.md): Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in sp (CVSS 4.3, Google Chrome)
- [CVE-2024-7001](https://cve.now/CVE-2024-7001.md): Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in spe (CVSS 4.3, Google Chrome)
- [CVE-2024-7000](https://cve.now/CVE-2024-7000.md): Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestur (CVSS 8.8, Google Chrome)
- [CVE-2024-6999](https://cve.now/CVE-2024-6999.md): Inappropriate implementation in FedCM in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in sp (CVSS 4.3, Google Chrome)
- [CVE-2024-6998](https://cve.now/CVE-2024-6998.md): Use after free in User Education in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specifi (CVSS 8.8, Google Chrome)
- [CVE-2024-6997](https://cve.now/CVE-2024-6997.md): Use after free in Tabs in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestu (CVSS 8.8, Google Chrome)
- [CVE-2024-6996](https://cve.now/CVE-2024-6996.md): Race in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to p (CVSS 3.1, Google Chrome)
- [CVE-2024-6995](https://cve.now/CVE-2024-6995.md): Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 127.0.6533.72 allowed a remote attacker who convinced a user (CVSS 8.8, Google Chrome)
- [CVE-2024-6994](https://cve.now/CVE-2024-6994.md): Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2024-6991](https://cve.now/CVE-2024-6991.md): Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-6989](https://cve.now/CVE-2024-6989.md): Use after free in Loader in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-6988](https://cve.now/CVE-2024-6988.md): Use after free in Downloads in Google Chrome on iOS prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2024-23483](https://cve.now/CVE-2024-23483.md): Local Privilege Escalation via lack of input validation (CVSS 7.0, Zscaler Client Connector)
- [CVE-2024-23460](https://cve.now/CVE-2024-23460.md): Incorrect signature validation of package (CVSS 6.4, Zscaler Client Connector)
- [CVE-2024-6720](https://cve.now/CVE-2024-6720.md): Light Poll \<= 1.0.0 - Poll Answers Deletion via CSRF (CVSS 6.1, Light Poll)
- [CVE-2024-23464](https://cve.now/CVE-2024-23464.md): Zscaler bypass with administrative privileges on Windows (CVSS 7.2, Zscaler Client Connector)
- [CVE-2024-23458](https://cve.now/CVE-2024-23458.md): Local Privilege Escalation on Zscaler Client Connector on Windows (CVSS 7.3, Zscaler Client Connector)
- [CVE-2024-23456](https://cve.now/CVE-2024-23456.md): Signature validation issue leads to Anti-Tampering bypass (CVSS 7.8, Zscaler Client Connector)
- [CVE-2024-39751](https://cve.now/CVE-2024-39751.md): IBM InfoSphere Information Server information disclosure (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2024-7552](https://cve.now/CVE-2024-7552.md): DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection (CVSS 5.3, DataGear)
- [CVE-2024-41911](https://cve.now/CVE-2024-41911.md): A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. (CVSS 5.4, HP Poly Clariti Manager)
- [CVE-2024-41910](https://cve.now/CVE-2024-41910.md): A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. (CVSS 6.1, HP Poly Clariti Manager)
- [CVE-2024-41913](https://cve.now/CVE-2024-41913.md): Clariti Manager – Arbitrary File Upload (CVSS 8.8, HP Poly Clariti Manager)
- [CVE-2024-33994](https://cve.now/CVE-2024-33994.md): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (CVSS 7.1, Janobe School Event Management System)
- [CVE-2024-33993](https://cve.now/CVE-2024-33993.md): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (CVSS 7.1, Janobe School Event Management System)
- [CVE-2024-6357](https://cve.now/CVE-2024-6357.md): Insecure Direct Object Reference vulnerability (CVSS 6.3, OpenText ArcSight Intelligence)
- [CVE-2024-6359](https://cve.now/CVE-2024-6359.md): Privilege escalation vulnerability (CVSS 6.4, OpenText ArcSight Intelligence)
- [CVE-2024-6358](https://cve.now/CVE-2024-6358.md): Incorrect Authorization vulnerability (CVSS 6.3, OpenText ArcSight Intelligence)
- [CVE-2024-33992](https://cve.now/CVE-2024-33992.md): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (CVSS 7.1, Janobe School Event Management System)
- [CVE-2024-33991](https://cve.now/CVE-2024-33991.md): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (CVSS 7.1, Janobe School Event Management System)
- [CVE-2024-33990](https://cve.now/CVE-2024-33990.md): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (CVSS 7.1, Janobe School Event Management System)
- [CVE-2024-33989](https://cve.now/CVE-2024-33989.md): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (CVSS 7.1, Janobe School Event Management System)
- [CVE-2024-33988](https://cve.now/CVE-2024-33988.md): Cross-Site Scripting (XSS) vulnerability in Janobe products (CVSS 7.1, Janobe School Attendance Monitoring System · Janobe School…)
- [CVE-2024-33987](https://cve.now/CVE-2024-33987.md): Cross-Site Scripting (XSS) vulnerability in Janobe products (CVSS 7.1, Janobe School Attendance Monitoring System · Janobe School…)
- [CVE-2024-33986](https://cve.now/CVE-2024-33986.md): Cross-Site Scripting (XSS) vulnerability in Janobe products (CVSS 7.1, Janobe School Attendance Monitoring System · Janobe School…)
- [CVE-2024-33985](https://cve.now/CVE-2024-33985.md): Cross-Site Scripting (XSS) vulnerability in Janobe products (CVSS 7.1, Janobe School Attendance Monitoring System · Janobe School…)
- [CVE-2024-33984](https://cve.now/CVE-2024-33984.md): Cross-Site Scripting (XSS) vulnerability in Janobe products (CVSS 7.1, Janobe School Attendance Monitoring System · Janobe School…)
- [CVE-2024-33983](https://cve.now/CVE-2024-33983.md): Cross-Site Scripting (XSS) vulnerability in Janobe products (CVSS 7.1, Janobe School Attendance Monitoring System · Janobe School…)
- [CVE-2024-33982](https://cve.now/CVE-2024-33982.md): Cross-Site Scripting (XSS) vulnerability in Janobe products (CVSS 7.1, Janobe School Attendance Monitoring System · Janobe School…)
- [CVE-2024-43114](https://cve.now/CVE-2024-43114.md): In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions (CVSS 7.5, JetBrains TeamCity)
- [CVE-2024-7530](https://cve.now/CVE-2024-7530.md): Incorrect garbage collection interaction could have led to a use-after-free. (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-7523](https://cve.now/CVE-2024-7523.md): A select option could partially obscure security prompts. (CVSS 6.3, Mozilla Firefox)
- [CVE-2024-7531](https://cve.now/CVE-2024-7531.md): Calling \`PK11\_Encrypt()\` in NSS using CKM\_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge (CVSS 6.3, Mozilla Firefox)
- [CVE-2024-7529](https://cve.now/CVE-2024-7529.md): The date picker could partially obscure security prompts. (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7528](https://cve.now/CVE-2024-7528.md): Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7527](https://cve.now/CVE-2024-7527.md): Unexpected marking work at the start of sweeping could have led to a use-after-free. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7526](https://cve.now/CVE-2024-7526.md): ANGLE failed to initialize parameters which lead to reading from uninitialized memory. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7525](https://cve.now/CVE-2024-7525.md): It was possible for a web extension with minimal permissions to create a \`StreamFilter\` which could be used to read and modify the response (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7524](https://cve.now/CVE-2024-7524.md): Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. (CVSS 6.1, Mozilla Firefox)
- [CVE-2024-7522](https://cve.now/CVE-2024-7522.md): Editor code failed to check an attribute value. (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7521](https://cve.now/CVE-2024-7521.md): Incomplete WebAssembly exception handing could have led to a use-after-free. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7520](https://cve.now/CVE-2024-7520.md): A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7519](https://cve.now/CVE-2024-7519.md): Insufficient checks when processing graphics shared memory could have led to memory corruption. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7518](https://cve.now/CVE-2024-7518.md): Select options could obscure the fullscreen notification dialog. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-7551](https://cve.now/CVE-2024-7551.md): juzaweb CMS Theme Editor default path traversal (CVSS 5.1, juzaweb CMS)
- [CVE-2024-33974](https://cve.now/CVE-2024-33974.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33973](https://cve.now/CVE-2024-33973.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33972](https://cve.now/CVE-2024-33972.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33971](https://cve.now/CVE-2024-33971.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33970](https://cve.now/CVE-2024-33970.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33969](https://cve.now/CVE-2024-33969.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33968](https://cve.now/CVE-2024-33968.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33967](https://cve.now/CVE-2024-33967.md): SQL injection in Janobe products (CVSS 9.8, Janobe School Attendance Monitoring System · Janobe chool E…)
- [CVE-2024-33966](https://cve.now/CVE-2024-33966.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33965](https://cve.now/CVE-2024-33965.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33964](https://cve.now/CVE-2024-33964.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33963](https://cve.now/CVE-2024-33963.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33962](https://cve.now/CVE-2024-33962.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33961](https://cve.now/CVE-2024-33961.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33960](https://cve.now/CVE-2024-33960.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33959](https://cve.now/CVE-2024-33959.md): SQL injection in Janobe products (CVSS 9.8, Janobe PayPal · Janobe Janove Credit Card +1)
- [CVE-2024-33981](https://cve.now/CVE-2024-33981.md): Cross-site Scripting in Janobe products (CVSS 7.1, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33980](https://cve.now/CVE-2024-33980.md): Cross-site Scripting in Janobe products (CVSS 7.1, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33979](https://cve.now/CVE-2024-33979.md): Cross-site Scripting in Janobe products (CVSS 7.1, Janobe PayPal · Janobe Credit Card +1)
- [CVE-2024-33958](https://cve.now/CVE-2024-33958.md): SQL injection in Janobe E-Negosyo System (CVSS 9.8, Janobe E-Negosyo System)
- [CVE-2024-33957](https://cve.now/CVE-2024-33957.md): SQL injection in Janobe E-Negosyo System (CVSS 9.8, Janobe E-Negosyo System)
- [CVE-2024-33978](https://cve.now/CVE-2024-33978.md): Cross-site Scripting in Janobe E-Negosyo System (CVSS 7.1, Janobe E-Negosyo System)
- [CVE-2024-7317](https://cve.now/CVE-2024-7317.md): Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager \<= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, premio Folders – Unlimited Folders to Organize Media Librar…)
- [CVE-2024-33977](https://cve.now/CVE-2024-33977.md): Cross-site Scripting in Janobe E-Negosyo System (CVSS 7.1, Janobe E-Negosyo System)
- [CVE-2024-33976](https://cve.now/CVE-2024-33976.md): Cross-site Scripting in Janobe E-Negosyo System (CVSS 7.1, Janobe E-Negosyo System)
- [CVE-2024-33975](https://cve.now/CVE-2024-33975.md): Cross-site Scripting in Janobe E-Negosyo System (CVSS 7.1, Janobe E-Negosyo System)
- [CVE-2024-7246](https://cve.now/CVE-2024-7246.md): HPACK table poisoning in gRPC C++, Python & Ruby (CVSS 6.3, Google gRPC)
- [CVE-2024-41995](https://cve.now/CVE-2024-41995.md): Initialization of a resource with an insecure default vulnerability exists in JavaTM Platform Ver.12.89 and earlier. (CVSS 7.5, Ricoh Company JavaTM Platform)
- [CVE-2024-6203](https://cve.now/CVE-2024-6203.md): HaloITSM - Password Reset Poisoning (CVSS 8.3, Halo Service Solutions HaloITSM)
- [CVE-2024-6202](https://cve.now/CVE-2024-6202.md): HaloITSM - SAML XML Signature Wrapping (XSW) (CVSS 9.8, Halo Service Solutions HaloITSM)
- [CVE-2024-7055](https://cve.now/CVE-2024-7055.md): FFmpeg pnmdec.c pnm\_decode\_frame heap-based overflow (CVSS 6.9, FFmpeg)
- [CVE-2024-7084](https://cve.now/CVE-2024-7084.md): Ajax Search Lite \< 4.12.1 - Admin+ Stored XSS (CVSS 4.8, Ajax Search Lite)
- [CVE-2024-7082](https://cve.now/CVE-2024-7082.md): easy-table-of-contents \< 2.0.68 - Editor+ Stored XSS (CVSS 6.1, Easy Table of Contents)
- [CVE-2024-6766](https://cve.now/CVE-2024-6766.md): Shortcodes Ultimate Pro \< 7.2.1 - Contributor+ Stored XSS (CVSS 5.4, shortcodes-ultimate-pro)
- [CVE-2024-6651](https://cve.now/CVE-2024-6651.md): WordPress File Upload \< 4.24.8 - Reflected XSS (CVSS 6.1, WordPress File Upload)
- [CVE-2024-6201](https://cve.now/CVE-2024-6201.md): HaloITSM - Emailing Template Injection (CVSS 5.3, Halo Service Solutions HaloITSM)
- [CVE-2024-6200](https://cve.now/CVE-2024-6200.md): HaloITSM - Stored Cross-Site Scripting in Tickets (CVSS 8.0, Halo Service Solutions HaloITSM)
- [CVE-2024-5709](https://cve.now/CVE-2024-5709.md): WPBakery \<= 7.7 - Authenticated (Author+) Local File Inclusion (CVSS 8.8, WPBakery Page Builder)
- [CVE-2024-5708](https://cve.now/CVE-2024-5708.md): WPBakery \<= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, WPBakery Page Builder)
- [CVE-2024-39817](https://cve.now/CVE-2024-39817.md): Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to th (CVSS 6.5, Cybozu Office)
- [CVE-2024-7506](https://cve.now/CVE-2024-7506.md): itsourcecode Tailoring Management System setlogo.php unrestricted upload (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-7505](https://cve.now/CVE-2024-7505.md): itsourcecode Bike Delivery System contact\_us\_action.php sql injection (CVSS 6.9, itsourcecode Bike Delivery System)
- [CVE-2024-28962](https://cve.now/CVE-2024-28962.md): Dell Command | Update, Dell Update, and Alienware Update UWP, versions prior to 5.4, contain an Exposed Dangerous Method or Function vulnera (CVSS 6.5, Dell Update)
- [CVE-2024-7009](https://cve.now/CVE-2024-7009.md): Calibre SQL Injection (CVSS 4.2, Calibre)
- [CVE-2024-7008](https://cve.now/CVE-2024-7008.md): Calibre Reflected Cross-Site Scripting (XSS) (CVSS 5.4, Calibre)
- [CVE-2024-6782](https://cve.now/CVE-2024-6782.md): Calibre Remote Code Execution (CVSS 9.8, Calibre)
- [CVE-2024-6781](https://cve.now/CVE-2024-6781.md): Calibre Arbitrary File Read (CVSS 7.5, Calibre)
- [CVE-2024-7500](https://cve.now/CVE-2024-7500.md): itsourcecode Airline Reservation System admin\_class.php save\_settings unrestricted upload (CVSS 5.3, itsourcecode Airline Reservation System)
- [CVE-2024-6886](https://cve.now/CVE-2024-6886.md): Inproper Sanitation of field leading to stored XSS (CVSS 10.0, Gitea Open Source Git Server · code.gitea.io/gitea)
- [CVE-2024-7499](https://cve.now/CVE-2024-7499.md): itsourcecode Airline Reservation System flights.php sql injection (CVSS 5.3, itsourcecode Airline Reservation System)
- [CVE-2024-7498](https://cve.now/CVE-2024-7498.md): itsourcecode Airline Reservation System Admin Login Page login.php login2 sql injection (CVSS 6.9, itsourcecode Airline Reservation System)
- [CVE-2024-5828](https://cve.now/CVE-2024-5828.md): EL Injection Vulnerability in Hitachi Tuning Manager (CVSS 8.6, Hitachi Tuning Manager)
- [CVE-2024-5963](https://cve.now/CVE-2024-5963.md): An unquoted executable path exists in Hitachi Device Manager (CVSS 6.7, Hitachi Device Manager)
- [CVE-2024-7497](https://cve.now/CVE-2024-7497.md): itsourcecode Airline Reservation System index.php file inclusion (CVSS 5.3, itsourcecode Airline Reservation System)
- [CVE-2024-7485](https://cve.now/CVE-2024-7485.md): Traffic Manager \<= 1.4.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, kaizencoders Traffic Manager)
- [CVE-2023-5000](https://cve.now/CVE-2023-5000.md): Horizontal scrolling announcements \<= 2.4 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, gopiplus Horizontal scrolling announcements)
- [CVE-2024-6315](https://cve.now/CVE-2024-6315.md): Blox Page Builder \<= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, unitecms Blox Page Builder)
- [CVE-2024-7484](https://cve.now/CVE-2024-7484.md): CRM Perks Forms \<= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, crmperks CRM Perks Forms – WordPress Form Builder)
- [CVE-2024-7496](https://cve.now/CVE-2024-7496.md): itsourcecode Airline Reservation System index.php file inclusion (CVSS 5.3, itsourcecode Airline Reservation System)
- [CVE-2024-7495](https://cve.now/CVE-2024-7495.md): itsourcecode Laravel Accounting System HomeController.php unrestricted upload (CVSS 5.3, itsourcecode Laravel Accounting System)
- [CVE-2023-40819](https://cve.now/CVE-2023-40819.md): ID4Portais in version \< V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability. (CVSS 6.1)
- [CVE-2024-28739](https://cve.now/CVE-2024-28739.md): An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter. (CVSS 9.6)
- [CVE-2024-28740](https://cve.now/CVE-2024-28740.md): Cross Site Scripting vulnerability in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via the additonal-content (CVSS 6.1)
- [CVE-2024-30170](https://cve.now/CVE-2024-30170.md): PrivX before 34.0 allows data exfiltration and denial of service via the REST API. (CVSS 7.5)
- [CVE-2024-33897](https://cve.now/CVE-2024-33897.md): A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in (CVSS 9.1)
- [CVE-2024-36424](https://cve.now/CVE-2024-36424.md): K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer deref (CVSS 5.5)
- [CVE-2024-39225](https://cve.now/CVE-2024-39225.md): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, (CVSS 9.8)
- [CVE-2024-39226](https://cve.now/CVE-2024-39226.md): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, (CVSS 4.3)
- [CVE-2024-39227](https://cve.now/CVE-2024-39227.md): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, (CVSS 9.8)
- [CVE-2024-39228](https://cve.now/CVE-2024-39228.md): GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, (CVSS 9.8)
- [CVE-2024-39229](https://cve.now/CVE-2024-39229.md): An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X3 (CVSS 6.5)
- [CVE-2024-40101](https://cve.now/CVE-2024-40101.md): A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote at (CVSS 7.2, microweber/microweber)
- [CVE-2024-41226](https://cve.now/CVE-2024-41226.md): A CSV injection vulnerability in Automation Anywhere Automation 360 version 21094 allows attackers to execute arbitrary code via a crafted p (CVSS 8.8)
- [CVE-2024-41270](https://cve.now/CVE-2024-41270.md): An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecat (CVSS 9.1, github.com/appleboy/gorush)
- [CVE-2024-41333](https://cve.now/CVE-2024-41333.md): A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code (CVSS 6.1)
- [CVE-2024-41616](https://cve.now/CVE-2024-41616.md): D-Link DIR-300 REVA FIRMWARE v1.06B05\_WW contains hardcoded credentials in the Telnet service. (CVSS 8.8)
- [CVE-2024-42218](https://cve.now/CVE-2024-42218.md): 1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by bypassing macOS-specific security mechanisms. (CVSS 6.3)
- [CVE-2024-42219](https://cve.now/CVE-2024-42219.md): 1Password 8 before 8.10.36 for macOS allows local attackers to exfiltrate vault items because XPC inter-process communication validation is (CVSS 7.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.