CVEs published August 7, 2024
118 CVEs were published on August 7, 2024: 11 critical, 42 high.
- Published
- 118
- Critical
- 11
- High
- 42
- Medium
- 54
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Linux
- 19
- Samsung Mobile Devices
- 17
- Samsung Mobile Samsung Notes
- 15
- django
- 4
- Ivanti EPMM
- 4
- Journyx
- 4
- Tenda i22
- 4
- Alien Technology ALR-F800
- 3
- Cisco Small Business IP Phones
- 3
- Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…
- 3
Critical 11
- CVE-2024-6890Journyx Unauthenticated Password Reset BruteforceJournyx
- CVE-2024-41912A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices.HP Poly Clariti Manager
- CVE-2024-20454Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5Cisco Small Business IP Phones
- CVE-2024-20450Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5Cisco Small Business IP Phones
- CVE-2024-42232libceph: fix race between delayed_work() and ceph_monc_stop()Linux
- CVE-2024-36130An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network toIvanti EPMM
- CVE-2024-34479SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection.
- CVE-2024-34480SourceCodester Computer Laboratory Management System 1.0 allows admin/category/view_category.php id SQL Injection.
- CVE-2024-41237A SQL injection vulnerability in /smsa/teacher_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute
- CVE-2024-41247An Incorrect Access Control vulnerability was found in /smsa/add_class.php and /smsa/add_class_submit.php in Kashipara Responsive School Man
- CVE-2024-42005An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
High 42
- CVE-2024-6893Journyx Unauthenticated XML External Entities InjectionJournyx
- CVE-2024-6891Journyx Authenticated Remote Code ExecutionJournyx
- CVE-2024-6707Open WebUI Arbitrary File Upload + Path TraversalOpen WebUI
- CVE-2024-7585Tenda i22 apPortalAuth formApPortalWebAuth buffer overflowTenda i22
- CVE-2024-20451Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5Cisco Small Business IP Phones
- CVE-2024-7584Tenda i22 apPortalPhoneAuth formApPortalPhoneAuth buffer overflowTenda i22
- CVE-2024-7583Tenda i22 apPortalOneKeyAuth formApPortalOneKeyAuth buffer overflowTenda i22
- CVE-2024-7582Tenda i22 apPortalAccessCodeAuth formApPortalAccessCodeAuth buffer overflowTenda i22
- CVE-2024-42250cachefiles: add missing lock protection when pollingLinux
- CVE-2024-42249spi: don't unoptimize message in spi_async()Linux
- CVE-2024-42247wireguard: allowedips: avoid unaligned 64-bit memory accessesLinux
- CVE-2024-42236usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()Linux
- CVE-2024-42235s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()Linux
- CVE-2024-42234mm: fix crashes from deferred split racing folio migrationLinux
- CVE-2024-42233filemap: replace pte_offset_map() with pte_offset_map_nolock()Linux
- CVE-2024-7581Tenda A301 WifiBasicSet formWifiBasicSet stack-based overflowTenda A301
- CVE-2024-43044Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system byJenkins Project Jenkins · org.jenkins-ci.main:remoting +1
- CVE-2024-6522Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request ForgeryWebnus Modern Events Calendar · webnus/ Modern Events Calen…
- CVE-2024-7267Internal infrastructure data leak in EZD RPNaukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…
- CVE-2024-7266Users listing in EZD RPNaukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…
- CVE-2024-7265Privilege Escalation in EZD RPNaukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…
- CVE-2024-7553Accessing Untrusted Directory May Allow Local Privilege EscalationMongoDB Server · MongoDB C Driver +1
- CVE-2024-5290An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attCanonical wpa_supplicant
- CVE-2024-42062Apache CloudStack: User Key Exposure to Domain AdminsApache Software Foundation Apache CloudStack
- CVE-2024-36131An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbiIvanti EPMM
- CVE-2024-36132Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access Ivanti EPMM
- CVE-2024-34623Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execSamsung Mobile Samsung Notes
- CVE-2024-34622Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitraSamsung Mobile Samsung Notes
- CVE-2024-34620Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service.Samsung Mobile Devices
- CVE-2024-34619Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privileSamsung Mobile Devices
- CVE-2024-34614Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2024-34612Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2024-41244An Incorrect Access Control vulnerability was found in /smsa/view_class.php in Kashipara Responsive School Management System v3.2.0, which a
- CVE-2024-41245An Incorrect Access Control vulnerability was found in /smsa/view_teachers.php in Kashipara Responsive School Management System v3.2.0, whic
- CVE-2024-41248An Incorrect Access Control vulnerability was found in /smsa/add_subject.php and /smsa/add_subject_submit.php in Kashipara Responsive School
- CVE-2024-41249An Incorrect Access Control vulnerability was found in /smsa/view_subject.php in Kashipara Responsive School Management System v3.2.0, which
- CVE-2024-41308An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root-
- CVE-2024-41309An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and ga
- CVE-2024-41989An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
- CVE-2024-41990An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
- CVE-2024-41991An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.django
- CVE-2024-43199Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user.
Medium, low and unrated 65
- CVE-2024-6892Journyx Reflected Cross Site ScriptingJournyx
- CVE-2024-6706Open WebUI Stored Cross-Site ScriptingOpen WebUI · open-webui
- CVE-2024-7143Pulpcore: rbac permissions incorrectly assigned in tasks that create objectspulp · Red Hat Ansible Automation Platform +3
- CVE-2024-20479A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack agCisco Identity Services Engine Software
- CVE-2024-20443A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack agCisco Adaptive Security Appliance (ASA) Software · Cisco Id…
- CVE-2024-7061Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking.Okta Verify for Windows
- CVE-2024-42248tty: serial: ma35d1: Add a NULL check for of_nodeLinux
- CVE-2024-42246net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socketLinux
- CVE-2024-42245Revert "sched/fair: Make sure to try to detach at least one movable task"Linux
- CVE-2024-42244USB: serial: mos7840: fix crash on resumeLinux
- CVE-2024-42243mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarrayLinux
- CVE-2024-42242mmc: sdhci: Fix max_seg_size for 64KiB PAGE_SIZELinux
- CVE-2024-42241mm/shmem: disable PMD-sized page cache if neededLinux
- CVE-2024-42240x86/bhi: Avoid warning in #DB handler due to BHI mitigationLinux
- CVE-2024-42239bpf: Fail bpf_timer_cancel when callback is being cancelledLinux
- CVE-2024-42238firmware: cs_dsp: Return error if block header overflows fileLinux
- CVE-2024-42237firmware: cs_dsp: Validate payload length before processing blockLinux
- CVE-2024-7580Alien Technology ALR-F800 system.html os command injectionAlien Technology ALR-F800
- CVE-2024-7579Alien Technology ALR-F800 File Name upgrade.cgi popen os command injectionAlien Technology ALR-F800
- CVE-2024-43045Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2024-7578Alien Technology ALR-F800 cmd.php improper authorizationAlien Technology ALR-F800
- CVE-2024-7355Organization chart <= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title_input and node_description Parameterswpdevart Organization chart
- CVE-2024-7353Accept Stripe Payments <= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcodemra13 Accept Stripe Payments
- CVE-2024-42222Apache CloudStack: Unauthorised Network List AccessApache Software Foundation Apache CloudStack
- CVE-2024-6494WordPress File Upload < 4.24.8 - Unauthenticated Stored XSSWordPress File Upload
- CVE-2024-3973House Manager <= 1.0.8.4 - Reflected XSSHouse Manager
- CVE-2024-37403Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability.Ivanti Docs@Work
- CVE-2024-34788An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially senIvanti EPMM
- CVE-2024-34636Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive informSamsung Mobile Samsung Email
- CVE-2024-34635Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memorySamsung Mobile Samsung Notes
- CVE-2024-34634Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorizedSamsung Mobile Samsung Notes
- CVE-2024-34633Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.Samsung Mobile Samsung Notes
- CVE-2024-34632Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory.Samsung Mobile Samsung Notes
- CVE-2024-34631Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.Samsung Mobile Samsung Notes
- CVE-2024-34630Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially reaSamsung Mobile Samsung Notes
- CVE-2024-34629Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentiaSamsung Mobile Samsung Notes
- CVE-2024-34628Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memorSamsung Mobile Samsung Notes
- CVE-2024-34627Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.Samsung Mobile Samsung Notes
- CVE-2024-34626Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.Samsung Mobile Samsung Notes
- CVE-2024-34625Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memorSamsung Mobile Samsung Notes
- CVE-2024-34624Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory.Samsung Mobile Samsung Notes
- CVE-2024-34621Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memorSamsung Mobile Samsung Notes
- CVE-2024-34618Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information.Samsung Mobile Devices
- CVE-2024-34617Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default MessagSamsung Mobile Devices
- CVE-2024-34616Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitiveSamsung Mobile Devices
- CVE-2024-34615Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption.Samsung Mobile Devices
- CVE-2024-34613Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy watSamsung Mobile Devices
- CVE-2024-34611Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information.Samsung Mobile Devices
- CVE-2024-34610Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data.Samsung Mobile Devices
- CVE-2024-34609Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting servicSamsung Mobile Devices
- CVE-2024-34608Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting sSamsung Mobile Devices
- CVE-2024-34607Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting serSamsung Mobile Devices
- CVE-2024-34606Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting servSamsung Mobile Devices
- CVE-2024-34605Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting seSamsung Mobile Devices
- CVE-2024-34604Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting serviceSamsung Mobile Devices
- CVE-2024-41239A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add_class_submit.php" in Responsive School Management System v3.2.0, w
- CVE-2024-41240A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher_login.php" in Kashipara Responsive School Management Syste
- CVE-2024-41241A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System
- CVE-2024-41242A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student_login.php in Kashipara Responsive School Management System v
- CVE-2024-41243An Incorrect Access Control vulnerability was found in /smsa/view_marks.php in Kashipara Responsive School Management System v3.2.0, which a
- CVE-2024-41246An Incorrect Access Control vulnerability was found in /smsa/admin_dashboard.php in Kashipara Responsive School Management System v3.2.0, wh
- CVE-2024-41250An Incorrect Access Control vulnerability was found in /smsa/view_students.php in Kashipara Responsive School Management System v3.2.0, whic
- CVE-2024-41251An Incorrect Access Control vulnerability was found in /smsa/admin_teacher_register_approval.php and /smsa/admin_teacher_register_approval_s
- CVE-2024-41252An Incorrect Access Control vulnerability was found in /smsa/admin_student_register_approval.php and /smsa/admin_student_register_approval_s
- CVE-2024-41432An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811.