# CVEs published 2024-08-07

118 CVEs were published on August 7, 2024: 11 critical, 42 high. Days are UTC.

- [CVE-2024-6893](https://cve.now/CVE-2024-6893.md): Journyx Unauthenticated XML External Entities Injection (CVSS 7.5, Journyx)
- [CVE-2024-6892](https://cve.now/CVE-2024-6892.md): Journyx Reflected Cross Site Scripting (CVSS 6.1, Journyx)
- [CVE-2024-6891](https://cve.now/CVE-2024-6891.md): Journyx Authenticated Remote Code Execution (CVSS 8.8, Journyx)
- [CVE-2024-6890](https://cve.now/CVE-2024-6890.md): Journyx Unauthenticated Password Reset Bruteforce (CVSS 9.8, Journyx)
- [CVE-2024-6707](https://cve.now/CVE-2024-6707.md): Open WebUI Arbitrary File Upload + Path Traversal (CVSS 7.5, Open WebUI)
- [CVE-2024-6706](https://cve.now/CVE-2024-6706.md): Open WebUI Stored Cross-Site Scripting (CVSS 6.3, Open WebUI · open-webui)
- [CVE-2024-41912](https://cve.now/CVE-2024-41912.md): A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. (CVSS 9.8, HP Poly Clariti Manager)
- [CVE-2024-7585](https://cve.now/CVE-2024-7585.md): Tenda i22 apPortalAuth formApPortalWebAuth buffer overflow (CVSS 8.7, Tenda i22)
- [CVE-2024-7143](https://cve.now/CVE-2024-7143.md): Pulpcore: rbac permissions incorrectly assigned in tasks that create objects (CVSS 6.7, pulp · Red Hat Ansible Automation Platform +3)
- [CVE-2024-20451](https://cve.now/CVE-2024-20451.md): Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5 (CVSS 7.5, Cisco Small Business IP Phones)
- [CVE-2024-20454](https://cve.now/CVE-2024-20454.md): Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5 (CVSS 9.8, Cisco Small Business IP Phones)
- [CVE-2024-20450](https://cve.now/CVE-2024-20450.md): Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA5 (CVSS 9.8, Cisco Small Business IP Phones)
- [CVE-2024-20479](https://cve.now/CVE-2024-20479.md): A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack ag (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2024-20443](https://cve.now/CVE-2024-20443.md): A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack ag (CVSS 5.4, Cisco Adaptive Security Appliance (ASA) Software · Cisco Id…)
- [CVE-2024-7061](https://cve.now/CVE-2024-7061.md): Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. (CVSS 5.5, Okta Verify for Windows)
- [CVE-2024-7584](https://cve.now/CVE-2024-7584.md): Tenda i22 apPortalPhoneAuth formApPortalPhoneAuth buffer overflow (CVSS 8.7, Tenda i22)
- [CVE-2024-7583](https://cve.now/CVE-2024-7583.md): Tenda i22 apPortalOneKeyAuth formApPortalOneKeyAuth buffer overflow (CVSS 8.7, Tenda i22)
- [CVE-2024-7582](https://cve.now/CVE-2024-7582.md): Tenda i22 apPortalAccessCodeAuth formApPortalAccessCodeAuth buffer overflow (CVSS 8.7, Tenda i22)
- [CVE-2024-42250](https://cve.now/CVE-2024-42250.md): cachefiles: add missing lock protection when polling (CVSS 7.8, Linux)
- [CVE-2024-42249](https://cve.now/CVE-2024-42249.md): spi: don't unoptimize message in spi\_async() (CVSS 7.8, Linux)
- [CVE-2024-42248](https://cve.now/CVE-2024-42248.md): tty: serial: ma35d1: Add a NULL check for of\_node (no CVSS, Linux)
- [CVE-2024-42247](https://cve.now/CVE-2024-42247.md): wireguard: allowedips: avoid unaligned 64-bit memory accesses (CVSS 7.5, Linux)
- [CVE-2024-42246](https://cve.now/CVE-2024-42246.md): net, sunrpc: Remap EPERM in case of connection failure in xs\_tcp\_setup\_socket (no CVSS, Linux)
- [CVE-2024-42245](https://cve.now/CVE-2024-42245.md): Revert "sched/fair: Make sure to try to detach at least one movable task" (no CVSS, Linux)
- [CVE-2024-42244](https://cve.now/CVE-2024-42244.md): USB: serial: mos7840: fix crash on resume (no CVSS, Linux)
- [CVE-2024-42243](https://cve.now/CVE-2024-42243.md): mm/filemap: make MAX\_PAGECACHE\_ORDER acceptable to xarray (no CVSS, Linux)
- [CVE-2024-42242](https://cve.now/CVE-2024-42242.md): mmc: sdhci: Fix max\_seg\_size for 64KiB PAGE\_SIZE (no CVSS, Linux)
- [CVE-2024-42241](https://cve.now/CVE-2024-42241.md): mm/shmem: disable PMD-sized page cache if needed (no CVSS, Linux)
- [CVE-2024-42240](https://cve.now/CVE-2024-42240.md): x86/bhi: Avoid warning in #DB handler due to BHI mitigation (no CVSS, Linux)
- [CVE-2024-42239](https://cve.now/CVE-2024-42239.md): bpf: Fail bpf\_timer\_cancel when callback is being cancelled (no CVSS, Linux)
- [CVE-2024-42238](https://cve.now/CVE-2024-42238.md): firmware: cs\_dsp: Return error if block header overflows file (no CVSS, Linux)
- [CVE-2024-42237](https://cve.now/CVE-2024-42237.md): firmware: cs\_dsp: Validate payload length before processing block (no CVSS, Linux)
- [CVE-2024-42236](https://cve.now/CVE-2024-42236.md): usb: gadget: configfs: Prevent OOB read/write in usb\_string\_copy() (CVSS 7.8, Linux)
- [CVE-2024-42235](https://cve.now/CVE-2024-42235.md): s390/mm: Add NULL pointer check to crst\_table\_free() base\_crst\_free() (CVSS 7.8, Linux)
- [CVE-2024-42234](https://cve.now/CVE-2024-42234.md): mm: fix crashes from deferred split racing folio migration (CVSS 7.8, Linux)
- [CVE-2024-42233](https://cve.now/CVE-2024-42233.md): filemap: replace pte\_offset\_map() with pte\_offset\_map\_nolock() (CVSS 7.8, Linux)
- [CVE-2024-42232](https://cve.now/CVE-2024-42232.md): libceph: fix race between delayed\_work() and ceph\_monc\_stop() (CVSS 9.8, Linux)
- [CVE-2024-7581](https://cve.now/CVE-2024-7581.md): Tenda A301 WifiBasicSet formWifiBasicSet stack-based overflow (CVSS 8.7, Tenda A301)
- [CVE-2024-7580](https://cve.now/CVE-2024-7580.md): Alien Technology ALR-F800 system.html os command injection (CVSS 5.3, Alien Technology ALR-F800)
- [CVE-2024-7579](https://cve.now/CVE-2024-7579.md): Alien Technology ALR-F800 File Name upgrade.cgi popen os command injection (CVSS 5.3, Alien Technology ALR-F800)
- [CVE-2024-43045](https://cve.now/CVE-2024-43045.md): Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ (CVSS 6.3, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2024-43044](https://cve.now/CVE-2024-43044.md): Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by (CVSS 8.8, Jenkins Project Jenkins · org.jenkins-ci.main:remoting +1)
- [CVE-2024-7578](https://cve.now/CVE-2024-7578.md): Alien Technology ALR-F800 cmd.php improper authorization (CVSS 6.9, Alien Technology ALR-F800)
- [CVE-2024-7355](https://cve.now/CVE-2024-7355.md): Organization chart \<= 1.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via title\_input and node\_description Parameters (CVSS 4.9, wpdevart Organization chart)
- [CVE-2024-7353](https://cve.now/CVE-2024-7353.md): Accept Stripe Payments \<= 2.0.86 - Authenticated (Contributor+) Stored Cross-Site Scripting via accept\_stripe\_payment\_ng Shortcode (CVSS 5.4, mra13 Accept Stripe Payments)
- [CVE-2024-6522](https://cve.now/CVE-2024-6522.md): Modern Events Calendar \<= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery (CVSS 8.5, Webnus Modern Events Calendar · webnus/ Modern Events Calen…)
- [CVE-2024-7267](https://cve.now/CVE-2024-7267.md): Internal infrastructure data leak in EZD RP (CVSS 7.1, Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…)
- [CVE-2024-7266](https://cve.now/CVE-2024-7266.md): Users listing in EZD RP (CVSS 7.1, Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…)
- [CVE-2024-7265](https://cve.now/CVE-2024-7265.md): Privilege Escalation in EZD RP (CVSS 8.7, Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut…)
- [CVE-2024-7553](https://cve.now/CVE-2024-7553.md): Accessing Untrusted Directory May Allow Local Privilege Escalation (CVSS 7.3, MongoDB Server · MongoDB C Driver +1)
- [CVE-2024-5290](https://cve.now/CVE-2024-5290.md): An issue was discovered in Ubuntu wpa\_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged att (CVSS 8.8, Canonical wpa\_supplicant)
- [CVE-2024-42062](https://cve.now/CVE-2024-42062.md): Apache CloudStack: User Key Exposure to Domain Admins (CVSS 7.2, Apache Software Foundation Apache CloudStack)
- [CVE-2024-42222](https://cve.now/CVE-2024-42222.md): Apache CloudStack: Unauthorised Network List Access (CVSS 4.3, Apache Software Foundation Apache CloudStack)
- [CVE-2024-6494](https://cve.now/CVE-2024-6494.md): WordPress File Upload \< 4.24.8 - Unauthenticated Stored XSS (CVSS 6.1, WordPress File Upload)
- [CVE-2024-3973](https://cve.now/CVE-2024-3973.md): House Manager \<= 1.0.8.4 - Reflected XSS (CVSS 4.8, House Manager)
- [CVE-2024-36130](https://cve.now/CVE-2024-36130.md): An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to (CVSS 9.8, Ivanti EPMM)
- [CVE-2024-36131](https://cve.now/CVE-2024-36131.md): An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbi (CVSS 8.8, Ivanti EPMM)
- [CVE-2024-36132](https://cve.now/CVE-2024-36132.md): Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access (CVSS 8.2, Ivanti EPMM)
- [CVE-2024-37403](https://cve.now/CVE-2024-37403.md): Ivanti Docs@Work for Android, before 2.26.0 is affected by the 'Dirty Stream' vulnerability. (CVSS 5.0, Ivanti Docs@Work)
- [CVE-2024-34788](https://cve.now/CVE-2024-34788.md): An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to access potentially sen (CVSS 5.3, Ivanti EPMM)
- [CVE-2024-34636](https://cve.now/CVE-2024-34636.md): Use of implicit intent for sensitive communication in Samsung Email prior to version 6.1.94.2 allows local attackers to get sensitive inform (CVSS 4.0, Samsung Mobile Samsung Email)
- [CVE-2024-34635](https://cve.now/CVE-2024-34635.md): Out-of-bounds read in parsing textbox object in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2024-34634](https://cve.now/CVE-2024-34634.md): Out-of-bounds read in parsing connected object list in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2024-34633](https://cve.now/CVE-2024-34633.md): Out-of-bounds read in parsing object header in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2024-34632](https://cve.now/CVE-2024-34632.md): Out-of-bounds read in uuid parsing in Samsung Notes prior to version 4.4.21.62 allows local attacker to access unauthorized memory. (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2024-34631](https://cve.now/CVE-2024-34631.md): Out-of-bounds read in applying new binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34630](https://cve.now/CVE-2024-34630.md): Out-of-bounds read in applying own binary with textbox in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially rea (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34629](https://cve.now/CVE-2024-34629.md): Out-of-bounds read in applying binary with text common object in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentia (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34628](https://cve.now/CVE-2024-34628.md): Out-of-bounds read in applying binary with path in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memor (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34627](https://cve.now/CVE-2024-34627.md): Out-of-bounds read in parsing implemention in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34626](https://cve.now/CVE-2024-34626.md): Out-of-bounds read in applying own binary in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34625](https://cve.now/CVE-2024-34625.md): Out-of-bounds read in applying connection point in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memor (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34624](https://cve.now/CVE-2024-34624.md): Out-of-bounds read in applying paragraphs in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34623](https://cve.now/CVE-2024-34623.md): Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially exec (CVSS 7.8, Samsung Mobile Samsung Notes)
- [CVE-2024-34622](https://cve.now/CVE-2024-34622.md): Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially execute arbitra (CVSS 7.8, Samsung Mobile Samsung Notes)
- [CVE-2024-34621](https://cve.now/CVE-2024-34621.md): Out-of-bounds read in applying binary with data in Samsung Notes prior to version 4.4.21.62 allows local attackers to potentially read memor (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2024-34620](https://cve.now/CVE-2024-34620.md): Improper privilege management in SumeNNService prior to SMR Aug-2024 Release 1 allows local attackers to start privileged service. (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2024-34619](https://cve.now/CVE-2024-34619.md): Improper input validation in librtp.so prior to SMR Aug-2024 Release 1 allows remote attackers to execute arbitrary code with system privile (CVSS 7.5, Samsung Mobile Devices)
- [CVE-2024-34618](https://cve.now/CVE-2024-34618.md): Improper access control in System property prior to SMR Aug-2024 Release 1 allows local attackers to access cell related information. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34617](https://cve.now/CVE-2024-34617.md): Improper handling of insufficient permission in Telephony prior to SMR Aug-2024 Release 1 allows local attackers to configure default Messag (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34616](https://cve.now/CVE-2024-34616.md): Improper handling of insufficient permission in KnoxDualDARPolicy prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-34615](https://cve.now/CVE-2024-34615.md): Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to cause memory corruption. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-34614](https://cve.now/CVE-2024-34614.md): Out-of-bound write in libsmat.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2024-34613](https://cve.now/CVE-2024-34613.md): Improper access control in Galaxy Watch prior to SMR Aug-2024 Release 1 allows local attackers to access sensitive information of Galaxy wat (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34612](https://cve.now/CVE-2024-34612.md): Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2024-34611](https://cve.now/CVE-2024-34611.md): Improper access control in KnoxService prior to SMR Aug-2024 Release 1 allows local attackers to get sensitive information. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-34610](https://cve.now/CVE-2024-34610.md): Improper access control in ExtControlDeviceService prior to SMR Aug-2024 Release 1 allows local attackers to access protected data. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-34609](https://cve.now/CVE-2024-34609.md): Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting servic (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34608](https://cve.now/CVE-2024-34608.md): Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting s (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34607](https://cve.now/CVE-2024-34607.md): Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting ser (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34606](https://cve.now/CVE-2024-34606.md): Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting serv (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34605](https://cve.now/CVE-2024-34605.md): Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting se (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34604](https://cve.now/CVE-2024-34604.md): Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting service (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-34479](https://cve.now/CVE-2024-34479.md): SourceCodester Computer Laboratory Management System 1.0 allows classes/Master.php id SQL Injection. (CVSS 9.8)
- [CVE-2024-34480](https://cve.now/CVE-2024-34480.md): SourceCodester Computer Laboratory Management System 1.0 allows admin/category/view\_category.php id SQL Injection. (CVSS 9.8)
- [CVE-2024-41237](https://cve.now/CVE-2024-41237.md): A SQL injection vulnerability in /smsa/teacher\_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute (CVSS 9.8)
- [CVE-2024-41239](https://cve.now/CVE-2024-41239.md): A Stored Cross Site Scripting (XSS) vulnerability was found in "/smsa/add\_class\_submit.php" in Responsive School Management System v3.2.0, w (CVSS 5.9)
- [CVE-2024-41240](https://cve.now/CVE-2024-41240.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/teacher\_login.php" in Kashipara Responsive School Management Syste (CVSS 6.3)
- [CVE-2024-41241](https://cve.now/CVE-2024-41241.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin\_login.php" in Kashipara Responsive School Management System (CVSS 4.8)
- [CVE-2024-41242](https://cve.now/CVE-2024-41242.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /smsa/student\_login.php in Kashipara Responsive School Management System v (CVSS 5.5)
- [CVE-2024-41243](https://cve.now/CVE-2024-41243.md): An Incorrect Access Control vulnerability was found in /smsa/view\_marks.php in Kashipara Responsive School Management System v3.2.0, which a (CVSS 5.3)
- [CVE-2024-41244](https://cve.now/CVE-2024-41244.md): An Incorrect Access Control vulnerability was found in /smsa/view\_class.php in Kashipara Responsive School Management System v3.2.0, which a (CVSS 7.5)
- [CVE-2024-41245](https://cve.now/CVE-2024-41245.md): An Incorrect Access Control vulnerability was found in /smsa/view\_teachers.php in Kashipara Responsive School Management System v3.2.0, whic (CVSS 7.5)
- [CVE-2024-41246](https://cve.now/CVE-2024-41246.md): An Incorrect Access Control vulnerability was found in /smsa/admin\_dashboard.php in Kashipara Responsive School Management System v3.2.0, wh (CVSS 5.3)
- [CVE-2024-41247](https://cve.now/CVE-2024-41247.md): An Incorrect Access Control vulnerability was found in /smsa/add\_class.php and /smsa/add\_class\_submit.php in Kashipara Responsive School Man (CVSS 9.1)
- [CVE-2024-41248](https://cve.now/CVE-2024-41248.md): An Incorrect Access Control vulnerability was found in /smsa/add\_subject.php and /smsa/add\_subject\_submit.php in Kashipara Responsive School (CVSS 7.5)
- [CVE-2024-41249](https://cve.now/CVE-2024-41249.md): An Incorrect Access Control vulnerability was found in /smsa/view\_subject.php in Kashipara Responsive School Management System v3.2.0, which (CVSS 7.5)
- [CVE-2024-41250](https://cve.now/CVE-2024-41250.md): An Incorrect Access Control vulnerability was found in /smsa/view\_students.php in Kashipara Responsive School Management System v3.2.0, whic (CVSS 5.3)
- [CVE-2024-41251](https://cve.now/CVE-2024-41251.md): An Incorrect Access Control vulnerability was found in /smsa/admin\_teacher\_register\_approval.php and /smsa/admin\_teacher\_register\_approval\_s (CVSS 6.5)
- [CVE-2024-41252](https://cve.now/CVE-2024-41252.md): An Incorrect Access Control vulnerability was found in /smsa/admin\_student\_register\_approval.php and /smsa/admin\_student\_register\_approval\_s (CVSS 5.3)
- [CVE-2024-41308](https://cve.now/CVE-2024-41308.md): An issue in the Ping feature of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and gain root- (CVSS 8.4)
- [CVE-2024-41309](https://cve.now/CVE-2024-41309.md): An issue in the Hardware info module of IT Solutions Enjay CRM OS v1.0 allows attackers to escape the restricted terminal environment and ga (CVSS 8.4)
- [CVE-2024-41432](https://cve.now/CVE-2024-41432.md): An IP Spoofing vulnerability has been discovered in Likeshop up to 2.5.7.20210811. (CVSS 5.3)
- [CVE-2024-41989](https://cve.now/CVE-2024-41989.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 7.5, django)
- [CVE-2024-41990](https://cve.now/CVE-2024-41990.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 7.5, django)
- [CVE-2024-41991](https://cve.now/CVE-2024-41991.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 7.5, django)
- [CVE-2024-42005](https://cve.now/CVE-2024-42005.md): An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. (CVSS 9.8, django)
- [CVE-2024-43199](https://cve.now/CVE-2024-43199.md): Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.