CVEs published August 8, 2024
110 CVEs were published on August 8, 2024: 11 critical, 37 high.
- Published
- 110
- Critical
- 11
- High
- 37
- Medium
- 53
- Low
- 4
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- GitLab
- 11
- Huawei HarmonyOS · Huawei EMUI
- 10
- Linux
- 7
- Vonets VAR1200-H · Vonets VAR1200-L +12
- 7
- shopware · shopware/core +1
- 4
- Dorsett Controls InfoScan
- 3
- Tenda FH1206
- 3
- Avaya Aura System Manager
- 2
- Microsoft Edge
- 2
- Microsoft Windows
- 2
Critical 11
- CVE-2024-39791Vonets WiFi Bridges Stack-based Buffer OverflowVonets VAR1200-H · Vonets VAR1200-L +12
- CVE-2024-39815Vonets WiFi Bridges Improper Check or Handling of Exceptional ConditionsVonets VAR1200-H · Vonets VAR1200-L +12
- CVE-2024-37023Vonets WiFi Bridges Command InjectionVonets VAR1200-H · Vonets VAR1200-L +12
- CVE-2024-42366VR Overlay RCEvrcx-team VRCX
- CVE-2024-7490Remote Code Execution in Advanced Software Framework DHCP serverMicrochip Techology Advanced Software Framework
- CVE-2024-3659Command injection in KAON AR2140 routersKAON Group AR2140
- CVE-2024-42037Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confideHuawei HarmonyOS · Huawei EMUI
- CVE-2024-7350Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeoverreputeinfosystems Appointment Booking Calendar Plugin and S…
- CVE-2024-40477A SQL injection vulnerability in "/oahms/admin/forgot-password.php" in PHPGurukul Old Age Home Management System v1.0 allows an attacker to
- CVE-2024-40482An Unrestricted file upload vulnerability was found in "/Membership/edit_member.php" of Kashipara Live Membership System v1.0, which allows
- CVE-2024-40486A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL comm
High 37
- CVE-2024-7615Tenda FH1206 fromSafeUrlFilter stack-based overflowTenda FH1206
- CVE-2024-7614Tenda FH1206 qossetting fromqossetting stack-based overflowTenda FH1206
- CVE-2024-7613Tenda FH1206 GstDhcpSetSer fromGstDhcpSetSer buffer overflowTenda FH1206
- CVE-2024-7557Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift aiodh-dashboard · Red Hat RHOAI-2.14-RHEL-8 +1
- CVE-2024-7006Libtiff: null pointer dereference in tif_dirinfo.clibtiff · Red Hat Enterprise Linux
- CVE-2024-38218Microsoft Edge (HTML-based) Memory Corruption VulnerabilityMicrosoft Edge
- CVE-2024-42001Vonets WiFi Bridges Forced BrowsingVonets VAR1200-H · Vonets VAR1200-L +12
- CVE-2024-41936Vonets WiFi Bridges Path TraversalVonets VAR1200-H · Vonets VAR1200-L +12
- CVE-2024-29082Vonets WiFi Bridges Improper Access ControlVonets VAR1200-H · Vonets VAR1200-L +12
- CVE-2024-41161Vonets WiFi Bridges Use of Hard-coded CredentialsVonets VAR1200-H · Vonets VAR1200-L +12
- CVE-2024-0101NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in ipfilter, where improper ipfilter definitions could enNVIDIA Mellanox OS · NVIDIA ONYX +3
- CVE-2024-0107NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-oNVIDIA GPU Display Driver, vGPU Software, Cloud Gaming
- CVE-2024-42365Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplanasterisk
- CVE-2024-0108NVIDIA Jetson Linux contains a vulnerability in NvGPU where error handling paths in GPU MMU mapping code fail to clean up a failed mapping aNVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2024-42357Shopware vulnerable to blind SQL-injection in DAL aggregationsshopware · shopware/core +1
- CVE-2024-42356Shopware vulnerable to Server Side Template Injection in Twig using Context functionsshopware · shopware/core +1
- CVE-2024-42355Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tagshopware · shopware/core +1
- CVE-2024-41942JupyterHub has a privilege escalation vulnerability with the `admin:users` scopejupyterhub
- CVE-2024-7348PostgreSQL relation replacement during pg_dump executes arbitrary SQLPostgreSQL
- CVE-2024-42038Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect serviceHuawei HarmonyOS · Huawei EMUI
- CVE-2024-42035Permission control vulnerability in the App Multiplier module Impact:Successful exploitation of this vulnerability may affect functionality Huawei HarmonyOS · Huawei EMUI
- CVE-2024-42031Access permission verification vulnerability in the Settings module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-42256cifs: Fix server re-repick on subrequest retryLinux
- CVE-2024-42253gpio: pca953x: fix pca953x_irq_bus_sync_unlock raceLinux
- CVE-2024-22069Permission and Access Control Vulnerability in ZXV10 XT802/ET301ZTE ZXV10 XT802 · ZTE ZXV10 ET301
- CVE-2024-7150Slider by 10Web – Responsive Image Slider <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id ParameterSlider by 10Web – Responsive Image Slider
- CVE-2024-7548LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-7492MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options UpdateMainWP Child Reports
- CVE-2024-38202Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-7486MultiPurpose <= 1.2.0 - Authenticated (Contributor+) PHP Object Injectioncodename065 MultiPurpose
- CVE-2024-7560News Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injectioncodename065 News Flash
- CVE-2024-7561The Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injectionshahriar0822 The Next
- CVE-2023-33206Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR16, 4.0.0 SR06, 4.1.0 SR04, 4.2.0 SR03, and 4.3.0 SR01 fails to validate symlink
- CVE-2024-40474A Reflected Cross Site Scripting (XSS) vulnerability was found in "edit-cate.php" in SourceCodester House Rental Management System v1.0.
- CVE-2024-40476A Cross-Site Request Forgery (CSRF) vulnerability was found in SourceCodester Best House Rental Management System v1.0.
- CVE-2024-40487A Stored Cross Site Scripting (XSS) vulnerability was found in "/view_type.php" of Kashipara Live Membership System v1.0, which allows remot
- CVE-2024-40488A Cross-Site Request Forgery (CSRF) vulnerability was found in the Kashipara Live Membership System v1.0.
Medium, low and unrated 62
- CVE-2024-37283Elastic Agent Insertion of Sensitive Information into Log FileElastic Agent
- CVE-2024-7616Edimax IC-6220DC/IC-5150W ipcam_cgi cgiFormString command injectionEdimax IC-6220DC · Edimax IC-5150W
- CVE-2024-5445Ecosystem Agent Insufficient Transport Layer SecurityN-able Ecosystem Agent
- CVE-2024-38200Microsoft Office Spoofing VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2024-38219Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-43168Unbound: heap-buffer-overflow in unboundRed Hat Enterprise Linux · Red Hat OpenShift Container P… +1
- CVE-2024-43167Unbound: null pointer dereference in unboundRed Hat Enterprise Linux · Red Hat OpenShift Container P… +1
- CVE-2024-7272FFmpeg swresample.c fill_audiodata heap-based overflowFFmpeg
- CVE-2024-42408Dorsett Controls InfoScan Path TraversalDorsett Controls InfoScan
- CVE-2024-39287Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized ActorDorsett Controls InfoScan
- CVE-2024-42493Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized ActorDorsett Controls InfoScan
- CVE-2024-0104NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2 and MetroX-3 XC contain a vulnerability in the LDAP AAA component, where a user can cause impropeNVIDIA Mellanox OS · NVIDIA ONYX +3
- CVE-2024-7394Concrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName()Concrete CMS · concrete5/concrete5
- CVE-2024-0102NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm, where an attacker can cause an out-of-bounds read issue by deceiNVIDIA CUDA Toolkit
- CVE-2024-7480Improper access control in Avaya Aura System ManagerAvaya Aura System Manager
- CVE-2024-7477Avaya Aura System Manager SQL injection vulnerabilityAvaya Aura System Manager
- CVE-2024-42354Shopware vulnerable to Improper Access Control with ManyToMany associations in store-apishopware · shopware/core +1
- CVE-2024-2800Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-3035Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2024-3114Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-3958Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2024-4207Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-5423Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-7554Exposure of Sensitive Information to an Unauthorized Actor in GitLabGitLab
- CVE-2024-7610Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-4210Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-4784Authentication Bypass by Primary Weakness in GitLabGitLab
- CVE-2024-6329Improper Encoding or Escaping of Output in GitLabGitLab
- CVE-2024-42036Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service Huawei HarmonyOS · Huawei EMUI
- CVE-2024-42034LaunchAnywhere vulnerability in the account module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-42033Access control vulnerability in the security verification module mpact: Successful exploitation of this vulnerability will affect integrity Huawei HarmonyOS · Huawei EMUI
- CVE-2024-42032Access permission verification vulnerability in the Contacts module Impact: Successful exploitation of this vulnerability may affect serviceHuawei HarmonyOS · Huawei EMUI
- CVE-2024-42257ext4: use memtostr_pad() for s_volume_nameLinux
- CVE-2024-42255tpm: Use auth only after NULL check in tpm_buf_check_hmac_response()Linux
- CVE-2024-42254io_uring: fix error pbuf checkingLinux
- CVE-2024-42252closures: Change BUG_ON() to WARN_ON()Linux
- CVE-2024-42251mm: page_ref: remove folio_try_get_rcu()Linux
- CVE-2024-42030Access permission verification vulnerability in the content sharing pop-up module Impact: Successful exploitation of this vulnerability may Huawei HarmonyOS · Huawei EMUI
- CVE-2023-7265Permission verification vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect availabilitHuawei HarmonyOS · Huawei EMUI
- CVE-2024-6884Gutenberg Blocks with AI by Kadence WP < 3.2.39 - Contributor+ Stored XSSGutenberg Blocks with AI by Kadence WP
- CVE-2024-6481Search Filter Pro < 2.5.18 - Admin+ Stored XSSSearch & Filter Pro
- CVE-2024-6824Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Updateleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-5226Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Uploaddaniyalahmedk Fuse Social Floating Sidebar
- CVE-2024-5668Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributesfooplugins Lightbox & Modal Popup WordPress Plugin – FooBox
- CVE-2024-6869Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposuresbouey Falang multilanguage for WordPress
- CVE-2024-6987Orchid Store <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activationthemebeez Orchid Store
- CVE-2024-6552Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosureameliabooking Booking for Appointments and Events Calendar…
- CVE-2024-6254Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgerythemefusecom Brizy – Page Builder
- CVE-2024-21302Windows Secure Kernel Mode Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-24062Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR12, 4.0.0 SR04, 4.1.0 SR02, and 4.2.0 SR01 fails to validate the directory struc
- CVE-2023-24063Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process.
- CVE-2023-24064Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR4 fails to validate /etc/initab during the Pre-Boot Authorization (PBA) process.
- CVE-2023-28865Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory conte
- CVE-2023-40261Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR17, 4.0.0 SR07, 4.1.0 SR04, 4.2.0 SR04, and 4.3.0 SR02 fails to validate file at
- CVE-2024-37382An issue discovered in import host feature in Ab Initio Metadata Hub and Authorization Gateway before 4.3.1.1 allows attackers to run arbitr
- CVE-2024-40473A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.
- CVE-2024-40475SourceCodester Best House Rental Management System v1.0 is vulnerable to Incorrect Access Control via /rental/payment_report.php, /rental/ba
- CVE-2024-40481A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0,
- CVE-2024-40484A Reflected Cross Site Scripting (XSS) vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, whi
- CVE-2024-41238A SQL injection vulnerability in /smsa/student_login.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute
- CVE-2024-41481Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the Mermaid component.
- CVE-2024-41482Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.