CVEs published August 9, 2024
65 CVEs were published on August 9, 2024: 10 critical, 13 high. 1 is now in CISA KEV.
- Published
- 65
- Critical
- 10
- High
- 13
- Medium
- 40
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 28
Most affected products
- Zabbix
- 8
- SourceCodester Kortex Lite Advocate Office Management System
- 5
- openhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…
- 4
- Apache Software Foundation Apache Answer · github.com/apach…
- 2
- Apache Software Foundation Apache DolphinScheduler · org.ap…
- 2
- bdthemes Element Pack – Widgets, Templates & Addons for Ele…
- 2
- code-projects Simple Ticket Booking
- 2
- Concrete CMS · concrete5/concrete5
- 2
- SourceCodester Leads Manager Tool
- 2
- wp-cart-for-digital-products
- 2
Critical 10
- CVE-2024-42469CometVisu Backend for openHAB affected by RCE through path traversalopenhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…
- CVE-2024-42467CometVisu Backend for openHAB affected by SSRF/XSSopenhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…
- CVE-2024-22116Remote code execution within ping scriptZabbix
- CVE-2024-36461Direct access to memory pointers within the JS engine for modificationZabbix
- CVE-2024-3279Improper Access Control in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-38989izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js.@bunt/app
- CVE-2024-40480A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which al
- CVE-2024-41476AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card_detail.php.
- CVE-2024-41570An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network t
- CVE-2024-41577An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uplo
High 13
- CVE-2024-42473OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2024-42370Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflowlitestar-org litestar
- CVE-2023-31315Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while S3rd Gen AMD EPYC™ Processors · 1st Gen AMD EPYC™ Proces… +25
- CVE-2024-30188Apache DolphinScheduler: Resource File Read And Write VulnerabilityApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2024-29831Apache DolphinScheduler: RCE by arbitrary js executionApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2024-7408Information Disclosure Vulnerability in Airveda Air Quality MonitorAirveda Air Quality Monitor PM2.5 PM10
- CVE-2024-36462Allocation of resources without limits or throttling (uncontrolled resource consumption)Zabbix
- CVE-2024-36460Front-end audit log shows passwords in plaintextZabbix
- CVE-2024-7399Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackSamsung Electronics MagicINFO 9 Server
- CVE-2024-0113NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traverNVIDIA Mellanox OS · NVIDIA Skyway +2
- CVE-2023-50809In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt_7615.ko wireless driver does not properly validate an informat
- CVE-2024-37826A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
- CVE-2024-40479A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary
Medium, low and unrated 42
- CVE-2024-42468Path traversal (CometVisu)openhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…
- CVE-2024-42470CometVisu Backend for openHAB has a sensitive information disclosure vulnerabilityopenhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…
- CVE-2024-42367In aiohttp, compressed files as symlinks are not protected from path traversalaio-libs aiohttp · aiohttp
- CVE-2024-32765QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-38018IBM Aspera Shares session fixationIBM Aspera Shares
- CVE-2024-7645SourceCodester Clinics Patient Management System User Page users.php cross-site request forgerySourceCodester Clinics Patient Management System
- CVE-2024-7644SourceCodester Leads Manager Tool Add Leads add-leads.php cross site scriptingSourceCodester Leads Manager Tool
- CVE-2024-7643SourceCodester Leads Manager Tool Delete Leads delete-leads.php sql injectionSourceCodester Leads Manager Tool
- CVE-2024-7642SourceCodester Kortex Lite Advocate Office Management System activate_act.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-41888Apache Answer: The link for resetting user password is not Single-UseApache Software Foundation Apache Answer · github.com/apach…
- CVE-2024-41890Apache Answer: The link to reset the user's password will remain valid after sending a new linkApache Software Foundation Apache Answer · github.com/apach…
- CVE-2024-7641SourceCodester Kortex Lite Advocate Office Management System deactivate_act.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7640SourceCodester Kortex Lite Advocate Office Management System delete_register.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7639SourceCodester Kortex Lite Advocate Office Management System delete_act.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7638SourceCodester Kortex Lite Advocate Office Management System delete_client.php sql injectionSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7637code-projects Online Polling Registration registeracc.php sql injectioncode-projects Online Polling
- CVE-2024-7636code-projects Simple Ticket Booking Login authenticate.php sql injectioncode-projects Simple Ticket Booking
- CVE-2024-7635code-projects Simple Ticket Booking Registration register_insert.php sql injectioncode-projects Simple Ticket Booking
- CVE-2024-22123Zabbix Arbitrary File ReadZabbix
- CVE-2024-22114System Information Widget in Global View Dashboard exposes information about Hosts to Users without PermissionZabbix
- CVE-2024-6562affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosurecservit affiliate-toolkit – Multi-Network Affiliate & Amazo…
- CVE-2024-7410My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosureesthertyler My Custom CSS PHP & ADS
- CVE-2024-7412No Update Nag <= 1.4.12 - Unauthenticated Full Path Disclosurecoffee2code No Update Nag
- CVE-2024-7416Reveal Template <= 3.7 - Unauthenticated Full Path Disclosurecoffee2code Reveal Template
- CVE-2024-7414PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosureedgarrojas PDF Builder for WPForms
- CVE-2024-7413Obfuscate Email <= 3.8.1 - Unauthenticated Full Path Disclosurecoffee2code Obfuscate Email
- CVE-2024-7382Linkify Text <= 1.9.1 - Unauthenticated Full Path Disclosurecoffee2code Linkify Text
- CVE-2024-22122AT(GSM) Command InjectionZabbix
- CVE-2024-22121Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exeZabbix
- CVE-2024-6158Category Posts Widget (Free < 4.9.17, Pro < 4.9.13) - Admin+ Stored XSSCategory Posts Widget · term-and-category-based-posts-widget
- CVE-2024-6136WP eStore < 8.5.6 - Settings Reset via CSRFwp-cart-for-digital-products
- CVE-2024-6133WP eStore < 8.5.6 - Reflected XSS in Customer Searchwp-cart-for-digital-products
- CVE-2024-4359Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Arbitrary File Readbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-4360Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tagbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-0115NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled reNVIDIA CV-CUDA
- CVE-2024-4350Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS DisplayerConcrete CMS · concrete5/concrete5
- CVE-2024-7512Concrete CMS Stored XSS in Board instancesConcrete CMS · concrete5/concrete5
- CVE-2023-50810In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware
- CVE-2024-39338axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.axios
- CVE-2024-40472Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php."
- CVE-2024-40478A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows rem
- CVE-2024-41332Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated a