# CVEs published 2024-08-09

65 CVEs were published on August 9, 2024: 10 critical, 13 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-42473](https://cve.now/CVE-2024-42473.md): OpenFGA Authorization Bypass (CVSS 7.5, openfga · github.com/openfga/openfga)
- [CVE-2024-42370](https://cve.now/CVE-2024-42370.md): Litestar repository vulnerable to Environment Variable injection in \`docs-preview.yml\` workflow (CVSS 8.3, litestar-org litestar)
- [CVE-2024-42469](https://cve.now/CVE-2024-42469.md): CometVisu Backend for openHAB affected by RCE through path traversal (CVSS 9.8, openhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…)
- [CVE-2024-42468](https://cve.now/CVE-2024-42468.md): Path traversal (CometVisu) (CVSS 5.3, openhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…)
- [CVE-2024-42467](https://cve.now/CVE-2024-42467.md): CometVisu Backend for openHAB affected by SSRF/XSS (CVSS 10.0, openhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…)
- [CVE-2024-42470](https://cve.now/CVE-2024-42470.md): CometVisu Backend for openHAB has a sensitive information disclosure vulnerability (CVSS 6.5, openhab-webui · org.openhab.ui.bundles:org.openhab.ui.comet…)
- [CVE-2024-42367](https://cve.now/CVE-2024-42367.md): In aiohttp, compressed files as symlinks are not protected from path traversal (CVSS 4.8, aio-libs aiohttp · aiohttp)
- [CVE-2024-32765](https://cve.now/CVE-2024-32765.md): QTS, QuTS hero (CVSS 4.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-31315](https://cve.now/CVE-2023-31315.md): Improper validation in a model specific register (MSR) could allow a malicious program with ring0 access to modify SMM configuration while S (CVSS 7.5, 3rd Gen AMD EPYC™ Processors · 1st Gen AMD EPYC™ Proces… +25)
- [CVE-2023-38018](https://cve.now/CVE-2023-38018.md): IBM Aspera Shares session fixation (CVSS 6.3, IBM Aspera Shares)
- [CVE-2024-7645](https://cve.now/CVE-2024-7645.md): SourceCodester Clinics Patient Management System User Page users.php cross-site request forgery (CVSS 6.9, SourceCodester Clinics Patient Management System)
- [CVE-2024-7644](https://cve.now/CVE-2024-7644.md): SourceCodester Leads Manager Tool Add Leads add-leads.php cross site scripting (CVSS 5.3, SourceCodester Leads Manager Tool)
- [CVE-2024-7643](https://cve.now/CVE-2024-7643.md): SourceCodester Leads Manager Tool Delete Leads delete-leads.php sql injection (CVSS 5.3, SourceCodester Leads Manager Tool)
- [CVE-2024-7642](https://cve.now/CVE-2024-7642.md): SourceCodester Kortex Lite Advocate Office Management System activate\_act.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-41888](https://cve.now/CVE-2024-41888.md): Apache Answer: The link for resetting user password is not Single-Use (CVSS 5.3, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2024-41890](https://cve.now/CVE-2024-41890.md): Apache Answer: The link to reset the user's password will remain valid after sending a new link (CVSS 5.3, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2024-7641](https://cve.now/CVE-2024-7641.md): SourceCodester Kortex Lite Advocate Office Management System deactivate\_act.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-30188](https://cve.now/CVE-2024-30188.md): Apache DolphinScheduler: Resource File Read And Write Vulnerability (CVSS 8.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2024-29831](https://cve.now/CVE-2024-29831.md): Apache DolphinScheduler: RCE by arbitrary js execution (CVSS 8.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2024-7640](https://cve.now/CVE-2024-7640.md): SourceCodester Kortex Lite Advocate Office Management System delete\_register.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-7639](https://cve.now/CVE-2024-7639.md): SourceCodester Kortex Lite Advocate Office Management System delete\_act.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-7638](https://cve.now/CVE-2024-7638.md): SourceCodester Kortex Lite Advocate Office Management System delete\_client.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2024-7637](https://cve.now/CVE-2024-7637.md): code-projects Online Polling Registration registeracc.php sql injection (CVSS 6.9, code-projects Online Polling)
- [CVE-2024-7636](https://cve.now/CVE-2024-7636.md): code-projects Simple Ticket Booking Login authenticate.php sql injection (CVSS 6.9, code-projects Simple Ticket Booking)
- [CVE-2024-7635](https://cve.now/CVE-2024-7635.md): code-projects Simple Ticket Booking Registration register\_insert.php sql injection (CVSS 6.9, code-projects Simple Ticket Booking)
- [CVE-2024-22123](https://cve.now/CVE-2024-22123.md): Zabbix Arbitrary File Read (CVSS 2.7, Zabbix)
- [CVE-2024-7408](https://cve.now/CVE-2024-7408.md): Information Disclosure Vulnerability in Airveda Air Quality Monitor (CVSS 8.6, Airveda Air Quality Monitor PM2.5 PM10)
- [CVE-2024-22116](https://cve.now/CVE-2024-22116.md): Remote code execution within ping script (CVSS 9.9, Zabbix)
- [CVE-2024-22114](https://cve.now/CVE-2024-22114.md): System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission (CVSS 4.3, Zabbix)
- [CVE-2024-36462](https://cve.now/CVE-2024-36462.md): Allocation of resources without limits or throttling (uncontrolled resource consumption) (CVSS 7.5, Zabbix)
- [CVE-2024-36461](https://cve.now/CVE-2024-36461.md): Direct access to memory pointers within the JS engine for modification (CVSS 9.1, Zabbix)
- [CVE-2024-6562](https://cve.now/CVE-2024-6562.md): affiliate-toolkit \<= 3.5.5 - Unauthenticated Full Path Dislcosure (CVSS 5.3, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2024-7410](https://cve.now/CVE-2024-7410.md): My Custom CSS PHP & ADS \<= 3.3 - Unauthenticated Full Path Disclosure (CVSS 5.3, esthertyler My Custom CSS PHP & ADS)
- [CVE-2024-7412](https://cve.now/CVE-2024-7412.md): No Update Nag \<= 1.4.12 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code No Update Nag)
- [CVE-2024-7416](https://cve.now/CVE-2024-7416.md): Reveal Template \<= 3.7 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code Reveal Template)
- [CVE-2024-7414](https://cve.now/CVE-2024-7414.md): PDF Builder for WPForms \<= 1.2.116 - Unauthenticated Full Path Disclosure (CVSS 5.3, edgarrojas PDF Builder for WPForms)
- [CVE-2024-7413](https://cve.now/CVE-2024-7413.md): Obfuscate Email \<= 3.8.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code Obfuscate Email)
- [CVE-2024-7382](https://cve.now/CVE-2024-7382.md): Linkify Text \<= 1.9.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, coffee2code Linkify Text)
- [CVE-2024-36460](https://cve.now/CVE-2024-36460.md): Front-end audit log shows passwords in plaintext (CVSS 8.1, Zabbix)
- [CVE-2024-22122](https://cve.now/CVE-2024-22122.md): AT(GSM) Command Injection (CVSS 3.0, Zabbix)
- [CVE-2024-22121](https://cve.now/CVE-2024-22121.md): Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe (CVSS 6.1, Zabbix)
- [CVE-2024-6158](https://cve.now/CVE-2024-6158.md): Category Posts Widget (Free \< 4.9.17, Pro \< 4.9.13) - Admin+ Stored XSS (CVSS 4.8, Category Posts Widget · term-and-category-based-posts-widget)
- [CVE-2024-6136](https://cve.now/CVE-2024-6136.md): WP eStore \< 8.5.6 - Settings Reset via CSRF (CVSS 5.4, wp-cart-for-digital-products)
- [CVE-2024-6133](https://cve.now/CVE-2024-6133.md): WP eStore \< 8.5.6 - Reflected XSS in Customer Search (CVSS 6.5, wp-cart-for-digital-products)
- [CVE-2024-7399](https://cve.now/CVE-2024-7399.md): Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attack (CVSS 8.8, KEV, Samsung Electronics MagicINFO 9 Server)
- [CVE-2024-4359](https://cve.now/CVE-2024-4359.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.7.2 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-4360](https://cve.now/CVE-2024-4360.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title\_tag (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-0115](https://cve.now/CVE-2024-0115.md): NVIDIA CV-CUDA for Ubuntu 20.04, Ubuntu 22.04, and Jetpack contains a vulnerability in Python APIs where a user may cause an uncontrolled re (CVSS 6.1, NVIDIA CV-CUDA)
- [CVE-2024-0113](https://cve.now/CVE-2024-0113.md): NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traver (CVSS 7.5, NVIDIA Mellanox OS · NVIDIA Skyway +2)
- [CVE-2024-4350](https://cve.now/CVE-2024-4350.md): Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer (CVSS 5.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-7512](https://cve.now/CVE-2024-7512.md): Concrete CMS Stored XSS in Board instances (CVSS 4.6, Concrete CMS · concrete5/concrete5)
- [CVE-2024-3279](https://cve.now/CVE-2024-3279.md): Improper Access Control in mintplex-labs/anything-llm (CVSS 9.1, mintplex-labs/anything-llm)
- [CVE-2023-50809](https://cve.now/CVE-2023-50809.md): In certain Sonos products before S1 Release 11.12 and S2 release 15.9, the mt\_7615.ko wireless driver does not properly validate an informat (CVSS 7.8)
- [CVE-2023-50810](https://cve.now/CVE-2023-50810.md): In certain Sonos products before Sonos S1 Release 11.12 and S2 release 15.9, a vulnerability exists in the U-Boot component of the firmware (CVSS 6.0)
- [CVE-2024-37826](https://cve.now/CVE-2024-37826.md): A NULL pointer dereference in vercot Serva v4.6.0 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. (CVSS 7.5)
- [CVE-2024-38989](https://cve.now/CVE-2024-38989.md): izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js. (CVSS 9.8, @bunt/app)
- [CVE-2024-39338](https://cve.now/CVE-2024-39338.md): axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. (CVSS 4.0, axios)
- [CVE-2024-40472](https://cve.now/CVE-2024-40472.md): Sourcecodester Daily Calories Monitoring Tool v1.0 is vulnerable to SQL Injection via "delete-calorie.php." (CVSS 6.5)
- [CVE-2024-40478](https://cve.now/CVE-2024-40478.md): A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin/afeedback.php" in Kashipara Online Exam System v1.0, which allows rem (CVSS 5.4)
- [CVE-2024-40479](https://cve.now/CVE-2024-40479.md): A SQL injection vulnerability in "/admin/quizquestion.php" in Kashipara Online Exam System v1.0 allows remote attackers to execute arbitrary (CVSS 8.1)
- [CVE-2024-40480](https://cve.now/CVE-2024-40480.md): A Broken Access Control vulnerability was found in /admin/update.php and /admin/dashboard.php in Kashipara Online Exam System v1.0, which al (CVSS 9.8)
- [CVE-2024-41332](https://cve.now/CVE-2024-41332.md): Incorrect access control in the delete\_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated a (CVSS 6.5)
- [CVE-2024-41476](https://cve.now/CVE-2024-41476.md): AMTT Hotel Broadband Operation System (HiBOS) V3.0.3.151204 and before is vulnerable to SQL Injection via /manager/card/card\_detail.php. (CVSS 9.8)
- [CVE-2024-41570](https://cve.now/CVE-2024-41570.md): An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network t (CVSS 9.8)
- [CVE-2024-41577](https://cve.now/CVE-2024-41577.md): An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uplo (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.