CVEs published August 10, 2024
16 CVEs were published on August 10, 2024: 2 critical, 6 high.
- Published
- 16
- Critical
- 2
- High
- 6
- Medium
- 7
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Enphase Envoy
- 5
- B&R Industrial Automation Automation Runtime
- 2
- smub Easy Digital Downloads – eCommerce Payments and Subscr…
- 2
- wpopal Opal Membership
- 2
- cyberfoxdigital Christmasify!
- 1
- Enphase IQ Gateway
- 1
- wp-cart-for-digital-products
- 1
- wpfeedback Atarim – Visual Feedback, Review & AI Collaborat…
- 1
- WPWeb WooCommerce - Social Login
- 1
Critical 2
High 6
- CVE-2024-21879URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225Enphase Envoy
- CVE-2024-21877Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225Enphase Envoy
- CVE-2024-21878Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.xEnphase Envoy
- CVE-2024-21880URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.xEnphase Envoy
- CVE-2024-21881Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.xEnphase Envoy
- CVE-2024-5800Diffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation RuntimeB&R Industrial Automation Automation Runtime
Medium, low and unrated 8
- CVE-2024-6134WP eStore < 8.5.6 - Reflected XSS in Product Editingwp-cart-for-digital-products
- CVE-2024-7574Christmasify! <= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scriptingcyberfoxdigital Christmasify!
- CVE-2024-5801IP Forwarding enabled in B&R Automation RuntimeB&R Industrial Automation Automation Runtime
- CVE-2024-7649Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scriptingwpopal Opal Membership
- CVE-2024-7648Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosurewpopal Opal Membership
- CVE-2024-6692Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Textsmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2024-7621Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Updatewpfeedback Atarim – Visual Feedback, Review & AI Collaborat…
- CVE-2024-6691Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settingssmub Easy Digital Downloads – eCommerce Payments and Subscr…