# CVEs published 2024-08-10

16 CVEs were published on August 10, 2024: 2 critical, 6 high. Days are UTC.

- [CVE-2024-21876](https://cve.now/CVE-2024-21876.md): Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version \< 8.2.4225 (CVSS 9.3, Enphase IQ Gateway)
- [CVE-2024-21879](https://cve.now/CVE-2024-21879.md): URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and \< v8.2.4225 (CVSS 8.7, Enphase Envoy)
- [CVE-2024-21877](https://cve.now/CVE-2024-21877.md): Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and \< 8.2.4225 (CVSS 8.6, Enphase Envoy)
- [CVE-2024-21878](https://cve.now/CVE-2024-21878.md): Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x (CVSS 7.1, Enphase Envoy)
- [CVE-2024-21880](https://cve.now/CVE-2024-21880.md): URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x \<= 7.x (CVSS 8.6, Enphase Envoy)
- [CVE-2024-21881](https://cve.now/CVE-2024-21881.md): Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x (CVSS 8.6, Enphase Envoy)
- [CVE-2024-6134](https://cve.now/CVE-2024-6134.md): WP eStore \< 8.5.6 - Reflected XSS in Product Editing (CVSS 5.4, wp-cart-for-digital-products)
- [CVE-2024-7574](https://cve.now/CVE-2024-7574.md): Christmasify! \<= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, cyberfoxdigital Christmasify!)
- [CVE-2024-5801](https://cve.now/CVE-2024-5801.md): IP Forwarding enabled in B&R Automation Runtime (CVSS 5.3, B&R Industrial Automation Automation Runtime)
- [CVE-2024-5800](https://cve.now/CVE-2024-5800.md): Diffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation Runtime (CVSS 8.3, B&R Industrial Automation Automation Runtime)
- [CVE-2024-7649](https://cve.now/CVE-2024-7649.md): Opal Membership \<= 1.2.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, wpopal Opal Membership)
- [CVE-2024-7648](https://cve.now/CVE-2024-7648.md): Opal Membership \<= 1.2.4 - Authenticated (Subscriber+) Information Disclosure (CVSS 4.3, wpopal Opal Membership)
- [CVE-2024-7503](https://cve.now/CVE-2024-7503.md): WooCommerce - Social Login \<= 2.7.5 - Authentication Bypass to Account Takeover (CVSS 9.8, WPWeb WooCommerce - Social Login)
- [CVE-2024-6692](https://cve.now/CVE-2024-6692.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text (CVSS 3.3, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2024-7621](https://cve.now/CVE-2024-7621.md): Visual Website Collaboration, Feedback & Project Management – Atarim \<= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 5.4, wpfeedback Atarim – Visual Feedback, Review & AI Collaborat…)
- [CVE-2024-6691](https://cve.now/CVE-2024-6691.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings (CVSS 4.4, smub Easy Digital Downloads – eCommerce Payments and Subscr…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.