CVEs published August 12, 2024
119 CVEs were published on August 12, 2024: 16 critical, 45 high. 3 are now in CISA KEV.
- Published
- 119
- Critical
- 16
- High
- 45
- Medium
- 57
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 23
Most affected products
- FIWARE Keyrock
- 5
- ManageEngine ADAudit Plus
- 5
- SourceCodester Kortex Lite Advocate Office Management System
- 4
- zoneminder
- 4
- ggerganov llama.cpp
- 3
- Antoine Hurkmans Football Pool
- 2
- Firewalla Box Software
- 2
- Fujian mwcms
- 2
- 10Web Form Builder Team Form Maker by 10Web
- 1
- AddonMaster Post Grid Master
- 1
Critical 16
- CVE-2024-43360ZoneMinder Time-based SQL Injectionzoneminder
- CVE-2024-42489Pro Macros Remote Code Execution via Viewpdf and similar macrosxwikisas xwiki-pro-macros
- CVE-2024-42479llama.cpp allows write-what-where in rpc_server::set_tensorggerganov llama.cpp
- CVE-2024-6917RCE in Veribilim Software's Veribase Order ManagementVeribilim Software Veribase Order Management
- CVE-2024-38530Open eClass Platform allows Arbitrary File Upload in "modules/h5p/save.php"gunet openeclass
- CVE-2024-6684Authentication Bypass in GST Electronics' inohom Nova Panel N7GST Electronics inohom Nova Panel N7
- CVE-2024-42167Command Injection in OrganisationnameFIWARE Keyrock
- CVE-2024-42166Command Injection in ApplicationnameFIWARE Keyrock
- CVE-2024-41475Gnuboard g6 6.0.7 is vulnerable to Session hijacking due to a CORS misconfiguration.
- CVE-2024-41651An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.
- CVE-2024-42520TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl.
- CVE-2024-42545TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the ssid parameter in setWizardCfg function.
- CVE-2024-42546TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function.
- CVE-2024-42547TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
- CVE-2024-42745In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg.
- CVE-2024-42748In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg.
High 45
- CVE-2024-43126WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) vulnerabilitySender – Newsletter, SMS and Email Marketing Automation for…
- CVE-2024-43127WordPress Products, Order & Customers Export for WooCommerce plugin <= 2.0.11 - Reflected Cross Site Scripting (XSS) vulnerabilityWPFactory Products, Order & Customers Export for WooCommerce
- CVE-2024-43156WordPress Post Grid Master plugin <= 3.4.10 - Reflected Cross Site Scripting (XSS) vulnerabilityAddonMaster Post Grid Master
- CVE-2024-43163WordPress ParcelPanel plugin <= 4.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityParcel Panel ParcelPanel
- CVE-2023-7066Siemens Teamcenter Visualization and JT2Go Out-of-bounds ReadSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2024-43213WordPress MultiVendorX Marketplace plugin <= 4.1.17 - Reflected Cross Site Scripting (XSS) vulnerabilityMultiVendorX WC Marketplace
- CVE-2024-43217WordPress Kodex Posts likes plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityPierre Lebedel Kodex Posts likes
- CVE-2024-43220WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability10Web Form Builder Team Form Maker by 10Web
- CVE-2024-43233WordPress BSK Forms Blacklist plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityBannerSky BSK Forms Blacklist
- CVE-2023-41884ZoneMinder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in watch.phpzoneminder
- CVE-2024-40892Firewalla BTLE Weak CredentialsFirewalla Box Software
- CVE-2024-42485Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpointpxlrbt filament-excel · pxlrbt/filament-excel
- CVE-2024-42481Complete crash of host system due to calculateDirectorySize in skyportdskyportlabs skyportd
- CVE-2024-42480Kamaji's RBAC Roles for `etcd` are not disjunctclastix kamaji · github.com/clastix/kamaji
- CVE-2024-42258mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machinesLinux
- CVE-2024-42163Password ManipulationFIWARE Keyrock
- CVE-2024-7697Logical vulnerability in com.transsion.carlcareTECNO com.transsion.carlcare
- CVE-2024-36034SQL InjectionManageEngine ADAudit Plus
- CVE-2024-36035SQL InjectionManageEngine ADAudit Plus
- CVE-2024-36518SQL InjectionManageEngine ADAudit Plus
- CVE-2024-5487SQL InjectionManageEngine ADAudit Plus
- CVE-2024-5651Fence-agents-remediation: fence agent command line options leads to remote code executionfence-agents-remediation · Red Hat Fence Agents Remediation…
- CVE-2024-5527SQL InjectionManageEngine ADAudit Plus
- CVE-2024-7694TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File UploadTeamT5 ThreatSonar Anti-Ransomware
- CVE-2024-7693Team Johnlong software Raiden MAILD Remote Management System - Arbitrary File Reading through Path TraversalTeam Johnlong software Raiden MAILD Remote Management System
- CVE-2023-48171An issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via the user permissions component.
- CVE-2024-27442An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.
- CVE-2024-33535An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.
- CVE-2024-36877Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7
- CVE-2024-39091An OS command injection vulnerability in the ccm_debug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers withi
- CVE-2024-40500Cross Site Scripting vulnerability in Martin Kucej i-librarian v.5.11.0 and before allows a local attacker to execute arbitrary code via the
- CVE-2024-42543TOTOLINK A3700R v9.1.2u.5822_B20200513 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.
- CVE-2024-42623FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/delete/1
- CVE-2024-42624FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/delete/10.
- CVE-2024-42626FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/add.
- CVE-2024-42627FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/delete/3.
- CVE-2024-42628FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/snippet/edit/3.
- CVE-2024-42630FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_file.
- CVE-2024-42631FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/edit/1.
- CVE-2024-42632FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/add.
- CVE-2024-42741In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg
- CVE-2024-42742In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRule
- CVE-2024-42743In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg .
- CVE-2024-42744In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser
- CVE-2024-42747In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg.
Medium, low and unrated 58
- CVE-2024-37930WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerabilityThemeSphere SmartMag
- CVE-2024-37924WordPress WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin <= 1.0.1 - Sensitive Data Exposure vulnerabilityWP2Speed Faster
- CVE-2024-35775WordPress Slider by Soliloquy plugin <= 2.7.6 - Broken Access Control to XSS vulnerabilitySoliloquy Team Slider by Soliloquy
- CVE-2024-43123WordPress Card Elements for Elementor plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerabilityTecheshta Card Elements for Elementor
- CVE-2024-43124WordPress Graphina plugin <= 1.8.10 - Cross Site Scripting (XSS) vulnerabilityIqonic Design Graphina
- CVE-2024-43125WordPress WP Table Builder plugin <= 1.4.15 - Cross Site Scripting (XSS) vulnerabilityWP Table Builder – WordPress Table Plugin
- CVE-2024-7706Fujian mwcms uploadfile.html uploadimage unrestricted uploadFujian mwcms
- CVE-2024-7705Fujian mwcms Image Upload uploadeditor.html uploadeditor unrestricted uploadFujian mwcms
- CVE-2024-43130WordPress Football Pool plugin <= 2.11.10 - Cross Site Scripting (XSS) vulnerabilityAntoine Hurkmans Football Pool
- CVE-2024-43133WordPress Themify Shortcodes plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityThemify Shortcodes
- CVE-2024-43137WordPress WappPress Basic plugin <= 6.0.4 - Cross Site Scripting (XSS) vulnerabilityWappPress Team WappPress
- CVE-2024-43139WordPress Football Pool plugin <= 2.11.9 - Cross Site Scripting (XSS) vulnerabilityAntoine Hurkmans Football Pool
- CVE-2024-43147WordPress Selection Lite plugin <= 1.11 - Cross Site Scripting (XSS) vulnerabilityMerkulove Selection Lite
- CVE-2024-43148WordPress StreamCast <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerabilitybPlugins StreamCast
- CVE-2024-43149WordPress CM Tooltip Glossary Plugin <= 4.3.7 - Cross Site Scripting (XSS) vulnerabilityCreativeMindsSolutions CM Tooltip Glossary
- CVE-2024-43150WordPress Xpro Elementor Addons plugin <= 1.4.4.2 - Cross Site Scripting (XSS) vulnerabilityXpro Elementor Addons
- CVE-2024-43151WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Ultimate Addons for Beaver Builder – Lite
- CVE-2024-43152WordPress 3D FlipBook plugin <= 1.15.6 - Cross Site Scripting (XSS) vulnerabilityiberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Ima…
- CVE-2024-43155WordPress ComboBlocks plugin <= 2.2.86 - Cross Site Scripting (XSS) vulnerabilityPickPlugins ComboBlocks
- CVE-2024-43161WordPress Slider & Popup Builder by Depicter plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerabilityAverta Depicter Slider
- CVE-2024-43164WordPress Blockspare plugin <= 3.2.0 - Cross Site Scripting (XSS) vulnerabilityBlockspare
- CVE-2024-7590WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Spectra
- CVE-2024-43210WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.9.2 - Cross Site Scripting (XSS) vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2024-43216WordPress Filr plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityWP Chill Filr
- CVE-2024-43218WordPress Mediavine Control Panel plugin <= 2.10.4 - Cross Site Scripting (XSS) vulnerabilityMediavine Control Panel
- CVE-2024-43224WordPress YaMaps for WordPress Plugin plugin <= 0.6.27 - Cross Site Scripting (XSS) vulnerabilityYuri Baranov YaMaps for WordPress
- CVE-2024-43225WordPress Enter Addons plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerabilityThemeLooks Enter Addons
- CVE-2024-43226WordPress WP Dashboard Notes plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerabilityJeroen Sormani WP Dashboard Notes
- CVE-2024-43227WordPress BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper BetterDocs
- CVE-2024-43231WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS
- CVE-2024-43359XSS vulnerabilities in montagereviewzoneminder
- CVE-2024-43358XSS vulnerability in filter viewzoneminder
- CVE-2024-7704Weaver e-cology Source Code ecology_dev.zip information disclosureWeaver e-cology
- CVE-2024-40893Firewalla BTLE Authenticated Command InjectionFirewalla Box Software
- CVE-2024-6768Denial of Service in CLFS.sysMicrosoft Windows
- CVE-2024-42474Streamlit Path Traversal Security Vulnerability on Windowsstreamlit
- CVE-2024-7700Foreman: command injection in "host init config" template via "install packages" field on foremanforeman · Red Hat Satellite
- CVE-2024-41909Apache MINA SSHD: integrity check bypassApache Software Foundation Apache MINA SSHD · org.apache.ss…
- CVE-2023-7249Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows OpenText Directory Services
- CVE-2024-42482fish-shop/syntax-check Improper Neutralization of Delimitersfish-shop syntax-check
- CVE-2024-42478llama.cpp allows Arbitrary Address Read in rpc_server::get_tensorggerganov llama.cpp
- CVE-2024-42477llama.cpp global-buffer-overflow in ggml_type_sizeggerganov llama.cpp
- CVE-2024-21550SteVe is an open platform that implements different version of the OCPP protocol for Electric Vehicle charge points, acting as a central serSteVe
- CVE-2024-6639MDx <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdx_list_item ShortcodeAxtonYao MDx
- CVE-2024-42165Arbitrary User ActivationFIWARE Keyrock
- CVE-2024-42164Disabling MFA without AuthenticationFIWARE Keyrock
- CVE-2024-6758Improper Privilege Management vulnerability in Sprecher Automation SPRECON-ESprecher Automation SPRECON-E
- CVE-2024-7686SourceCodester Kortex Lite Advocate Office Management System register_case.php cross site scriptingSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7685SourceCodester Kortex Lite Advocate Office Management System adds.php cross site scriptingSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7684SourceCodester Kortex Lite Advocate Office Management System add_act.php cross site scriptingSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7683SourceCodester Kortex Lite Advocate Office Management System addcase_stage.php cross site scriptingSourceCodester Kortex Lite Advocate Office Management System
- CVE-2024-7682code-projects Job Portal rw_i_nat.php sql injectioncode-projects Job Portal
- CVE-2024-27443An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.
- CVE-2024-33533An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2.
- CVE-2024-33536An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.
- CVE-2024-41710A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (
- CVE-2024-42625FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/layout/add
- CVE-2024-42629FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/page/edit/10.