CVEs published August 13, 2024
226 CVEs were published on August 13, 2024: 21 critical, 101 high. 8 are now in CISA KEV.
- Published
- 226
- Critical
- 21
- High
- 101
- Medium
- 92
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 8
- Fix available
- 110
Most affected products
- Microsoft Windows
- 50
- AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- 7
- Microsoft Windows Server
- 7
- Siemens SINEC NMS
- 5
- Siemens SINEC Traffic Analyzer
- 5
- AMD μProf Tool
- 4
- Microsoft Windows Server · Microsoft Windows
- 4
- SAP_SE SAP BusinessObjects Business Intelligence Platform
- 4
- wanglongcn ltcms
- 4
- Microsoft Office · Microsoft 365 Apps for Enterprise +1
- 3
Critical 21
- CVE-2024-28986SolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2024-7593Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated aIvanti vTM
- CVE-2024-7569An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated atIvanti ITSM
- CVE-2024-38109Azure Health Bot Elevation of Privilege VulnerabilityMicrosoft Azure Health Bot
- CVE-2024-38140Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38063Windows TCP/IP Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38199Windows Line Printer Daemon (LPD) Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38160Windows Network Virtualization Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38159Windows Network Virtualization Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38108Azure Stack Hub Spoofing VulnerabilityMicrosoft Azure Stack Hub
- CVE-2024-7746Use of default credentials at Traccar fleet management solutionTraccar Server
- CVE-2024-43160WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerabilityBerqWP
- CVE-2024-43153WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerabilityWofficeIO Woffice
- CVE-2024-43141WordPress Participants Database plugin <= 2.5.9.2 - PHP Object Injection vulnerabilityRoland Barker, xnau webdesign Participants Database
- CVE-2024-37287Kibana arbitrary code execution via prototype pollutionElastic Kibana
- CVE-2024-43121WordPress HUSKY plugin <= 1.3.6.1 - Privilege Escalation vulnerabilityrealmag777 HUSKY
- CVE-2024-41940A vulnerability has been identified in SINEC NMS (All versions < V3.0).Siemens SINEC NMS
- CVE-2024-41730Missing Authentication check in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-7094JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Executionrabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2024-41623An issue in D3D Security D3D IP Camera (D8801) v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payloa
- CVE-2024-42737In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist.
High 101
- CVE-2024-38163Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-7570Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM pIvanti ITSM
- CVE-2024-37968Windows DNS Spoofing VulnerabilityMicrosoft Windows Server
- CVE-2024-38215Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38120Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38211Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2024-38195Azure CycleCloud Remote Code Execution VulnerabilityMicrosoft Azure CycleCloud
- CVE-2024-38189Microsoft Project Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2024-38187Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38186Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38185Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38180Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38177Windows App Installer Spoofing VulnerabilityMicrosoft App Installer
- CVE-2024-38171Microsoft PowerPoint Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2024-38170Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC f…
- CVE-2024-38169Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2024-38162Azure Connected Machine Agent Elevation of Privilege VulnerabilityMicrosoft Azure Connected Machine Agent
- CVE-2024-38158Azure IoT SDK Remote Code Execution VulnerabilityMicrosoft C SDK for Azure IoT
- CVE-2024-38157Azure IoT SDK Remote Code Execution VulnerabilityMicrosoft Azure IoT Hub Device Client SDK
- CVE-2024-38154Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38153Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38152Windows OLE Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38150Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-38148Windows Secure Channel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38147Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-38146Windows Layer-2 Bridge Network Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38145Windows Layer-2 Bridge Network Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38144Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38142Windows Secure Kernel Mode Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38141Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38138Windows Deployment Services Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38137Windows Resource Manager PSM Service Extension Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-38136Windows Resource Manager PSM Service Extension Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38135Windows Resilient File System (ReFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38134Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38133Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38132Windows Network Address Translation (NAT) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38131Clipboard Virtual Channel Extension Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Remote Desktop client for Win…
- CVE-2024-38130Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38128Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38127Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38126Windows Network Address Translation (NAT) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38125Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38121Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38117NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38116Windows IP Routing Management Snapin Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38115Windows IP Routing Management Snapin Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38114Windows IP Routing Management Snapin Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29995Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38107Windows Power Dependency Coordinator Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38106Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38098Azure Connected Machine Agent Elevation of Privilege VulnerabilityMicrosoft Azure Connected Machine Agent
- CVE-2024-38084Microsoft OfficePlus Elevation of Privilege VulnerabilityMicrosoft OfficePLUS
- CVE-2024-38201Azure Stack Hub Elevation of Privilege VulnerabilityMicrosoft Azure Stack Hub
- CVE-2024-38198Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38196Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38193Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38191Kernel Streaming Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38184Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38178Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows
- CVE-2024-38172Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC f…
- CVE-2024-38168.NET and Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft Visual Studio +4
- CVE-2023-31349Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially rAMD μProf Tool
- CVE-2023-31348A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code AMD μProf Tool
- CVE-2023-31341Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attacker to cause an out-ofAMD μProf Tool
- CVE-2023-20578A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify AMD EPYC™ 7001 Processors · AMD EPYC™ 7002 Processors +10
- CVE-2022-23817Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application toAMD Athlon™ 3000 Series Mobile Processors with Radeon™… +24
- CVE-2022-23815Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially leAMD Athlon™ 3000 Series Desktop Processors with Radeon™… +4
- CVE-2021-26344An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to modAMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +26
- CVE-2024-6619Incorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream ReportOcean Data Systems Dream Report · AVEVA Reports for Operati…
- CVE-2024-6618Path Traversal in Ocean Data Systems Dream ReportOcean Data Systems Dream Report · AVEVA Reports for Operati…
- CVE-2024-7113Allocation of Resources Without Limits or Throttling in AVEVA SuiteLink ServerAVEVA SuiteLink Server · AVEVA Historian +4
- CVE-2024-6788Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user passwordPHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2
- CVE-2024-38502Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows stored XSSPepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-DIN · Pepperl+Fuchs… +42
- CVE-2024-5849Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows reflected XSSPepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-DIN · Pepperl+Fuchs… +42
- CVE-2024-43140WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.4 - Local File Inclusion vulnerabilityG5Theme Ultimate Bootstrap Elements for Elementor
- CVE-2024-35124IBM OpenBMC authentication bypassIBM OpenBMC
- CVE-2024-40697IBM Common Licensing information disclosureIBM Common Licensing
- CVE-2024-43135WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerabilityThemewinter WPCafe
- CVE-2024-43131WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerabilityWPWeb Docket
- CVE-2024-39651WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerabilityWPWeb WooCommerce PDF Vouchers
- CVE-2024-38787WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerabilityJavier Carazo Import and export users and customers
- CVE-2024-38747WordPress HitPay Payment Gateway for WooCommerce plugin <= 4.1.3 - Sensitive Data Exposure via Log File vulnerabilityHitPay Payment Solutions Pte HitPay Payment Gateway for Woo…
- CVE-2024-38724WordPress Contact Form 7 Summary and Print plugin <= 1.2.5 - Cross Site Request Forgery (CSRF) to XSS vulnerabilityMuhammad Rehman Contact Form 7 Summary and Print
- CVE-2024-38699WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerabilityWP Swings Wallet System for WooCommerce
- CVE-2024-37935WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerabilityanhvnit Woocommerce OpenPos
- CVE-2024-41977A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12
- CVE-2024-41976A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12
- CVE-2024-41939A vulnerability has been identified in SINEC NMS (All versions < V3.0).Siemens SINEC NMS
- CVE-2024-41908A vulnerability has been identified in NX (All versions < V2406.3000).Siemens NX
- CVE-2024-41904A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0).Siemens SINEC Traffic Analyzer
- CVE-2024-36398A vulnerability has been identified in SINEC NMS (All versions < V3.0).Siemens SINEC NMS
- CVE-2024-6823Media Library Assistant <= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Actiondglingren Media Library Assistant
- CVE-2024-33003Information Disclosure Vulnerability in SAP Commerce CloudSAP_SE SAP Commerce Cloud
- CVE-2024-42374XML injection in SAP BEx Web Java Runtime Export Web ServiceSAP_SE SAP BEx Web Java Runtime Export Web Service
- CVE-2024-7707Tenda FH1206 HTTP POST Request SafeEmailFilter formSafeEmailFilter stack-based overflowTenda FH1206
- CVE-2024-36446The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authenticatio
- CVE-2024-37015An issue was discovered in Ada Web Server 20.0.
- CVE-2024-42736In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist.
- CVE-2024-42738In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg.
- CVE-2024-42739In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceC
Medium, low and unrated 104
- CVE-2024-7752SourceCodester Clinics Patient Management System update_medicine.php cross site scriptingSourceCodester Clinics Patient Management System
- CVE-2024-7751SourceCodester Clinics Patient Management System update_medicine.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2024-7750SourceCodester Clinics Patient Management System medicines.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2024-7749SourceCodester Accounts Manager App add-account.php cross site scriptingSourceCodester Accounts Manager App
- CVE-2024-7748SourceCodester Accounts Manager App delete-account.php sql injectionSourceCodester Accounts Manager App
- CVE-2024-7743wanglongcn ltcms API Endpoint downloadUrl server-side request forgerywanglongcn ltcms
- CVE-2024-7742wanglongcn ltcms API Endpoint multiDownload server-side request forgerywanglongcn ltcms
- CVE-2024-7741wanglongcn ltcms API Endpoint downloadfile downloadFile path traversalwanglongcn ltcms
- CVE-2024-7740wanglongcn ltcms API Endpoint download server-side request forgerywanglongcn ltcms
- CVE-2024-42368open-telemetry has an Observable Timing Discrepancyopen-telemetry opentelemetry-collector-contrib · github.com…
- CVE-2024-7739yzane vscode-markdown-pdf cross site scriptingyzane vscode-markdown-pdf
- CVE-2024-7738yzane vscode-markdown-pdf Markdown File pathname traversalyzane vscode-markdown-pdf
- CVE-2024-7733FastCMS New Article Category Page cross site scriptingFastCMS
- CVE-2024-7567Rockwell Automation Micro850/870 Vulnerable to denial-of-service Vulnerability via CIP/Modbus PortRockwell Automation PLC - Micro850/870
- CVE-2024-6079DLL Hijacking Vulnerability Exists in Rockwell Automation Emulate3D™Rockwell Automation Emulate3D™
- CVE-2024-38223Windows Initial Machine Configuration Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38214Windows Routing and Remote Access Service (RRAS) Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2024-38173Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2024-38165Windows Compressed Folder Tampering VulnerabilityMicrosoft Windows
- CVE-2024-38155Security Center Broker Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38151Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38143Windows WLAN AutoConfig Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38122Microsoft Local Security Authority (LSA) Server Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38118Microsoft Local Security Authority (LSA) Server Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38213Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38197Microsoft Teams for iOS Spoofing VulnerabilityMicrosoft Teams for iOS
- CVE-2024-38167.NET and Visual Studio Information Disclosure VulnerabilityMicrosoft Visual Studio · Microsoft .NET +12
- CVE-2024-38161Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38123Windows Bluetooth Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-31366Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of AMD μProf Tool
- CVE-2023-31339Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform AMD Zynq™ UltraScale+™ MPSoC/RFSoC
- CVE-2024-21981Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitrary code execution priAMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +18
- CVE-2023-31356Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting inAMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +1
- CVE-2023-31310Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set tAMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- CVE-2023-31307Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory readAMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- CVE-2023-31304Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) to modify the PCIe® lanAMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- CVE-2023-31305Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to rAMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- CVE-2023-20591Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker toAMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Serie… +2
- CVE-2023-20584IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an attacker with privilegeAMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors
- CVE-2023-20518Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shellAMD EPYC™ 9004 Series Processors · AMD Ryzen™ 3000 Seri… +24
- CVE-2023-20513An insufficient bounds check in PMFW (Power Management Firmware) may allow an attacker to utilize a malicious VF (virtualization function) tAMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- CVE-2023-20512A hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug informaAMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- CVE-2023-20510An insufficient DRAM address validation in PMFW may allow a privileged attacker to read from an invalid DRAM address to SRAM, potentially reAMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…
- CVE-2023-20509An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™… +2
- CVE-2021-46772Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the strucAMD EPYC™ 7002 Series Processors · AMD EPYC™ 7003 Serie… +25
- CVE-2021-46746Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with accessAMD EPYC™ 7001 Processors · AMD EPYC™ 7002 Processors +32
- CVE-2021-26387Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell tAMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +29
- CVE-2021-26367A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address ranAMD Ryzen™ 5000 Series Desktop Processor with Radeon™ G… +13
- CVE-2024-21757A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 througFortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2022-27486A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5Fortinet FortiDDoS · Fortinet FortiDDoS-F
- CVE-2022-45862An insufficient session expiration vulnerability [CWE-613] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; ForFortinet FortiPAM · Fortinet FortiProxy +2
- CVE-2024-36505An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may Fortinet FortiOS
- CVE-2023-26211An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an Fortinet FortiSOAR
- CVE-2024-6384Backup files may be downloaded by underprivileged users in MongoDB Enterprise ServerMongoDB Server
- CVE-2024-38501Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injectionPepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-DIN · Pepperl+Fuchs… +42
- CVE-2024-3913Phoenix Contact: Start sequence allows attack during the boot processPhoenix Contact CHARX SEC-3000 · Phoenix Contact CHARX S… +2
- CVE-2024-43165WordPress WPSection plugin <= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerabilityRashid87 WPSection
- CVE-2024-43138WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.2.1 - Local File Inclusion vulnerabilityMagePeople Team Event Manager for WooCommerce
- CVE-2024-41774IBM Common Licensing cross-site scriptingIBM Common Licensing
- CVE-2024-43129WordPress BetterDocs plugin <= 3.5.8 - Local File Inclusion vulnerabilityWPDeveloper BetterDocs
- CVE-2024-43128WordPress WooCommerce Product Table Lite plugin <= 3.5.1 - Arbitrary Code Execution vulnerabilityWC Product Table WooCommerce Product Table Lite
- CVE-2024-39642WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerabilityThimPress LearnPress
- CVE-2024-38760WordPress Send Users Email plugin <= 1.5.1 - Sensitive Data Exposure vulnerabilityDavid Maucher Send Users Email
- CVE-2024-38756WordPress Coming Soon Page – Responsive Coming Soon & Maintenance Mode plugin <= 1.6.3 - Sensitive Data Exposure vulnerabilityWeblizar Coming Soon
- CVE-2024-38752WordPress Zoho Campaigns plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerabilityZoho Campaigns
- CVE-2024-38749WordPress Olive One Click Demo Import plugin <= 1.1.2 - Sensitive Data Exposure vulnerabilityOlive Themes Olive One Click Demo Import
- CVE-2024-2259Reflected XXS Vulnerability in InstaRISPACS SoftwareMeddiff Technologies InstaRISPACS
- CVE-2024-38742WordPress MBE eShip plugin <= 2.1.2 - Sensitive Data Exposure vulnerabilityMBE Worldwide S.p.A. MBE eShip
- CVE-2024-41978A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12
- CVE-2024-41941A vulnerability has been identified in SINEC NMS (All versions < V3.0).Siemens SINEC NMS
- CVE-2024-41938A vulnerability has been identified in SINEC NMS (All versions < V3.0).Siemens SINEC NMS
- CVE-2024-41907A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0).Siemens SINEC Traffic Analyzer
- CVE-2024-41906A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0).Siemens SINEC Traffic Analyzer
- CVE-2024-41905A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0).Siemens SINEC Traffic Analyzer
- CVE-2024-41903A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0).Siemens SINEC Traffic Analyzer
- CVE-2024-41683A vulnerability has been identified in Location Intelligence family (All versions < V4.4).Siemens Location Intelligence family
- CVE-2024-41682A vulnerability has been identified in Location Intelligence family (All versions < V4.4).Siemens Location Intelligence family
- CVE-2024-41681A vulnerability has been identified in Location Intelligence family (All versions < V4.4).Siemens Location Intelligence family
- CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versionSiemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14
- CVE-2024-7715D-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-6724Generate Images – Magic Post Thumbnail < 5.2.8 - Admin+ Stored XSSGenerate Images
- CVE-2024-7247Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgetsbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-39591Missing Authorization check in SAP Document BuilderSAP_SE SAP Document Builder
- CVE-2024-42373Missing Authorization Check in SAP Student Life Cycle Management (SLcM)SAP_SE SAP Student Life Cycle Management
- CVE-2024-7092Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameterwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-41734Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server ABAP and ABAP Platf…
- CVE-2024-41736Information Disclosure vulnerability in SAP Permit to WorkSAP_SE SAP Permit to Work
- CVE-2024-41731Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-28166Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-42375Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-41732Improper Access Control in SAP Netweaver Application Server ABAPSAP_SE SAP NetWeaver Application Server ABAP
- CVE-2024-41737Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management)SAP_SE SAP CRM ABAP
- CVE-2024-41733Information Disclosure Vulnerability in SAP CommerceSAP_SE SAP Commerce
- CVE-2024-41735Cross-Site Scripting (XSS) vulnerability in SAP Commerce BackofficeSAP_SE SAP Commerce Backoffice
- CVE-2024-33005Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content ServerSAP_SE SAP NetWeaver Application Server (ABAP and Java),SAP…
- CVE-2024-42377Multiple Missing Authorization Check vulnerabilities in SAP Shared Service FrameworkSAP_SE SAP Shared Service Framework
- CVE-2024-42376Multiple Missing Authorization Check vulnerabilities in SAP Shared Service FrameworkSAP_SE SAP Shared Service Framework
- CVE-2024-7388WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scriptinggfazioli WP Bannerize Pro
- CVE-2022-38382IBM Cloud Pak for Security session fixationIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2024-7709OcoMon URL require_access_recovery.php cross site scriptingOcoMon
- CVE-2024-41613A Cross Site Scripting (XSS) vulnerability in Symphony CMS 2.7.10 allows remote attackers to inject arbitrary web script or HTML by editing
- CVE-2024-41614symphonycms <=2.7.10 is vulnerable to Cross Site Scripting (XSS) in the Comment component for articles.
- CVE-2024-41711A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (
- CVE-2024-42740In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg.