# CVEs published 2024-08-13

226 CVEs were published on August 13, 2024: 21 critical, 101 high. 8 are now in CISA KEV. Days are UTC.

- [CVE-2024-7752](https://cve.now/CVE-2024-7752.md): SourceCodester Clinics Patient Management System update\_medicine.php cross site scripting (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-38163](https://cve.now/CVE-2024-38163.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-7751](https://cve.now/CVE-2024-7751.md): SourceCodester Clinics Patient Management System update\_medicine.php sql injection (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-7750](https://cve.now/CVE-2024-7750.md): SourceCodester Clinics Patient Management System medicines.php sql injection (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-28986](https://cve.now/CVE-2024-28986.md): SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability (CVSS 9.8, KEV, SolarWinds Web Help Desk)
- [CVE-2024-7749](https://cve.now/CVE-2024-7749.md): SourceCodester Accounts Manager App add-account.php cross site scripting (CVSS 5.3, SourceCodester Accounts Manager App)
- [CVE-2024-7748](https://cve.now/CVE-2024-7748.md): SourceCodester Accounts Manager App delete-account.php sql injection (CVSS 5.3, SourceCodester Accounts Manager App)
- [CVE-2024-7743](https://cve.now/CVE-2024-7743.md): wanglongcn ltcms API Endpoint downloadUrl server-side request forgery (CVSS 6.9, wanglongcn ltcms)
- [CVE-2024-7742](https://cve.now/CVE-2024-7742.md): wanglongcn ltcms API Endpoint multiDownload server-side request forgery (CVSS 6.9, wanglongcn ltcms)
- [CVE-2024-7741](https://cve.now/CVE-2024-7741.md): wanglongcn ltcms API Endpoint downloadfile downloadFile path traversal (CVSS 6.9, wanglongcn ltcms)
- [CVE-2024-7740](https://cve.now/CVE-2024-7740.md): wanglongcn ltcms API Endpoint download server-side request forgery (CVSS 6.9, wanglongcn ltcms)
- [CVE-2024-42368](https://cve.now/CVE-2024-42368.md): open-telemetry has an Observable Timing Discrepancy (CVSS 6.5, open-telemetry opentelemetry-collector-contrib · github.com…)
- [CVE-2024-7739](https://cve.now/CVE-2024-7739.md): yzane vscode-markdown-pdf cross site scripting (CVSS 6.9, yzane vscode-markdown-pdf)
- [CVE-2024-7738](https://cve.now/CVE-2024-7738.md): yzane vscode-markdown-pdf Markdown File pathname traversal (CVSS 4.8, yzane vscode-markdown-pdf)
- [CVE-2024-7593](https://cve.now/CVE-2024-7593.md): Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated a (CVSS 9.8, KEV, Ivanti vTM)
- [CVE-2024-7570](https://cve.now/CVE-2024-7570.md): Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM p (CVSS 8.3, Ivanti ITSM)
- [CVE-2024-7569](https://cve.now/CVE-2024-7569.md): An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated at (CVSS 9.6, Ivanti ITSM)
- [CVE-2024-7733](https://cve.now/CVE-2024-7733.md): FastCMS New Article Category Page cross site scripting (CVSS 5.3, FastCMS)
- [CVE-2024-7567](https://cve.now/CVE-2024-7567.md): Rockwell Automation Micro850/870 Vulnerable to denial-of-service Vulnerability via CIP/Modbus Port (CVSS 6.9, Rockwell Automation PLC - Micro850/870)
- [CVE-2024-6079](https://cve.now/CVE-2024-6079.md): DLL Hijacking Vulnerability Exists in Rockwell Automation Emulate3D™ (CVSS 5.4, Rockwell Automation Emulate3D™)
- [CVE-2024-37968](https://cve.now/CVE-2024-37968.md): Windows DNS Spoofing Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38109](https://cve.now/CVE-2024-38109.md): Azure Health Bot Elevation of Privilege Vulnerability (CVSS 9.1, Microsoft Azure Health Bot)
- [CVE-2024-38223](https://cve.now/CVE-2024-38223.md): Windows Initial Machine Configuration Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-38215](https://cve.now/CVE-2024-38215.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38214](https://cve.now/CVE-2024-38214.md): Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2024-38120](https://cve.now/CVE-2024-38120.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2024-38211](https://cve.now/CVE-2024-38211.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 8.2, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-38195](https://cve.now/CVE-2024-38195.md): Azure CycleCloud Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure CycleCloud)
- [CVE-2024-38189](https://cve.now/CVE-2024-38189.md): Microsoft Project Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2024-38187](https://cve.now/CVE-2024-38187.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38186](https://cve.now/CVE-2024-38186.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38185](https://cve.now/CVE-2024-38185.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38180](https://cve.now/CVE-2024-38180.md): Windows SmartScreen Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38177](https://cve.now/CVE-2024-38177.md): Windows App Installer Spoofing Vulnerability (CVSS 7.8, Microsoft App Installer)
- [CVE-2024-38173](https://cve.now/CVE-2024-38173.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 6.7, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2024-38171](https://cve.now/CVE-2024-38171.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2024-38170](https://cve.now/CVE-2024-38170.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC f…)
- [CVE-2024-38169](https://cve.now/CVE-2024-38169.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2024-38165](https://cve.now/CVE-2024-38165.md): Windows Compressed Folder Tampering Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38162](https://cve.now/CVE-2024-38162.md): Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Connected Machine Agent)
- [CVE-2024-38158](https://cve.now/CVE-2024-38158.md): Azure IoT SDK Remote Code Execution Vulnerability (CVSS 7.0, Microsoft C SDK for Azure IoT)
- [CVE-2024-38157](https://cve.now/CVE-2024-38157.md): Azure IoT SDK Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Azure IoT Hub Device Client SDK)
- [CVE-2024-38155](https://cve.now/CVE-2024-38155.md): Security Center Broker Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38154](https://cve.now/CVE-2024-38154.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2024-38153](https://cve.now/CVE-2024-38153.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38152](https://cve.now/CVE-2024-38152.md): Windows OLE Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38151](https://cve.now/CVE-2024-38151.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38150](https://cve.now/CVE-2024-38150.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-38148](https://cve.now/CVE-2024-38148.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38147](https://cve.now/CVE-2024-38147.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-38146](https://cve.now/CVE-2024-38146.md): Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38145](https://cve.now/CVE-2024-38145.md): Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38144](https://cve.now/CVE-2024-38144.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38143](https://cve.now/CVE-2024-38143.md): Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability (CVSS 4.2, Microsoft Windows)
- [CVE-2024-38142](https://cve.now/CVE-2024-38142.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38141](https://cve.now/CVE-2024-38141.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38140](https://cve.now/CVE-2024-38140.md): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2024-38138](https://cve.now/CVE-2024-38138.md): Windows Deployment Services Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38137](https://cve.now/CVE-2024-38137.md): Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-38136](https://cve.now/CVE-2024-38136.md): Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-38135](https://cve.now/CVE-2024-38135.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38134](https://cve.now/CVE-2024-38134.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38133](https://cve.now/CVE-2024-38133.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38132](https://cve.now/CVE-2024-38132.md): Windows Network Address Translation (NAT) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38131](https://cve.now/CVE-2024-38131.md): Clipboard Virtual Channel Extension Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows · Microsoft Remote Desktop client for Win…)
- [CVE-2024-38130](https://cve.now/CVE-2024-38130.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38128](https://cve.now/CVE-2024-38128.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2024-38127](https://cve.now/CVE-2024-38127.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38126](https://cve.now/CVE-2024-38126.md): Windows Network Address Translation (NAT) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38125](https://cve.now/CVE-2024-38125.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38122](https://cve.now/CVE-2024-38122.md): Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38121](https://cve.now/CVE-2024-38121.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2024-38118](https://cve.now/CVE-2024-38118.md): Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38117](https://cve.now/CVE-2024-38117.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38116](https://cve.now/CVE-2024-38116.md): Windows IP Routing Management Snapin Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38115](https://cve.now/CVE-2024-38115.md): Windows IP Routing Management Snapin Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38114](https://cve.now/CVE-2024-38114.md): Windows IP Routing Management Snapin Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-29995](https://cve.now/CVE-2024-29995.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-38107](https://cve.now/CVE-2024-38107.md): Windows Power Dependency Coordinator Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-38106](https://cve.now/CVE-2024-38106.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, KEV, Microsoft Windows)
- [CVE-2024-38098](https://cve.now/CVE-2024-38098.md): Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Connected Machine Agent)
- [CVE-2024-38063](https://cve.now/CVE-2024-38063.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2024-38084](https://cve.now/CVE-2024-38084.md): Microsoft OfficePlus Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft OfficePLUS)
- [CVE-2024-38213](https://cve.now/CVE-2024-38213.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 6.5, KEV, Microsoft Windows)
- [CVE-2024-38201](https://cve.now/CVE-2024-38201.md): Azure Stack Hub Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure Stack Hub)
- [CVE-2024-38199](https://cve.now/CVE-2024-38199.md): Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2024-38198](https://cve.now/CVE-2024-38198.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38197](https://cve.now/CVE-2024-38197.md): Microsoft Teams for iOS Spoofing Vulnerability (CVSS 6.5, Microsoft Teams for iOS)
- [CVE-2024-38196](https://cve.now/CVE-2024-38196.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38193](https://cve.now/CVE-2024-38193.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-38191](https://cve.now/CVE-2024-38191.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38184](https://cve.now/CVE-2024-38184.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38178](https://cve.now/CVE-2024-38178.md): Scripting Engine Memory Corruption Vulnerability (CVSS 7.5, KEV, Microsoft Windows)
- [CVE-2024-38172](https://cve.now/CVE-2024-38172.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC f…)
- [CVE-2024-38168](https://cve.now/CVE-2024-38168.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +4)
- [CVE-2024-38167](https://cve.now/CVE-2024-38167.md): .NET and Visual Studio Information Disclosure Vulnerability (CVSS 6.5, Microsoft Visual Studio · Microsoft .NET +12)
- [CVE-2024-38161](https://cve.now/CVE-2024-38161.md): Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-38160](https://cve.now/CVE-2024-38160.md): Windows Network Virtualization Remote Code Execution Vulnerability (CVSS 9.1, Microsoft Windows)
- [CVE-2024-38159](https://cve.now/CVE-2024-38159.md): Windows Network Virtualization Remote Code Execution Vulnerability (CVSS 9.1, Microsoft Windows)
- [CVE-2024-38123](https://cve.now/CVE-2024-38123.md): Windows Bluetooth Driver Information Disclosure Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2024-38108](https://cve.now/CVE-2024-38108.md): Azure Stack Hub Spoofing Vulnerability (CVSS 9.3, Microsoft Azure Stack Hub)
- [CVE-2023-31366](https://cve.now/CVE-2023-31366.md): Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of (CVSS 3.3, AMD μProf Tool)
- [CVE-2023-31349](https://cve.now/CVE-2023-31349.md): Incorrect default permissions in the AMD μProf installation directory could allow an attacker to achieve privilege escalation, potentially r (CVSS 7.3, AMD μProf Tool)
- [CVE-2023-31348](https://cve.now/CVE-2023-31348.md): A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code (CVSS 7.3, AMD μProf Tool)
- [CVE-2023-31341](https://cve.now/CVE-2023-31341.md): Insufficient validation of the Input Output Control (IOCTL) input buffer in AMD μProf may allow an authenticated attacker to cause an out-of (CVSS 7.3, AMD μProf Tool)
- [CVE-2023-31339](https://cve.now/CVE-2023-31339.md): Improper input validation in ARM® Trusted Firmware used in AMD’s Zynq™ UltraScale+™) MPSoC/RFSoC may allow a privileged attacker to perform (CVSS 4.8, AMD Zynq™ UltraScale+™ MPSoC/RFSoC)
- [CVE-2024-21981](https://cve.now/CVE-2024-21981.md): Improper key usage control in AMD Secure Processor (ASP) may allow an attacker with local access who has gained arbitrary code execution pri (CVSS 5.7, AMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +18)
- [CVE-2023-31356](https://cve.now/CVE-2023-31356.md): Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in (CVSS 4.4, AMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors +1)
- [CVE-2023-31310](https://cve.now/CVE-2023-31310.md): Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set t (CVSS 5.0, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…)
- [CVE-2023-31307](https://cve.now/CVE-2023-31307.md): Improper validation of array index in Power Management Firmware (PMFW) may allow a privileged attacker to cause an out-of-bounds memory read (CVSS 2.3, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…)
- [CVE-2023-31304](https://cve.now/CVE-2023-31304.md): Improper input validation in SMU may allow an attacker with privileges and a compromised physical function (PF) to modify the PCIe® lan (CVSS 2.3, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…)
- [CVE-2023-31305](https://cve.now/CVE-2023-31305.md): Generation of weak and predictable Initialization Vector (IV) in PMFW (Power Management Firmware) may allow an attacker with privileges to r (CVSS 1.9, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…)
- [CVE-2023-20591](https://cve.now/CVE-2023-20591.md): Improper re-initialization of IOMMU during the DRTM event may permit an untrusted platform configuration to persist, allowing an attacker to (CVSS 6.5, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Serie… +2)
- [CVE-2023-20584](https://cve.now/CVE-2023-20584.md): IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an attacker with privilege (CVSS 5.3, AMD EPYC™ 7003 Processors · AMD EPYC™ 9004 Processors)
- [CVE-2023-20578](https://cve.now/CVE-2023-20578.md): A TOCTOU (Time-Of-Check-Time-Of-Use) in SMM may allow an attacker with ring0 privileges and access to the BIOS menu or UEFI shell to modify (CVSS 7.5, AMD EPYC™ 7001 Processors · AMD EPYC™ 7002 Processors +10)
- [CVE-2023-20518](https://cve.now/CVE-2023-20518.md): Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shell (CVSS 1.9, AMD EPYC™ 9004 Series Processors · AMD Ryzen™ 3000 Seri… +24)
- [CVE-2023-20513](https://cve.now/CVE-2023-20513.md): An insufficient bounds check in PMFW (Power Management Firmware) may allow an attacker to utilize a malicious VF (virtualization function) t (CVSS 3.3, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…)
- [CVE-2023-20512](https://cve.now/CVE-2023-20512.md): A hardcoded AES key in PMFW may result in a privileged attacker gaining access to the key, potentially resulting in internal debug informa (CVSS 1.9, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…)
- [CVE-2023-20510](https://cve.now/CVE-2023-20510.md): An insufficient DRAM address validation in PMFW may allow a privileged attacker to read from an invalid DRAM address to SRAM, potentially re (CVSS 4.7, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™ PRO…)
- [CVE-2023-20509](https://cve.now/CVE-2023-20509.md): An insufficient DRAM address validation in PMFW may allow a privileged attacker to perform a DMA read from an invalid DRAM address to SRAM, (CVSS 5.2, AMD Radeon™ RX 6000 Series Graphics Cards · AMD Radeon™… +2)
- [CVE-2022-23817](https://cve.now/CVE-2022-23817.md): Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to (CVSS 7.3, AMD Athlon™ 3000 Series Mobile Processors with Radeon™… +24)
- [CVE-2022-23815](https://cve.now/CVE-2022-23815.md): Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially le (CVSS 7.5, AMD Athlon™ 3000 Series Desktop Processors with Radeon™… +4)
- [CVE-2021-46772](https://cve.now/CVE-2021-46772.md): Insufficient input validation in the ABL may allow a privileged attacker with access to the BIOS menu or UEFI shell to tamper with the struc (CVSS 3.9, AMD EPYC™ 7002 Series Processors · AMD EPYC™ 7003 Serie… +25)
- [CVE-2021-46746](https://cve.now/CVE-2021-46746.md): Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment (TEE) may allow a privileged attacker with access (CVSS 5.2, AMD EPYC™ 7001 Processors · AMD EPYC™ 7002 Processors +32)
- [CVE-2021-26387](https://cve.now/CVE-2021-26387.md): Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell t (CVSS 3.9, AMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +29)
- [CVE-2021-26367](https://cve.now/CVE-2021-26367.md): A malicious attacker in x86 can misconfigure the Trusted Memory Regions (TMRs), which may allow the attacker to set an arbitrary address ran (CVSS 5.7, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ G… +13)
- [CVE-2021-26344](https://cve.now/CVE-2021-26344.md): An out of bounds memory write when processing the AMD PSP1 Configuration Block (APCB) could allow an attacker with access the ability to mod (CVSS 7.2, AMD EPYC™ 7001 Series Processors · AMD EPYC™ 7002 Serie… +26)
- [CVE-2024-6619](https://cve.now/CVE-2024-6619.md): Incorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream Report (CVSS 8.5, Ocean Data Systems Dream Report · AVEVA Reports for Operati…)
- [CVE-2024-6618](https://cve.now/CVE-2024-6618.md): Path Traversal in Ocean Data Systems Dream Report (CVSS 8.5, Ocean Data Systems Dream Report · AVEVA Reports for Operati…)
- [CVE-2024-7113](https://cve.now/CVE-2024-7113.md): Allocation of Resources Without Limits or Throttling in AVEVA SuiteLink Server (CVSS 8.7, AVEVA SuiteLink Server · AVEVA Historian +4)
- [CVE-2024-21757](https://cve.now/CVE-2024-21757.md): A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 throug (CVSS 5.5, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2022-27486](https://cve.now/CVE-2022-27486.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5 (CVSS 5.9, Fortinet FortiDDoS · Fortinet FortiDDoS-F)
- [CVE-2022-45862](https://cve.now/CVE-2022-45862.md): An insufficient session expiration vulnerability \[CWE-613\] vulnerability in FortiOS 7.2.5 and below, 7.0 all versions, 6.4 all versions; For (CVSS 3.5, Fortinet FortiPAM · Fortinet FortiProxy +2)
- [CVE-2024-36505](https://cve.now/CVE-2024-36505.md): An improper access control vulnerability \[CWE-284\] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may (CVSS 4.7, Fortinet FortiOS)
- [CVE-2023-26211](https://cve.now/CVE-2023-26211.md): An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an (CVSS 6.4, Fortinet FortiSOAR)
- [CVE-2024-7746](https://cve.now/CVE-2024-7746.md): Use of default credentials at Traccar fleet management solution (CVSS 9.5, Traccar Server)
- [CVE-2024-6384](https://cve.now/CVE-2024-6384.md): Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server (CVSS 5.3, MongoDB Server)
- [CVE-2024-6788](https://cve.now/CVE-2024-6788.md): Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password (CVSS 8.6, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-38502](https://cve.now/CVE-2024-38502.md): Pepperl+Fuchs: Device Master ICDM-RX/\* XSS vulnerability allows stored XSS (CVSS 7.1, Pepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-DIN · Pepperl+Fuchs… +42)
- [CVE-2024-38501](https://cve.now/CVE-2024-38501.md): Pepperl+Fuchs: Device Master ICDM-RX/\* XSS vulnerability allows HTML injection (CVSS 6.1, Pepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-DIN · Pepperl+Fuchs… +42)
- [CVE-2024-5849](https://cve.now/CVE-2024-5849.md): Pepperl+Fuchs: Device Master ICDM-RX/\* XSS vulnerability allows reflected XSS (CVSS 7.1, Pepperl+Fuchs ICDM-RX/TCP-DB9/RJ45-DIN · Pepperl+Fuchs… +42)
- [CVE-2024-3913](https://cve.now/CVE-2024-3913.md): Phoenix Contact: Start sequence allows attack during the boot process (CVSS 5.9, Phoenix Contact CHARX SEC-3000 · Phoenix Contact CHARX S… +2)
- [CVE-2024-43165](https://cve.now/CVE-2024-43165.md): WordPress WPSection plugin \<= 1.3.8 - Contributor+ Limited Local File Inclusion vulnerability (CVSS 6.5, Rashid87 WPSection)
- [CVE-2024-43160](https://cve.now/CVE-2024-43160.md): WordPress BerqWP plugin \<= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, BerqWP)
- [CVE-2024-43153](https://cve.now/CVE-2024-43153.md): WordPress Woffice theme \<= 5.4.10 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, WofficeIO Woffice)
- [CVE-2024-43141](https://cve.now/CVE-2024-43141.md): WordPress Participants Database plugin \<= 2.5.9.2 - PHP Object Injection vulnerability (CVSS 9.8, Roland Barker, xnau webdesign Participants Database)
- [CVE-2024-43140](https://cve.now/CVE-2024-43140.md): WordPress Ultimate Bootstrap Elements for Elementor plugin \<= 1.4.4 - Local File Inclusion vulnerability (CVSS 7.5, G5Theme Ultimate Bootstrap Elements for Elementor)
- [CVE-2024-43138](https://cve.now/CVE-2024-43138.md): WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin \<= 4.2.1 - Local File Inclusion vulnerability (CVSS 6.5, MagePeople Team Event Manager for WooCommerce)
- [CVE-2024-37287](https://cve.now/CVE-2024-37287.md): Kibana arbitrary code execution via prototype pollution (CVSS 9.1, Elastic Kibana)
- [CVE-2024-35124](https://cve.now/CVE-2024-35124.md): IBM OpenBMC authentication bypass (CVSS 7.5, IBM OpenBMC)
- [CVE-2024-41774](https://cve.now/CVE-2024-41774.md): IBM Common Licensing cross-site scripting (CVSS 4.8, IBM Common Licensing)
- [CVE-2024-40697](https://cve.now/CVE-2024-40697.md): IBM Common Licensing information disclosure (CVSS 7.5, IBM Common Licensing)
- [CVE-2024-43135](https://cve.now/CVE-2024-43135.md): WordPress WPCafe plugin \<= 2.2.28 - Local File Inclusion vulnerability (CVSS 7.5, Themewinter WPCafe)
- [CVE-2024-43131](https://cve.now/CVE-2024-43131.md): WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin \< 1.7.0 - Unauthenticated Arbitrary Post/Page Deletion vulnerability (CVSS 7.5, WPWeb Docket)
- [CVE-2024-43129](https://cve.now/CVE-2024-43129.md): WordPress BetterDocs plugin \<= 3.5.8 - Local File Inclusion vulnerability (CVSS 6.5, WPDeveloper BetterDocs)
- [CVE-2024-43128](https://cve.now/CVE-2024-43128.md): WordPress WooCommerce Product Table Lite plugin \<= 3.5.1 - Arbitrary Code Execution vulnerability (CVSS 6.5, WC Product Table WooCommerce Product Table Lite)
- [CVE-2024-43121](https://cve.now/CVE-2024-43121.md): WordPress HUSKY plugin \<= 1.3.6.1 - Privilege Escalation vulnerability (CVSS 9.1, realmag777 HUSKY)
- [CVE-2024-39651](https://cve.now/CVE-2024-39651.md): WordPress WooCommerce PDF Vouchers plugin \< 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability (CVSS 8.6, WPWeb WooCommerce PDF Vouchers)
- [CVE-2024-39642](https://cve.now/CVE-2024-39642.md): WordPress LearnPress plugin \<= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, ThimPress LearnPress)
- [CVE-2024-38787](https://cve.now/CVE-2024-38787.md): WordPress Import and export users and customers plugin \<= 1.26.8 - Sensitive Information via Imported File vulnerability (CVSS 7.5, Javier Carazo Import and export users and customers)
- [CVE-2024-38760](https://cve.now/CVE-2024-38760.md): WordPress Send Users Email plugin \<= 1.5.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, David Maucher Send Users Email)
- [CVE-2024-38756](https://cve.now/CVE-2024-38756.md): WordPress Coming Soon Page – Responsive Coming Soon & Maintenance Mode plugin \<= 1.6.3 - Sensitive Data Exposure vulnerability (CVSS 5.3, Weblizar Coming Soon)
- [CVE-2024-38752](https://cve.now/CVE-2024-38752.md): WordPress Zoho Campaigns plugin \<= 2.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zoho Campaigns)
- [CVE-2024-38749](https://cve.now/CVE-2024-38749.md): WordPress Olive One Click Demo Import plugin \<= 1.1.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Olive Themes Olive One Click Demo Import)
- [CVE-2024-38747](https://cve.now/CVE-2024-38747.md): WordPress HitPay Payment Gateway for WooCommerce plugin \<= 4.1.3 - Sensitive Data Exposure via Log File vulnerability (CVSS 7.5, HitPay Payment Solutions Pte HitPay Payment Gateway for Woo…)
- [CVE-2024-2259](https://cve.now/CVE-2024-2259.md): Reflected XXS Vulnerability in InstaRISPACS Software (CVSS 6.4, Meddiff Technologies InstaRISPACS)
- [CVE-2024-38742](https://cve.now/CVE-2024-38742.md): WordPress MBE eShip plugin \<= 2.1.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, MBE Worldwide S.p.A. MBE eShip)
- [CVE-2024-38724](https://cve.now/CVE-2024-38724.md): WordPress Contact Form 7 Summary and Print plugin \<= 1.2.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability (CVSS 7.1, Muhammad Rehman Contact Form 7 Summary and Print)
- [CVE-2024-38699](https://cve.now/CVE-2024-38699.md): WordPress Wallet System for WooCommerce plugin \<= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability (CVSS 7.5, WP Swings Wallet System for WooCommerce)
- [CVE-2024-37935](https://cve.now/CVE-2024-37935.md): WordPress Woocommerce OpenPos plugin \<= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability (CVSS 7.5, anhvnit Woocommerce OpenPos)
- [CVE-2024-41978](https://cve.now/CVE-2024-41978.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 6.5, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2024-41977](https://cve.now/CVE-2024-41977.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 7.1, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2024-41976](https://cve.now/CVE-2024-41976.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 7.2, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2024-41941](https://cve.now/CVE-2024-41941.md): A vulnerability has been identified in SINEC NMS (All versions \< V3.0). (CVSS 4.3, Siemens SINEC NMS)
- [CVE-2024-41940](https://cve.now/CVE-2024-41940.md): A vulnerability has been identified in SINEC NMS (All versions \< V3.0). (CVSS 9.1, Siemens SINEC NMS)
- [CVE-2024-41939](https://cve.now/CVE-2024-41939.md): A vulnerability has been identified in SINEC NMS (All versions \< V3.0). (CVSS 8.8, Siemens SINEC NMS)
- [CVE-2024-41938](https://cve.now/CVE-2024-41938.md): A vulnerability has been identified in SINEC NMS (All versions \< V3.0). (CVSS 5.5, Siemens SINEC NMS)
- [CVE-2024-41908](https://cve.now/CVE-2024-41908.md): A vulnerability has been identified in NX (All versions \< V2406.3000). (CVSS 7.8, Siemens NX)
- [CVE-2024-41907](https://cve.now/CVE-2024-41907.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V2.0). (CVSS 4.2, Siemens SINEC Traffic Analyzer)
- [CVE-2024-41906](https://cve.now/CVE-2024-41906.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V2.0). (CVSS 4.8, Siemens SINEC Traffic Analyzer)
- [CVE-2024-41905](https://cve.now/CVE-2024-41905.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V2.0). (CVSS 6.8, Siemens SINEC Traffic Analyzer)
- [CVE-2024-41904](https://cve.now/CVE-2024-41904.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V2.0). (CVSS 7.5, Siemens SINEC Traffic Analyzer)
- [CVE-2024-41903](https://cve.now/CVE-2024-41903.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V2.0). (CVSS 6.6, Siemens SINEC Traffic Analyzer)
- [CVE-2024-41683](https://cve.now/CVE-2024-41683.md): A vulnerability has been identified in Location Intelligence family (All versions \< V4.4). (CVSS 5.3, Siemens Location Intelligence family)
- [CVE-2024-41682](https://cve.now/CVE-2024-41682.md): A vulnerability has been identified in Location Intelligence family (All versions \< V4.4). (CVSS 5.3, Siemens Location Intelligence family)
- [CVE-2024-41681](https://cve.now/CVE-2024-41681.md): A vulnerability has been identified in Location Intelligence family (All versions \< V4.4). (CVSS 6.7, Siemens Location Intelligence family)
- [CVE-2024-39922](https://cve.now/CVE-2024-39922.md): A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All version (CVSS 4.6, Siemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14)
- [CVE-2024-36398](https://cve.now/CVE-2024-36398.md): A vulnerability has been identified in SINEC NMS (All versions \< V3.0). (CVSS 7.8, Siemens SINEC NMS)
- [CVE-2024-7715](https://cve.now/CVE-2024-7715.md): D-Link DNS-1550-04 photocenter\_mgr.cgi sprintf command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-6724](https://cve.now/CVE-2024-6724.md): Generate Images – Magic Post Thumbnail \< 5.2.8 - Admin+ Stored XSS (CVSS 4.8, Generate Images)
- [CVE-2024-6823](https://cve.now/CVE-2024-6823.md): Media Library Assistant \<= 3.18 - Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action (CVSS 8.8, dglingren Media Library Assistant)
- [CVE-2024-7247](https://cve.now/CVE-2024-7247.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-39591](https://cve.now/CVE-2024-39591.md): Missing Authorization check in SAP Document Builder (CVSS 4.3, SAP\_SE SAP Document Builder)
- [CVE-2024-42373](https://cve.now/CVE-2024-42373.md): Missing Authorization Check in SAP Student Life Cycle Management (SLcM) (CVSS 4.3, SAP\_SE SAP Student Life Cycle Management)
- [CVE-2024-7092](https://cve.now/CVE-2024-7092.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no\_more\_items\_text Parameter (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-41734](https://cve.now/CVE-2024-41734.md): Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 4.3, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2024-41736](https://cve.now/CVE-2024-41736.md): Information Disclosure vulnerability in SAP Permit to Work (CVSS 4.3, SAP\_SE SAP Permit to Work)
- [CVE-2024-41731](https://cve.now/CVE-2024-41731.md): Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform (CVSS 3.1, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-28166](https://cve.now/CVE-2024-28166.md): Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform (CVSS 3.7, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-42375](https://cve.now/CVE-2024-42375.md): Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform (CVSS 4.3, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-41732](https://cve.now/CVE-2024-41732.md): Improper Access Control in SAP Netweaver Application Server ABAP (CVSS 4.7, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2024-41737](https://cve.now/CVE-2024-41737.md): Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management) (CVSS 5.0, SAP\_SE SAP CRM ABAP)
- [CVE-2024-41733](https://cve.now/CVE-2024-41733.md): Information Disclosure Vulnerability in SAP Commerce (CVSS 5.3, SAP\_SE SAP Commerce)
- [CVE-2024-41735](https://cve.now/CVE-2024-41735.md): Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice (CVSS 5.4, SAP\_SE SAP Commerce Backoffice)
- [CVE-2024-33005](https://cve.now/CVE-2024-33005.md): Missing Authorization check in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server (CVSS 6.3, SAP\_SE SAP NetWeaver Application Server (ABAP and Java),SAP…)
- [CVE-2024-42377](https://cve.now/CVE-2024-42377.md): Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework (CVSS 4.3, SAP\_SE SAP Shared Service Framework)
- [CVE-2024-42376](https://cve.now/CVE-2024-42376.md): Multiple Missing Authorization Check vulnerabilities in SAP Shared Service Framework (CVSS 6.5, SAP\_SE SAP Shared Service Framework)
- [CVE-2024-33003](https://cve.now/CVE-2024-33003.md): Information Disclosure Vulnerability in SAP Commerce Cloud (CVSS 7.4, SAP\_SE SAP Commerce Cloud)
- [CVE-2024-42374](https://cve.now/CVE-2024-42374.md): XML injection in SAP BEx Web Java Runtime Export Web Service (CVSS 8.2, SAP\_SE SAP BEx Web Java Runtime Export Web Service)
- [CVE-2024-41730](https://cve.now/CVE-2024-41730.md): Missing Authentication check in SAP BusinessObjects Business Intelligence Platform (CVSS 9.8, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-7094](https://cve.now/CVE-2024-7094.md): JS Help Desk – The Ultimate Help Desk & Support Plugin \<= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution (CVSS 9.8, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2024-7388](https://cve.now/CVE-2024-7388.md): WP Bannerize Pro \<= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 4.0, gfazioli WP Bannerize Pro)
- [CVE-2022-38382](https://cve.now/CVE-2022-38382.md): IBM Cloud Pak for Security session fixation (CVSS 4.7, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-7709](https://cve.now/CVE-2024-7709.md): OcoMon URL require\_access\_recovery.php cross site scripting (CVSS 6.9, OcoMon)
- [CVE-2024-7707](https://cve.now/CVE-2024-7707.md): Tenda FH1206 HTTP POST Request SafeEmailFilter formSafeEmailFilter stack-based overflow (CVSS 8.7, Tenda FH1206)
- [CVE-2024-36446](https://cve.now/CVE-2024-36446.md): The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authenticatio (CVSS 8.8)
- [CVE-2024-37015](https://cve.now/CVE-2024-37015.md): An issue was discovered in Ada Web Server 20.0. (CVSS 7.4)
- [CVE-2024-41613](https://cve.now/CVE-2024-41613.md): A Cross Site Scripting (XSS) vulnerability in Symphony CMS 2.7.10 allows remote attackers to inject arbitrary web script or HTML by editing (CVSS 6.1)
- [CVE-2024-41614](https://cve.now/CVE-2024-41614.md): symphonycms \<=2.7.10 is vulnerable to Cross Site Scripting (XSS) in the Comment component for articles. (CVSS 4.8)
- [CVE-2024-41623](https://cve.now/CVE-2024-41623.md): An issue in D3D Security D3D IP Camera (D8801) v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payloa (CVSS 9.8)
- [CVE-2024-41711](https://cve.now/CVE-2024-41711.md): A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 ( (CVSS 6.8)
- [CVE-2024-42736](https://cve.now/CVE-2024-42736.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. (CVSS 7.8)
- [CVE-2024-42737](https://cve.now/CVE-2024-42737.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. (CVSS 9.8)
- [CVE-2024-42738](https://cve.now/CVE-2024-42738.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. (CVSS 8.8)
- [CVE-2024-42739](https://cve.now/CVE-2024-42739.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceC (CVSS 8.8)
- [CVE-2024-42740](https://cve.now/CVE-2024-42740.md): In TOTOLINK X5000r v9.1.0cu.2350\_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. (CVSS 6.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.