CVEs published August 15, 2024
121 CVEs were published on August 15, 2024: 11 critical, 43 high. 1 is now in CISA KEV.
- Published
- 121
- Critical
- 11
- High
- 43
- Medium
- 64
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 22
Most affected products
- Google Android
- 12
- D-Link DNS-120 · D-Link DNR-202L +18
- 6
- SourceCodester Online Graduate Tracer System
- 6
- Xpdf
- 3
- cilium · github.com/cilium/cilium
- 2
- CodeAstro Online Railway Reservation System
- 2
- CORDEA oauth
- 2
- Directus
- 2
- IBM InfoSphere Information Server
- 2
- Kingsoft WPS Office
- 2
Critical 11
- CVE-2024-42472Flatpak may allow access to files outside sandbox for certain appsflatpak
- CVE-2024-7263Arbitrary Code Execution in WPS OfficeKingsoft WPS Office
- CVE-2024-7262Arbitrary Code Execution in WPS OfficeKingsoft WPS Office
- CVE-2024-23168Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting i
- CVE-2024-27730Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary cod
- CVE-2024-42757Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function
- CVE-2024-42843Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php.
- CVE-2024-42947An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a craf
- CVE-2024-42966Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains t
- CVE-2024-42967Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains th
- CVE-2024-42978An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted
High 43
- CVE-2024-43378calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systemscalamares-nixos-extensions
- CVE-2024-43370gettext.js vulnerable to cross-site scripting (XSS)guillaumepotier gettext.js · gettext.js
- CVE-2024-7849D-Link DNS-1550-04 photocenter_mgr.cgi cgi_create_album buffer overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-43369Persistent Cross-site Scripting in Ibexa RichText Field Typeibexa fieldtype-richtext · ibexa/fieldtype-richtext
- CVE-2024-34743In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code.Google Android
- CVE-2024-34741In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensaGoogle Android
- CVE-2024-34740In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer oveGoogle Android
- CVE-2024-34739In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the cGoogle Android
- CVE-2024-34738In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due Google Android
- CVE-2024-34737In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable and undeletable pip wGoogle Android
- CVE-2024-34734In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen Google Android
- CVE-2024-34731In multiple functions of TranscodingResourcePolicy.cpp, there is a possible memory corruption due to a race condition.Google Android
- CVE-2024-34727In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow.Google Android
- CVE-2024-31333In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow.Google Android
- CVE-2024-43367Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objectsboa-dev boa · boa_engine
- CVE-2024-43366zkvyper ignored loop range boundsmatter-labs era-compiler-vyper
- CVE-2024-6456SQL Injection vulnerability in AVEVA Historian ServerAVEVA Historian Web Server
- CVE-2024-43357JavaScript specification issue may lead to type confusion and pointer dereference in implementationstc39 ecma262
- CVE-2024-43373webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundlej4k0xb webcrack · webcrack
- CVE-2024-7832D-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_fullscreen_photos buffer overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-7831D-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_cooliris buffer overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-7830D-Link DNS-1550-04 photocenter_mgr.cgi cgi_move_photo buffer overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-7829D-Link DNS-1550-04 photocenter_mgr.cgi cgi_del_photo buffer overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-7828D-Link DNS-1550-04 photocenter_mgr.cgi cgi_set_cover buffer overflowD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-7628MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeoverinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2024-7624Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalationdylanjkotze Zephyr Project Manager
- CVE-2024-22218XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users
- CVE-2024-27729Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location paramete
- CVE-2024-42676File Upload vulnerability in Huizhi enterprise resource management system v.1.0 and before allows a remote attacker to execute arbitrary cod
- CVE-2024-42679SQL Injection vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrary code
- CVE-2024-42681Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.com.xuxueli:xxl-job-core
- CVE-2024-42941Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function.
- CVE-2024-42943Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function.
- CVE-2024-42948Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function.
- CVE-2024-42950Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the Go parameter in the fromSafeClientFilter function.
- CVE-2024-42951Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the mit_pptpusrpw parameter in the fromWizardHandle function.
- CVE-2024-42952Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromqossetting function.
- CVE-2024-42969Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeUrlFilter function.
- CVE-2024-42977Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the qos parameter in the fromqossetting function.
- CVE-2024-42980Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function.
- CVE-2024-42981Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function.
- CVE-2024-42986Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function.
- CVE-2024-42987Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function.
Medium, low and unrated 67
- CVE-2024-43374Vim heap-use-after-free in src/arglist.c:207vim
- CVE-2024-7845SourceCodester Online Graduate Tracer System fetch_it.php sql injectionSourceCodester Online Graduate Tracer System
- CVE-2024-7844SourceCodester Online Graduate Tracer System add_acc.php cross site scriptingSourceCodester Online Graduate Tracer System
- CVE-2024-7843SourceCodester Online Graduate Tracer System exportcs.php information disclosureSourceCodester Online Graduate Tracer System
- CVE-2024-34742In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to a logic error in theGoogle Android
- CVE-2024-34736In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enabled.Google Android
- CVE-2024-7842SourceCodester Online Graduate Tracer System export_it.php information disclosureSourceCodester Online Graduate Tracer System
- CVE-2024-7841SourceCodester Clinics Patient Management System check_user_name.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2024-7839itsourcecode Billing System addbill.php sql injectionitsourcecode Billing System
- CVE-2024-42488Cilium agent's race condition may lead to policy bypass for Host Firewall policycilium · github.com/cilium/cilium
- CVE-2024-42487Cilium's Gateway API route matching order contradicts specificationcilium · github.com/cilium/cilium
- CVE-2024-7868Uninitialized variable in Xpdf 4.05 due to invalid JPEG headerXpdf
- CVE-2024-7867Integer overflow and divide-by-zero in Xpdf 4.05 due to bogus page box coordinatesXpdf
- CVE-2024-7838itsourcecode Online Food Ordering System addcategory.php sql injectionitsourcecode Online Food Ordering System
- CVE-2024-7866Stack overflow in Xpdf 4.05 due to object loop in PDF patternXpdf
- CVE-2024-42476oauth CSRF vulnerabilityCORDEA oauth
- CVE-2024-42475OAuth library for nim allows insecure generation of state values by generateState - entropy too low and uses regular PRNG instead of CSPRNGCORDEA oauth
- CVE-2024-25633In eLabFTW, if administrators can create users, users can tooelabftw
- CVE-2024-31905IBM QRadar Network Packet Capture information disclosureIBM QRadar Network Packet Capture
- CVE-2024-40705IBM InfoSphere Information Server denial of serviceIBM InfoSphere Information Server
- CVE-2024-40704IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-6347Unauthorized access to ECU functionalityNissan Altima
- CVE-2024-7833D-Link DI-8100 upgrade_filter.asp upgrade_filter_asp command injectionD-Link DI-8100
- CVE-2024-7411Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosurecontrid Newsletters
- CVE-2024-7063ElementsKit Pro <= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposurewpmet ElementsKit Pro
- CVE-2024-7064ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpmet ElementsKit Pro
- CVE-2024-7815CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scriptingCodeAstro Online Railway Reservation System
- CVE-2024-7814CodeAstro Online Railway Reservation System Add Employee Page admin-add-employee.php cross site scriptingCodeAstro Online Railway Reservation System
- CVE-2024-6534Directus 10.13.0 - Insecure object reference via PATH presetsDirectus
- CVE-2024-6533Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_optionsDirectus
- CVE-2024-7813SourceCodester Prison Management System Profile Image insufficiently protected credentialsSourceCodester Prison Management System
- CVE-2024-7812SourceCodester Best House Rental Management System POST Parameter ajax.php cross site scriptingSourceCodester Best House Rental Management System
- CVE-2024-25024IBM QRadar Suite Software information disclosureIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2024-7811SourceCodester Daily Expenses Monitoring App delete-expense.php sql injectionSourceCodester Daily Expenses Monitoring App
- CVE-2024-7420Insert PHP Code Snippet <= 1.3.6 - Cross-Site Request Forgery to Code Snippet Activate/Deactivate/Deletionf1logic Insert PHP Code Snippet
- CVE-2024-7810SourceCodester Online Graduate Tracer System view_itprofile.php sql injectionSourceCodester Online Graduate Tracer System
- CVE-2024-7809SourceCodester Online Graduate Tracer System nbproject exposure of information through directory listingSourceCodester Online Graduate Tracer System
- CVE-2024-7808code-projects Job Portal logindbc.php sql injectioncode-projects Job Portal
- CVE-2024-22217A Server-Side Request Forgery (SSRF) vulnerability in Terminalfour before 8.3.19 allows authenticated users to use specific features to acce
- CVE-2024-22219XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users
- CVE-2024-27728Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of
- CVE-2024-27731Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type
- CVE-2024-31798Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retr
- CVE-2024-31799Information Disclosure in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to read the WiFi passphrase via th
- CVE-2024-31800Authentication Bypass in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to gain a privileged command shell
- CVE-2024-32231Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.github.com/stashapp/stash
- CVE-2024-42677An issue in Huizhi enterprise resource management system v.1.0 and before allows a local attacker to obtain sensitive information via the /n
- CVE-2024-42678Cross Site Scripting vulnerability in Super easy enterprise management system v.1.0.0 and before allows a local attacker to execute arbitrar
- CVE-2024-42680An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by enterin
- CVE-2024-42940Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function.
- CVE-2024-42942Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function.
- CVE-2024-42944Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromNatlimit function.
- CVE-2024-42945Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromAddressNat function.
- CVE-2024-42946Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function.
- CVE-2024-42949Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the qos parameter in the fromqossetting function.
- CVE-2024-42953Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPW parameter in the fromWizardHandle function.
- CVE-2024-42954Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function.
- CVE-2024-42955Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function.
- CVE-2024-42968Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the Go parameter in the fromSafeUrlFilter function.
- CVE-2024-42973Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSetlpBind function.
- CVE-2024-42974Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function.
- CVE-2024-42976Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function.
- CVE-2024-42979Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ProtForm function.
- CVE-2024-42982Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function.
- CVE-2024-42983Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan function.
- CVE-2024-42984Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function.
- CVE-2024-42985Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromNatlimit function.