CVEs published August 16, 2024
56 CVEs were published on August 16, 2024: 10 critical, 13 high.
- Published
- 56
- Critical
- 10
- High
- 13
- Medium
- 31
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Lenovo Printers
- 5
- upKeeper Solutions upKeeper Manager
- 5
- JetBrains TeamCity
- 4
- SourceCodester Yoga Class Registration System
- 3
- Crocoblock JetElements
- 2
- Lenovo Display Control Center · Lenovo Accessories and Disp…
- 2
- cilium · github.com/cilium/cilium
- 1
- Crocoblock JetBlocks for Elementor
- 1
- Crocoblock JetSearch
- 1
- Crocoblock JetTabs
- 1
Critical 10
- CVE-2024-42466Lack of resources and rate limiting - loginupKeeper Solutions upKeeper Manager
- CVE-2024-42465Lack of resources and rate limiting - two factor authenticationupKeeper Solutions upKeeper Manager
- CVE-2024-42462Bypass multifactor authenticationupKeeper Solutions upKeeper Manager
- CVE-2024-6460Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFIGrow by Tradedoubler
- CVE-2024-42634A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42.
- CVE-2024-42637H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
- CVE-2024-42638H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as roo
- CVE-2024-42639H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.
- CVE-2024-42850An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.org.silverpeas.core:silverpeas-core
- CVE-2024-43042Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.
High 13
- CVE-2024-7886Scooter Software Beyond Compare 7zxa.dll uncontrolled search pathScooter Software Beyond Compare
- CVE-2024-43395CraftOS-PC 2's improperly sanitizied paths cause filesystem escape (Windows)MCJack123 craftos2
- CVE-2022-33162IBM Directory Server buffer overflowIBM Security Directory Integrator · IBM Security Verify Dir…
- CVE-2024-7646A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `exKubernetes ingress-nginx · github.com/kubernetes/ingress-ng…
- CVE-2024-4763An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) thLenovo Display Control Center · Lenovo Accessories and Disp…
- CVE-2024-2175An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM)Lenovo Display Control Center · Lenovo Accessories and Disp…
- CVE-2024-7145JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File InclusionCrocoblock JetElements
- CVE-2024-42464Leak of user informationupKeeper Solutions upKeeper Manager
- CVE-2024-42463Leak of organizations messagesupKeeper Solutions upKeeper Manager
- CVE-2024-7146JetTabs <= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File InclusionCrocoblock JetTabs
- CVE-2024-7301WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Uploadnickboss Iptanus File Upload
- CVE-2024-42994VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDeta
- CVE-2024-42995VTiger CRM <= 8.1.0 does not correctly check user privileges.
Medium, low and unrated 33
- CVE-2023-47728IBM QRadar Suite Software information disclosureIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2024-43472Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2024-6098PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or ThrottlingPTC Kepware ThingWorx Kepware Server · PTC Kepware KEPSe… +2
- CVE-2024-43810In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core pluginJetBrains TeamCity
- CVE-2024-43809In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset pageJetBrains TeamCity
- CVE-2024-43808In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault pluginJetBrains TeamCity
- CVE-2024-43807In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds pageJetBrains TeamCity
- CVE-2024-43381reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoningyogeshojha rengine
- CVE-2024-42486Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway APIcilium · github.com/cilium/cilium
- CVE-2024-6004A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to dLenovo Printers
- CVE-2024-5210A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to pLenovo Printers
- CVE-2024-5209A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to dLenovo Printers
- CVE-2024-4782A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to dLenovo Printers
- CVE-2024-4781A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to cLenovo Printers
- CVE-2024-7144JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingCrocoblock JetElements
- CVE-2024-7136JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingCrocoblock JetSearch
- CVE-2024-7147JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site ScriptingCrocoblock JetBlocks for Elementor
- CVE-2024-25008Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation VulnerabilityEricsson RAN Compute Basebands · Ericsson Site Controller
- CVE-2024-7501Download Plugins and Themes from Dashboard <= 1.8.7 - Cross-Site Request Forgerywpcodefactory Download Plugins and Themes in ZIP from Dashb…
- CVE-2024-7422Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Updatejfarthing84 Theme My Login
- CVE-2022-3399Cookie Notice & Compliance for GDPR / CCPA <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scriptinghumanityco Cookie Notice & Compliance for GDPR / CCPA
- CVE-2023-7049Custom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcodegravitymaster97 Custom Field For WP Job Manager
- CVE-2024-7630Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information ExposureRelevanssi Premium · comesio Relevanssi – A Better Search
- CVE-2024-7853SourceCodester Yoga Class Registration System sql injectionSourceCodester Yoga Class Registration System
- CVE-2024-7852SourceCodester Yoga Class Registration System view_inquiry.php cross site scriptingSourceCodester Yoga Class Registration System
- CVE-2024-7851SourceCodester Yoga Class Registration System Add User Users.php improper authorizationSourceCodester Yoga Class Registration System
- CVE-2024-25837A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web s
- CVE-2024-42758A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open
- CVE-2024-42849An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.
- CVE-2024-43005A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrar
- CVE-2024-43006A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21.
- CVE-2024-43009A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier.
- CVE-2024-43011An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier.