# CVEs published 2024-08-16

56 CVEs were published on August 16, 2024: 10 critical, 13 high. Days are UTC.

- [CVE-2024-7886](https://cve.now/CVE-2024-7886.md): Scooter Software Beyond Compare 7zxa.dll uncontrolled search path (CVSS 8.5, Scooter Software Beyond Compare)
- [CVE-2024-43395](https://cve.now/CVE-2024-43395.md): CraftOS-PC 2's improperly sanitizied paths cause filesystem escape (Windows) (CVSS 8.2, MCJack123 craftos2)
- [CVE-2023-47728](https://cve.now/CVE-2023-47728.md): IBM QRadar Suite Software information disclosure (CVSS 6.5, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-43472](https://cve.now/CVE-2024-43472.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 5.8, Microsoft Edge)
- [CVE-2022-33162](https://cve.now/CVE-2022-33162.md): IBM Directory Server buffer overflow (CVSS 7.3, IBM Security Directory Integrator · IBM Security Verify Dir…)
- [CVE-2024-7646](https://cve.now/CVE-2024-7646.md): A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the \`networking.k8s.io\` or \`ex (CVSS 8.8, Kubernetes ingress-nginx · github.com/kubernetes/ingress-ng…)
- [CVE-2024-6098](https://cve.now/CVE-2024-6098.md): PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling (CVSS 5.3, PTC Kepware ThingWorx Kepware Server · PTC Kepware KEPSe… +2)
- [CVE-2024-43810](https://cve.now/CVE-2024-43810.md): In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin (CVSS 4.6, JetBrains TeamCity)
- [CVE-2024-43809](https://cve.now/CVE-2024-43809.md): In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page (CVSS 3.5, JetBrains TeamCity)
- [CVE-2024-43808](https://cve.now/CVE-2024-43808.md): In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin (CVSS 3.7, JetBrains TeamCity)
- [CVE-2024-43807](https://cve.now/CVE-2024-43807.md): In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page (CVSS 4.6, JetBrains TeamCity)
- [CVE-2024-43381](https://cve.now/CVE-2024-43381.md): reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning (CVSS 5.0, yogeshojha rengine)
- [CVE-2024-42486](https://cve.now/CVE-2024-42486.md): Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API (CVSS 5.4, cilium · github.com/cilium/cilium)
- [CVE-2024-6004](https://cve.now/CVE-2024-6004.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d (CVSS 6.5, Lenovo Printers)
- [CVE-2024-5210](https://cve.now/CVE-2024-5210.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to p (CVSS 6.5, Lenovo Printers)
- [CVE-2024-5209](https://cve.now/CVE-2024-5209.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d (CVSS 6.5, Lenovo Printers)
- [CVE-2024-4782](https://cve.now/CVE-2024-4782.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d (CVSS 6.5, Lenovo Printers)
- [CVE-2024-4781](https://cve.now/CVE-2024-4781.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to c (CVSS 6.5, Lenovo Printers)
- [CVE-2024-4763](https://cve.now/CVE-2024-4763.md): An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) th (CVSS 7.8, Lenovo Display Control Center · Lenovo Accessories and Disp…)
- [CVE-2024-2175](https://cve.now/CVE-2024-2175.md): An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) (CVSS 7.8, Lenovo Display Control Center · Lenovo Accessories and Disp…)
- [CVE-2024-7144](https://cve.now/CVE-2024-7144.md): JetElements \<= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Crocoblock JetElements)
- [CVE-2024-7145](https://cve.now/CVE-2024-7145.md): JetElements \<= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion (CVSS 8.8, Crocoblock JetElements)
- [CVE-2024-42466](https://cve.now/CVE-2024-42466.md): Lack of resources and rate limiting - login (CVSS 9.5, upKeeper Solutions upKeeper Manager)
- [CVE-2024-42465](https://cve.now/CVE-2024-42465.md): Lack of resources and rate limiting - two factor authentication (CVSS 9.0, upKeeper Solutions upKeeper Manager)
- [CVE-2024-42464](https://cve.now/CVE-2024-42464.md): Leak of user information (CVSS 7.6, upKeeper Solutions upKeeper Manager)
- [CVE-2024-42463](https://cve.now/CVE-2024-42463.md): Leak of organizations messages (CVSS 8.6, upKeeper Solutions upKeeper Manager)
- [CVE-2024-42462](https://cve.now/CVE-2024-42462.md): Bypass multifactor authentication (CVSS 10.0, upKeeper Solutions upKeeper Manager)
- [CVE-2024-7146](https://cve.now/CVE-2024-7146.md): JetTabs \<= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File Inclusion (CVSS 8.8, Crocoblock JetTabs)
- [CVE-2024-7136](https://cve.now/CVE-2024-7136.md): JetSearch \<= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Crocoblock JetSearch)
- [CVE-2024-7147](https://cve.now/CVE-2024-7147.md): JetBlocks \<= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Crocoblock JetBlocks for Elementor)
- [CVE-2024-25008](https://cve.now/CVE-2024-25008.md): Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation Vulnerability (CVSS 6.8, Ericsson RAN Compute Basebands · Ericsson Site Controller)
- [CVE-2024-7501](https://cve.now/CVE-2024-7501.md): Download Plugins and Themes from Dashboard \<= 1.8.7 - Cross-Site Request Forgery (CVSS 4.2, wpcodefactory Download Plugins and Themes in ZIP from Dashb…)
- [CVE-2024-6460](https://cve.now/CVE-2024-6460.md): Grow by Tradedoubler \<= 2.0.21 - Unauthenticated LFI (CVSS 9.8, Grow by Tradedoubler)
- [CVE-2024-7301](https://cve.now/CVE-2024-7301.md): WordPress File Upload \<= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 7.2, nickboss Iptanus File Upload)
- [CVE-2024-7422](https://cve.now/CVE-2024-7422.md): Theme My Login \<= 7.1.7 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, jfarthing84 Theme My Login)
- [CVE-2022-3399](https://cve.now/CVE-2022-3399.md): Cookie Notice & Compliance for GDPR / CCPA \<= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, humanityco Cookie Notice & Compliance for GDPR / CCPA)
- [CVE-2023-7049](https://cve.now/CVE-2023-7049.md): Custom Field For WP Job Manager \<= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode (CVSS 4.3, gravitymaster97 Custom Field For WP Job Manager)
- [CVE-2024-7630](https://cve.now/CVE-2024-7630.md): Relevanssi \<= 4.22.2 (Free) and \<= 2.25.1 (Premium) - Unauthenticated Information Exposure (CVSS 5.3, Relevanssi Premium · comesio Relevanssi – A Better Search)
- [CVE-2024-7853](https://cve.now/CVE-2024-7853.md): SourceCodester Yoga Class Registration System sql injection (CVSS 5.3, SourceCodester Yoga Class Registration System)
- [CVE-2024-7852](https://cve.now/CVE-2024-7852.md): SourceCodester Yoga Class Registration System view\_inquiry.php cross site scripting (CVSS 5.3, SourceCodester Yoga Class Registration System)
- [CVE-2024-7851](https://cve.now/CVE-2024-7851.md): SourceCodester Yoga Class Registration System Add User Users.php improper authorization (CVSS 5.3, SourceCodester Yoga Class Registration System)
- [CVE-2024-25837](https://cve.now/CVE-2024-25837.md): A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web s (CVSS 5.4)
- [CVE-2024-42634](https://cve.now/CVE-2024-42634.md): A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. (CVSS 9.8)
- [CVE-2024-42637](https://cve.now/CVE-2024-42637.md): H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. (CVSS 9.8)
- [CVE-2024-42638](https://cve.now/CVE-2024-42638.md): H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as roo (CVSS 9.8)
- [CVE-2024-42639](https://cve.now/CVE-2024-42639.md): H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root. (CVSS 9.8)
- [CVE-2024-42758](https://cve.now/CVE-2024-42758.md): A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open (CVSS 5.4)
- [CVE-2024-42849](https://cve.now/CVE-2024-42849.md): An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function. (CVSS 6.5)
- [CVE-2024-42850](https://cve.now/CVE-2024-42850.md): An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. (CVSS 9.8, org.silverpeas.core:silverpeas-core)
- [CVE-2024-42994](https://cve.now/CVE-2024-42994.md): VTiger CRM \<= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDeta (CVSS 7.2)
- [CVE-2024-42995](https://cve.now/CVE-2024-42995.md): VTiger CRM \<= 8.1.0 does not correctly check user privileges. (CVSS 8.3)
- [CVE-2024-43005](https://cve.now/CVE-2024-43005.md): A reflected cross-site scripting (XSS) vulnerability in the component dl\_liuyan\_save.php of ZZCMS v2023 allows attackers to execute arbitrar (CVSS 4.7)
- [CVE-2024-43006](https://cve.now/CVE-2024-43006.md): A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. (CVSS 5.4)
- [CVE-2024-43009](https://cve.now/CVE-2024-43009.md): A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. (CVSS 4.7)
- [CVE-2024-43011](https://cve.now/CVE-2024-43011.md): An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. (CVSS 4.9)
- [CVE-2024-43042](https://cve.now/CVE-2024-43042.md): Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.