# CVEs published 2024-08-17

135 CVEs were published on August 17, 2024: 4 critical, 40 high. Days are UTC.

- [CVE-2024-7902](https://cve.now/CVE-2024-7902.md): pkp ojs signOut redirect (CVSS 6.9, pkp ojs)
- [CVE-2024-7901](https://cve.now/CVE-2024-7901.md): Scada-LTS Message Scada cross site scripting (CVSS 5.3, Scada-LTS)
- [CVE-2024-7900](https://cve.now/CVE-2024-7900.md): xiaohe4966 TpMeCMS Basic Configuration config cross site scripting (CVSS 5.1, xiaohe4966 TpMeCMS)
- [CVE-2024-7899](https://cve.now/CVE-2024-7899.md): InnoCMS Backend edit code injection (CVSS 5.1, InnoCMS)
- [CVE-2024-7898](https://cve.now/CVE-2024-7898.md): Tosei Online Store Management System ネット店舗管理システム Backend default credentials (CVSS 6.9, Tosei Online Store Management System ネット店舗管理システム)
- [CVE-2024-7897](https://cve.now/CVE-2024-7897.md): Tosei Online Store Management System ネット店舗管理システム tosei\_kikai.php command injection (CVSS 5.3, Tosei Online Store Management System ネット店舗管理システム)
- [CVE-2024-7896](https://cve.now/CVE-2024-7896.md): Tosei Online Store Management System ネット店舗管理システム p1\_ftpserver.php command injection (CVSS 5.3, Tosei Online Store Management System ネット店舗管理システム)
- [CVE-2024-7703](https://cve.now/CVE-2024-7703.md): ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup \<= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2023-3416](https://cve.now/CVE-2023-3416.md): tagDiv Opt-In Builder \<= 1.4.4 - Authenticated (Admin+) SQL Injection (CVSS 7.2, tagDiv Opt-In Builder)
- [CVE-2023-0714](https://cve.now/CVE-2023-0714.md): Metform Elementor Contact Form Builder \<= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload (CVSS 8.1, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-3419](https://cve.now/CVE-2023-3419.md): tagDiv Opt-In Builder \<= 1.4.4 - Authenticated (Admin+) SQL Injection (CVSS 7.2, tagDiv Opt-In Builder)
- [CVE-2024-43860](https://cve.now/CVE-2024-43860.md): remoteproc: imx\_rproc: Skip over memory region when node value is NULL (no CVSS, Linux)
- [CVE-2024-43859](https://cve.now/CVE-2024-43859.md): f2fs: fix to truncate preallocated blocks in f2fs\_file\_open() (no CVSS, Linux)
- [CVE-2024-43858](https://cve.now/CVE-2024-43858.md): jfs: Fix array-index-out-of-bounds in diFree (CVSS 7.8, Linux)
- [CVE-2024-43857](https://cve.now/CVE-2024-43857.md): f2fs: fix null reference error when checking end of zone (no CVSS, Linux)
- [CVE-2024-43856](https://cve.now/CVE-2024-43856.md): dma: fix call order in dmam\_free\_coherent (CVSS 7.8, Linux)
- [CVE-2024-43855](https://cve.now/CVE-2024-43855.md): md: fix deadlock between mddev\_suspend and flush bio (no CVSS, Linux)
- [CVE-2024-43854](https://cve.now/CVE-2024-43854.md): block: initialize integrity buffer to zero before writing it to media (no CVSS, Linux)
- [CVE-2024-43853](https://cve.now/CVE-2024-43853.md): cgroup/cpuset: Prevent UAF in proc\_cpuset\_show() (CVSS 7.0, Linux)
- [CVE-2024-43852](https://cve.now/CVE-2024-43852.md): hwmon: (ltc2991) re-order conditions to fix off by one bug (no CVSS, Linux)
- [CVE-2024-43851](https://cve.now/CVE-2024-43851.md): soc: xilinx: rename cpu\_number1 to dummy\_cpu\_number (no CVSS, Linux)
- [CVE-2024-43850](https://cve.now/CVE-2024-43850.md): soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon\_remove (no CVSS, Linux)
- [CVE-2024-43849](https://cve.now/CVE-2024-43849.md): soc: qcom: pdr: protect locator\_addr with the main mutex (no CVSS, Linux)
- [CVE-2024-43848](https://cve.now/CVE-2024-43848.md): wifi: mac80211: fix TTLM teardown work (CVSS 8.8, Linux)
- [CVE-2024-43847](https://cve.now/CVE-2024-43847.md): wifi: ath12k: fix invalid memory access while processing fragmented packets (CVSS 8.8, Linux)
- [CVE-2024-43846](https://cve.now/CVE-2024-43846.md): lib: objagg: Fix general protection fault (CVSS 7.8, Linux)
- [CVE-2024-43845](https://cve.now/CVE-2024-43845.md): udf: Fix bogus checksum computation in udf\_rename() (CVSS 7.8, Linux)
- [CVE-2024-43844](https://cve.now/CVE-2024-43844.md): wifi: rtw89: wow: fix GTK offload H2C skbuff issue (no CVSS, Linux)
- [CVE-2024-43843](https://cve.now/CVE-2024-43843.md): riscv, bpf: Fix out-of-bounds issue when preparing trampoline image (no CVSS, Linux)
- [CVE-2024-43842](https://cve.now/CVE-2024-43842.md): wifi: rtw89: Fix array index mistake in rtw89\_sta\_info\_get\_iter() (no CVSS, Linux)
- [CVE-2024-43841](https://cve.now/CVE-2024-43841.md): wifi: virt\_wifi: avoid reporting connection success with wrong SSID (no CVSS, Linux)
- [CVE-2024-43840](https://cve.now/CVE-2024-43840.md): bpf, arm64: Fix trampoline for BPF\_TRAMP\_F\_CALL\_ORIG (CVSS 7.8, Linux)
- [CVE-2024-43839](https://cve.now/CVE-2024-43839.md): bna: adjust 'name' buf size of bna\_tcb and bna\_ccb structures (no CVSS, Linux)
- [CVE-2024-43838](https://cve.now/CVE-2024-43838.md): bpf: fix overflow check in adjust\_jmp\_off() (no CVSS, Linux)
- [CVE-2024-43837](https://cve.now/CVE-2024-43837.md): bpf: Fix null pointer dereference in resolve\_prog\_type() for BPF\_PROG\_TYPE\_EXT (no CVSS, Linux)
- [CVE-2024-43836](https://cve.now/CVE-2024-43836.md): net: ethtool: pse-pd: Fix possible null-deref (no CVSS, Linux)
- [CVE-2024-43835](https://cve.now/CVE-2024-43835.md): virtio\_net: Fix napi\_skb\_cache\_put warning (no CVSS, Linux)
- [CVE-2024-43834](https://cve.now/CVE-2024-43834.md): xdp: fix invalid wait context of page\_pool\_destroy() (no CVSS, Linux)
- [CVE-2024-43833](https://cve.now/CVE-2024-43833.md): media: v4l: async: Fix NULL pointer dereference in adding ancillary links (no CVSS, Linux)
- [CVE-2024-43832](https://cve.now/CVE-2024-43832.md): s390/uv: Don't call folio\_wait\_writeback() without a folio reference (CVSS 7.8, Linux)
- [CVE-2024-43831](https://cve.now/CVE-2024-43831.md): media: mediatek: vcodec: Handle invalid decoder vsi (no CVSS, Linux)
- [CVE-2024-43830](https://cve.now/CVE-2024-43830.md): leds: trigger: Unregister sysfs attributes before calling deactivate() (CVSS 7.8, Linux)
- [CVE-2024-43829](https://cve.now/CVE-2024-43829.md): drm/qxl: Add check for drm\_cvt\_mode (no CVSS, Linux)
- [CVE-2024-43828](https://cve.now/CVE-2024-43828.md): ext4: fix infinite loop when replaying fast\_commit (no CVSS, Linux)
- [CVE-2024-43827](https://cve.now/CVE-2024-43827.md): drm/amd/display: Add null check before access structs (no CVSS, Linux)
- [CVE-2024-43826](https://cve.now/CVE-2024-43826.md): nfs: pass explicit offset/count to trace events (no CVSS, Linux)
- [CVE-2024-43825](https://cve.now/CVE-2024-43825.md): iio: Fix the sorting functionality in iio\_gts\_build\_avail\_time\_table (CVSS 7.8, Linux)
- [CVE-2024-43824](https://cve.now/CVE-2024-43824.md): PCI: endpoint: pci-epf-test: Make use of cached 'epc\_features' in pci\_epf\_test\_core\_init() (no CVSS, Linux)
- [CVE-2024-43823](https://cve.now/CVE-2024-43823.md): PCI: keystone: Fix NULL pointer dereference in case of DT error in ks\_pcie\_setup\_rc\_app\_regs() (no CVSS, Linux)
- [CVE-2024-43822](https://cve.now/CVE-2024-43822.md): ASoc: PCM6240: Return directly after a failed devm\_kzalloc() in pcmdevice\_i2c\_probe() (no CVSS, Linux)
- [CVE-2024-43821](https://cve.now/CVE-2024-43821.md): scsi: lpfc: Fix a possible null pointer dereference (no CVSS, Linux)
- [CVE-2024-43820](https://cve.now/CVE-2024-43820.md): dm-raid: Fix WARN\_ON\_ONCE check for sync\_thread in raid\_resume (no CVSS, Linux)
- [CVE-2024-43819](https://cve.now/CVE-2024-43819.md): kvm: s390: Reject memory region operations for ucontrol VMs (no CVSS, Linux)
- [CVE-2024-43818](https://cve.now/CVE-2024-43818.md): ASoC: amd: Adjust error handling in case of absent codec device (no CVSS, Linux)
- [CVE-2024-43817](https://cve.now/CVE-2024-43817.md): net: missing check virtio (no CVSS, Linux)
- [CVE-2024-43816](https://cve.now/CVE-2024-43816.md): scsi: lpfc: Revise lpfc\_prep\_embed\_io routine with proper endian macro usages (CVSS 7.8, Linux)
- [CVE-2024-43815](https://cve.now/CVE-2024-43815.md): crypto: mxs-dcp - Ensure payload is zero when using key slot (no CVSS, Linux)
- [CVE-2024-42322](https://cve.now/CVE-2024-42322.md): ipvs: properly dereference pe in ip\_vs\_add\_service (no CVSS, Linux)
- [CVE-2024-42321](https://cve.now/CVE-2024-42321.md): net: flow\_dissector: use DEBUG\_NET\_WARN\_ON\_ONCE (no CVSS, Linux)
- [CVE-2024-42320](https://cve.now/CVE-2024-42320.md): s390/dasd: fix error checks in dasd\_copy\_pair\_store() (no CVSS, Linux)
- [CVE-2024-42319](https://cve.now/CVE-2024-42319.md): mailbox: mtk-cmdq: Move devm\_mbox\_controller\_register() after devm\_pm\_runtime\_enable() (no CVSS, Linux)
- [CVE-2024-42318](https://cve.now/CVE-2024-42318.md): landlock: Don't lose track of restrictions on cred\_transfer (CVSS 8.8, Linux)
- [CVE-2024-42317](https://cve.now/CVE-2024-42317.md): mm/huge\_memory: avoid PMD-size page cache if needed (no CVSS, Linux)
- [CVE-2024-42316](https://cve.now/CVE-2024-42316.md): mm/mglru: fix div-by-zero in vmpressure\_calc\_level() (no CVSS, Linux)
- [CVE-2024-42315](https://cve.now/CVE-2024-42315.md): exfat: fix potential deadlock on \_\_exfat\_get\_dentry\_set (no CVSS, Linux)
- [CVE-2024-42314](https://cve.now/CVE-2024-42314.md): btrfs: fix extent map use-after-free when adding pages to compressed bio (CVSS 7.8, Linux)
- [CVE-2024-42313](https://cve.now/CVE-2024-42313.md): media: venus: fix use after free in vdec\_close (CVSS 7.8, Linux)
- [CVE-2024-42312](https://cve.now/CVE-2024-42312.md): sysctl: always initialize i\_uid/i\_gid (no CVSS, Linux)
- [CVE-2024-42311](https://cve.now/CVE-2024-42311.md): hfs: fix to initialize fields of hfs\_inode\_info after hfs\_alloc\_inode() (CVSS 7.8, Linux)
- [CVE-2024-42310](https://cve.now/CVE-2024-42310.md): drm/gma500: fix null pointer dereference in cdv\_intel\_lvds\_get\_modes (no CVSS, Linux)
- [CVE-2024-42309](https://cve.now/CVE-2024-42309.md): drm/gma500: fix null pointer dereference in psb\_intel\_lvds\_get\_modes (no CVSS, Linux)
- [CVE-2024-42307](https://cve.now/CVE-2024-42307.md): cifs: fix potential null pointer use in destroy\_workqueue in init\_cifs error path (no CVSS, Linux)
- [CVE-2024-42306](https://cve.now/CVE-2024-42306.md): udf: Avoid using corrupted block bitmap buffer (CVSS 7.8, Linux)
- [CVE-2024-42305](https://cve.now/CVE-2024-42305.md): ext4: check dot and dotdot of dx\_root before making dir indexed (no CVSS, Linux)
- [CVE-2024-42304](https://cve.now/CVE-2024-42304.md): ext4: make sure the first directory block is not a hole (CVSS 7.8, Linux)
- [CVE-2024-42303](https://cve.now/CVE-2024-42303.md): media: imx-pxp: Fix ERR\_PTR dereference in pxp\_probe() (no CVSS, Linux)
- [CVE-2024-42302](https://cve.now/CVE-2024-42302.md): PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal (no CVSS, Linux)
- [CVE-2024-42301](https://cve.now/CVE-2024-42301.md): dev/parport: fix the array out-of-bounds risk (CVSS 7.8, Linux)
- [CVE-2024-42300](https://cve.now/CVE-2024-42300.md): erofs: fix race in z\_erofs\_get\_gbuf() (CVSS 7.8, Linux)
- [CVE-2024-42299](https://cve.now/CVE-2024-42299.md): fs/ntfs3: Update log-\>page\_{mask,bits} if log-\>page\_size changed (CVSS 7.8, Linux)
- [CVE-2024-42298](https://cve.now/CVE-2024-42298.md): ASoC: fsl: fsl\_qmc\_audio: Check devm\_kasprintf() returned value (no CVSS, Linux)
- [CVE-2024-42297](https://cve.now/CVE-2024-42297.md): f2fs: fix to don't dirty inode for readonly filesystem (CVSS 7.8, Linux)
- [CVE-2024-42296](https://cve.now/CVE-2024-42296.md): f2fs: fix return value of f2fs\_convert\_inline\_inode() (CVSS 7.8, Linux)
- [CVE-2024-42295](https://cve.now/CVE-2024-42295.md): nilfs2: handle inconsistent state in nilfs\_btnode\_create\_block() (no CVSS, Linux)
- [CVE-2024-42294](https://cve.now/CVE-2024-42294.md): block: fix deadlock between sd\_remove & sd\_release (no CVSS, Linux)
- [CVE-2024-42293](https://cve.now/CVE-2024-42293.md): arm64: mm: Fix lockless walks with static and dynamic page-table folding (CVSS 7.8, Linux)
- [CVE-2024-42292](https://cve.now/CVE-2024-42292.md): kobject\_uevent: Fix OOB access within zap\_modalias\_env() (no CVSS, Linux)
- [CVE-2024-42291](https://cve.now/CVE-2024-42291.md): ice: Add a per-VF limit on number of FDIR filters (no CVSS, Linux)
- [CVE-2024-42290](https://cve.now/CVE-2024-42290.md): irqchip/imx-irqsteer: Handle runtime power management correctly (no CVSS, Linux)
- [CVE-2024-42289](https://cve.now/CVE-2024-42289.md): scsi: qla2xxx: During vport delete send async logout explicitly (no CVSS, Linux)
- [CVE-2024-42288](https://cve.now/CVE-2024-42288.md): scsi: qla2xxx: Fix for possible memory corruption (CVSS 7.8, Linux)
- [CVE-2024-42287](https://cve.now/CVE-2024-42287.md): scsi: qla2xxx: Complete command early within lock (CVSS 8.8, Linux)
- [CVE-2024-42286](https://cve.now/CVE-2024-42286.md): scsi: qla2xxx: validate nvme\_local\_port correctly (CVSS 7.5, Linux)
- [CVE-2024-42285](https://cve.now/CVE-2024-42285.md): RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (CVSS 9.8, Linux)
- [CVE-2024-42284](https://cve.now/CVE-2024-42284.md): tipc: Return non-zero value from tipc\_udp\_addr2str() on error (CVSS 9.1, Linux)
- [CVE-2024-42283](https://cve.now/CVE-2024-42283.md): net: nexthop: Initialize all fields in dumped nexthops (no CVSS, Linux)
- [CVE-2024-42282](https://cve.now/CVE-2024-42282.md): net: mediatek: Fix potential NULL pointer dereference in dummy net\_device handling (no CVSS, Linux)
- [CVE-2024-42281](https://cve.now/CVE-2024-42281.md): bpf: Fix a segment issue when downgrading gso\_size (no CVSS, Linux)
- [CVE-2024-42280](https://cve.now/CVE-2024-42280.md): mISDN: Fix a use after free in hfcmulti\_tx() (CVSS 7.8, Linux)
- [CVE-2024-42279](https://cve.now/CVE-2024-42279.md): spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer (CVSS 7.8, Linux)
- [CVE-2024-42278](https://cve.now/CVE-2024-42278.md): ASoC: TAS2781: Fix tasdev\_load\_calibrated\_data() (no CVSS, Linux)
- [CVE-2024-42277](https://cve.now/CVE-2024-42277.md): iommu: sprd: Avoid NULL deref in sprd\_iommu\_hw\_en (no CVSS, Linux)
- [CVE-2024-42276](https://cve.now/CVE-2024-42276.md): nvme-pci: add missing condition check for existence of mapped data (CVSS 7.8, Linux)
- [CVE-2023-52889](https://cve.now/CVE-2023-52889.md): apparmor: Fix null pointer deref when receiving skb during sock creation (no CVSS, Linux)
- [CVE-2024-7887](https://cve.now/CVE-2024-7887.md): LimeSurvey File Upload index.php denial of service (CVSS 5.1, LimeSurvey)
- [CVE-2024-42275](https://cve.now/CVE-2024-42275.md): drm/client: Fix error code in drm\_client\_buffer\_vmap\_local() (CVSS 7.8, Linux)
- [CVE-2024-42274](https://cve.now/CVE-2024-42274.md): Revert "ALSA: firewire-lib: operate for period elapse event in process context" (no CVSS, Linux)
- [CVE-2024-42273](https://cve.now/CVE-2024-42273.md): f2fs: assign CURSEG\_ALL\_DATA\_ATGC if blkaddr is valid (CVSS 7.8, Linux)
- [CVE-2024-42272](https://cve.now/CVE-2024-42272.md): sched: act\_ct: take care of padding in struct zones\_ht\_key (CVSS 7.8, Linux)
- [CVE-2024-42271](https://cve.now/CVE-2024-42271.md): net/iucv: fix use after free in iucv\_sock\_close() (CVSS 7.8, Linux)
- [CVE-2024-42270](https://cve.now/CVE-2024-42270.md): netfilter: iptables: Fix null-ptr-deref in iptable\_nat\_table\_init(). (no CVSS, Linux)
- [CVE-2024-42269](https://cve.now/CVE-2024-42269.md): netfilter: iptables: Fix potential null-ptr-deref in ip6table\_nat\_table\_init(). (no CVSS, Linux)
- [CVE-2024-42268](https://cve.now/CVE-2024-42268.md): net/mlx5: Fix missing lock on sync reset reload (no CVSS, Linux)
- [CVE-2024-42267](https://cve.now/CVE-2024-42267.md): riscv/mm: Add handling for VM\_FAULT\_SIGSEGV in mm\_fault\_error() (no CVSS, Linux)
- [CVE-2024-42266](https://cve.now/CVE-2024-42266.md): btrfs: make cow\_file\_range\_inline() honor locked\_page on error (CVSS 7.8, Linux)
- [CVE-2024-42265](https://cve.now/CVE-2024-42265.md): protect the fetch of -\>fd\[fd\] in do\_dup2() from mispredictions (no CVSS, Linux)
- [CVE-2024-42264](https://cve.now/CVE-2024-42264.md): drm/v3d: Prevent out of bounds access in performance query extensions (CVSS 7.8, Linux)
- [CVE-2024-42263](https://cve.now/CVE-2024-42263.md): drm/v3d: Fix potential memory leak in the timestamp extension (no CVSS, Linux)
- [CVE-2024-42262](https://cve.now/CVE-2024-42262.md): drm/v3d: Fix potential memory leak in the performance extension (no CVSS, Linux)
- [CVE-2024-42261](https://cve.now/CVE-2024-42261.md): drm/v3d: Validate passed in drm syncobj handles in the timestamp extension (no CVSS, Linux)
- [CVE-2024-42260](https://cve.now/CVE-2024-42260.md): drm/v3d: Validate passed in drm syncobj handles in the performance extension (no CVSS, Linux)
- [CVE-2023-3408](https://cve.now/CVE-2023-3408.md): Bricks \<= 1.8.1 - Cross-Site Request Forgery via save\_settings (CVSS 4.3, Bricks Builder Bricks)
- [CVE-2023-5505](https://cve.now/CVE-2023-5505.md): BackWPup \<= 4.0.1 - Authenticated (Administrator+) Directory Traversal (CVSS 6.8, wp\_media BackWPup – WordPress Backup & Restore Plugin)
- [CVE-2023-3409](https://cve.now/CVE-2023-3409.md): Bricks \<= 1.8.1 - Cross-Site Request Forgery via reset\_settings (CVSS 5.4, Bricks Builder Bricks)
- [CVE-2023-4604](https://cve.now/CVE-2023-4604.md): Slideshow, Image Slider by 2J \<= 1.3.54 - Reflected Cross-Site Scripting via 'post' (CVSS 6.1, 2j-slideshow Slideshow, Image Slider by)
- [CVE-2023-1604](https://cve.now/CVE-2023-1604.md): Short URL \<= 1.6.8 - Cross-Site Request Forgery via configuration\_page (CVSS 4.7, kaizencoders Short URL)
- [CVE-2023-4025](https://cve.now/CVE-2023-4025.md): Radio Player \<= 2.0.73 - Missing Authorization to Player Update (CVSS 5.3, princeahmed Radio Player – Live Shoutcast, Icecast and Any…)
- [CVE-2023-4730](https://cve.now/CVE-2023-4730.md): LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \<= 4.3 - Missing Authorization via init\_endpoint (CVSS 5.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2023-4507](https://cve.now/CVE-2023-4507.md): Admission AppManager \<= 1.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, zvijerka Admission AppManager)
- [CVE-2022-4532](https://cve.now/CVE-2022-4532.md): LOGIN AND REGISTRATION ATTEMPTS LIMIT\<= 2.1 - IP Address Spoofing to Protection Mechanism Bypass (CVSS 6.5, krut1 LOGIN AND REGISTRATION ATTEMPTS LIMIT)
- [CVE-2023-4024](https://cve.now/CVE-2023-4024.md): Radio Player \<= 2.0.73 - Missing Authorization to Player Deletion (CVSS 5.3, princeahmed Radio Player – Live Shoutcast, Icecast and Any…)
- [CVE-2023-4027](https://cve.now/CVE-2023-4027.md): Radio Player \<= 2.0.73 - Missing Authorization to Settings Update (CVSS 5.3, princeahmed Radio Player – Live Shoutcast, Icecast and Any…)
- [CVE-2022-1751](https://cve.now/CVE-2022-1751.md): Skitter Slideshow \<= 2.5.2 - Unauthenticated Server-Side Request Forgery (CVSS 7.2, thiagosf Skitter Slideshow)
- [CVE-2024-6459](https://cve.now/CVE-2024-6459.md): News Element Elementor Blog Magazine \< 1.0.6 - Unauthenticated LFI (CVSS 9.8, News Element Elementor Blog Magazine)
- [CVE-2024-6500](https://cve.now/CVE-2024-6500.md): InPost for WooCommerce \<= 1.4.0 and InPost PL \<= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete (CVSS 10.0, inspirelabs InPost for WooCommerce · inspirelabs InPost PL)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.