CVEs published August 19, 2024
70 CVEs were published on August 19, 2024: 17 critical, 22 high.
- Published
- 70
- Critical
- 17
- High
- 22
- Medium
- 30
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- itsourcecode Project Expense Monitoring System
- 4
- ZZCMS
- 4
- Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2…
- 3
- Bit Apps Bit Form Pro
- 3
- azzaroco Ultimate Membership Pro
- 2
- AI Engine
- 1
- Autodesk AutoCAD · Autodesk Civil +2
- 1
- Chatbot with ChatGPT WordPress
- 1
- creativeon WHMpress
- 1
- Crew HRM
- 1
Critical 17
- CVE-2024-43354WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerabilitySaad Iqbal myCred
- CVE-2024-43311WordPress Login As Users plugin <= 1.4.2 - Broken Authentication vulnerabilityGeek Code Lab Login As Users
- CVE-2024-43261WordPress Compute Links plugin <= 1.2.1 - Remote File Inclusion vulnerabilityHamed Naderfar Compute Links
- CVE-2024-43252WordPress Crew HRM plugin <= 1.1.1 - PHP Object Injection vulnerabilityCrew HRM
- CVE-2024-43249WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Arbitrary File Upload vulnerabilityBit Apps Bit Form Pro
- CVE-2024-43245WordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerabilityeyecix JobSearch
- CVE-2024-43242WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated PHP Object Injection vulnerabilityazzaroco Ultimate Membership Pro
- CVE-2024-43240WordPress Indeed Ultimate Membership Pro plugin <= 12.7 - Unauthenticated Privilege Escalation vulnerabilityazzaroco Ultimate Membership Pro
- CVE-2024-37099WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerabilityLiquid Web GiveWP
- CVE-2024-43400XWiki Platform allows XSS through XClass name in string propertiesxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2024-43401In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit themxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2024-6330GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFIGEO my WP
- CVE-2024-42812In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi.
- CVE-2024-42813In TRENDnet TEW-752DRU FW1.03B01, there is a buffer overflow vulnerability due to the lack of length verification for the service field in g
- CVE-2024-42815In the TP-Link RE365 V1_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER_AGENT field in
- CVE-2024-44070An issue was discovered in FRRouting (FRR) through 10.1.
- CVE-2024-44076In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.io.github.microcks:microcks-app
High 22
- CVE-2024-7305DWF Vulnerability in Autodesk Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +2
- CVE-2024-4785BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zerozephyrproject-rtos Zephyr
- CVE-2024-43345WordPress Landing Page Builder plugin <= 1.5.2.0 - Local File Inclusion vulnerabilityPluginOps Landing Page Builder
- CVE-2024-43328WordPress EmbedPress plugin <= 4.0.9 - Local File Inclusion vulnerabilityWPDeveloper EmbedPress
- CVE-2024-7592Quadratic complexity parsing cookies with backslashesPython Software Foundation CPython
- CVE-2024-43271WordPress Widgets for WooCommerce Products on Elementor plugin <= 2.0.0 - Local File Inclusion vulnerabilityThemelocation Woo Products Widgets For Elementor
- CVE-2024-43256WordPress Leopard plugin <= 2.0.36 - Subscriber+ Plugin Settings Change vulnerabilitynouthemes Leopard - WordPress offload media
- CVE-2024-43250WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Plugin Settings Change vulnerabilityBit Apps Bit Form Pro
- CVE-2024-43248WordPress Bit Form Pro plugin <= 2.6.4 - Unauthenticated Arbitrary File Deletion vulnerabilityBit Apps Bit Form Pro
- CVE-2024-43247WordPress WHMpress plugin <= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerabilitycreativeon WHMpress
- CVE-2024-43232WordPress Timeline and History slider plugin <= 2.3 - Local File Inclusion vulnerabilityWP OnlineSupport, Essential Plugin Timeline and History sli…
- CVE-2024-43221WordPress JetGridBuilder plugin <= 1.1.2 - Local File Inclusion vulnerabilityCrocoblock JetGridBuilder
- CVE-2024-32927In sendDeviceState_1_6 of RadioExt.cpp, there is a possible use after free due to improper locking.Google Android
- CVE-2024-43399Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library FilesMobile-Security-Framework-MobSF · mobsf
- CVE-2024-6451AI Engine < 2.5.1 - Admin+ RCEAI Engine
- CVE-2024-42633A Command Injection vulnerability exists in the do_upgrade_post function of the httpd binary in Linksys E1500 v1.0.06.001.
- CVE-2024-42657An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encry
- CVE-2024-42658An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's para
- CVE-2024-44067The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged
- CVE-2024-44069Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard.
- CVE-2024-44073The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.miniscript
- CVE-2024-44083ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the
Medium, low and unrated 31
- CVE-2024-7936itsourcecode Project Expense Monitoring System transferred_report.php sql injectionitsourcecode Project Expense Monitoring System
- CVE-2024-7935itsourcecode Project Expense Monitoring System print.php sql injectionitsourcecode Project Expense Monitoring System
- CVE-2024-7934itsourcecode Project Expense Monitoring System execute.php sql injectionitsourcecode Project Expense Monitoring System
- CVE-2024-7933itsourcecode Project Expense Monitoring System Backend Login login1.php sql injectionitsourcecode Project Expense Monitoring System
- CVE-2024-7931SourceCodester Online Graduate Tracer System view_csprofile.php sql injectionSourceCodester Online Graduate Tracer System
- CVE-2024-7930SourceCodester Clinics Patient Management System get_packings.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2024-7929SourceCodester Simple Forum Website Signup Page registration.php cross site scriptingSourceCodester Simple Forum Website
- CVE-2024-7928FastAdmin lang path traversalFastAdmin
- CVE-2024-7927ZZCMS class.php path traversalZZCMS
- CVE-2024-7926ZZCMS about_edit.php path traversalZZCMS
- CVE-2024-43326WordPress Plugin Notes Plus plugin <= 1.2.7 - Arbitrary Content Deletion vulnerabilityJamie Bergen Plugin Notes Plus
- CVE-2024-43317WordPress RegistrationMagic plugin <= 6.0.1.0 - Cross Site Scripting (XSS) vulnerabilityMetagauss User Registration Team RegistrationMagic
- CVE-2024-7925ZZCMS eginfo.php information disclosureZZCMS
- CVE-2024-7924ZZCMS list.php path traversalZZCMS
- CVE-2024-43281WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.3 - Local File Inclusion vulnerabilityVOID CODERS Void Elementor Post Grid Addon for Elementor Pa…
- CVE-2024-43280WordPress Salon Booking System plugin <= 10.8.1 - Open Redirection vulnerabilitySalon booking system
- CVE-2024-43272WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerabilityIcegram
- CVE-2024-43236WordPress Easy PayPal & Stripe Buy Now Button plugin <= 1.9 - Open Redirection vulnerabilityScott Paterson Easy PayPal Buy Now Button
- CVE-2024-32928The libcurl CURLOPT_SSL_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential manGoogle Nest Speakers
- CVE-2024-6348Predictable seed generation after ECU resetNissan Altima
- CVE-2024-7922D-Link DNS-1550-04 myMusic.cgi cgi_write_playlist command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-43380fugit parse and parse_nat stall on lengthy inputfloraison fugit · fugit
- CVE-2024-43379TruffleHog has a Blind SSRF in some Detectorstrufflesecurity trufflehog · github.com/trufflesecurity/… +1
- CVE-2024-25582Module savepoints could be abused to inject references to malicious code delivered through the same domain.Open-Xchange OX App Suite
- CVE-2024-6843SmartSearch WP <= 2.4.4 - Unauthenticated Stored XSSChatbot with ChatGPT WordPress
- CVE-2024-7921Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access controlAnhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2…
- CVE-2024-7920Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetParkInThroughDeivces access controlAnhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2…
- CVE-2024-7919Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access controlAnhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2…
- CVE-2024-23729The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript
- CVE-2024-35538Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specify
- CVE-2024-35539Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function.