# CVEs published 2024-08-19

70 CVEs were published on August 19, 2024: 17 critical, 22 high. Days are UTC.

- [CVE-2024-7936](https://cve.now/CVE-2024-7936.md): itsourcecode Project Expense Monitoring System transferred\_report.php sql injection (CVSS 5.3, itsourcecode Project Expense Monitoring System)
- [CVE-2024-7305](https://cve.now/CVE-2024-7305.md): DWF Vulnerability in Autodesk Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +2)
- [CVE-2024-7935](https://cve.now/CVE-2024-7935.md): itsourcecode Project Expense Monitoring System print.php sql injection (CVSS 5.3, itsourcecode Project Expense Monitoring System)
- [CVE-2024-7934](https://cve.now/CVE-2024-7934.md): itsourcecode Project Expense Monitoring System execute.php sql injection (CVSS 5.3, itsourcecode Project Expense Monitoring System)
- [CVE-2024-7933](https://cve.now/CVE-2024-7933.md): itsourcecode Project Expense Monitoring System Backend Login login1.php sql injection (CVSS 6.9, itsourcecode Project Expense Monitoring System)
- [CVE-2024-4785](https://cve.now/CVE-2024-4785.md): BT: Missing Check in LL\_CONNECTION\_UPDATE\_IND Packet Leads to Division by Zero (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2024-7931](https://cve.now/CVE-2024-7931.md): SourceCodester Online Graduate Tracer System view\_csprofile.php sql injection (CVSS 5.3, SourceCodester Online Graduate Tracer System)
- [CVE-2024-7930](https://cve.now/CVE-2024-7930.md): SourceCodester Clinics Patient Management System get\_packings.php sql injection (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-7929](https://cve.now/CVE-2024-7929.md): SourceCodester Simple Forum Website Signup Page registration.php cross site scripting (CVSS 6.9, SourceCodester Simple Forum Website)
- [CVE-2024-7928](https://cve.now/CVE-2024-7928.md): FastAdmin lang path traversal (CVSS 5.3, FastAdmin)
- [CVE-2024-7927](https://cve.now/CVE-2024-7927.md): ZZCMS class.php path traversal (CVSS 6.9, ZZCMS)
- [CVE-2024-7926](https://cve.now/CVE-2024-7926.md): ZZCMS about\_edit.php path traversal (CVSS 6.9, ZZCMS)
- [CVE-2024-43354](https://cve.now/CVE-2024-43354.md): WordPress myCred plugin \<= 2.7.2 - PHP Object Injection vulnerability (CVSS 9.8, Saad Iqbal myCred)
- [CVE-2024-43345](https://cve.now/CVE-2024-43345.md): WordPress Landing Page Builder plugin \<= 1.5.2.0 - Local File Inclusion vulnerability (CVSS 7.5, PluginOps Landing Page Builder)
- [CVE-2024-43328](https://cve.now/CVE-2024-43328.md): WordPress EmbedPress plugin \<= 4.0.9 - Local File Inclusion vulnerability (CVSS 8.3, WPDeveloper EmbedPress)
- [CVE-2024-43326](https://cve.now/CVE-2024-43326.md): WordPress Plugin Notes Plus plugin \<= 1.2.7 - Arbitrary Content Deletion vulnerability (CVSS 5.4, Jamie Bergen Plugin Notes Plus)
- [CVE-2024-43317](https://cve.now/CVE-2024-43317.md): WordPress RegistrationMagic plugin \<= 6.0.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 4.3, Metagauss User Registration Team RegistrationMagic)
- [CVE-2024-43311](https://cve.now/CVE-2024-43311.md): WordPress Login As Users plugin \<= 1.4.2 - Broken Authentication vulnerability (CVSS 9.8, Geek Code Lab Login As Users)
- [CVE-2024-7592](https://cve.now/CVE-2024-7592.md): Quadratic complexity parsing cookies with backslashes (CVSS 7.5, Python Software Foundation CPython)
- [CVE-2024-7925](https://cve.now/CVE-2024-7925.md): ZZCMS eginfo.php information disclosure (CVSS 5.3, ZZCMS)
- [CVE-2024-7924](https://cve.now/CVE-2024-7924.md): ZZCMS list.php path traversal (CVSS 6.9, ZZCMS)
- [CVE-2024-43281](https://cve.now/CVE-2024-43281.md): WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin \<= 2.3 - Local File Inclusion vulnerability (CVSS 5.3, VOID CODERS Void Elementor Post Grid Addon for Elementor Pa…)
- [CVE-2024-43280](https://cve.now/CVE-2024-43280.md): WordPress Salon Booking System plugin \<= 10.8.1 - Open Redirection vulnerability (CVSS 4.7, Salon booking system)
- [CVE-2024-43272](https://cve.now/CVE-2024-43272.md): WordPress Icegram Engage plugin \<= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability (CVSS 5.3, Icegram)
- [CVE-2024-43271](https://cve.now/CVE-2024-43271.md): WordPress Widgets for WooCommerce Products on Elementor plugin \<= 2.0.0 - Local File Inclusion vulnerability (CVSS 8.5, Themelocation Woo Products Widgets For Elementor)
- [CVE-2024-43261](https://cve.now/CVE-2024-43261.md): WordPress Compute Links plugin \<= 1.2.1 - Remote File Inclusion vulnerability (CVSS 9.6, Hamed Naderfar Compute Links)
- [CVE-2024-43256](https://cve.now/CVE-2024-43256.md): WordPress Leopard plugin \<= 2.0.36 - Subscriber+ Plugin Settings Change vulnerability (CVSS 7.1, nouthemes Leopard - WordPress offload media)
- [CVE-2024-43252](https://cve.now/CVE-2024-43252.md): WordPress Crew HRM plugin \<= 1.1.1 - PHP Object Injection vulnerability (CVSS 9.0, Crew HRM)
- [CVE-2024-43250](https://cve.now/CVE-2024-43250.md): WordPress Bit Form Pro plugin \<= 2.6.4 - Authenticated Plugin Settings Change vulnerability (CVSS 7.1, Bit Apps Bit Form Pro)
- [CVE-2024-43249](https://cve.now/CVE-2024-43249.md): WordPress Bit Form Pro plugin \<= 2.6.4 - Authenticated Arbitrary File Upload vulnerability (CVSS 9.9, Bit Apps Bit Form Pro)
- [CVE-2024-43248](https://cve.now/CVE-2024-43248.md): WordPress Bit Form Pro plugin \<= 2.6.4 - Unauthenticated Arbitrary File Deletion vulnerability (CVSS 8.6, Bit Apps Bit Form Pro)
- [CVE-2024-43247](https://cve.now/CVE-2024-43247.md): WordPress WHMpress plugin \<= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerability (CVSS 8.8, creativeon WHMpress)
- [CVE-2024-43245](https://cve.now/CVE-2024-43245.md): WordPress JobSearch plugin \<= 2.3.4 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, eyecix JobSearch)
- [CVE-2024-43242](https://cve.now/CVE-2024-43242.md): WordPress Indeed Ultimate Membership Pro plugin \<= 12.7 - Unauthenticated PHP Object Injection vulnerability (CVSS 9.0, azzaroco Ultimate Membership Pro)
- [CVE-2024-43240](https://cve.now/CVE-2024-43240.md): WordPress Indeed Ultimate Membership Pro plugin \<= 12.7 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.4, azzaroco Ultimate Membership Pro)
- [CVE-2024-43236](https://cve.now/CVE-2024-43236.md): WordPress Easy PayPal & Stripe Buy Now Button plugin \<= 1.9 - Open Redirection vulnerability (CVSS 4.7, Scott Paterson Easy PayPal Buy Now Button)
- [CVE-2024-43232](https://cve.now/CVE-2024-43232.md): WordPress Timeline and History slider plugin \<= 2.3 - Local File Inclusion vulnerability (CVSS 8.5, WP OnlineSupport, Essential Plugin Timeline and History sli…)
- [CVE-2024-43221](https://cve.now/CVE-2024-43221.md): WordPress JetGridBuilder plugin \<= 1.1.2 - Local File Inclusion vulnerability (CVSS 8.5, Crocoblock JetGridBuilder)
- [CVE-2024-37099](https://cve.now/CVE-2024-37099.md): WordPress GiveWP plugin \<= 3.14.1 - Unauthenticated PHP Object Injection vulnerability (CVSS 10.0, Liquid Web GiveWP)
- [CVE-2024-32927](https://cve.now/CVE-2024-32927.md): In sendDeviceState\_1\_6 of RadioExt.cpp, there is a possible use after free due to improper locking. (CVSS 7.8, Google Android)
- [CVE-2024-32928](https://cve.now/CVE-2024-32928.md): The libcurl CURLOPT\_SSL\_VERIFYPEER option was disabled on a subset of requests made by Nest production devices which enabled a potential man (CVSS 5.9, Google Nest Speakers)
- [CVE-2024-43400](https://cve.now/CVE-2024-43400.md): XWiki Platform allows XSS through XClass name in string properties (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2024-43401](https://cve.now/CVE-2024-43401.md): In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2024-6348](https://cve.now/CVE-2024-6348.md): Predictable seed generation after ECU reset (CVSS 5.3, Nissan Altima)
- [CVE-2024-7922](https://cve.now/CVE-2024-7922.md): D-Link DNS-1550-04 myMusic.cgi cgi\_write\_playlist command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-43399](https://cve.now/CVE-2024-43399.md): Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files (CVSS 8.0, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2024-43380](https://cve.now/CVE-2024-43380.md): fugit parse and parse\_nat stall on lengthy input (CVSS 5.3, floraison fugit · fugit)
- [CVE-2024-43379](https://cve.now/CVE-2024-43379.md): TruffleHog has a Blind SSRF in some Detectors (CVSS 3.4, trufflesecurity trufflehog · github.com/trufflesecurity/… +1)
- [CVE-2024-25582](https://cve.now/CVE-2024-25582.md): Module savepoints could be abused to inject references to malicious code delivered through the same domain. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2024-6843](https://cve.now/CVE-2024-6843.md): SmartSearch WP \<= 2.4.4 - Unauthenticated Stored XSS (CVSS 6.1, Chatbot with ChatGPT WordPress)
- [CVE-2024-6451](https://cve.now/CVE-2024-6451.md): AI Engine \< 2.5.1 - Admin+ RCE (CVSS 7.2, AI Engine)
- [CVE-2024-6330](https://cve.now/CVE-2024-6330.md): GEO my WordPress \< 4.4.0.2 - Unauthenticated RCE via LFI (CVSS 9.8, GEO my WP)
- [CVE-2024-7921](https://cve.now/CVE-2024-7921.md): Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control (CVSS 5.3, Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2…)
- [CVE-2024-7920](https://cve.now/CVE-2024-7920.md): Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetParkInThroughDeivces access control (CVSS 5.3, Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2…)
- [CVE-2024-7919](https://cve.now/CVE-2024-7919.md): Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control (CVSS 6.9, Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2…)
- [CVE-2024-23729](https://cve.now/CVE-2024-23729.md): The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript (CVSS 6.1)
- [CVE-2024-35538](https://cve.now/CVE-2024-35538.md): Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specify (CVSS 5.3)
- [CVE-2024-35539](https://cve.now/CVE-2024-35539.md): Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. (CVSS 6.5)
- [CVE-2024-42633](https://cve.now/CVE-2024-42633.md): A Command Injection vulnerability exists in the do\_upgrade\_post function of the httpd binary in Linksys E1500 v1.0.06.001. (CVSS 8.0)
- [CVE-2024-42657](https://cve.now/CVE-2024-42657.md): An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encry (CVSS 7.5)
- [CVE-2024-42658](https://cve.now/CVE-2024-42658.md): An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's para (CVSS 8.8)
- [CVE-2024-42812](https://cve.now/CVE-2024-42812.md): In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. (CVSS 9.8)
- [CVE-2024-42813](https://cve.now/CVE-2024-42813.md): In TRENDnet TEW-752DRU FW1.03B01, there is a buffer overflow vulnerability due to the lack of length verification for the service field in g (CVSS 9.8)
- [CVE-2024-42815](https://cve.now/CVE-2024-42815.md): In the TP-Link RE365 V1\_180213, there is a buffer overflow vulnerability due to the lack of length verification for the USER\_AGENT field in (CVSS 9.8)
- [CVE-2024-44067](https://cve.now/CVE-2024-44067.md): The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged (CVSS 8.4)
- [CVE-2024-44069](https://cve.now/CVE-2024-44069.md): Pi-hole before 6 allows unauthenticated admin/api.php?setTempUnit= calls to change the temperature units of the web dashboard. (CVSS 7.5)
- [CVE-2024-44070](https://cve.now/CVE-2024-44070.md): An issue was discovered in FRRouting (FRR) through 10.1. (CVSS 9.8)
- [CVE-2024-44073](https://cve.now/CVE-2024-44073.md): The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth. (CVSS 7.5, miniscript)
- [CVE-2024-44076](https://cve.now/CVE-2024-44076.md): In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access. (CVSS 9.8, io.github.microcks:microcks-app)
- [CVE-2024-44083](https://cve.now/CVE-2024-44083.md): ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.