CVEs published August 20, 2024
147 CVEs were published on August 20, 2024: 28 critical, 60 high.
- Published
- 147
- Critical
- 28
- High
- 60
- Medium
- 52
- Low
- 0
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Linux
- 8
- bitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…
- 5
- Joomla! Project Joomla! CMS
- 5
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- 4
- GitHub Enterprise Server
- 3
- itsourcecode Laravel Property Management System
- 3
- Priority
- 3
- Apache HertzBeat
- 2
- casdoor · github.com/casdoor/casdoor
- 2
- Dassault Systèmes 3DSwymer
- 2
Critical 28
- CVE-2024-43864net/mlx5e: Fix CT entry update leaks of modify header contextLinux
- CVE-2024-6800An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identityGitHub Enterprise Server
- CVE-2024-38175Azure Managed Instance for Apache Cassandra Elevation of Privilege VulnerabilityMicrosoft Azure Managed Instance for Apache Cassandra
- CVE-2024-27185[20240802] - Core - Cache Poisoning in PaginationJoomla! Project Joomla! CMS
- CVE-2024-43404Remote Code Execution Vulnerability in MEGABOTNicPWNs MEGABOT
- CVE-2024-43202Apache DolphinScheduler: Remote Code Execution VulnerabilityApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2024-6847SmartSearch WP <= 2.4.4 - Unauthenticated SQLiChatbot with ChatGPT WordPress
- CVE-2024-7777Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary File Read And Deletionbitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…
- CVE-2024-5932GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Executionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-30949An issue in newlib v.4.3.0 allows an attacker to execute arbitrary code via the time unit scaling in the _gettimeofday function.
- CVE-2024-33872Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of
- CVE-2024-42556Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_rem
- CVE-2024-42558Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_roo
- CVE-2024-42559An issue in the login component (process_login.php) of Hotel Management System commit 79d688 allows attackers to authenticate without provid
- CVE-2024-42562Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at preview
- CVE-2024-42563An arbitrary file upload vulnerability in ERP commit 44bd04 allows attackers to execute arbitrary code via uploading a crafted HTML file.
- CVE-2024-42565ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=
- CVE-2024-42567School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at /search.php?action=2
- CVE-2024-42568School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.
- CVE-2024-42569School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php.
- CVE-2024-42570School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php.
- CVE-2024-42571School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.
- CVE-2024-42572School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php.
- CVE-2024-42573School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php.
- CVE-2024-42574School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php.
- CVE-2024-42575School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php.
- CVE-2024-42581A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privil
- CVE-2024-42919eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.
High 60
- CVE-2024-22281Apache Helix Front (UI): Helix front hard-coded secret in the express-sessionApache Software Foundation Apache Helix Front · org.apache.…
- CVE-2024-43403Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalationkanisterio kanister · github.com/kanisterio/kanister
- CVE-2024-42362GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/importApache HertzBeat
- CVE-2024-42361GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}Apache HertzBeat
- CVE-2024-42363GHSL-2023-136_SamsonZendesk Samson
- CVE-2024-41657GHSL-2024-035: Casdoor CORS misconfigurationcasdoor · github.com/casdoor/casdoor
- CVE-2024-41659GHSL-2024-034: memos CORS Misconfiguration in server.gousememos memos · github.com/usememos/memos
- CVE-2024-35214Vulnerability in CylanceOPTICS Windows Installer Package Impacts CylanceOPTICS for WindowsBlackBerry CylanceOPTICS for Windows
- CVE-2024-27187[20240804] - Core - Improper ACL for backend profile viewJoomla! Project Joomla! CMS
- CVE-2024-43406LF Edge eKuiper has a SQL Injection in sqlKvStorelf-edge ekuiper · ekuiper +1
- CVE-2024-39690Capsule tenant owner with "patch namespace" permission can hijack system namespacesprojectcapsule capsule · github.com/projectcapsule/capsule
- CVE-2024-6377URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-6378Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2024-6379Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-42336Servision - CWE-287: Improper AuthenticationServision IVG Webmax
- CVE-2024-6918CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the AccutecSchneider Electric Accutech Manager
- CVE-2024-41700Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized ActorBarix SIP Client Web Management Interface UI
- CVE-2024-21689This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, aAtlassian Bamboo Data Center · Atlassian Bamboo Server
- CVE-2024-7782Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administrator+) Arbitrary File Deletionbitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…
- CVE-2022-1206AdRotate – Ad manager & AdSense Ads <= 5.13.2 - Authenticated (Admin+) Double Extension Arbitrary File Uploadadegans AdRotate Banner Manager
- CVE-2024-7780Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injectionbitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…
- CVE-2024-7702Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection via getLogHistory Functionbitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…
- CVE-2024-7827Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameterlevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2024-31842An issue was discovered in Italtel Embrace 1.6.4.
- CVE-2024-34458Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.
- CVE-2024-35540A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2024-42006Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure.
- CVE-2024-42552Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_room_histo
- CVE-2024-42553A Cross-Site Request Forgery (CSRF) in the component admin_room_added.php of Hotel Management System commit 91caab8 allows attackers to esca
- CVE-2024-42554Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the room_type parameter at admin_room_add
- CVE-2024-42555A Cross-Site Request Forgery (CSRF) in the component admin_room_removed.php of Hotel Management System commit 91caab8 allows attackers to es
- CVE-2024-42557A Cross-Site Request Forgery (CSRF) in the component admin_modify_room.php of Hotel Management System commit 91caab8 allows attackers to esc
- CVE-2024-42561Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at sales_r
- CVE-2024-42564ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/inventory/delete?actio
- CVE-2024-42566School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password parameter at login.php
- CVE-2024-42576A Cross-Site Request Forgery (CSRF) in the component edit_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate priv
- CVE-2024-42577A Cross-Site Request Forgery (CSRF) in the component add_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privile
- CVE-2024-42578A Cross-Site Request Forgery (CSRF) in the component edit_product.php of Warehouse Inventory System v2.0 allows attackers to escalate privil
- CVE-2024-42579A Cross-Site Request Forgery (CSRF) in the component add_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privilege
- CVE-2024-42582A Cross-Site Request Forgery (CSRF) in the component delete_categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate pr
- CVE-2024-42583A Cross-Site Request Forgery (CSRF) in the component delete_user.php of Warehouse Inventory System v2.0 allows attackers to escalate privile
- CVE-2024-42584A Cross-Site Request Forgery (CSRF) in the component delete_product.php of Warehouse Inventory System v2.0 allows attackers to escalate priv
- CVE-2024-42585A Cross-Site Request Forgery (CSRF) in the component delete_media.php of Warehouse Inventory System v2.0 allows attackers to escalate privil
- CVE-2024-42586A Cross-Site Request Forgery (CSRF) in the component categorie.php of Warehouse Inventory System v2.0 allows attackers to escalate privilege
- CVE-2024-42604Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_group.php?mode=delete&group_id
- CVE-2024-42605Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/edit_page.php?link_id=1
- CVE-2024-42607Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=database
- CVE-2024-42608Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/submit_page.php.
- CVE-2024-42609Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars
- CVE-2024-42610Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=files
- CVE-2024-42611Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/admin_page.php?link_id=1&mode=delete
- CVE-2024-42612Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?whitelist_add
- CVE-2024-42613Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=install&wid
- CVE-2024-42616Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_widgets.php?action=remove&widg
- CVE-2024-42617Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_config.php?action=save&var_id=
- CVE-2024-42618Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /module.php?module=karma
- CVE-2024-42619Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/domain_management.php?id=0&list=whit
- CVE-2024-42621Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_editor.php
- CVE-2024-42662An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request.
- CVE-2024-43688cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption.
Medium, low and unrated 59
- CVE-2024-43868riscv/purgatory: align riscv_kernel_entryLinux
- CVE-2024-43867drm/nouveau: prime: fix refcount underflowLinux
- CVE-2024-43866net/mlx5: Always drain health in shutdown callbackLinux
- CVE-2024-43865s390/fpu: Re-add exception handling in load_fpu_state()Linux
- CVE-2024-43863drm/vmwgfx: Fix a deadlock in dma buf fence pollingLinux
- CVE-2024-43862net: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutexLinux
- CVE-2024-8023chillzhuang SpringBlade list sql injectionchillzhuang SpringBlade
- CVE-2024-8022Genexis Tilgin Home Gateway cross site scriptingGenexis Tilgin Home Gateway
- CVE-2024-43861net: usb: qmi_wwan: fix memory leak for not ip packetsLinux
- CVE-2024-43396Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)khoj-ai khoj · khoj
- CVE-2024-41658GHSL-2024-036: Reflected XSS in QrCodePage.jscasdoor · github.com/casdoor/casdoor
- CVE-2024-41773IBM Global Configuration Management incorrect ownership assignmentIBM Global Configuration Management
- CVE-2024-6337Incorrect Authorization allows read access to issues in GitHub Enterprise ServerGitHub Enterprise Server
- CVE-2024-7711An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an attacker to update the title, assignees, anGitHub Enterprise Server
- CVE-2024-6322Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account Grafana · github.com/grafana/grafana
- CVE-2024-43408Discourse Placeholder Forms has a XSS stopped by CSPdiscourse-placeholder-theme-component
- CVE-2024-27186[20240803] - Core - XSS in HTML Mail TemplatesJoomla! Project Joomla! CMS
- CVE-2024-27184[20240801] - Core - Inadequate validation of internal URLsJoomla! Project Joomla! CMS
- CVE-2024-40743[20240805] - Core - XSS vectors in Outputfilter::strip* methodsJoomla! Project Joomla! CMS
- CVE-2024-43409Ghost's improper authentication allows access to member information and actionsTryGhost Ghost · ghost +1
- CVE-2024-43397Potential unauthorized access issue in apollo-portalapolloconfig apollo · com.ctrip.framework.apollo:apollo
- CVE-2024-43377Umbraco CMS Improper Access Control vulnerabilityUmbraco-CMS · Umbraco.Cms
- CVE-2024-43376Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive InformationUmbraco-CMS · Umbraco.Cms.Api.Management
- CVE-2024-42369A room with itself as a its predecessor will freeze matrix-js-sdkmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2024-8005demozx gf_cms JWT Authentication auth.go init hard-coded credentialsdemozx gf_cms
- CVE-2024-8003Go-Tribe gotribe-admin Log routes.go InitRoutes deserializationGo-Tribe gotribe-admin
- CVE-2024-423357Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7Twenty Bot
- CVE-2024-25009Ericsson Packet Core Controller (PCC) - Improper Input Validation VulnerabilityEricsson Packet Core Controller
- CVE-2024-41699Priority – CWE-552: Files or Directories Accessible to External PartiesPriority
- CVE-2024-41698Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorPriority
- CVE-2024-41697Priority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)Priority
- CVE-2024-7054Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingdanieliser Popup Maker – Boost Sales, Conversions, Optins,…
- CVE-2024-28829Privilege escalation in mk_informix pluginCheckmk
- CVE-2024-38808CVE-2024-38808: Spring Expression DoS VulnerabilitySpring Framework · org.springframework:spring-expression
- CVE-2024-5576Tutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widgetthemeum Tutor LMS Elementor Addons
- CVE-2024-6864WP Last Modified Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via lmt-post-modified-info Shortcodeinfosatech WP Last Modified Info
- CVE-2024-38810Missing Authorization When Using @AuthorizeReturnObjectspring security · org.springframework.security:spring-secur…
- CVE-2024-6575The Plus Addons for Elementor <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TP Page Scroll Widgetposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-5763The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widgetposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-7775Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) Arbitrary JavaScript File Uploadsbitpressadmin Contact Form by Bit Form: Multi Step Form, Ca…
- CVE-2024-5940GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Updatestellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-5939GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposurestellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-5941GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-7850BP Profile Search <= 5.7.5 - Cross-Site Request Forgery to Reflected Cross-Site Scriptingdontdream BP Profile Search
- CVE-2024-7949SourceCodester Online Graduate Tracer System fetch_genderit.php sql injectionSourceCodester Online Graduate Tracer System
- CVE-2024-7948SourceCodester Accounts Manager App Update Account Page update-account.php cross site scriptingSourceCodester Accounts Manager App
- CVE-2024-7947SourceCodester Point of Sales and Inventory Management System login.php sql injectionSourceCodester Point of Sales and Inventory Management Syst…
- CVE-2024-7946itsourcecode Online Blood Bank Management System User Signup register.php sql injectionitsourcecode Online Blood Bank Management System
- CVE-2024-7945itsourcecode Laravel Property Management System Notes Page create cross site scriptingitsourcecode Laravel Property Management System
- CVE-2024-7944itsourcecode Laravel Property Management System DocumentsController.php UpdateDocumentsRequest unrestricted uploaditsourcecode Laravel Property Management System
- CVE-2024-7943itsourcecode Laravel Property Management System PropertiesController.php upload unrestricted uploaditsourcecode Laravel Property Management System
- CVE-2024-7942SourceCodester Leads Manager Tool update-leads.php cross site scriptingSourceCodester Leads Manager Tool
- CVE-2024-7937itsourcecode Project Expense Monitoring System printtransfer.php sql injectionitsourcecode Project Expense Monitoring System
- CVE-2024-39094Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters.
- CVE-2024-42560A cross-site scripting (XSS) vulnerability in the component update_page_details.php of Blood Bank And Donation Management System commit dc9e
- CVE-2024-42580A Cross-Site Request Forgery (CSRF) in the component edit_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileg
- CVE-2024-42598SeaCMS 13.0 has a remote code execution vulnerability.
- CVE-2024-42603Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=clearall
- CVE-2024-42606Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_log.php?clear=1