CVEs published August 21, 2024
175 CVEs were published on August 21, 2024: 9 critical, 79 high. 3 are now in CISA KEV.
- Published
- 175
- Critical
- 9
- High
- 79
- Medium
- 35
- Low
- 4
- Unrated
- 48
- Now in CISA KEV
- 3
- Fix available
- 47
Most affected products
- Linux
- 68
- Google Chrome
- 20
- Logsign Unified SecOps Platform
- 5
- Foxit PDF Reader
- 4
- Cisco Identity Services Engine Software
- 3
- ckan
- 3
- VIPRE Advanced Security
- 3
- AMI AptioV
- 2
- Centreon
- 2
- Cisco Unified Communications Manager
- 2
Critical 9
- CVE-2024-28987SolarWinds Web Help Desk Hardcoded Credential VulnerabilitySolarWinds Web Help Desk
- CVE-2024-6386WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template InjectionWPML
- CVE-2024-28000WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2024-5335Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider <= 1.6.4 - Unauthenticated PHP Object Injectionbdthemes Ultimate Store Kit – Addon For WooCommerce, EDD an…
- CVE-2024-7854Woo Inquiry <= 0.1 - Unauthenticated SQL Injectionsjhoo Woo Inquiry
- CVE-2024-40453squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varNasquirrelly
- CVE-2024-42777An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allo
- CVE-2024-42781A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute
- CVE-2024-42784A SQL injection vulnerability in "/music/controller.php?page=view_music" in Kashipara Music Management System v1.0 allows an attacker to exe
High 79
- CVE-2024-7980Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege eGoogle Chrome
- CVE-2024-7979Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege eGoogle Chrome
- CVE-2024-7977Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege eGoogle Chrome
- CVE-2024-7974Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2024-7973Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read viaGoogle Chrome
- CVE-2024-7972Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds meGoogle Chrome
- CVE-2024-7971Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2024-7969Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2024-7968Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specifiGoogle Chrome
- CVE-2024-7967Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2024-7966Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2024-7965Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2024-7964Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2024-20375A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications MaCisco Unified Communications Manager
- CVE-2024-33657Smm Callout in SmmComputrace ModuleAMI AptioV
- CVE-2024-33656Memory Leak in SmmComuptrace ModuleAMI AptioV
- CVE-2024-5762Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution VulnerabilityZen Cart
- CVE-2024-5725Centreon initCurveList SQL Injection Remote Code Execution VulnerabilityCentreon
- CVE-2024-5723Centreon updateServiceHost SQL Injection Remote Code Execution VulnerabilityCentreon
- CVE-2024-5930VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation VulnerabilityVIPRE Advanced Security
- CVE-2024-5929VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityVIPRE Advanced Security
- CVE-2024-5928VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation VulnerabilityVIPRE Advanced Security
- CVE-2024-6141Windscribe Directory Traversal Local Privilege Escalation VulnerabilityWindscribe
- CVE-2024-7448Magnet Forensics AXIOM Command Injection Remote Code Execution VulnerabilityMagnet Forensics AXIOM
- CVE-2024-6814NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2024-6813NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2024-6812IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityIrfanView
- CVE-2024-6811IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityIrfanView
- CVE-2024-7603Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion VulnerabilityLogsign Unified SecOps Platform
- CVE-2024-7601Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion VulnerabilityLogsign Unified SecOps Platform
- CVE-2024-7600Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion VulnerabilityLogsign Unified SecOps Platform
- CVE-2024-21690This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2024-7725Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-7724Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-7723Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution VulnerabilityFoxit PDF Reader
- CVE-2024-7795Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution VulnerabilityAutel MaxiCharger AC Elite Business C50
- CVE-2024-43410Russh has an OOM Denial of Service due to allocation of untrusted amountEugeny russh · russh
- CVE-2024-7885Undertow: improper state management in proxy protocol parsing causes information leakageundertow · HawtIO 4.0.0 for Red Hat build of Apache Cam… +14
- CVE-2024-8007Openstack-tripleo-common: rhosp director disables tls verification for registry mirrorsopenstack-tripleo-common · Red Hat OpenStack Platform 17… +1
- CVE-2020-11847Vulnerability in sshrelay in privileged access manager provides full system access.OpenText Privileged Access Manager
- CVE-2020-11846Improper handling of token allows access to restricted resource in Privileged Access ManagerOpenText Privileged Access Manager
- CVE-2020-11850Cross site scripting vulnerability in Self Service Password ResetOpenText Self Service Password Reset
- CVE-2024-37008Stack-based Overflow Vulnerability in Revit SoftwareAutodesk Revit
- CVE-2023-22576Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module.Dell Repository Manager
- CVE-2023-49198Apache SeaTunnel Web: Arbitrary file read vulnerabilityApache Software Foundation Apache SeaTunnel Web · org.apach…
- CVE-2023-52913drm/i915: Fix potential context UAFsLinux
- CVE-2023-52910iommu/iova: Fix alloc iova overflows issueLinux
- CVE-2023-52909nfsd: fix handling of cached open files in nfsd4_open codepathLinux
- CVE-2023-52907nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()Linux
- CVE-2023-52903io_uring: lock overflowing for IOPOLLLinux
- CVE-2022-48899drm/virtio: Fix GEM handle creation UAFLinux
- CVE-2022-48892sched/core: Fix use-after-free bug in dup_user_cpus_ptr()Linux
- CVE-2022-48887drm/vmwgfx: Remove rcu locks from user resourcesLinux
- CVE-2022-48883net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parentLinux
- CVE-2022-48878Bluetooth: hci_qca: Fix driver shutdown on closed serdevLinux
- CVE-2022-48874misc: fastrpc: Fix use-after-free and race in fastrpc_map_findLinux
- CVE-2022-48873misc: fastrpc: Don't remove map on creater_process and device_releaseLinux
- CVE-2022-48872misc: fastrpc: Fix use-after-free race condition for mapsLinux
- CVE-2022-48871tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO bufferLinux
- CVE-2024-7013Stack-based buffer overflow in Control FPWIN Pro version 7.7.2.0 and all previous versions may allow attackers to execute arbitrary code viaPanasonic Holdings Control FPWIN Pro
- CVE-2024-6508Openshift-console: oauth2 insufficient state parameter entropyopenshift-console · Red Hat OpenShift Container Platform +1
- CVE-2024-7134LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data ParameterLiquidPoll – Polls, Surveys, NPS and Feedback Reviews
- CVE-2024-38305Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer.Dell SupportAssist for Home PCs
- CVE-2024-43882exec: Fix ToCToU between perm check and set-uid/gid usageLinux
- CVE-2024-43881wifi: ath12k: change DMA direction while mapping reinjected packetsLinux
- CVE-2024-43880mlxsw: spectrum_acl_erp: Fix object nesting warningLinux
- CVE-2024-43878xfrm: Fix input error path memory accessLinux
- CVE-2024-43877media: pci: ivtv: Add check for DMA map resultLinux
- CVE-2024-43872RDMA/hns: Fix soft lockup under heavy CEQE loadLinux
- CVE-2023-29929Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service v
- CVE-2024-39344An issue was discovered in the Docusign API package 8.142.14 for Salesforce.
- CVE-2024-42778An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0.
- CVE-2024-42779An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0.
- CVE-2024-42780An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save_genre" in Kashipara Music Management System v1.0.
- CVE-2024-42782A SQL injection vulnerability in "/music/ajax.php?action=find_music" in Kashipara Music Management System v1.0 allows an attacker to execute
- CVE-2024-42785A SQL injection vulnerability in /music/index.php?page=view_playlist in Kashipara Music Management System v1.0 allows an attacker to execute
- CVE-2024-42786A SQL injection vulnerability in "/music/view_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQ
- CVE-2024-43022An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a direc
- CVE-2024-43027DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5_Beta were discovered
Medium, low and unrated 87
- CVE-2024-8035Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2024-8034Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofGoogle Chrome
- CVE-2024-8033Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user Google Chrome
- CVE-2024-7981Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2024-7978Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to eGoogle Chrome
- CVE-2024-7976Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2024-7975Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2024-20417Cisco Identity Services Engine REST API Blind SQL Injection VulnerabitiesCisco Identity Services Engine Software
- CVE-2024-20466Cisco Identity Services Engine Sensitive Information Disclosure VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20486Cisco Identity Services Engine Cross-Site Request Forgery VulnerabilityCisco Identity Services Engine Software
- CVE-2024-20488Cisco Unified Communications Manager Cross-Site Scripting VulnerabilityCisco Unified Communications Manager
- CVE-2024-7604Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass VulnerabilityLogsign Unified SecOps Platform
- CVE-2024-7602Logsign Unified SecOps Platform Directory Traversal Information Disclosure VulnerabilityLogsign Unified SecOps Platform
- CVE-2024-7722Foxit PDF Reader Doc Object Use-After-Free Information Disclosure VulnerabilityFoxit PDF Reader
- CVE-2024-41937Apache Airflow: Stored XSS Vulnerability on provider linkApache Software Foundation Apache Airflow · apache-airflow
- CVE-2022-26327Stored cross-site scripting (XSS) has been discovered in OpenText™ Performance CenterOpenText Performance Center
- CVE-2022-26328User enumeration vulnerability has been discovered in OpenText™ Performance CenterOpenText Performance Center
- CVE-2024-43411CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeoverckeditor4
- CVE-2024-43407Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerabilityckeditor4 · ckeditor/ckeditor
- CVE-2024-43371Potential access to sensitive URLs via CKAN extensions (SSRF)ckan
- CVE-2024-41675CKAN has a Cross-site Scripting vector in the Datatables view pluginckan
- CVE-2024-41674CKAN may leak Solr credentials via error message in package_search actionckan
- CVE-2024-6339Phlox PRO <= 5.16.4 - Reflected Cross-Site Scripting via Search Parametersaverta Phlox PRO
- CVE-2023-52914io_uring/poll: add hash if ready poll request can't complete inlineLinux
- CVE-2023-52912drm/amdgpu: Fixed bug on error when unloading amdgpuLinux
- CVE-2023-52911drm/msm: another fix for the headless Adreno GPULinux
- CVE-2023-52908drm/amdgpu: Fix potential NULL dereferenceLinux
- CVE-2023-52906net/sched: act_mpls: Fix warning during failed attribute validationLinux
- CVE-2023-52905octeontx2-pf: Fix resource leakage in VF driver unbindLinux
- CVE-2023-52904ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()Linux
- CVE-2023-52902nommu: fix memory leak in do_mmap() error pathLinux
- CVE-2023-52901usb: xhci: Check endpoint is valid before dereferencing itLinux
- CVE-2023-52900nilfs2: fix general protection fault in nilfs_btree_insert()Linux
- CVE-2023-52899Add exception protection processing for vd in axi_chan_handle_err functionLinux
- CVE-2023-52898xhci: Fix null pointer dereference when host diesLinux
- CVE-2023-52897btrfs: qgroup: do not warn on record without old_roots populatedLinux
- CVE-2023-52896btrfs: fix race between quota rescan and disable leading to NULL pointer derefLinux
- CVE-2023-52895io_uring/poll: don't reissue in case of poll race on multishot requestLinux
- CVE-2023-52894usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()Linux
- CVE-2023-52893gsmi: fix null-deref in gsmi_get_variableLinux
- CVE-2022-48898drm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transferLinux
- CVE-2022-48897arm64/mm: fix incorrect file_map_count for invalid pmdLinux
- CVE-2022-48896ixgbe: fix pci device refcount leakLinux
- CVE-2022-48895iommu/arm-smmu: Don't unregister on shutdownLinux
- CVE-2022-48894iommu/arm-smmu-v3: Don't unregister on shutdownLinux
- CVE-2022-48893drm/i915/gt: Cleanup partial engine discovery failuresLinux
- CVE-2022-48891regulator: da9211: Use irq handler when readyLinux
- CVE-2022-48890scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VMLinux
- CVE-2022-48889ASoC: Intel: sof-nau8825: fix module alias overflowLinux
- CVE-2022-48888drm/msm/dpu: Fix memory leak in msm_mdss_parse_data_bus_icc_pathLinux
- CVE-2022-48886ice: Add check for kzallocLinux
- CVE-2022-48885ice: Fix potential memory leak in ice_gnss_tty_write()Linux
- CVE-2022-48884net/mlx5: Fix command stats access after freeLinux
- CVE-2022-48882net/mlx5e: Fix macsec possible null dereference when updating MAC security entity (SecY)Linux
- CVE-2022-48881platform/x86/amd: Fix refcount leak in amd_pmc_probeLinux
- CVE-2022-48880platform/surface: aggregator: Add missing call to ssam_request_sync_free()Linux
- CVE-2022-48879efi: fix NULL-deref in init error pathLinux
- CVE-2022-48876wifi: mac80211: fix initialization of rx->link and rx->link_staLinux
- CVE-2022-48875wifi: mac80211: sdata can be NULL during AMPDU startLinux
- CVE-2022-48870tty: fix possible null-ptr-defer in spk_ttyio_releaseLinux
- CVE-2022-48869USB: gadgetfs: Fix race between mounting and unmountingLinux
- CVE-2022-48868dmaengine: idxd: Let probe fail when workqueue cannot be enabledLinux
- CVE-2022-48867dmaengine: idxd: Prevent use after free on completion memoryLinux
- CVE-2024-7998In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifespOctopus Deploy Octopus Server
- CVE-2024-6568Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path DisclosureFlamix: Bitrix24 and Contact Form 7 integrations
- CVE-2024-7629Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingmarla14 Responsive Video
- CVE-2024-7651App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-searchappcheap App Builder – Create Native Android & iOS Apps On…
- CVE-2024-7090LH Add Media From Url <= 1.23 - Reflected Cross-Site Scriptingshawfactor LH Add Media From Url
- CVE-2024-7647OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scriptingotasync OTA Sync Booking Engine Widget
- CVE-2024-7032Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletionelbanyaoui Smart Online Order for Clover
- CVE-2024-7030Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Updateelbanyaoui Smart Online Order for Clover
- CVE-2024-6883Event Espresso 4 Decaf – Event Registration Event Ticketing <= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modificationeventespresso Event Espresso – Event Registration & Ticketi…
- CVE-2024-7390WP Testimonial Widget <= 3.1 - Missing Authorizationstarkinfo WP Testimonial Widget
- CVE-2024-6767WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parametersersis WordSurvey
- CVE-2024-5880Hide My Site <= 2.2 - Unauthenticated Information Exposureclevelandwebdeveloper Hide My Site
- CVE-2024-43879wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()Linux
- CVE-2024-43876PCI: rcar: Demote WARN() to dev_warn_ratelimited() in rcar_pcie_wakeup()Linux
- CVE-2024-43875PCI: endpoint: Clean up error handling in vpci_scan_bus()Linux
- CVE-2024-43874crypto: ccp - Fix null pointer dereference in __sev_snp_shutdown_lockedLinux
- CVE-2024-43873vhost/vsock: always initialize seqpacket_allowLinux
- CVE-2024-43871devres: Fix memory leakage caused by driver API devm_free_percpu()Linux
- CVE-2024-43870perf: Fix event leak upon exitLinux
- CVE-2024-43869perf: Fix event leak upon exec and file releaseLinux
- CVE-2024-41572Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-42550A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d a
- CVE-2024-42783Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage_playlist_items.php.
- CVE-2024-42939A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scr