# CVEs published 2024-08-21

175 CVEs were published on August 21, 2024: 9 critical, 79 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-28987](https://cve.now/CVE-2024-28987.md): SolarWinds Web Help Desk Hardcoded Credential Vulnerability (CVSS 9.1, KEV, SolarWinds Web Help Desk)
- [CVE-2024-6386](https://cve.now/CVE-2024-6386.md): WPML Multilingual CMS \<= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection (CVSS 9.9, WPML)
- [CVE-2024-8035](https://cve.now/CVE-2024-8035.md): Inappropriate implementation in Extensions in Google Chrome on Windows prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2024-8034](https://cve.now/CVE-2024-8034.md): Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoof (CVSS 4.3, Google Chrome)
- [CVE-2024-8033](https://cve.now/CVE-2024-8033.md): Inappropriate implementation in WebApp Installs in Google Chrome on Windows prior to 128.0.6613.84 allowed an attacker who convinced a user (CVSS 4.3, Google Chrome)
- [CVE-2024-7981](https://cve.now/CVE-2024-7981.md): Inappropriate implementation in Views in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2024-7980](https://cve.now/CVE-2024-7980.md): Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege e (CVSS 7.3, Google Chrome)
- [CVE-2024-7979](https://cve.now/CVE-2024-7979.md): Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege e (CVSS 7.0, Google Chrome)
- [CVE-2024-7978](https://cve.now/CVE-2024-7978.md): Insufficient policy enforcement in Data Transfer in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who convinced a user to e (CVSS 4.3, Google Chrome)
- [CVE-2024-7977](https://cve.now/CVE-2024-7977.md): Insufficient data validation in Installer in Google Chrome on Windows prior to 128.0.6613.84 allowed a local attacker to perform privilege e (CVSS 7.8, Google Chrome)
- [CVE-2024-7976](https://cve.now/CVE-2024-7976.md): Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2024-7975](https://cve.now/CVE-2024-7975.md): Inappropriate implementation in Permissions in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2024-7974](https://cve.now/CVE-2024-7974.md): Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corrupt (CVSS 8.8, Google Chrome)
- [CVE-2024-7973](https://cve.now/CVE-2024-7973.md): Heap buffer overflow in PDFium in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform an out of bounds memory read via (CVSS 8.8, Google Chrome)
- [CVE-2024-7972](https://cve.now/CVE-2024-7972.md): Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially perform out of bounds me (CVSS 8.1, Google Chrome)
- [CVE-2024-7971](https://cve.now/CVE-2024-7971.md): Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (CVSS 8.8, KEV, Google Chrome)
- [CVE-2024-7969](https://cve.now/CVE-2024-7969.md): Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-7968](https://cve.now/CVE-2024-7968.md): Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specifi (CVSS 8.8, Google Chrome)
- [CVE-2024-7967](https://cve.now/CVE-2024-7967.md): Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2024-7966](https://cve.now/CVE-2024-7966.md): Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer proce (CVSS 8.8, Google Chrome)
- [CVE-2024-7965](https://cve.now/CVE-2024-7965.md): Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, KEV, Google Chrome)
- [CVE-2024-7964](https://cve.now/CVE-2024-7964.md): Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corrupt (CVSS 8.8, Google Chrome)
- [CVE-2024-20417](https://cve.now/CVE-2024-20417.md): Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabities (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2024-20466](https://cve.now/CVE-2024-20466.md): Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2024-20486](https://cve.now/CVE-2024-20486.md): Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2024-20488](https://cve.now/CVE-2024-20488.md): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager)
- [CVE-2024-20375](https://cve.now/CVE-2024-20375.md): A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Ma (CVSS 8.6, Cisco Unified Communications Manager)
- [CVE-2024-33657](https://cve.now/CVE-2024-33657.md): Smm Callout in SmmComputrace Module (CVSS 7.8, AMI AptioV)
- [CVE-2024-33656](https://cve.now/CVE-2024-33656.md): Memory Leak in SmmComuptrace Module (CVSS 7.8, AMI AptioV)
- [CVE-2024-5762](https://cve.now/CVE-2024-5762.md): Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability (CVSS 8.1, Zen Cart)
- [CVE-2024-5725](https://cve.now/CVE-2024-5725.md): Centreon initCurveList SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Centreon)
- [CVE-2024-5723](https://cve.now/CVE-2024-5723.md): Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, Centreon)
- [CVE-2024-5930](https://cve.now/CVE-2024-5930.md): VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability (CVSS 7.8, VIPRE Advanced Security)
- [CVE-2024-5929](https://cve.now/CVE-2024-5929.md): VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, VIPRE Advanced Security)
- [CVE-2024-5928](https://cve.now/CVE-2024-5928.md): VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, VIPRE Advanced Security)
- [CVE-2024-6141](https://cve.now/CVE-2024-6141.md): Windscribe Directory Traversal Local Privilege Escalation Vulnerability (CVSS 7.8, Windscribe)
- [CVE-2024-7448](https://cve.now/CVE-2024-7448.md): Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability (CVSS 8.0, Magnet Forensics AXIOM)
- [CVE-2024-6814](https://cve.now/CVE-2024-6814.md): NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR ProSAFE Network Management System)
- [CVE-2024-6813](https://cve.now/CVE-2024-6813.md): NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR ProSAFE Network Management System)
- [CVE-2024-6812](https://cve.now/CVE-2024-6812.md): IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2024-6811](https://cve.now/CVE-2024-6811.md): IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, IrfanView)
- [CVE-2024-7604](https://cve.now/CVE-2024-7604.md): Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability (CVSS 5.1, Logsign Unified SecOps Platform)
- [CVE-2024-7603](https://cve.now/CVE-2024-7603.md): Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability (CVSS 7.1, Logsign Unified SecOps Platform)
- [CVE-2024-7602](https://cve.now/CVE-2024-7602.md): Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability (CVSS 6.5, Logsign Unified SecOps Platform)
- [CVE-2024-7601](https://cve.now/CVE-2024-7601.md): Logsign Unified SecOps Platform Directory data\_export\_delete\_all Traversal Arbitrary File Deletion Vulnerability (CVSS 7.1, Logsign Unified SecOps Platform)
- [CVE-2024-7600](https://cve.now/CVE-2024-7600.md): Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability (CVSS 7.1, Logsign Unified SecOps Platform)
- [CVE-2024-21690](https://cve.now/CVE-2024-21690.md): This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0 (CVSS 7.1, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2024-7725](https://cve.now/CVE-2024-7725.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-7724](https://cve.now/CVE-2024-7724.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-7723](https://cve.now/CVE-2024-7723.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-7722](https://cve.now/CVE-2024-7722.md): Foxit PDF Reader Doc Object Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-7795](https://cve.now/CVE-2024-7795.md): Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, Autel MaxiCharger AC Elite Business C50)
- [CVE-2024-41937](https://cve.now/CVE-2024-41937.md): Apache Airflow: Stored XSS Vulnerability on provider link (CVSS 6.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2022-26327](https://cve.now/CVE-2022-26327.md): Stored cross-site scripting (XSS) has been discovered in OpenText™ Performance Center (CVSS 5.1, OpenText Performance Center)
- [CVE-2022-26328](https://cve.now/CVE-2022-26328.md): User enumeration vulnerability has been discovered in OpenText™ Performance Center (CVSS 2.0, OpenText Performance Center)
- [CVE-2024-43411](https://cve.now/CVE-2024-43411.md): CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover (CVSS 3.1, ckeditor4)
- [CVE-2024-43410](https://cve.now/CVE-2024-43410.md): Russh has an OOM Denial of Service due to allocation of untrusted amount (CVSS 7.5, Eugeny russh · russh)
- [CVE-2024-43407](https://cve.now/CVE-2024-43407.md): Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability (CVSS 6.1, ckeditor4 · ckeditor/ckeditor)
- [CVE-2024-43371](https://cve.now/CVE-2024-43371.md): Potential access to sensitive URLs via CKAN extensions (SSRF) (CVSS 4.5, ckan)
- [CVE-2024-41675](https://cve.now/CVE-2024-41675.md): CKAN has a Cross-site Scripting vector in the Datatables view plugin (CVSS 6.8, ckan)
- [CVE-2024-41674](https://cve.now/CVE-2024-41674.md): CKAN may leak Solr credentials via error message in package\_search action (CVSS 5.3, ckan)
- [CVE-2024-7885](https://cve.now/CVE-2024-7885.md): Undertow: improper state management in proxy protocol parsing causes information leakage (CVSS 7.5, undertow · HawtIO 4.0.0 for Red Hat build of Apache Cam… +14)
- [CVE-2024-28000](https://cve.now/CVE-2024-28000.md): WordPress LiteSpeed Cache plugin \<= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, LiteSpeed Technologies LiteSpeed Cache)
- [CVE-2024-8007](https://cve.now/CVE-2024-8007.md): Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors (CVSS 8.1, openstack-tripleo-common · Red Hat OpenStack Platform 17… +1)
- [CVE-2020-11847](https://cve.now/CVE-2020-11847.md): Vulnerability in sshrelay in privileged access manager provides full system access. (CVSS 8.2, OpenText Privileged Access Manager)
- [CVE-2020-11846](https://cve.now/CVE-2020-11846.md): Improper handling of token allows access to restricted resource in Privileged Access Manager (CVSS 8.7, OpenText Privileged Access Manager)
- [CVE-2020-11850](https://cve.now/CVE-2020-11850.md): Cross site scripting vulnerability in Self Service Password Reset (CVSS 7.3, OpenText Self Service Password Reset)
- [CVE-2024-37008](https://cve.now/CVE-2024-37008.md): Stack-based Overflow Vulnerability in Revit Software (CVSS 7.8, Autodesk Revit)
- [CVE-2023-22576](https://cve.now/CVE-2023-22576.md): Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. (CVSS 7.0, Dell Repository Manager)
- [CVE-2023-49198](https://cve.now/CVE-2023-49198.md): Apache SeaTunnel Web: Arbitrary file read vulnerability (CVSS 7.5, Apache Software Foundation Apache SeaTunnel Web · org.apach…)
- [CVE-2024-5335](https://cve.now/CVE-2024-5335.md): Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \<= 1.6.4 - Unauthenticated PHP Object Injection (CVSS 9.8, bdthemes Ultimate Store Kit – Addon For WooCommerce, EDD an…)
- [CVE-2024-6339](https://cve.now/CVE-2024-6339.md): Phlox PRO \<= 5.16.4 - Reflected Cross-Site Scripting via Search Parameters (CVSS 6.1, averta Phlox PRO)
- [CVE-2023-52914](https://cve.now/CVE-2023-52914.md): io\_uring/poll: add hash if ready poll request can't complete inline (no CVSS, Linux)
- [CVE-2023-52913](https://cve.now/CVE-2023-52913.md): drm/i915: Fix potential context UAFs (CVSS 7.8, Linux)
- [CVE-2023-52912](https://cve.now/CVE-2023-52912.md): drm/amdgpu: Fixed bug on error when unloading amdgpu (no CVSS, Linux)
- [CVE-2023-52911](https://cve.now/CVE-2023-52911.md): drm/msm: another fix for the headless Adreno GPU (no CVSS, Linux)
- [CVE-2023-52910](https://cve.now/CVE-2023-52910.md): iommu/iova: Fix alloc iova overflows issue (CVSS 8.8, Linux)
- [CVE-2023-52909](https://cve.now/CVE-2023-52909.md): nfsd: fix handling of cached open files in nfsd4\_open codepath (CVSS 7.5, Linux)
- [CVE-2023-52908](https://cve.now/CVE-2023-52908.md): drm/amdgpu: Fix potential NULL dereference (no CVSS, Linux)
- [CVE-2023-52907](https://cve.now/CVE-2023-52907.md): nfc: pn533: Wait for out\_urb's completion in pn533\_usb\_send\_frame() (CVSS 7.8, Linux)
- [CVE-2023-52906](https://cve.now/CVE-2023-52906.md): net/sched: act\_mpls: Fix warning during failed attribute validation (no CVSS, Linux)
- [CVE-2023-52905](https://cve.now/CVE-2023-52905.md): octeontx2-pf: Fix resource leakage in VF driver unbind (no CVSS, Linux)
- [CVE-2023-52904](https://cve.now/CVE-2023-52904.md): ALSA: usb-audio: Fix possible NULL pointer dereference in snd\_usb\_pcm\_has\_fixed\_rate() (no CVSS, Linux)
- [CVE-2023-52903](https://cve.now/CVE-2023-52903.md): io\_uring: lock overflowing for IOPOLL (CVSS 7.8, Linux)
- [CVE-2023-52902](https://cve.now/CVE-2023-52902.md): nommu: fix memory leak in do\_mmap() error path (no CVSS, Linux)
- [CVE-2023-52901](https://cve.now/CVE-2023-52901.md): usb: xhci: Check endpoint is valid before dereferencing it (no CVSS, Linux)
- [CVE-2023-52900](https://cve.now/CVE-2023-52900.md): nilfs2: fix general protection fault in nilfs\_btree\_insert() (no CVSS, Linux)
- [CVE-2023-52899](https://cve.now/CVE-2023-52899.md): Add exception protection processing for vd in axi\_chan\_handle\_err function (no CVSS, Linux)
- [CVE-2023-52898](https://cve.now/CVE-2023-52898.md): xhci: Fix null pointer dereference when host dies (no CVSS, Linux)
- [CVE-2023-52897](https://cve.now/CVE-2023-52897.md): btrfs: qgroup: do not warn on record without old\_roots populated (no CVSS, Linux)
- [CVE-2023-52896](https://cve.now/CVE-2023-52896.md): btrfs: fix race between quota rescan and disable leading to NULL pointer deref (no CVSS, Linux)
- [CVE-2023-52895](https://cve.now/CVE-2023-52895.md): io\_uring/poll: don't reissue in case of poll race on multishot request (no CVSS, Linux)
- [CVE-2023-52894](https://cve.now/CVE-2023-52894.md): usb: gadget: f\_ncm: fix potential NULL ptr deref in ncm\_bitrate() (no CVSS, Linux)
- [CVE-2023-52893](https://cve.now/CVE-2023-52893.md): gsmi: fix null-deref in gsmi\_get\_variable (no CVSS, Linux)
- [CVE-2022-48899](https://cve.now/CVE-2022-48899.md): drm/virtio: Fix GEM handle creation UAF (CVSS 7.8, Linux)
- [CVE-2022-48898](https://cve.now/CVE-2022-48898.md): drm/msm/dp: do not complete dp\_aux\_cmd\_fifo\_tx() if irq is not for aux transfer (no CVSS, Linux)
- [CVE-2022-48897](https://cve.now/CVE-2022-48897.md): arm64/mm: fix incorrect file\_map\_count for invalid pmd (no CVSS, Linux)
- [CVE-2022-48896](https://cve.now/CVE-2022-48896.md): ixgbe: fix pci device refcount leak (no CVSS, Linux)
- [CVE-2022-48895](https://cve.now/CVE-2022-48895.md): iommu/arm-smmu: Don't unregister on shutdown (no CVSS, Linux)
- [CVE-2022-48894](https://cve.now/CVE-2022-48894.md): iommu/arm-smmu-v3: Don't unregister on shutdown (no CVSS, Linux)
- [CVE-2022-48893](https://cve.now/CVE-2022-48893.md): drm/i915/gt: Cleanup partial engine discovery failures (no CVSS, Linux)
- [CVE-2022-48892](https://cve.now/CVE-2022-48892.md): sched/core: Fix use-after-free bug in dup\_user\_cpus\_ptr() (CVSS 7.8, Linux)
- [CVE-2022-48891](https://cve.now/CVE-2022-48891.md): regulator: da9211: Use irq handler when ready (no CVSS, Linux)
- [CVE-2022-48890](https://cve.now/CVE-2022-48890.md): scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (no CVSS, Linux)
- [CVE-2022-48889](https://cve.now/CVE-2022-48889.md): ASoC: Intel: sof-nau8825: fix module alias overflow (no CVSS, Linux)
- [CVE-2022-48888](https://cve.now/CVE-2022-48888.md): drm/msm/dpu: Fix memory leak in msm\_mdss\_parse\_data\_bus\_icc\_path (no CVSS, Linux)
- [CVE-2022-48887](https://cve.now/CVE-2022-48887.md): drm/vmwgfx: Remove rcu locks from user resources (CVSS 7.8, Linux)
- [CVE-2022-48886](https://cve.now/CVE-2022-48886.md): ice: Add check for kzalloc (no CVSS, Linux)
- [CVE-2022-48885](https://cve.now/CVE-2022-48885.md): ice: Fix potential memory leak in ice\_gnss\_tty\_write() (no CVSS, Linux)
- [CVE-2022-48884](https://cve.now/CVE-2022-48884.md): net/mlx5: Fix command stats access after free (no CVSS, Linux)
- [CVE-2022-48883](https://cve.now/CVE-2022-48883.md): net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent (CVSS 7.8, Linux)
- [CVE-2022-48882](https://cve.now/CVE-2022-48882.md): net/mlx5e: Fix macsec possible null dereference when updating MAC security entity (SecY) (no CVSS, Linux)
- [CVE-2022-48881](https://cve.now/CVE-2022-48881.md): platform/x86/amd: Fix refcount leak in amd\_pmc\_probe (no CVSS, Linux)
- [CVE-2022-48880](https://cve.now/CVE-2022-48880.md): platform/surface: aggregator: Add missing call to ssam\_request\_sync\_free() (no CVSS, Linux)
- [CVE-2022-48879](https://cve.now/CVE-2022-48879.md): efi: fix NULL-deref in init error path (no CVSS, Linux)
- [CVE-2022-48878](https://cve.now/CVE-2022-48878.md): Bluetooth: hci\_qca: Fix driver shutdown on closed serdev (CVSS 7.8, Linux)
- [CVE-2022-48876](https://cve.now/CVE-2022-48876.md): wifi: mac80211: fix initialization of rx-\>link and rx-\>link\_sta (no CVSS, Linux)
- [CVE-2022-48875](https://cve.now/CVE-2022-48875.md): wifi: mac80211: sdata can be NULL during AMPDU start (no CVSS, Linux)
- [CVE-2022-48874](https://cve.now/CVE-2022-48874.md): misc: fastrpc: Fix use-after-free and race in fastrpc\_map\_find (CVSS 7.8, Linux)
- [CVE-2022-48873](https://cve.now/CVE-2022-48873.md): misc: fastrpc: Don't remove map on creater\_process and device\_release (CVSS 7.8, Linux)
- [CVE-2022-48872](https://cve.now/CVE-2022-48872.md): misc: fastrpc: Fix use-after-free race condition for maps (CVSS 7.8, Linux)
- [CVE-2022-48871](https://cve.now/CVE-2022-48871.md): tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer (CVSS 8.8, Linux)
- [CVE-2022-48870](https://cve.now/CVE-2022-48870.md): tty: fix possible null-ptr-defer in spk\_ttyio\_release (no CVSS, Linux)
- [CVE-2022-48869](https://cve.now/CVE-2022-48869.md): USB: gadgetfs: Fix race between mounting and unmounting (no CVSS, Linux)
- [CVE-2022-48868](https://cve.now/CVE-2022-48868.md): dmaengine: idxd: Let probe fail when workqueue cannot be enabled (no CVSS, Linux)
- [CVE-2022-48867](https://cve.now/CVE-2022-48867.md): dmaengine: idxd: Prevent use after free on completion memory (no CVSS, Linux)
- [CVE-2024-7013](https://cve.now/CVE-2024-7013.md): Stack-based buffer overflow in Control FPWIN Pro version 7.7.2.0 and all previous versions may allow attackers to execute arbitrary code via (CVSS 7.8, Panasonic Holdings Control FPWIN Pro)
- [CVE-2024-6508](https://cve.now/CVE-2024-6508.md): Openshift-console: oauth2 insufficient state parameter entropy (CVSS 8.0, openshift-console · Red Hat OpenShift Container Platform +1)
- [CVE-2024-7998](https://cve.now/CVE-2024-7998.md): In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifesp (CVSS 2.6, Octopus Deploy Octopus Server)
- [CVE-2024-6568](https://cve.now/CVE-2024-6568.md): Flamix: Bitrix24 and Contact Form 7 integrations \<= 3.1.0 - Unauthenticated Full Path Disclosure (CVSS 5.3, Flamix: Bitrix24 and Contact Form 7 integrations)
- [CVE-2024-7629](https://cve.now/CVE-2024-7629.md): Responsive Video \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, marla14 Responsive Video)
- [CVE-2024-7651](https://cve.now/CVE-2024-7651.md): App Builder – Create Native Android & iOS Apps On The Flight \<= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search (CVSS 5.6, appcheap App Builder – Create Native Android & iOS Apps On…)
- [CVE-2024-7090](https://cve.now/CVE-2024-7090.md): LH Add Media From Url \<= 1.23 - Reflected Cross-Site Scripting (CVSS 6.1, shawfactor LH Add Media From Url)
- [CVE-2024-7647](https://cve.now/CVE-2024-7647.md): OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, otasync OTA Sync Booking Engine Widget)
- [CVE-2024-7032](https://cve.now/CVE-2024-7032.md): Smart Online Order for Clover \<= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion (CVSS 6.5, elbanyaoui Smart Online Order for Clover)
- [CVE-2024-7030](https://cve.now/CVE-2024-7030.md): Smart Online Order for Clover \<= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update (CVSS 4.3, elbanyaoui Smart Online Order for Clover)
- [CVE-2024-6883](https://cve.now/CVE-2024-6883.md): Event Espresso 4 Decaf – Event Registration Event Ticketing \<= 4.10.46.decaf- Authenticated (Subscriber+) Missing Authorization to Limited Plugin Settings Modification (CVSS 4.3, eventespresso Event Espresso – Event Registration & Ticketi…)
- [CVE-2024-7390](https://cve.now/CVE-2024-7390.md): WP Testimonial Widget \<= 3.1 - Missing Authorization (CVSS 5.3, starkinfo WP Testimonial Widget)
- [CVE-2024-6767](https://cve.now/CVE-2024-6767.md): WordSurvey \<= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding\_title Parameter (CVSS 5.5, sersis WordSurvey)
- [CVE-2024-7134](https://cve.now/CVE-2024-7134.md): LiquidPoll \<= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form\_data Parameter (CVSS 7.2, LiquidPoll – Polls, Surveys, NPS and Feedback Reviews)
- [CVE-2024-5880](https://cve.now/CVE-2024-5880.md): Hide My Site \<= 2.2 - Unauthenticated Information Exposure (CVSS 4.3, clevelandwebdeveloper Hide My Site)
- [CVE-2024-7854](https://cve.now/CVE-2024-7854.md): Woo Inquiry \<= 0.1 - Unauthenticated SQL Injection (CVSS 10.0, sjhoo Woo Inquiry)
- [CVE-2024-38305](https://cve.now/CVE-2024-38305.md): Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. (CVSS 7.3, Dell SupportAssist for Home PCs)
- [CVE-2024-43882](https://cve.now/CVE-2024-43882.md): exec: Fix ToCToU between perm check and set-uid/gid usage (CVSS 7.8, Linux)
- [CVE-2024-43881](https://cve.now/CVE-2024-43881.md): wifi: ath12k: change DMA direction while mapping reinjected packets (CVSS 8.8, Linux)
- [CVE-2024-43880](https://cve.now/CVE-2024-43880.md): mlxsw: spectrum\_acl\_erp: Fix object nesting warning (CVSS 7.8, Linux)
- [CVE-2024-43879](https://cve.now/CVE-2024-43879.md): wifi: cfg80211: handle 2x996 RU allocation in cfg80211\_calculate\_bitrate\_he() (no CVSS, Linux)
- [CVE-2024-43878](https://cve.now/CVE-2024-43878.md): xfrm: Fix input error path memory access (CVSS 8.1, Linux)
- [CVE-2024-43877](https://cve.now/CVE-2024-43877.md): media: pci: ivtv: Add check for DMA map result (CVSS 7.8, Linux)
- [CVE-2024-43876](https://cve.now/CVE-2024-43876.md): PCI: rcar: Demote WARN() to dev\_warn\_ratelimited() in rcar\_pcie\_wakeup() (no CVSS, Linux)
- [CVE-2024-43875](https://cve.now/CVE-2024-43875.md): PCI: endpoint: Clean up error handling in vpci\_scan\_bus() (no CVSS, Linux)
- [CVE-2024-43874](https://cve.now/CVE-2024-43874.md): crypto: ccp - Fix null pointer dereference in \_\_sev\_snp\_shutdown\_locked (no CVSS, Linux)
- [CVE-2024-43873](https://cve.now/CVE-2024-43873.md): vhost/vsock: always initialize seqpacket\_allow (no CVSS, Linux)
- [CVE-2024-43872](https://cve.now/CVE-2024-43872.md): RDMA/hns: Fix soft lockup under heavy CEQE load (CVSS 7.5, Linux)
- [CVE-2024-43871](https://cve.now/CVE-2024-43871.md): devres: Fix memory leakage caused by driver API devm\_free\_percpu() (no CVSS, Linux)
- [CVE-2024-43870](https://cve.now/CVE-2024-43870.md): perf: Fix event leak upon exit (no CVSS, Linux)
- [CVE-2024-43869](https://cve.now/CVE-2024-43869.md): perf: Fix event leak upon exec and file release (no CVSS, Linux)
- [CVE-2023-29929](https://cve.now/CVE-2023-29929.md): Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service v (CVSS 7.5)
- [CVE-2024-39344](https://cve.now/CVE-2024-39344.md): An issue was discovered in the Docusign API package 8.142.14 for Salesforce. (CVSS 8.1)
- [CVE-2024-40453](https://cve.now/CVE-2024-40453.md): squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varNa (CVSS 9.8, squirrelly)
- [CVE-2024-41572](https://cve.now/CVE-2024-41572.md): Learning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2024-42550](https://cve.now/CVE-2024-42550.md): A cross-site scripting (XSS) vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d a (CVSS 5.4)
- [CVE-2024-42777](https://cve.now/CVE-2024-42777.md): An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=signup" of Kashipara Music Management System v1.0, which allo (CVSS 9.8)
- [CVE-2024-42778](https://cve.now/CVE-2024-42778.md): An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save\_playlist" in Kashipara Music Management System v1.0. (CVSS 8.8)
- [CVE-2024-42779](https://cve.now/CVE-2024-42779.md): An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save\_music" in Kashipara Music Management System v1.0. (CVSS 8.8)
- [CVE-2024-42780](https://cve.now/CVE-2024-42780.md): An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=save\_genre" in Kashipara Music Management System v1.0. (CVSS 8.8)
- [CVE-2024-42781](https://cve.now/CVE-2024-42781.md): A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute (CVSS 9.8)
- [CVE-2024-42782](https://cve.now/CVE-2024-42782.md): A SQL injection vulnerability in "/music/ajax.php?action=find\_music" in Kashipara Music Management System v1.0 allows an attacker to execute (CVSS 7.6)
- [CVE-2024-42783](https://cve.now/CVE-2024-42783.md): Kashipara Music Management System v1.0 is vulnerable to SQL Injection via /music/manage\_playlist\_items.php. (CVSS 5.4)
- [CVE-2024-42784](https://cve.now/CVE-2024-42784.md): A SQL injection vulnerability in "/music/controller.php?page=view\_music" in Kashipara Music Management System v1.0 allows an attacker to exe (CVSS 9.8)
- [CVE-2024-42785](https://cve.now/CVE-2024-42785.md): A SQL injection vulnerability in /music/index.php?page=view\_playlist in Kashipara Music Management System v1.0 allows an attacker to execute (CVSS 7.6)
- [CVE-2024-42786](https://cve.now/CVE-2024-42786.md): A SQL injection vulnerability in "/music/view\_user.php" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQ (CVSS 8.8)
- [CVE-2024-42939](https://cve.now/CVE-2024-42939.md): A cross-site scripting (XSS) vulnerability in the component /index/index.html of YZNCMS v1.4.2 allows attackers to execute arbitrary web scr (CVSS 4.6)
- [CVE-2024-43022](https://cve.now/CVE-2024-43022.md): An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a direc (CVSS 7.5)
- [CVE-2024-43027](https://cve.now/CVE-2024-43027.md): DrayTek Vigor 3900 before v1.5.1.5\_Beta, DrayTek Vigor 2960 before v1.5.1.5\_Beta and DrayTek Vigor 300B before v1.5.1.5\_Beta were discovered (CVSS 8.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.