CVEs published August 22, 2024
129 CVEs were published on August 22, 2024: 10 critical, 33 high. 1 is now in CISA KEV.
- Published
- 129
- Critical
- 10
- High
- 33
- Medium
- 55
- Low
- 2
- Unrated
- 29
- Now in CISA KEV
- 1
- Fix available
- 34
Most affected products
- Linux
- 42
- TOTOLINK AC1200 T8
- 5
- GitLab
- 4
- Mattermost · github.com/mattermost/mattermost-server +3
- 4
- IBM Sterling Connect:Direct Web Services
- 3
- Mattermost
- 3
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 3
- SourceCodester E-Commerce System
- 3
- Avtec Outpost
- 2
- Microsoft Edge
- 2
Critical 10
- CVE-2023-6452Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction VForcepoint Web Security
- CVE-2024-36439Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash
- CVE-2024-36445Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication.
- CVE-2024-42773An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allo
- CVE-2024-42775An Incorrect Access Control vulnerability was found in /admin/add_room_controller.php in Kashipara Hotel Management System v1.0, which allow
- CVE-2024-45163The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server.
- CVE-2024-45166An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12.
- CVE-2024-45167An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12.
- CVE-2024-45168An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12.
- CVE-2024-45169An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12.
High 33
- CVE-2024-38210Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-38209Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2024-8079TOTOLINK AC1200 T8 exportOvpn buffer overflowTOTOLINK AC1200 T8
- CVE-2024-8078TOTOLINK AC1200 T8 setTracerouteCfg buffer overflowTOTOLINK AC1200 T8
- CVE-2024-8076TOTOLINK AC1200 T8 setDiagnosisCfg buffer overflowTOTOLINK AC1200 T8
- CVE-2024-42418Avtec Outpost Use of Hard-coded Cryptographic KeyAvtec Outpost
- CVE-2024-39776Avtec Outpost Storage of File with Sensitive Data Under Web RootAvtec Outpost
- CVE-2024-8088Infinite loop when iterating over zip archive entry names from zipfile.PathPython Software Foundation CPython
- CVE-2024-42490authentik has Insufficient Authorization for several API endpointsgoauthentik authentik · goauthentik.io
- CVE-2022-48941ice: fix concurrent reset and removal of VFsLinux
- CVE-2022-48940bpf: Fix crash due to incorrect copy_map_valueLinux
- CVE-2022-48935netfilter: nf_tables: unregister flowtable hooks on netns exitLinux
- CVE-2022-48932net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fteLinux
- CVE-2022-48927iio: adc: tsc2046: fix memory corruption by preventing array overflowLinux
- CVE-2022-48943KVM: x86/mmu: make apf token non-zero to fix bugLinux
- CVE-2024-39576Dell Power Manager (DPM), versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability.Dell Power Manager
- CVE-2024-7384AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Functionacyba AcyMailing – An Ultimate Newsletter Plugin and Market…
- CVE-2022-48925RDMA/cma: Do not change route.addr.src_addr outside state checksLinux
- CVE-2022-48923btrfs: prevent copying too big compressed lzo segmentLinux
- CVE-2022-48919cifs: fix double free race when mount fails in cifs_get_root()Linux
- CVE-2022-48913blktrace: fix use after free for struct blk_traceLinux
- CVE-2022-48912netfilter: fix use-after-free in __nf_register_net_hook()Linux
- CVE-2022-48911netfilter: nf_queue: fix possible use-after-freeLinux
- CVE-2024-36442cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the devic
- CVE-2024-36443Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP.
- CVE-2024-36444cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an unauthenticated attacker to gain access to device logs.
- CVE-2024-42599SeaCMS 13.0 has a remote code execution vulnerability.
- CVE-2024-42767Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/add_room_controller.php.
- CVE-2024-42772An Incorrect Access Control vulnerability was found in /admin/rooms.php in Kashipara Hotel Management System v1.0, which allows an unauthent
- CVE-2024-42774An Incorrect Access Control vulnerability was found in /admin/delete_room.php in Kashipara Hotel Management System v1.0, which allows an una
- CVE-2024-42776Kashipara Hotel Management System v1.0 is vulnerable to Incorrect Access Control via /admin/users.php.
- CVE-2024-43033JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to Attachme
- CVE-2024-45201An issue was discovered in llama_index before 0.10.38.llama-index-core · llama-index
Medium, low and unrated 86
- CVE-2024-8089SourceCodester E-Commerce System controller.php unrestricted uploadSourceCodester E-Commerce System
- CVE-2024-38208Microsoft Edge for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2024-8087SourceCodester E-Commerce System popup_Item.php sql injectionSourceCodester E-Commerce System
- CVE-2024-8086SourceCodester E-Commerce System Admin Login login.php sql injectionSourceCodester E-Commerce System
- CVE-2024-8084SourceCodester Online Computer and Laptop Store Setting SystemSettings.php cross site scriptingSourceCodester Online Computer and Laptop Store
- CVE-2024-8083SourceCodester Online Computer and Laptop Store Master.php sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2024-8081itsourcecode Payroll Management System login.php sql injectionitsourcecode Payroll Management System
- CVE-2024-43790heap-buffer-overflow in do_search() in Vim < 9.1.0689vim
- CVE-2024-8080SourceCodester Online Health Care System search.php sql injectionSourceCodester Online Health Care System
- CVE-2023-7260A path traversal vulnerability has been discovered in OpenText™ CX-E Voice.OpenText™ CX-E Voice
- CVE-2024-8077TOTOLINK AC1200 T8 setTracerouteCfg os command injectionTOTOLINK AC1200 T8
- CVE-2024-8075TOTOLINK AC1200 T8 setDiagnosisCfg os command injectionTOTOLINK AC1200 T8
- CVE-2024-39717The Versa Director GUI provides an option to customize the look and feel of the user interface.Versa Director
- CVE-2024-7634NGINX Agent VulnerabilityF5 NGINX Agent
- CVE-2024-3127Improper Access Control in GitLabGitLab
- CVE-2024-6502Incorrect Provision of Specified Functionality in GitLabGitLab
- CVE-2024-7110Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabGitLab
- CVE-2024-8041Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-43780Unauthorized channel file uploadMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-42497Insufficient permissions checks on teamsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-40884Unauthorized disabling of invite URLMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-43787Hono CSRF middleware can be bypassed using crafted Content-Type headerhonojs hono · hono
- CVE-2024-43785gitoxide-core does not neutralize special characters for terminalsByron gitoxide · gitoxide-core +1
- CVE-2024-43398REXML denial of service vulnerabilityruby rexml · rexml
- CVE-2024-43331WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerabilityVeronaLabs WP SMS
- CVE-2024-39745IBM Sterling Connect:Direct Web Services information disclosureIBM Sterling Connect:Direct Web Services
- CVE-2024-7848User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Accessdeepakkite File Sharing & Download Manager – User Private F…
- CVE-2024-39744IBM Sterling Connect:Direct Web Services cross-site request forgeryIBM Sterling Connect:Direct Web Services
- CVE-2024-39746IBM Sterling Connect:Direct Web Services information disclosureIBM Sterling Connect:Direct Web Services
- CVE-2024-35151IBM OpenPages information disclosureIBM OpenPages with Watson
- CVE-2024-6870Responsive Lightbox & Gallery <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Uploaddfactory Responsive Lightbox & Gallery
- CVE-2024-7778Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2024-8072Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary usersmage-ai
- CVE-2024-8071System Role with edit access to permissions can elevate themselves to system adminMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-42411User creation date manipulation in POST /api/v4/usersMattermost
- CVE-2024-40886One-click Client-Side Path Traversal Leading to CSRF in User Management admin pageMattermost · github.com/mattermost/mattermost-server +3
- CVE-2024-43813IDOR when marking read a user's channelMattermost
- CVE-2024-39810Server crash via Elasticsearch certificate fileMattermost
- CVE-2024-32939Email addresses of remote users visible in props regardless of server settingsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-39836Munged email address used for password resets and notificationsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2022-48939bpf: Add schedule points in batch opsLinux
- CVE-2022-48938CDC-NCM: avoid overflow in sanity checkingLinux
- CVE-2022-48937io_uring: add a schedule point in io_add_buffers()Linux
- CVE-2022-48934nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()Linux
- CVE-2022-48933netfilter: nf_tables: fix memory leak during stateful obj updateLinux
- CVE-2022-48931configfs: fix a race in configfs_{,un}register_subsystem()Linux
- CVE-2022-48930RDMA/ib_srp: Fix a deadlockLinux
- CVE-2022-48929bpf: Fix crash due to out of bounds access into reg2btf_ids.Linux
- CVE-2022-48928iio: adc: men_z188_adc: Fix a resource leak in an error handling pathLinux
- CVE-2022-48926usb: gadget: rndis: add spinlock for rndis response listLinux
- CVE-2022-48942hwmon: Handle failure to register sensor with thermal zone correctlyLinux
- CVE-2024-5583The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget Settingsposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-7836Themify Builder <= 7.6.1 - Missing Authorization to Authenticated (Contributor+) Post Duplicationthemifyme Themify Builder
- CVE-2022-48924thermal: int340x: fix memory leak in int3400_notify()Linux
- CVE-2022-48922riscv: fix oops caused by irqsoff latency tracerLinux
- CVE-2022-48921sched/fair: Fix fault in reweight_entityLinux
- CVE-2022-48920btrfs: get rid of warning on transaction commit when using flushoncommitLinux
- CVE-2022-48918iwlwifi: mvm: check debugfs_dir ptr before useLinux
- CVE-2022-48916iommu/vt-d: Fix double list_add when enabling VMD in scalable modeLinux
- CVE-2022-48915thermal: core: Fix TZ_GET_TRIP NULL pointer dereferenceLinux
- CVE-2022-48914xen/netfront: destroy queues before real_num_tx_queues is zeroedLinux
- CVE-2022-48910net: ipv6: ensure we call ipv6_mc_down() at most onceLinux
- CVE-2022-48909net/smc: fix connection leakLinux
- CVE-2022-48908net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()Linux
- CVE-2022-48907auxdisplay: lcd2s: Fix memory leak in ->remove()Linux
- CVE-2022-48906mptcp: Correctly set DATA_FIN timeout when number of retransmits is largeLinux
- CVE-2022-48905ibmvnic: free reset-work-item when flushingLinux
- CVE-2022-48904iommu/amd: Fix I/O page table memory leakLinux
- CVE-2022-48903btrfs: fix relocation crash due to premature return from btrfs_commit_transaction()Linux
- CVE-2022-48902btrfs: do not WARN_ON() if we have PageError setLinux
- CVE-2022-48901btrfs: do not start relocation until in progress drops are doneLinux
- CVE-2021-4441spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op()Linux
- CVE-2024-36440An issue was discovered on Swissphone DiCal-RED 4009 devices.
- CVE-2024-36441Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that
- CVE-2024-42056Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data.
- CVE-2024-42761A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which
- CVE-2024-42762A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows
- CVE-2024-42763A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1
- CVE-2024-42768A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Hotel Management System v1.0 via /admin/delete_room.php.
- CVE-2024-42769A Reflected Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php " of Kashipara Hotel Management System v1.0, which
- CVE-2024-42770A Stored Cross Site Scripting (XSS) vulnerability was found in "/core/signup_user.php" of Kashipara Hotel Management System v1.0, which allo
- CVE-2024-42771A Stored Cross Site Scripting (XSS) vulnerability was found in " /admin/edit_room_controller.php" of the Kashipara Hotel Management System v
- CVE-2024-45165An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12.
- CVE-2024-45191An issue was discovered in Matrix libolm through 3.2.16.
- CVE-2024-45192An issue was discovered in Matrix libolm through 3.2.16.
- CVE-2024-45193An issue was discovered in Matrix libolm through 3.2.16.