CVEs published August 23, 2024
77 CVEs were published on August 23, 2024: 11 critical, 29 high. 1 is now in CISA KEV.
- Published
- 77
- Critical
- 11
- High
- 29
- Medium
- 37
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 19
Most affected products
- Adobe Experience Manager
- 13
- ManageEngine ADAudit Plus
- 8
- mage-ai
- 4
- OpenText™ Network Node Manager i
- 2
- aukejomm WPMR Google Feed Manager for WooCommerce – Sell on…
- 1
- CollaboraOnline online
- 1
- Ditty
- 1
- File Manager Pro
- 1
- gethomepage homepage
- 1
- Linux
- 1
Critical 11
- CVE-2024-7954SPIP porte_plume Plugin Arbitrary PHP ExecutionSPIP
- CVE-2024-43883usb: vhci-hcd: Do not drop references before new references are gainedLinux
- CVE-2024-40766An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorizedSonicWall SonicOS
- CVE-2024-32501A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13,
- CVE-2024-33852A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x befo
- CVE-2024-33853A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x be
- CVE-2024-33854A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.
- CVE-2024-42531Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets
- CVE-2024-42764Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.
- CVE-2024-42765A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitra
- CVE-2024-42914A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0.
High 29
- CVE-2024-45187Mage AI allows deleted users to use the terminal server with admin access, leading to remote code executionmage-ai
- CVE-2024-43791RequestStore has Incorrect Default Permissionssteveklabnik request_store · request_store
- CVE-2024-43782openedx-translations's Atlas translations for Open edX missing validationopenedx-translations
- CVE-2024-37311Collabora Online's remote host TLS certificates are not fully verifiedCollaboraOnline online
- CVE-2024-8113Stored XSS in Placeholder Samples in Mail Previewpretix
- CVE-2024-38869Incorrect AuthorizationManageEngine Endpoint Central
- CVE-2024-5586SQL InjectionManageEngine ADAudit Plus
- CVE-2024-5556SQL InjectionManageEngine ADAudit Plus
- CVE-2024-5490SQL InjectionManageEngine ADAudit Plus
- CVE-2024-36514SQL InjectionManageEngine ADAudit Plus
- CVE-2024-36515SQL InjectionManageEngine ADAudit Plus
- CVE-2024-36516SQL InjectionManageEngine ADAudit Plus
- CVE-2024-36517SQL InjectionManageEngine ADAudit Plus
- CVE-2024-5467SQL InjectionManageEngine ADAudit Plus
- CVE-2024-5466Remote Code ExecutionManageEngine OpManager, Remote Monitoring and Management
- CVE-2024-7258WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletionaukejomm WPMR Google Feed Manager for WooCommerce – Sell on…
- CVE-2024-7559File Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File UploadFile Manager Pro
- CVE-2024-43477Microsoft Entra ID Elevation of Privilege VulnerabilityMicrosoft Entra
- CVE-2024-39841A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10
- CVE-2024-42040Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allow
- CVE-2024-42523publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData
- CVE-2024-42636DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.
- CVE-2024-42756An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page
- CVE-2024-42845An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to ex
- CVE-2024-42915A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interactio
- CVE-2024-44381D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function.
- CVE-2024-44382D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function.
- CVE-2024-44386Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind.
- CVE-2024-44390Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset.
Medium, low and unrated 37
- CVE-2024-38207Microsoft Edge (HTML-based) Memory Corruption VulnerabilityMicrosoft Edge
- CVE-2024-45190Mage AI pipeline interaction request remote arbitrary file leakmage-ai
- CVE-2024-45189Mage AI git content request remote arbitrary file leakmage-ai
- CVE-2024-45188Mage AI file content request remote arbitrary file leakmage-ai
- CVE-2024-7427Potential Cross-Site Scripting vulnerability affect OpenText™ Network Node Manager i (NNMi).OpenText™ Network Node Manager i
- CVE-2024-7428Potential Open Redirect issues affect OpenText™ Network Node Manager i (NNMi).OpenText™ Network Node Manager i
- CVE-2024-41841Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41847Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41844Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41849Adobe Experience Manager | Improper Input Validation (CWE-20)Adobe Experience Manager
- CVE-2024-41875Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41845Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41848Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41843Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41876Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41846Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41877Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41842Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-41878Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-43794OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirectopensearch-project security-dashboards-plugin
- CVE-2024-42364homepage DNS rebinding vulnerability (GHSL-2024-096)gethomepage homepage
- CVE-2024-8112thinkgem JeeSite Cookie login cross site scriptingthinkgem JeeSite
- CVE-2024-41150Stored XSSManageEngine ServiceDesk Plus · ManageEngine SupportCenter…
- CVE-2024-7986Rockwell Automation ThinManager® ThinServer™ Information DisclosureRockwell Automation ThinManager® ThinServer™
- CVE-2024-5502Piotnet Addons For Elementor <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetspiotnetdotcom Piotnet Addons For Elementor
- CVE-2024-38807CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's LoaderSpring Boot · org.springframework.boot:spring-boot-loader +1
- CVE-2024-43105Excessive Resource Consumption via `/export`Mattermost · github.com/mattermost/mattermost-plugin-channe…
- CVE-2024-6715Ditty 3.1.39-3.1.45 - Author+ Stored XSSDitty
- CVE-2024-3282WP Table Builder <= 1.5.0 - Admin+ Stored XSSWP Table Builder
- CVE-2024-37392A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0.
- CVE-2024-40111A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4.
- CVE-2024-42766Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php.
- CVE-2024-42852Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php
- CVE-2024-42918itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbit
- CVE-2024-43031autMan v2.9.6 was discovered to contain an access control issue.
- CVE-2024-43032autMan v2.9.6 allows attackers to bypass authentication via a crafted web request.
- CVE-2024-44387Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet.