# CVEs published 2024-08-23

77 CVEs were published on August 23, 2024: 11 critical, 29 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-38207](https://cve.now/CVE-2024-38207.md): Microsoft Edge (HTML-based) Memory Corruption Vulnerability (CVSS 6.3, Microsoft Edge)
- [CVE-2024-45190](https://cve.now/CVE-2024-45190.md): Mage AI pipeline interaction request remote arbitrary file leak (CVSS 6.5, mage-ai)
- [CVE-2024-45189](https://cve.now/CVE-2024-45189.md): Mage AI git content request remote arbitrary file leak (CVSS 6.5, mage-ai)
- [CVE-2024-45188](https://cve.now/CVE-2024-45188.md): Mage AI file content request remote arbitrary file leak (CVSS 6.5, mage-ai)
- [CVE-2024-45187](https://cve.now/CVE-2024-45187.md): Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution (CVSS 7.1, mage-ai)
- [CVE-2024-7954](https://cve.now/CVE-2024-7954.md): SPIP porte\_plume Plugin Arbitrary PHP Execution (CVSS 9.8, SPIP)
- [CVE-2024-7427](https://cve.now/CVE-2024-7427.md): Potential Cross-Site Scripting vulnerability affect OpenText™ Network Node Manager i (NNMi). (CVSS 4.8, OpenText™ Network Node Manager i)
- [CVE-2024-7428](https://cve.now/CVE-2024-7428.md): Potential Open Redirect issues affect OpenText™ Network Node Manager i (NNMi). (CVSS 4.8, OpenText™ Network Node Manager i)
- [CVE-2024-41841](https://cve.now/CVE-2024-41841.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41847](https://cve.now/CVE-2024-41847.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41844](https://cve.now/CVE-2024-41844.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41849](https://cve.now/CVE-2024-41849.md): Adobe Experience Manager | Improper Input Validation (CWE-20) (CVSS 4.1, Adobe Experience Manager)
- [CVE-2024-41875](https://cve.now/CVE-2024-41875.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41845](https://cve.now/CVE-2024-41845.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41848](https://cve.now/CVE-2024-41848.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41843](https://cve.now/CVE-2024-41843.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41876](https://cve.now/CVE-2024-41876.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41846](https://cve.now/CVE-2024-41846.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41877](https://cve.now/CVE-2024-41877.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-41842](https://cve.now/CVE-2024-41842.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Experience Manager)
- [CVE-2024-41878](https://cve.now/CVE-2024-41878.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-43794](https://cve.now/CVE-2024-43794.md): OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect (CVSS 6.1, opensearch-project security-dashboards-plugin)
- [CVE-2024-42364](https://cve.now/CVE-2024-42364.md): homepage DNS rebinding vulnerability (GHSL-2024-096) (CVSS 6.5, gethomepage homepage)
- [CVE-2024-43791](https://cve.now/CVE-2024-43791.md): RequestStore has Incorrect Default Permissions (CVSS 7.8, steveklabnik request\_store · request\_store)
- [CVE-2024-43782](https://cve.now/CVE-2024-43782.md): openedx-translations's Atlas translations for Open edX missing validation (CVSS 7.7, openedx-translations)
- [CVE-2024-8112](https://cve.now/CVE-2024-8112.md): thinkgem JeeSite Cookie login cross site scripting (CVSS 6.9, thinkgem JeeSite)
- [CVE-2024-37311](https://cve.now/CVE-2024-37311.md): Collabora Online's remote host TLS certificates are not fully verified (CVSS 8.2, CollaboraOnline online)
- [CVE-2024-8113](https://cve.now/CVE-2024-8113.md): Stored XSS in Placeholder Samples in Mail Preview (CVSS 7.2, pretix)
- [CVE-2024-41150](https://cve.now/CVE-2024-41150.md): Stored XSS (CVSS 6.3, ManageEngine ServiceDesk Plus · ManageEngine SupportCenter…)
- [CVE-2024-38869](https://cve.now/CVE-2024-38869.md): Incorrect Authorization (CVSS 8.3, ManageEngine Endpoint Central)
- [CVE-2024-5586](https://cve.now/CVE-2024-5586.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-5556](https://cve.now/CVE-2024-5556.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-5490](https://cve.now/CVE-2024-5490.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-36514](https://cve.now/CVE-2024-36514.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-36515](https://cve.now/CVE-2024-36515.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-36516](https://cve.now/CVE-2024-36516.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-36517](https://cve.now/CVE-2024-36517.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-5467](https://cve.now/CVE-2024-5467.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2024-5466](https://cve.now/CVE-2024-5466.md): Remote Code Execution (CVSS 8.8, ManageEngine OpManager, Remote Monitoring and Management)
- [CVE-2024-43883](https://cve.now/CVE-2024-43883.md): usb: vhci-hcd: Do not drop references before new references are gained (CVSS 9.8, Linux)
- [CVE-2024-7986](https://cve.now/CVE-2024-7986.md): Rockwell Automation ThinManager® ThinServer™ Information Disclosure (CVSS 6.8, Rockwell Automation ThinManager® ThinServer™)
- [CVE-2024-5502](https://cve.now/CVE-2024-5502.md): Piotnet Addons For Elementor \<= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, piotnetdotcom Piotnet Addons For Elementor)
- [CVE-2024-38807](https://cve.now/CVE-2024-38807.md): CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader (CVSS 6.3, Spring Boot · org.springframework.boot:spring-boot-loader +1)
- [CVE-2024-43105](https://cve.now/CVE-2024-43105.md): Excessive Resource Consumption via \`/export\` (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-plugin-channe…)
- [CVE-2024-40766](https://cve.now/CVE-2024-40766.md): An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized (CVSS 9.3, KEV, SonicWall SonicOS)
- [CVE-2024-6715](https://cve.now/CVE-2024-6715.md): Ditty 3.1.39-3.1.45 - Author+ Stored XSS (CVSS 6.1, Ditty)
- [CVE-2024-3282](https://cve.now/CVE-2024-3282.md): WP Table Builder \<= 1.5.0 - Admin+ Stored XSS (CVSS 4.8, WP Table Builder)
- [CVE-2024-7258](https://cve.now/CVE-2024-7258.md): WooCommerce Google Feed Manager \<= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion (CVSS 8.8, aukejomm WPMR Google Feed Manager for WooCommerce – Sell on…)
- [CVE-2024-7559](https://cve.now/CVE-2024-7559.md): File Manager Pro \<= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, File Manager Pro)
- [CVE-2024-43477](https://cve.now/CVE-2024-43477.md): Microsoft Entra ID Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Entra)
- [CVE-2024-32501](https://cve.now/CVE-2024-32501.md): A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, (CVSS 9.8)
- [CVE-2024-33852](https://cve.now/CVE-2024-33852.md): A SQL Injection vulnerability exists in the Downtime component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x befo (CVSS 9.1)
- [CVE-2024-33853](https://cve.now/CVE-2024-33853.md): A SQL Injection vulnerability exists in the Timeperiod component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x be (CVSS 9.1)
- [CVE-2024-33854](https://cve.now/CVE-2024-33854.md): A SQL Injection vulnerability exists in the Graph Template component in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04. (CVSS 9.1)
- [CVE-2024-37392](https://cve.now/CVE-2024-37392.md): A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version \< 6.0. (CVSS 6.1)
- [CVE-2024-39841](https://cve.now/CVE-2024-39841.md): A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10 (CVSS 8.8)
- [CVE-2024-40111](https://cve.now/CVE-2024-40111.md): A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4. (CVSS 4.8)
- [CVE-2024-42040](https://cve.now/CVE-2024-42040.md): Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allow (CVSS 8.1)
- [CVE-2024-42523](https://cve.now/CVE-2024-42523.md): publiccms V4.0.202302.e and before is vulnerable to Any File Upload via publiccms/admin/cmsTemplate/saveMetaData (CVSS 7.2)
- [CVE-2024-42531](https://cve.now/CVE-2024-42531.md): Ezviz Internet PT Camera CS-CV246 D15655150 allows an unauthenticated host to access its live video stream by crafting a set of RTSP packets (CVSS 9.8)
- [CVE-2024-42636](https://cve.now/CVE-2024-42636.md): DedeCMS V5.7.115 has a command execution vulnerability via file\_manage\_view.php?fmdo=newfile&activepath. (CVSS 7.2)
- [CVE-2024-42756](https://cve.now/CVE-2024-42756.md): An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page (CVSS 8.8)
- [CVE-2024-42764](https://cve.now/CVE-2024-42764.md): Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php. (CVSS 9.4)
- [CVE-2024-42765](https://cve.now/CVE-2024-42765.md): A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitra (CVSS 9.8)
- [CVE-2024-42766](https://cve.now/CVE-2024-42766.md): Kashipara Bus Ticket Reservation System v1.0 0 is vulnerable to Incorrect Access Control via /deleteTicket.php. (CVSS 5.4)
- [CVE-2024-42845](https://cve.now/CVE-2024-42845.md): An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to ex (CVSS 8.0)
- [CVE-2024-42852](https://cve.now/CVE-2024-42852.md): Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php (CVSS 6.1)
- [CVE-2024-42914](https://cve.now/CVE-2024-42914.md): A host header injection vulnerability exists in the forgot password functionality of ArrowCMS version 1.0.0. (CVSS 9.1)
- [CVE-2024-42915](https://cve.now/CVE-2024-42915.md): A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interactio (CVSS 8.0)
- [CVE-2024-42918](https://cve.now/CVE-2024-42918.md): itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbit (CVSS 5.4)
- [CVE-2024-43031](https://cve.now/CVE-2024-43031.md): autMan v2.9.6 was discovered to contain an access control issue. (CVSS 4.3)
- [CVE-2024-43032](https://cve.now/CVE-2024-43032.md): autMan v2.9.6 allows attackers to bypass authentication via a crafted web request. (CVSS 4.3)
- [CVE-2024-44381](https://cve.now/CVE-2024-44381.md): D-Link DI\_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp\_info\_htm function. (CVSS 8.8)
- [CVE-2024-44382](https://cve.now/CVE-2024-44382.md): D-Link DI\_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade\_filter\_asp function. (CVSS 8.8)
- [CVE-2024-44386](https://cve.now/CVE-2024-44386.md): Tenda FH1206 V1.2.0.8(8155)\_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind. (CVSS 7.3)
- [CVE-2024-44387](https://cve.now/CVE-2024-44387.md): Tenda FH1206 V1.2.0.8(8155)\_EN contains a Buffer Overflow vulnerability via the functino formWrlExtraGet. (CVSS 6.5)
- [CVE-2024-44390](https://cve.now/CVE-2024-44390.md): Tenda FH1206 V1.2.0.8(8155)\_EN contains a Buffer Overflow vulnerability via the function formWrlsafeset. (CVSS 8.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.