CVEs published August 26, 2024
140 CVEs were published on August 26, 2024: 11 critical, 32 high.
- Published
- 140
- Critical
- 11
- High
- 32
- Medium
- 69
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Linux
- 39
- Chengdu Everbrite Network Technology BeikeShop
- 3
- OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- 3
- code-projects Blood Bank System
- 2
- Dylan James Zephyr Project Manager
- 2
- fastapi-admin
- 2
- Rockwell Automation ThinManager® ThinServer™
- 2
- Stark Digital WP Testimonial Widget
- 2
- 10up Simple Local Avatars
- 1
- Acer vz2694g · Acer aspire s +671
- 1
Critical 11
- CVE-2024-7988ThinManager® ThinServer™ Information Disclosure and Remote Code Execution VulnerabilitiesRockwell Automation ThinManager® ThinServer™
- CVE-2024-8162TOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentialsTOTOLINK T10 AC1200
- CVE-2024-8161SQL injection vulnerability in CIGESv2 systemCIGESv2
- CVE-2024-8073Command Injection Vulnerability in Hillstone Networks Web Application FirewallHillstone Networks Web Application Firewall
- CVE-2024-34087An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve r
- CVE-2024-41285A stack overflow in FAST FW300R v1.3.13 Build 141023 Rel.61347n allows attackers to execute arbitrary code or cause a Denial of Service (DoS
- CVE-2024-41444SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so.
- CVE-2024-44551Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.
- CVE-2024-44555Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo.
- CVE-2024-45256An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite database
- CVE-2024-45265A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL c
High 32
- CVE-2024-43798Chisel AUTH environment variable not respected in server entrypointjpillora chisel · github.com/jpillora/chisel
- CVE-2024-43301WordPress Fonts plugin <= 3.7.7 - Cross Site Request Forgery (CSRF) to Stored XSSvulnerabilityFonts Plugin Fonts
- CVE-2024-43255WordPress MyBookTable Bookstore by Stormhill Media plugin <= 3.3.9 - CSRF to XSS vulnerabilityzookatron MyBookTable Bookstore
- CVE-2024-7401Client Enrollment Process BypassNetskope Client
- CVE-2024-43289WordPress wpForo Forum plugin <= 2.3.4 - Unauthenticated Sensitive Data Exposure vulnerabilitygVectors Team wpForo Forum
- CVE-2024-43966WordPress WP Testimonial Widget plugin <= 3.1 - SQL Injection vulnerabilityStark Digital WP Testimonial Widget
- CVE-2024-7987Rockwell Automation ThinManager® ThinServer™ Information Disclosure and Remote Code Execution VulnerabilitiesRockwell Automation ThinManager® ThinServer™
- CVE-2024-41879RE: New Edge T5 MSRC Case [DCMSFT-1294]Adobe Acrobat Reader
- CVE-2024-44942f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GCLinux
- CVE-2024-44941f2fs: fix to cover read extent cache access with lockLinux
- CVE-2024-44940fou: remove warn in gue_gro_receive on unsupported protocolLinux
- CVE-2024-44939jfs: fix null ptr deref in dtInsertEntryLinux
- CVE-2024-44934net: bridge: mcast: wait for previous gc cycles when removing portLinux
- CVE-2024-44933bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl()Linux
- CVE-2024-43913nvme: apple: fix device reference countingLinux
- CVE-2024-43910bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accessesLinux
- CVE-2024-43897net: drop bad gso csum_start and offset in virtio_net_hdrLinux
- CVE-2024-43892memcg: protect concurrent access to mem_cgroup_idrLinux
- CVE-2024-43891tracing: Have format file honor EVENT_FILE_FL_FREEDLinux
- CVE-2024-43888mm: list_lru: fix UAF for memory cgroupLinux
- CVE-2024-43444Passwords are written to Admin Log ModuleOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2024-28077A denial-of-service issue was discovered on certain GL-iNet devices.
- CVE-2024-41996Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote att
- CVE-2024-42791A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genr
- CVE-2024-44550Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv.
- CVE-2024-44553Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv.
- CVE-2024-44557Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.
- CVE-2024-44558Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo.
- CVE-2024-44563Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo.
- CVE-2024-44565Tenda AX1806 v1.0.0.1 contains a stack overflow via the serverName parameter in the function form_fast_setting_internet_set.
- CVE-2024-44796A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execut
- CVE-2024-45241A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated at
Medium, low and unrated 97
- CVE-2024-45036Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat LinkShopify tophat
- CVE-2024-39628WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerabilitySaturday Drive Ninja Forms
- CVE-2024-39641WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerabilityThimPress LearnPress
- CVE-2024-39645WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityThemeum Tutor LMS
- CVE-2024-39657WordPress Sender plugin <= 2.6.18 - Cross Site Request Forgery (CSRF) vulnerabilitySender – Newsletter, SMS and Email Marketing Automation for…
- CVE-2024-43116WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability10up Simple Local Avatars
- CVE-2024-43117WordPress Hummingbird plugin <= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Hummingbird
- CVE-2024-43265WordPress Analytify plugin <= 5.3.1 - CSRF Leading to Optout VulnerabilityAnalytify
- CVE-2024-43269WordPress Backup and Restore WordPress plugin <= 1.50 - Cross Site Request Forgery (CSRF) vulnerabilityWPBackItUp Backup and Restore WordPress
- CVE-2024-43287WordPress Brevo plugin <= 3.1.82 - Cross Site Request Forgery (CSRF) vulnerabilityBrevo Newsletter, SMTP, Email marketing and Subscribe forms…
- CVE-2024-43295WordPress WP Data Access plugin <= 5.5.7 - Cross Site Request Forgery (CSRF) vulnerabilityPassionate Programmers B.V. WP Data Access
- CVE-2024-43299WordPress SpeedyCache plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerabilitySoftaculous SpeedyCache
- CVE-2024-43316WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityCheckout Plugins Stripe Payments For WooCommerce by Checkout
- CVE-2024-43325WordPress Dark Mode for WP Dashboard plugin <= 1.2.3 - Cross Site Request Forgery vulnerabilityNaiche Dark Mode for WP Dashboard
- CVE-2024-43336WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) vulnerabilityWP User Manager
- CVE-2024-43337WordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerabilityBrave Popup Builder
- CVE-2024-43340WordPress AFI – The Easiest Integration Plugin plugin <= 1.89.4 - Cross Site Request Forgery (CSRF) vulnerabilityNasirahmed Advanced Form Integration
- CVE-2024-43915WordPress Zephyr Project Manager plugin <=3.3.102 - Cross Site Scripting (XSS) vulnerabilityDylan James Zephyr Project Manager
- CVE-2024-43356WordPress oik plugin <= 4.12.0 - Arbitrary File Deletion vulnerabilitybobbingwide oik
- CVE-2024-43339WordPress WordPress Webinar Plugin – WebinarPress plugin <= 1.33.20 - Cross Site Request Forgery (CSRF) vulnerabilityWebinarPress
- CVE-2024-43916WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerabilityDylan James Zephyr Project Manager
- CVE-2024-43214WordPress myCred plugin <= 2.7.2 - Sensitive Data Exposure vulnerabilitySaad Iqbal myCred
- CVE-2024-43230WordPress Shared Files – Premium Download Manager & Secure File Sharing with Frontend File Upload plugin <= 1.7.28 - Sensitive Data Exposure vulnerabilityAnssi Laitila Shared Files
- CVE-2024-43251WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Sensitive Data Exposure vulnerabilityBit Apps Bit Form Pro
- CVE-2024-43257WordPress Leopard plugin <= 2.0.36 - Subscriber+ Sensitive Data Exposure vulnerabilityNouthemes Leopard - WordPress offload media
- CVE-2024-43258WordPress Store Locator Plus® for WordPress plugin <= 2311.17.01 - Sensitive Data Exposure vulnerabilityStore Locator Plus
- CVE-2024-43259WordPress Order Export for WooCommerce plugin <= 3.23 - Sensitive Data Exposure vulnerabilityWebFactory Order Export for WooCommerce
- CVE-2024-43264WordPress Create by Mediavine plugin <= 1.9.8 - Sensitive Data Exposure vulnerabilitymischiefmarmot Create by Mediavine
- CVE-2024-8105Insecure Platform Key (PK) used in UEFI system firmware signatureAcer vz2694g · Acer aspire s +671
- CVE-2024-43802heap-buffer-overflow in ins_typebuf() in Vim < 9.1.0697vim
- CVE-2024-43806`rustix::fs::Dir` iterator with the `linux_raw` backend can cause memory explosionbytecodealliance rustix · rustix
- CVE-2024-8174code-projects Blood Bank System Login Page login.php cross site scriptingcode-projects Blood Bank System
- CVE-2024-43283WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2024-43319WordPress HTML5 Video Player plugin <= 2.5.31 - Sensitive Data Exposure vulnerabilitybPlugins Flash & HTML5 Video
- CVE-2024-8173code-projects Blood Bank System Login Page login.php sql injectioncode-projects Blood Bank System
- CVE-2024-8172SourceCodester QR Code Attendance System delete-student.php cross site scriptingSourceCodester QR Code Attendance System
- CVE-2024-8171itsourcecode Tailoring Management System staffcatedit.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-8170SourceCodester Zipped Folder Manager App add-folder.php unrestricted uploadSourceCodester Zipped Folder Manager App
- CVE-2024-43967WordPress WP Testimonial Widget plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityStark Digital WP Testimonial Widget
- CVE-2024-8169code-projects Online Quiz Site signupuser.php sql injectioncode-projects Online Quiz Site
- CVE-2024-8168code-projects Online Bus Reservation Site login.php sql injectioncode-projects Online Bus Reservation Site
- CVE-2024-8167code-projects Job Portal forget.php sql injectioncode-projects Job Portal
- CVE-2024-8166Ruijie EG2000K index.php unrestricted uploadRuijie EG2000K
- CVE-2024-38859XSS in view page with SLA columnCheckmk
- CVE-2023-49582Apache Portable Runtime (APR): Unexpected lax shared memory permissionsApache Software Foundation Apache Portable Runtime
- CVE-2024-8165Chengdu Everbrite Network Technology BeikeShop export exportZip path traversalChengdu Everbrite Network Technology BeikeShop
- CVE-2024-8164Chengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted uploadChengdu Everbrite Network Technology BeikeShop
- CVE-2024-8163Chengdu Everbrite Network Technology BeikeShop files destroyFiles path traversalChengdu Everbrite Network Technology BeikeShop
- CVE-2023-26315Xiaomi router has a command injection vulnerability after authorizationXiaomi Router AX9000
- CVE-2024-44938jfs: Fix shift-out-of-bounds in dbDiscardAGLinux
- CVE-2024-44937platform/x86: intel-vbtn: Protect ACPI notify handler against recursionLinux
- CVE-2024-44936power: supply: rt5033: Bring back i2c_set_clientdataLinux
- CVE-2024-44935sctp: Fix null-ptr-deref in reuseport_add_sock().Linux
- CVE-2024-44932idpf: fix UAFs when destroying the queuesLinux
- CVE-2024-44931gpio: prevent potential speculation leaks in gpio_device_get_desc()Linux
- CVE-2024-43914md/raid5: avoid BUG_ON() while continue reshape after reassemblingLinux
- CVE-2024-43912wifi: nl80211: disallow setting special AP channel widthsLinux
- CVE-2024-43911wifi: mac80211: fix NULL dereference at band check in starting tx ba sessionLinux
- CVE-2024-43909drm/amdgpu/pm: Fix the null pointer dereference for smu7Linux
- CVE-2024-43908drm/amdgpu: Fix the null pointer dereference to ras_managerLinux
- CVE-2024-43907drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rulesLinux
- CVE-2024-43906drm/admgpu: fix dereferencing null pointer contextLinux
- CVE-2024-43905drm/amd/pm: Fix the null pointer dereference for vega10_hwmgrLinux
- CVE-2024-43904drm/amd/display: Add null checks for 'stream' and 'plane' before dereferencingLinux
- CVE-2024-43902drm/amd/display: Add null checker before passing variablesLinux
- CVE-2024-43901drm/amd/display: Fix NULL pointer dereference for DTN log in DCN401Linux
- CVE-2024-43900media: xc2028: avoid use-after-free in load_firmware_cb()Linux
- CVE-2024-43899drm/amd/display: Fix null pointer deref in dcn20_resource.cLinux
- CVE-2024-43896ASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULLLinux
- CVE-2024-43894drm/client: fix null pointer dereference in drm_client_modeset_probeLinux
- CVE-2024-43893serial: core: check uartclk for zero to avoid divide by zeroLinux
- CVE-2024-43890tracing: Fix overflow in get_free_elt()Linux
- CVE-2024-43889padata: Fix possible divide-by-0 panic in padata_mt_helper()Linux
- CVE-2024-43887net/tcp: Disable TCP-AO static key after RCU grace periodLinux
- CVE-2024-43886drm/amd/display: Add null check in resource_log_pipe_topology_updateLinux
- CVE-2024-43443Stored XSS in process managementOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2024-43442Stored XSS in System ConfigurationOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2024-43884Bluetooth: MGMT: Add error handling to pair_device()Linux
- CVE-2024-7313Shield Security < 20.0.6 - Reflected XSSShield Security
- CVE-2024-6879Quiz and Survey Master (QSM) < 9.1.1 - Contributor+ Stored XSSQuiz and Survey Master
- CVE-2024-39097There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the `url` parameter in login path.
- CVE-2024-42787A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v
- CVE-2024-42788A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0
- CVE-2024-42789A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/controller.php?page=test" in Kashipara Music Management System v1.
- CVE-2024-42790A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0.
- CVE-2024-42792A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_play
- CVE-2024-42816A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary fastapi-admin
- CVE-2024-42818A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary wfastapi-admin
- CVE-2024-42906TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file.
- CVE-2024-42913RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.
- CVE-2024-44549Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv.
- CVE-2024-44552Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv.
- CVE-2024-44556Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo.
- CVE-2024-44793A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to e
- CVE-2024-44794A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers
- CVE-2024-44795A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitr
- CVE-2024-44797A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to exec