CVEs published August 27, 2024
65 CVEs were published on August 27, 2024: 8 critical, 24 high.
- Published
- 65
- Critical
- 8
- High
- 24
- Medium
- 33
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- D-Link DNS-120 · D-Link DNR-202L +18
- 5
- wolfSSL
- 4
- Beckhoff IPC Diagnostics package · Beckhoff TwinCAT/BSD
- 3
- Hitachi Energy MicroSCADA SYS600
- 3
- nafisulbari Insurance Management System · itsourcecode Insu…
- 3
- SourceCodester Music Gallery Site
- 3
- FlowiseAI Flowise · flowise
- 2
- Fortra FileCatalyst Workflow
- 2
- Hitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…
- 2
- smub Reviews Feed – Add Testimonials and Customer Reviews F…
- 2
Critical 8
- CVE-2024-5991Buffer overread in domain name matchingwolfSSL
- CVE-2024-7720HP Security Manager - Potential Remote Code ExecutionHP Security Manager
- CVE-2024-6633Insecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)Fortra FileCatalyst Workflow
- CVE-2024-7071Unauthenticate SQLi in Brain Information Technologies' Brain Low-CodeBrain Information Technologies Brain Low-Code
- CVE-2024-8181Flowise Authentication BypassFlowiseAI Flowise · flowise
- CVE-2024-3980The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystHitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…
- CVE-2024-4872A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product.Hitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…
- CVE-2024-45321The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
High 24
- CVE-2024-8226Tenda O1 setcfm formSetCfm stack-based overflowTenda O1
- CVE-2024-8225Tenda G3 SetSysTimeCfg formSetSysTime stack-based overflowTenda G3
- CVE-2024-8224Tenda G3 setDebugCfg formSetDebugCfg stack-based overflowTenda G3
- CVE-2024-45038Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmwaremeshtastic firmware
- CVE-2024-45049Nix Hydra Missing authentication when triggering evaluationsNixOS hydra
- CVE-2024-43414Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queriesapollographql federation · apollo-router +2
- CVE-2024-43783Apollo Router Coprocessors may cause Denial-of-Service when handling request bodiesapollographql router · apollo-router
- CVE-2024-6632SQL Injection in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)Fortra FileCatalyst Workflow
- CVE-2024-8182Flowise Denial of ServiceFlowiseAI Flowise · flowise
- CVE-2024-7940The product exposes a service that is intended for local only to all network interfaces without any authentication.Hitachi Energy MicroSCADA SYS600
- CVE-2024-3982An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product andHitachi Energy MicroSCADA SYS600
- CVE-2024-6789Path traversal in M-Files APIM-Files Server
- CVE-2024-41176Beckhoff: Local Denial of Service issue in package MDP included in TwinCAT/BSDBeckhoff MDP package · Beckhoff TwinCAT/BSD
- CVE-2024-41174Beckhoff: Improper input neutralization vulnerability in the IPC-Diagnostics package in TwinCAT/BSDBeckhoff IPC Diagnostics package · Beckhoff TwinCAT/BSD
- CVE-2024-41173Beckhoff: Local authentication bypass in the IPC-Diagnostics package included in TwinCAT/BSDBeckhoff IPC Diagnostics package · Beckhoff TwinCAT/BSD
- CVE-2024-7125Authentication Bypass Vulnerability in Hitachi Ops Center Common ServicesHitachi Ops Center Common Services
- CVE-2022-39997A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges
- CVE-2024-36068An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network
- CVE-2024-41622D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address paramet
- CVE-2024-42851Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function.
- CVE-2024-44340D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos_express_devices and s
- CVE-2024-44341D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist paramet
- CVE-2024-44342D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the wl(0).(0)_ssid parameter.
- CVE-2024-45264A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a
Medium, low and unrated 33
- CVE-2024-8223SourceCodester Music Gallery Site Master.php sql injectionSourceCodester Music Gallery Site
- CVE-2024-8222SourceCodester Music Gallery Site sql injectionSourceCodester Music Gallery Site
- CVE-2024-8221SourceCodester Music Gallery Site manage_category.php sql injectionSourceCodester Music Gallery Site
- CVE-2024-8220itsourcecode Tailoring Management System staffedit.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-8219code-projects Responsive Hotel Site index.php sql injectioncode-projects Responsive Hotel Site
- CVE-2024-8218code-projects Online Quiz Site index.php sql injectioncode-projects Online Quiz Site
- CVE-2024-8217SourceCodester E-Commerce Website registration.php sql injectionSourceCodester E-Commerce Website
- CVE-2024-8216nafisulbari/itsourcecode Insurance Management System Payment editPayment.php access controlnafisulbari Insurance Management System · itsourcecode Insu…
- CVE-2024-8214D-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R5_2nd_DiskMGR command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-8213D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_1st_DiskMGR command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-8212D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_2nd_DiskMGR command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-8211D-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R1_DiskMGR command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-1544ECDSA nonce bias caused by truncationwolfSSL
- CVE-2024-5814Unverifed Ciphersuite used on a client-side TLS1.3 DowngradewolfSSL
- CVE-2024-5288Safe-error attack on TLS 1.3 ProtocolwolfSSL
- CVE-2024-45037AWS CDK RestApi not generating authorizationScope correctly in resultant CFN templateaws-cdk
- CVE-2024-8210D-Link DNS-1550-04 hd_config.cgi sprintf command injectionD-Link DNS-120 · D-Link DNR-202L +18
- CVE-2024-8209nafisulbari/itsourcecode Insurance Management System addClient.php cross site scriptingnafisulbari Insurance Management System · itsourcecode Insu…
- CVE-2024-8208nafisulbari/itsourcecode Insurance Management System editClient.php cross site scriptingnafisulbari Insurance Management System · itsourcecode Insu…
- CVE-2024-43788DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)webpack
- CVE-2024-8199Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Updatesmub Reviews Feed – Add Testimonials and Customer Reviews F…
- CVE-2024-8200Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request Forgerysmub Reviews Feed – Add Testimonials and Customer Reviews F…
- CVE-2024-7941An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL.Hitachi Energy MicroSCADA SYS600
- CVE-2024-8207MongoDB Server binaries may load potentially insecure shared libraries from specific relative pathsMongoDB Server
- CVE-2024-7791140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid WidgetXpro Addons — 140+ Widgets for Elementor
- CVE-2024-41175Beckhoff: Local Denial-of-Service vulnerability in TwinCAT/BSD and the IPC-Diagnostics packageBeckhoff IPC Diagnostics package · Beckhoff TwinCAT/BSD
- CVE-2024-7608An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal.Trellix NX, EX, AX, FX, CMS and IVX
- CVE-2024-8046Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpwax Logo Showcase Ultimate – Logo Carousel, Logo Slider &…
- CVE-2024-7304Ninja Tables – Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadtechjewel Ninja Tables – Easy Data Table Builder
- CVE-2024-6804Jeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Filejegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2024-6688Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet UpdateOxygen Builder
- CVE-2022-39996Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to
- CVE-2024-40395An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless