# CVEs published 2024-08-27

65 CVEs were published on August 27, 2024: 8 critical, 24 high. Days are UTC.

- [CVE-2024-8226](https://cve.now/CVE-2024-8226.md): Tenda O1 setcfm formSetCfm stack-based overflow (CVSS 8.7, Tenda O1)
- [CVE-2024-8225](https://cve.now/CVE-2024-8225.md): Tenda G3 SetSysTimeCfg formSetSysTime stack-based overflow (CVSS 8.7, Tenda G3)
- [CVE-2024-8224](https://cve.now/CVE-2024-8224.md): Tenda G3 setDebugCfg formSetDebugCfg stack-based overflow (CVSS 8.7, Tenda G3)
- [CVE-2024-8223](https://cve.now/CVE-2024-8223.md): SourceCodester Music Gallery Site Master.php sql injection (CVSS 5.3, SourceCodester Music Gallery Site)
- [CVE-2024-8222](https://cve.now/CVE-2024-8222.md): SourceCodester Music Gallery Site sql injection (CVSS 5.3, SourceCodester Music Gallery Site)
- [CVE-2024-8221](https://cve.now/CVE-2024-8221.md): SourceCodester Music Gallery Site manage\_category.php sql injection (CVSS 5.3, SourceCodester Music Gallery Site)
- [CVE-2024-8220](https://cve.now/CVE-2024-8220.md): itsourcecode Tailoring Management System staffedit.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-8219](https://cve.now/CVE-2024-8219.md): code-projects Responsive Hotel Site index.php sql injection (CVSS 6.9, code-projects Responsive Hotel Site)
- [CVE-2024-8218](https://cve.now/CVE-2024-8218.md): code-projects Online Quiz Site index.php sql injection (CVSS 6.9, code-projects Online Quiz Site)
- [CVE-2024-45038](https://cve.now/CVE-2024-45038.md): Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware (CVSS 7.5, meshtastic firmware)
- [CVE-2024-45049](https://cve.now/CVE-2024-45049.md): Nix Hydra Missing authentication when triggering evaluations (CVSS 7.5, NixOS hydra)
- [CVE-2024-8217](https://cve.now/CVE-2024-8217.md): SourceCodester E-Commerce Website registration.php sql injection (CVSS 6.9, SourceCodester E-Commerce Website)
- [CVE-2024-8216](https://cve.now/CVE-2024-8216.md): nafisulbari/itsourcecode Insurance Management System Payment editPayment.php access control (CVSS 5.3, nafisulbari Insurance Management System · itsourcecode Insu…)
- [CVE-2024-8214](https://cve.now/CVE-2024-8214.md): D-Link DNS-1550-04 hd\_config.cgi cgi\_FMT\_Std2R5\_2nd\_DiskMGR command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8213](https://cve.now/CVE-2024-8213.md): D-Link DNS-1550-04 hd\_config.cgi cgi\_FMT\_R12R5\_1st\_DiskMGR command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8212](https://cve.now/CVE-2024-8212.md): D-Link DNS-1550-04 hd\_config.cgi cgi\_FMT\_R12R5\_2nd\_DiskMGR command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8211](https://cve.now/CVE-2024-8211.md): D-Link DNS-1550-04 hd\_config.cgi cgi\_FMT\_Std2R1\_DiskMGR command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-1544](https://cve.now/CVE-2024-1544.md): ECDSA nonce bias caused by truncation (CVSS 4.1, wolfSSL)
- [CVE-2024-5814](https://cve.now/CVE-2024-5814.md): Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade (CVSS 5.1, wolfSSL)
- [CVE-2024-5288](https://cve.now/CVE-2024-5288.md): Safe-error attack on TLS 1.3 Protocol (CVSS 5.1, wolfSSL)
- [CVE-2024-45037](https://cve.now/CVE-2024-45037.md): AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template (CVSS 6.4, aws-cdk)
- [CVE-2024-5991](https://cve.now/CVE-2024-5991.md): Buffer overread in domain name matching (CVSS 10.0, wolfSSL)
- [CVE-2024-8210](https://cve.now/CVE-2024-8210.md): D-Link DNS-1550-04 hd\_config.cgi sprintf command injection (CVSS 5.3, D-Link DNS-120 · D-Link DNR-202L +18)
- [CVE-2024-8209](https://cve.now/CVE-2024-8209.md): nafisulbari/itsourcecode Insurance Management System addClient.php cross site scripting (CVSS 5.3, nafisulbari Insurance Management System · itsourcecode Insu…)
- [CVE-2024-8208](https://cve.now/CVE-2024-8208.md): nafisulbari/itsourcecode Insurance Management System editClient.php cross site scripting (CVSS 5.3, nafisulbari Insurance Management System · itsourcecode Insu…)
- [CVE-2024-7720](https://cve.now/CVE-2024-7720.md): HP Security Manager - Potential Remote Code Execution (CVSS 9.8, HP Security Manager)
- [CVE-2024-43414](https://cve.now/CVE-2024-43414.md): Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries (CVSS 7.5, apollographql federation · apollo-router +2)
- [CVE-2024-43783](https://cve.now/CVE-2024-43783.md): Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2024-43788](https://cve.now/CVE-2024-43788.md): DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) (CVSS 6.4, webpack)
- [CVE-2024-8199](https://cve.now/CVE-2024-8199.md): Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3, smub Reviews Feed – Add Testimonials and Customer Reviews F…)
- [CVE-2024-8200](https://cve.now/CVE-2024-8200.md): Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More \<= 1.1.2 - Cross-Site Request Forgery (CVSS 4.3, smub Reviews Feed – Add Testimonials and Customer Reviews F…)
- [CVE-2024-6632](https://cve.now/CVE-2024-6632.md): SQL Injection in FileCatalyst Workflow 5.1.6 Build 139 (and earlier) (CVSS 7.2, Fortra FileCatalyst Workflow)
- [CVE-2024-6633](https://cve.now/CVE-2024-6633.md): Insecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier) (CVSS 9.8, Fortra FileCatalyst Workflow)
- [CVE-2024-7071](https://cve.now/CVE-2024-7071.md): Unauthenticate SQLi in Brain Information Technologies' Brain Low-Code (CVSS 9.3, Brain Information Technologies Brain Low-Code)
- [CVE-2024-8181](https://cve.now/CVE-2024-8181.md): Flowise Authentication Bypass (CVSS 9.8, FlowiseAI Flowise · flowise)
- [CVE-2024-8182](https://cve.now/CVE-2024-8182.md): Flowise Denial of Service (CVSS 7.5, FlowiseAI Flowise · flowise)
- [CVE-2024-7941](https://cve.now/CVE-2024-7941.md): An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. (CVSS 4.3, Hitachi Energy MicroSCADA SYS600)
- [CVE-2024-7940](https://cve.now/CVE-2024-7940.md): The product exposes a service that is intended for local only to all network interfaces without any authentication. (CVSS 8.3, Hitachi Energy MicroSCADA SYS600)
- [CVE-2024-3982](https://cve.now/CVE-2024-3982.md): An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and (CVSS 8.2, Hitachi Energy MicroSCADA SYS600)
- [CVE-2024-3980](https://cve.now/CVE-2024-3980.md): The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesyst (CVSS 9.9, Hitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…)
- [CVE-2024-4872](https://cve.now/CVE-2024-4872.md): A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. (CVSS 9.9, Hitachi Energy MicroSCADA X SYS600 · Hitachi Energy MicroSC…)
- [CVE-2024-8207](https://cve.now/CVE-2024-8207.md): MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths (CVSS 6.4, MongoDB Server)
- [CVE-2024-7791](https://cve.now/CVE-2024-7791.md): 140+ Widgets | Xpro Addons For Elementor – FREE \<= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2024-6789](https://cve.now/CVE-2024-6789.md): Path traversal in M-Files API (CVSS 8.4, M-Files Server)
- [CVE-2024-41176](https://cve.now/CVE-2024-41176.md): Beckhoff: Local Denial of Service issue in package MDP included in TwinCAT/BSD (CVSS 7.3, Beckhoff MDP package · Beckhoff TwinCAT/BSD)
- [CVE-2024-41175](https://cve.now/CVE-2024-41175.md): Beckhoff: Local Denial-of-Service vulnerability in TwinCAT/BSD and the IPC-Diagnostics package (CVSS 5.5, Beckhoff IPC Diagnostics package · Beckhoff TwinCAT/BSD)
- [CVE-2024-41174](https://cve.now/CVE-2024-41174.md): Beckhoff: Improper input neutralization vulnerability in the IPC-Diagnostics package in TwinCAT/BSD (CVSS 7.3, Beckhoff IPC Diagnostics package · Beckhoff TwinCAT/BSD)
- [CVE-2024-41173](https://cve.now/CVE-2024-41173.md): Beckhoff: Local authentication bypass in the IPC-Diagnostics package included in TwinCAT/BSD (CVSS 7.8, Beckhoff IPC Diagnostics package · Beckhoff TwinCAT/BSD)
- [CVE-2024-7608](https://cve.now/CVE-2024-7608.md): An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. (CVSS 5.9, Trellix NX, EX, AX, FX, CMS and IVX)
- [CVE-2024-8046](https://cve.now/CVE-2024-8046.md): Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid \<= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, wpwax Logo Showcase Ultimate – Logo Carousel, Logo Slider &…)
- [CVE-2024-7304](https://cve.now/CVE-2024-7304.md): Ninja Tables – Easiest Data Table Builder \<= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, techjewel Ninja Tables – Easy Data Table Builder)
- [CVE-2024-6804](https://cve.now/CVE-2024-6804.md): Jeg Elementor Kit \<= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-6688](https://cve.now/CVE-2024-6688.md): Oxygen Builder \<= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update (CVSS 4.3, Oxygen Builder)
- [CVE-2024-7125](https://cve.now/CVE-2024-7125.md): Authentication Bypass Vulnerability in Hitachi Ops Center Common Services (CVSS 7.8, Hitachi Ops Center Common Services)
- [CVE-2022-39996](https://cve.now/CVE-2022-39996.md): Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to (CVSS 4.8)
- [CVE-2022-39997](https://cve.now/CVE-2022-39997.md): A weak password requirement issue was discovered in Teldats Router RS123, RS123w allows a remote attacker to escalate privileges (CVSS 8.0)
- [CVE-2024-36068](https://cve.now/CVE-2024-36068.md): An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network (CVSS 7.5)
- [CVE-2024-40395](https://cve.now/CVE-2024-40395.md): An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless (CVSS 6.5)
- [CVE-2024-41622](https://cve.now/CVE-2024-41622.md): D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the tomography\_ping\_address paramet (CVSS 8.8)
- [CVE-2024-42851](https://cve.now/CVE-2024-42851.md): Buffer Overflow vulnerability in open source exiftags v.1.01 allows a local attacker to execute arbitrary code via the paresetag function. (CVSS 8.4)
- [CVE-2024-44340](https://cve.now/CVE-2024-44340.md): D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via keys smartqos\_express\_devices and s (CVSS 8.8)
- [CVE-2024-44341](https://cve.now/CVE-2024-44341.md): D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)\_dhcps\_staticlist paramet (CVSS 8.8)
- [CVE-2024-44342](https://cve.now/CVE-2024-44342.md): D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the wl(0).(0)\_ssid parameter. (CVSS 8.8)
- [CVE-2024-45264](https://cve.now/CVE-2024-45264.md): A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a (CVSS 8.0)
- [CVE-2024-45321](https://cve.now/CVE-2024-45321.md): The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.