# CVEs published 2024-08-28

75 CVEs were published on August 28, 2024: 5 critical, 31 high. Days are UTC.

- [CVE-2024-8250](https://cve.now/CVE-2024-8250.md): Expired Pointer Dereference in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-8198](https://cve.now/CVE-2024-8198.md): Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to (CVSS 7.5, Google Chrome)
- [CVE-2024-8194](https://cve.now/CVE-2024-8194.md): Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 7.5, Google Chrome)
- [CVE-2024-8193](https://cve.now/CVE-2024-8193.md): Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to (CVSS 8.8, Google Chrome)
- [CVE-2024-45046](https://cve.now/CVE-2024-45046.md): PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information (CVSS 5.4, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-45048](https://cve.now/CVE-2024-45048.md): XML External Entity Reference (XXE) in PHPSpreadsheet (CVSS 8.8, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet +1)
- [CVE-2024-45059](https://cve.now/CVE-2024-45059.md): Authenticated SQL Injection in i-Educar (CVSS 8.8, portabilis i-educar)
- [CVE-2024-45058](https://cve.now/CVE-2024-45058.md): Privilege escalation in i-Educar (CVSS 8.1, portabilis i-educar)
- [CVE-2024-45057](https://cve.now/CVE-2024-45057.md): Reflected Cross-Site Scripting in i-Educar (CVSS 6.3, portabilis i-educar)
- [CVE-2024-45043](https://cve.now/CVE-2024-45043.md): OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability (CVSS 5.3, open-telemetry opentelemetry-collector-contrib · github.com…)
- [CVE-2024-45054](https://cve.now/CVE-2024-45054.md): Potential Permission Leakage of Cluster Level in hwameistor (CVSS 2.8, hwameistor · github.com/hwameistor/hwameistor)
- [CVE-2024-43805](https://cve.now/CVE-2024-43805.md): HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering (CVSS 7.6, jupyterlab · notebook)
- [CVE-2024-20284](https://cve.now/CVE-2024-20284.md): Cisco NX-OS Software Python Parser Escape Vulnerability (CVSS 5.3, Cisco NX-OS Software)
- [CVE-2024-20285](https://cve.now/CVE-2024-20285.md): Cisco NX-OS Software Python Parser Escape Vulnerability (CVSS 5.3, Cisco NX-OS Software)
- [CVE-2024-20286](https://cve.now/CVE-2024-20286.md): Cisco NX-OS Software Python Parser Escape Vulnerability (CVSS 5.3, Cisco NX-OS Software)
- [CVE-2024-20446](https://cve.now/CVE-2024-20446.md): Cisco NX-OS Software DHCPv6 Relay Agent Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2024-20289](https://cve.now/CVE-2024-20289.md): Cisco NX-OS Software Command Injection Vulnerability (CVSS 4.4, Cisco NX-OS Software · Cisco NX-OS System Software in ACI M…)
- [CVE-2024-7745](https://cve.now/CVE-2024-7745.md): Multi-Factor Authentication Bypass in Progress WS\_FTP Server (CVSS 6.5, Progress Software WS\_FTP Server)
- [CVE-2024-6053](https://cve.now/CVE-2024-6053.md): Improper access control in the clipboard synchronization feature (CVSS 4.3, TeamViewer Meeting · TeamViewer Remote Full Client)
- [CVE-2024-7744](https://cve.now/CVE-2024-7744.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Progress WS\_FTP Server (CVSS 6.5, Progress Software WS\_FTP Server)
- [CVE-2024-20478](https://cve.now/CVE-2024-20478.md): Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability (CVSS 6.5, Cisco Application Policy Infrastructure Controller)
- [CVE-2024-20411](https://cve.now/CVE-2024-20411.md): Cisco NX-OS Bash Arbitrary Code Execution Vulnerability (CVSS 6.7, Cisco NX-OS Software)
- [CVE-2024-20413](https://cve.now/CVE-2024-20413.md): Cisco NX-OS Bash Privilege Escalation Vulnerability (CVSS 6.7, Cisco NX-OS Software)
- [CVE-2024-20279](https://cve.now/CVE-2024-20279.md): Cisco Application Policy Infrastructure Controller Unauthorized Policy Actions Vulnerability (CVSS 4.3, Cisco Application Policy Infrastructure Controller)
- [CVE-2024-8195](https://cve.now/CVE-2024-8195.md): Permalink Manager Lite \<= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3, mbis Permalink Manager Lite)
- [CVE-2024-6450](https://cve.now/CVE-2024-6450.md): Reflected XSS in HyperView Geoportal Toolkit (CVSS 5.3, HyperView Geoportal Toolkit)
- [CVE-2024-6449](https://cve.now/CVE-2024-6449.md): Arbitrary cross-domain file inclusion in HyperView Geoportal Toolkit (CVSS 5.3, HyperView Geoportal Toolkit)
- [CVE-2024-7447](https://cve.now/CVE-2024-7447.md): Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free \<= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload (CVSS 5.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2024-7269](https://cve.now/CVE-2024-7269.md): Stored XSS in ConnX ESP HR Management (CVSS 8.7, ConnX ESP HR Management)
- [CVE-2024-5546](https://cve.now/CVE-2024-5546.md): SQL Injection (CVSS 8.3, ManageEngine Password Manager Pro · ManageEngine PAM360)
- [CVE-2023-26322](https://cve.now/CVE-2023-26322.md): GetApps application has code execution vulnerability (CVSS 8.8, Xiaomi GetApps application)
- [CVE-2023-26323](https://cve.now/CVE-2023-26323.md): Xiaomi App Market has a code execution vulnerability (CVSS 7.6, Xiaomi App Market)
- [CVE-2023-26321](https://cve.now/CVE-2023-26321.md): The international version of Xiaomi File Manager has a path traversal vulnerability (CVSS 6.3, Xiaomi File Manager App International Version)
- [CVE-2023-26324](https://cve.now/CVE-2023-26324.md): GetApps application has code execution vulnerability (CVSS 8.8, Xiaomi GetApps application)
- [CVE-2024-44943](https://cve.now/CVE-2024-44943.md): mm: gup: stop abusing try\_grab\_folio (no CVSS, Linux)
- [CVE-2024-45346](https://cve.now/CVE-2024-45346.md): GetApps application has code execution vulnerability (CVSS 8.8, Xiaomi GetApps application)
- [CVE-2024-6311](https://cve.now/CVE-2024-6311.md): Funnelforms Free \<= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2024-6312](https://cve.now/CVE-2024-6312.md): Funnelforms Free \<= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion (CVSS 6.5, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2021-22509](https://cve.now/CVE-2021-22509.md): Handling of sensitive data in process memory in NetIQ Advance Authentication (CVSS 8.1, OpenText NetIQ Advance Authentication)
- [CVE-2021-22529](https://cve.now/CVE-2021-22529.md): Sensitive Data Exposure leaks potential information in NetIQ Advance Authentication (CVSS 6.3, OpenText NetIQ Advance Authentication)
- [CVE-2021-22530](https://cve.now/CVE-2021-22530.md): Improper account management vulnerability in NetIQ Advance Authentication (CVSS 8.2, OpenText NetIQ Advance Authentication)
- [CVE-2021-38120](https://cve.now/CVE-2021-38120.md): Remote Code Execution using Bash command Injection in backup scheduling functionality in NetIQ Advance Authentication (CVSS 5.1, OpenText NetIQ Advance Authentication)
- [CVE-2021-38121](https://cve.now/CVE-2021-38121.md): Weak communication protocol identified in Advance Authentication client application (CVSS 8.3, OpenText NetIQ Advance Authentication)
- [CVE-2021-38122](https://cve.now/CVE-2021-38122.md): Cross-Site Scripting (XSS) in Advance Authentication (CVSS 6.2, OpenText NetIQ Advance Authentication)
- [CVE-2024-4554](https://cve.now/CVE-2024-4554.md): Multiple xss vulnerability in NetIQ Access Manager (CVSS 7.3, OpenText Access Manager)
- [CVE-2024-4555](https://cve.now/CVE-2024-4555.md): User impersonation with MFA when configure in specific way (CVSS 7.7, OpenText NetIQ Access Manager)
- [CVE-2024-4556](https://cve.now/CVE-2024-4556.md): Directory traversal vulnerability in NetIQ Access Manager (CVSS 5.7, OpenText NetIQ Access Manager)
- [CVE-2024-39771](https://cve.now/CVE-2024-39771.md): QBiC CLOUD CC-2L v1.1.30 and earlier and Safie One v1.8.2 and earlier do not properly validate certificates, which may allow a network-adjac (CVSS 4.2, Safie QBiC CLOUD CC-2L · Safie One)
- [CVE-2024-39584](https://cve.now/CVE-2024-39584.md): Dell Client Platform BIOS contains a Use of Default Cryptographic Key Vulnerability. (CVSS 8.2, Dell Client Platform BIOS)
- [CVE-2023-43078](https://cve.now/CVE-2023-43078.md): Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary fol (CVSS 6.7, Dell Client Platform, Dell Dock Firmware)
- [CVE-2024-6448](https://cve.now/CVE-2024-6448.md): Mollie Payments for WooCommerce \<= 7.7.0 - Unauthenticated Full Path Disclosure (CVSS 5.3, mollieintegration Mollie Payments for WooCommerce)
- [CVE-2024-8030](https://cve.now/CVE-2024-8030.md): Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider \<= 2.0.3 - Unauthenticated PHP Object Injection (CVSS 9.8, bdthemes Ultimate Store Kit – Addon For WooCommerce, EDD an…)
- [CVE-2024-7573](https://cve.now/CVE-2024-7573.md): Relevanssi Live Ajax Search \<= 2.4 - Unauthenticated WP\_Query Argument Injection (CVSS 5.3, comesio Relevanssi Live Ajax Search)
- [CVE-2024-8231](https://cve.now/CVE-2024-8231.md): Tenda O6 setPortForward fromVirtualSet stack-based overflow (CVSS 8.7, Tenda O6)
- [CVE-2024-8230](https://cve.now/CVE-2024-8230.md): Tenda O6 setMacFilterList fromSafeSetMacFilter stack-based overflow (CVSS 8.7, Tenda O6)
- [CVE-2024-8229](https://cve.now/CVE-2024-8229.md): Tenda O6 operateMacFilter frommacFilterModify stack-based overflow (CVSS 8.7, Tenda O6)
- [CVE-2024-8228](https://cve.now/CVE-2024-8228.md): Tenda O5 setMacFilterList fromSafeSetMacFilter stack-based overflow (CVSS 8.7, Tenda O5)
- [CVE-2024-8227](https://cve.now/CVE-2024-8227.md): Tenda O1 DhcpSetSer fromDhcpSetSer stack-based overflow (CVSS 8.7, Tenda O1)
- [CVE-2023-45896](https://cve.now/CVE-2023-45896.md): ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Li (CVSS 7.1)
- [CVE-2024-34195](https://cve.now/CVE-2024-34195.md): TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. (CVSS 8.8)
- [CVE-2024-34198](https://cve.now/CVE-2024-34198.md): TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2024-41236](https://cve.now/CVE-2024-41236.md): A SQL injection vulnerability in /smsa/admin\_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute (CVSS 5.4)
- [CVE-2024-41564](https://cve.now/CVE-2024-41564.md): EMI v.1.1.10 and before, fixed in v.1.1.11, contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. (CVSS 4.3)
- [CVE-2024-41565](https://cve.now/CVE-2024-41565.md): JustEnoughItems (JEI) 19.5.0.33 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerability. (CVSS 4.3)
- [CVE-2024-42698](https://cve.now/CVE-2024-42698.md): Roughly Enough Items (REI) v.16.0.729 and before contains an Improper Validation of Specified Index, Position, or Offset in Input vulnerabil (CVSS 4.3)
- [CVE-2024-42793](https://cve.now/CVE-2024-42793.md): A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/aj (CVSS 5.4)
- [CVE-2024-42900](https://cve.now/CVE-2024-42900.md): Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the sql parameter of the createTable() func (CVSS 6.1)
- [CVE-2024-42905](https://cve.now/CVE-2024-42905.md): Beijing Digital China Cloud Technology Co., Ltd. (CVSS 9.8)
- [CVE-2024-44760](https://cve.now/CVE-2024-44760.md): Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allow (CVSS 9.1)
- [CVE-2024-44761](https://cve.now/CVE-2024-44761.md): An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests. (CVSS 9.9)
- [CVE-2024-44913](https://cve.now/CVE-2024-44913.md): An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. (CVSS 5.5)
- [CVE-2024-44914](https://cve.now/CVE-2024-44914.md): An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. (CVSS 5.5)
- [CVE-2024-44915](https://cve.now/CVE-2024-44915.md): An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. (CVSS 5.5)
- [CVE-2024-45232](https://cve.now/CVE-2024-45232.md): An issue was discovered in powermail extension through 12.3.5 for TYPO3. (CVSS 7.3, in2code/powermail)
- [CVE-2024-45233](https://cve.now/CVE-2024-45233.md): An issue was discovered in powermail extension through 12.3.5 for TYPO3. (CVSS 7.3, in2code/powermail)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.