CVEs published August 29, 2024
135 CVEs were published on August 29, 2024: 32 critical, 26 high. 1 is now in CISA KEV.
- Published
- 135
- Critical
- 32
- High
- 26
- Medium
- 72
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 1
- Fix available
- 20
Most affected products
- SportsNET
- 9
- Acronis Snap Deploy
- 3
- B&R Industrial Automation B&R APROL
- 3
- CridioStudio ListingPro
- 3
- dingfanzu CMS
- 3
- FeehiCMS · feehi/cms
- 3
- Progress Software WhatsUp Gold
- 3
- Dell PowerEdge Platform
- 2
- Dinesh Karki WP Armour Extended
- 2
- rustaurius Front End Users
- 2
Critical 32
- CVE-2024-6671WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-6670WhatsUp Gold HasErrors SQL Injection Authentication Bypass VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-43955WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerabilityThemeum Droip
- CVE-2024-43941WordPress Propovoice Pro plugin <= 1.7.0.3 - Unauthenticated SQL Injection vulnerabilityPropovoice Pro
- CVE-2024-43931WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerabilityeyecix JobSearch
- CVE-2024-43918WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerabilityWBW Product Table PRO
- CVE-2024-43917WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerabilityTemplateInvaders TI WooCommerce Wishlist
- CVE-2024-43144WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerabilityStylemixThemes Cost Calculator Builder
- CVE-2024-43132WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin < 1.7.0 - Unauthenticated SQL Injection vulnerabilityWPWeb Elite Docket
- CVE-2024-39653WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerabilityE4J s.r.l. VikRentCar
- CVE-2024-39622WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerabilityCridioStudio ListingPro
- CVE-2024-38795WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerabilityCridioStudio ListingPro
- CVE-2024-5057WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerabilityEasy Digital Downloads
- CVE-2024-29723Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29724Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29725Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29726Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29727Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29728Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29729Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29730Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-29731Multiple vulnerabilities in SportsNETSportsNET
- CVE-2024-41361RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php
- CVE-2024-41364RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php
- CVE-2024-41366RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php
- CVE-2024-41367RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.p
- CVE-2024-41368RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php
- CVE-2024-41369RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php
- CVE-2024-41370Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.
- CVE-2024-41372Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php.
- CVE-2024-45435Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.
- CVE-2024-45436extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.github.com/ollama/ollama
High 26
- CVE-2024-6672WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-43921WordPress Generate Images – Magic Post Thumbnail plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerabilityMagic Post Thumbnail
- CVE-2024-43926WordPress Beaver Builder plugin <= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityThe Beaver Builder Team Beaver Builder
- CVE-2024-43948WordPress WP Armour Extended plugin <= 1.26 - Reflected Cross Site Scripting (XSS) vulnerabilityDinesh Karki WP Armour Extended
- CVE-2024-43950WordPress Brickscore plugin <= 1.4.2.5 - Cross Site Scripting (XSS) vulnerabilityNextbricks Brickscore
- CVE-2024-43958WordPress Into The Dark theme <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityGianni Porto IntoTheDark
- CVE-2024-43963WordPress Visual CSS Style Editor plugin <= 7.6.1 - Cross Site Scripting (XSS) vulnerabilityWaspThemes YellowPencil Visual CSS Style Editor
- CVE-2024-43804OS Command Injection via Port Scan Functionality in Roxy-WIroxy-wi
- CVE-2024-41964Insufficient permission checks in the language settings in Kirby CMSgetkirby kirby · getkirby/cms
- CVE-2024-43965WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerabilitySmackcoders SendGrid for WordPress
- CVE-2024-8255Path Traversal in Ocean Data Systems Dream ReportDelta Electronics DTN Soft
- CVE-2024-43943WordPress Greenshift Woocommerce Addon plugin < 1.9.8 - Subscriber+ SQL Injection vulnerabilityWpsoul Greenshift Woocommerce Addon
- CVE-2024-43942WordPress Greenshift Query and Meta Addon plugin < 3.9.2 - Subscriber+ SQL Injection vulnerabilityWpsoul Greenshift Query and Meta Addon
- CVE-2024-39658WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerabilitySalon booking system
- CVE-2024-39638WordPress Registrations for the Events Calendar plugin <= 2.12.2 - SQL Injection vulnerabilityRoundup WP Registrations for the Events Calendar
- CVE-2024-39620WordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerabilityCridioStudio ListingPro
- CVE-2024-38793WordPress Best Restaurant Menu by Pricelisto plugin <= 1.4.1 - SQL Injection vulnerabilityBest Restaurant Menu by PriceListo
- CVE-2024-38693WordPress WP User Frontend plugin <= 4.0.7 - SQL Injection vulnerabilityweDevs WP User Frontend
- CVE-2024-5622Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROLB&R Industrial Automation B&R APROL
- CVE-2024-43700xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow Philip Hazel xfpt
- CVE-2024-7607Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injectionrustaurius Front End Users
- CVE-2024-7856MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File DeletionMP3 Audio Player – Music Player, Podcast Player & Radio by…
- CVE-2022-2440Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserializationmndpsingh287 Theme Editor
- CVE-2024-44777A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute
- CVE-2024-44778A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execu
- CVE-2024-44779A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to exe
Medium, low and unrated 77
- CVE-2024-2881Fault Injection of EdDSA signature in WolfCryptWolfSSL wolfCrypt
- CVE-2024-1545Fault Injection of RSA encryption in WolfCryptWolfSSL wolfCrypt
- CVE-2024-1543AES T-Table sub-cache-line leakagewolfSSL
- CVE-2024-2502Failure to update the tamper reset cause register when a tamper event occurssilabs.com SE Firmware
- CVE-2024-45302CRLF Injection in RestSharp's `RestRequest.AddHeader` methodRestSharp
- CVE-2024-34018Sensitive information disclosure due to insecure folder permissions.Acronis Snap Deploy
- CVE-2024-34017Local privilege escalation due to DLL hijacking vulnerability.Acronis Snap Deploy
- CVE-2024-34019Local privilege escalation due to DLL hijacking vulnerability.Acronis Snap Deploy
- CVE-2024-43947WordPress WP Armour Extended plugin <= 1.26 - Cross Site Request Forgery (CSRF) vulnerabilityDinesh Karki WP Armour Extended
- CVE-2024-43920WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerabilityJegstudio Gutenverse
- CVE-2024-43934WordPress Collapsing Archives plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerabilityRobert Felty Collapsing Archives
- CVE-2024-43935WordPress WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerabilityWP Delicious Delicious Recipes – WordPress Recipe Plugin
- CVE-2024-43936WordPress EmbedPress plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper EmbedPress
- CVE-2024-43946WordPress SKT Blocks plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilitySKT Themes SKT Blocks – Gutenberg based Page Builder
- CVE-2024-43949WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerabilityAutomattic GHActivity
- CVE-2024-43951WordPress Tempera theme <= 1.8.2 - Cross Site Scripting (XSS) vulnerabilityCryoutCreations Tempera
- CVE-2024-43952WordPress Esotera theme <= 1.2.5.1 - Cross Site Scripting (XSS) vulnerabilityCryoutCreations Esotera
- CVE-2024-43953WordPress Classic Addons – WPBakery Page Builder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilitywebcodingplace Classic Addons – WPBakery Page Builder
- CVE-2024-43960WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerabilityPage Builder Addons Web and WooCommerce Addons for WPBakery…
- CVE-2024-43961WordPress azurecurve Toggle Show/Hide plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityazurecurve Toggle Show/Hide
- CVE-2024-43964WordPress DSGVO All in one for WP plugin <= 4.5 - Cross Site Scripting (XSS) vulnerabilityMichael Leithold DSGVO All in one for WP
- CVE-2024-45056`fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolcmatter-labs era-compiler-solidity
- CVE-2024-45045JavaScript Injection via url encoded values in links in Collabora Office AndroidCollaboraOnline online
- CVE-2024-35133IBM Security Verify Access HTTP open redirectIBM Security Verify Access
- CVE-2024-43957WordPress Animated Number Counters plugin <= 1.9 - Editor+ Limited Local File Inclusion vulnerabilitySk. Abul Hasan Animated Number Counters
- CVE-2024-35118IBM MaaS360 information disclosureIBM MaaS360
- CVE-2024-43954WordPress Droip plugin <= 1.1.1 - Subscriber+ Settings Change/Data Exposure VulnerabilityThemeum Droip
- CVE-2024-43944WordPress Maintenance & Coming Soon Redirect Animation plugin <= 2.3.3 - Bypass Vulnerability vulnerabilityilyasine Maintenance & Coming Soon Redirect Animation
- CVE-2024-43940WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Plugin Settings Change vulnerabilityVIICTORY MEDIA Z Y N I T H
- CVE-2024-43939WordPress Z Y N I T H plugin <= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerabilityVIICTORY MEDIA Z Y N I T H
- CVE-2024-43922WordPress NitroPack plugin <= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution vulnerabilityNitroPack
- CVE-2024-8304jpress Template Module edit path traversaljpress
- CVE-2024-8303dingfanzu CMS getBasicInfo.php sql injectiondingfanzu CMS
- CVE-2024-8302dingfanzu CMS chpwd.php sql injectiondingfanzu CMS
- CVE-2024-1056Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_postFunnelKit Funnel Builder Pro
- CVE-2024-8301dingfanzu CMS checkin.php sql injectiondingfanzu CMS
- CVE-2024-8297kitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logskitsada8621 Digital Library Management System
- CVE-2024-3679Premium SEO Pack – WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposurecalinvingan Premium SEO Pack – WP SEO Plugin
- CVE-2024-1384Premium Portfolio Features for Phlox theme <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingaverta Premium Portfolio Features for Phlox theme
- CVE-2024-8296FeehiCMS index.php insert unrestricted uploadFeehiCMS · feehi/cms
- CVE-2024-2541Popup Builder <= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV Filepopupbuilder Popup Builder – Create highly converting, mobi…
- CVE-2024-8295FeehiCMS index.php createBanner unrestricted uploadFeehiCMS · feehi/cms
- CVE-2024-8294FeehiCMS index.php update unrestricted uploadFeehiCMS · feehi/cms
- CVE-2024-7895Beaver Builder (Lite Version) <= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameterbeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-6551GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosurestellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2021-4442tcp: add sanity tests to TCP_QUEUE_SEQLinux
- CVE-2024-43986WordPress E-cab taxi booking manager plugin <=1.0.9 - Cross Site Scripting (XSS) vulnerabilityMagePeople Team Taxi Booking Manager for WooCommerce
- CVE-2024-5624Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROLB&R Industrial Automation B&R APROL
- CVE-2024-5623Untrusted search path vulnerability in B&R APROLB&R Industrial Automation B&R APROL
- CVE-2024-38304Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability.Dell PowerEdge Platform
- CVE-2024-4428Sensetive Data Exposure in Menulux Managment PortalMenulux Information Technologies Managment Portal
- CVE-2024-7132CoBlocks < 3.1.13 - Editor+ Stored XSSPage Builder Gutenberg Blocks
- CVE-2024-6927Viral Signup <= 2.1 - Admin+ Stored XSSViral Signup
- CVE-2024-5417Gutentor < 3.3.6 - Contributor+ Stored XSSGutentor
- CVE-2024-5987WP Accessibility Helper <= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Updatevol4ikman WP Accessibility Helper
- CVE-2024-3944WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Commentsdelower186 WP To Do
- CVE-2024-7606Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderustaurius Front End Users
- CVE-2024-38303Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability.Dell PowerEdge Platform
- CVE-2024-7418The Post Grid <= 7.7.11 - Authenticated (Contributor+) Information Disclosuretechlabpro1 The Post Grid – Shortcode, Gutenberg Blocks and…
- CVE-2024-5857Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media DeletionInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2024-41918'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authorizaRakuten Group 'Rakuten Ichiba App' for Android · Rakuten Gr…
- CVE-2024-7857Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injectionmaxfoundry Media Library Folders
- CVE-2024-41345openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php
- CVE-2024-41346openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php
- CVE-2024-41347openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php
- CVE-2024-41348openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php
- CVE-2024-41349unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add_by_url.php.
- CVE-2024-41350bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php
- CVE-2024-41351bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php
- CVE-2024-41358phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.
- CVE-2024-41371Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php.
- CVE-2024-44716A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-44717A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-44776An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a craft
- CVE-2024-44919A cross-site scripting (XSS) vulnerability in the component admin_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts
- CVE-2024-44930Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by Serilog.Enrichers.ClientInfo
- CVE-2024-45440core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_coDrupal core · drupal/drupal +2