# CVEs published 2024-08-29

135 CVEs were published on August 29, 2024: 32 critical, 26 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-2881](https://cve.now/CVE-2024-2881.md): Fault Injection of EdDSA signature in WolfCrypt (CVSS 6.7, WolfSSL wolfCrypt)
- [CVE-2024-1545](https://cve.now/CVE-2024-1545.md): Fault Injection of RSA encryption in WolfCrypt (CVSS 5.9, WolfSSL wolfCrypt)
- [CVE-2024-1543](https://cve.now/CVE-2024-1543.md): AES T-Table sub-cache-line leakage (CVSS 4.1, wolfSSL)
- [CVE-2024-6672](https://cve.now/CVE-2024-6672.md): WhatsUp Gold getMonitorJoin SQL Injection Privilege Escalation Vulnerability (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2024-2502](https://cve.now/CVE-2024-2502.md): Failure to update the tamper reset cause register when a tamper event occurs (CVSS 2.0, silabs.com SE Firmware)
- [CVE-2024-6671](https://cve.now/CVE-2024-6671.md): WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability (CVSS 9.8, Progress Software WhatsUp Gold)
- [CVE-2024-6670](https://cve.now/CVE-2024-6670.md): WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability (CVSS 9.8, KEV, Progress Software WhatsUp Gold)
- [CVE-2024-45302](https://cve.now/CVE-2024-45302.md): CRLF Injection in RestSharp's \`RestRequest.AddHeader\` method (CVSS 6.1, RestSharp)
- [CVE-2024-34018](https://cve.now/CVE-2024-34018.md): Sensitive information disclosure due to insecure folder permissions. (CVSS 5.5, Acronis Snap Deploy)
- [CVE-2024-34017](https://cve.now/CVE-2024-34017.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis Snap Deploy)
- [CVE-2024-34019](https://cve.now/CVE-2024-34019.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.7, Acronis Snap Deploy)
- [CVE-2024-43947](https://cve.now/CVE-2024-43947.md): WordPress WP Armour Extended plugin \<= 1.26 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Dinesh Karki WP Armour Extended)
- [CVE-2024-43920](https://cve.now/CVE-2024-43920.md): WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin \<= 1.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jegstudio Gutenverse)
- [CVE-2024-43921](https://cve.now/CVE-2024-43921.md): WordPress Generate Images – Magic Post Thumbnail plugin \<= 5.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Magic Post Thumbnail)
- [CVE-2024-43926](https://cve.now/CVE-2024-43926.md): WordPress Beaver Builder plugin \<= 2.8.3.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, The Beaver Builder Team Beaver Builder)
- [CVE-2024-43934](https://cve.now/CVE-2024-43934.md): WordPress Collapsing Archives plugin \<= 3.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Robert Felty Collapsing Archives)
- [CVE-2024-43935](https://cve.now/CVE-2024-43935.md): WordPress WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin \<= 1.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Delicious Delicious Recipes – WordPress Recipe Plugin)
- [CVE-2024-43936](https://cve.now/CVE-2024-43936.md): WordPress EmbedPress plugin \<= 4.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPDeveloper EmbedPress)
- [CVE-2024-43946](https://cve.now/CVE-2024-43946.md): WordPress SKT Blocks plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SKT Themes SKT Blocks – Gutenberg based Page Builder)
- [CVE-2024-43948](https://cve.now/CVE-2024-43948.md): WordPress WP Armour Extended plugin \<= 1.26 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dinesh Karki WP Armour Extended)
- [CVE-2024-43949](https://cve.now/CVE-2024-43949.md): WordPress GHActivity plugin \<= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic GHActivity)
- [CVE-2024-43950](https://cve.now/CVE-2024-43950.md): WordPress Brickscore plugin \<= 1.4.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Nextbricks Brickscore)
- [CVE-2024-43951](https://cve.now/CVE-2024-43951.md): WordPress Tempera theme \<= 1.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Tempera)
- [CVE-2024-43952](https://cve.now/CVE-2024-43952.md): WordPress Esotera theme \<= 1.2.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Esotera)
- [CVE-2024-43953](https://cve.now/CVE-2024-43953.md): WordPress Classic Addons – WPBakery Page Builder plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, webcodingplace Classic Addons – WPBakery Page Builder)
- [CVE-2024-43958](https://cve.now/CVE-2024-43958.md): WordPress Into The Dark theme \<= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Gianni Porto IntoTheDark)
- [CVE-2024-43960](https://cve.now/CVE-2024-43960.md): WordPress Web and WooCommerce Addons for WPBakery Builder plugin \<= 1.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Page Builder Addons Web and WooCommerce Addons for WPBakery…)
- [CVE-2024-43961](https://cve.now/CVE-2024-43961.md): WordPress azurecurve Toggle Show/Hide plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, azurecurve Toggle Show/Hide)
- [CVE-2024-43963](https://cve.now/CVE-2024-43963.md): WordPress Visual CSS Style Editor plugin \<= 7.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WaspThemes YellowPencil Visual CSS Style Editor)
- [CVE-2024-43964](https://cve.now/CVE-2024-43964.md): WordPress DSGVO All in one for WP plugin \<= 4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Michael Leithold DSGVO All in one for WP)
- [CVE-2024-45056](https://cve.now/CVE-2024-45056.md): \`fold (xor (shl 1, x), -1) -\> (rotl ~1, x)\` misoptimization in zksolc (CVSS 5.9, matter-labs era-compiler-solidity)
- [CVE-2024-45045](https://cve.now/CVE-2024-45045.md): JavaScript Injection via url encoded values in links in Collabora Office Android (CVSS 6.3, CollaboraOnline online)
- [CVE-2024-43804](https://cve.now/CVE-2024-43804.md): OS Command Injection via Port Scan Functionality in Roxy-WI (CVSS 8.8, roxy-wi)
- [CVE-2024-35133](https://cve.now/CVE-2024-35133.md): IBM Security Verify Access HTTP open redirect (CVSS 6.8, IBM Security Verify Access)
- [CVE-2024-41964](https://cve.now/CVE-2024-41964.md): Insufficient permission checks in the language settings in Kirby CMS (CVSS 8.1, getkirby kirby · getkirby/cms)
- [CVE-2024-43965](https://cve.now/CVE-2024-43965.md): WordPress SendGrid for WordPress plugin \<= 1.4 - SQL Injection vulnerability (CVSS 8.2, Smackcoders SendGrid for WordPress)
- [CVE-2024-43957](https://cve.now/CVE-2024-43957.md): WordPress Animated Number Counters plugin \<= 1.9 - Editor+ Limited Local File Inclusion vulnerability (CVSS 6.5, Sk. Abul Hasan Animated Number Counters)
- [CVE-2024-35118](https://cve.now/CVE-2024-35118.md): IBM MaaS360 information disclosure (CVSS 4.6, IBM MaaS360)
- [CVE-2024-43955](https://cve.now/CVE-2024-43955.md): WordPress Droip plugin \<= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability (CVSS 10.0, Themeum Droip)
- [CVE-2024-8255](https://cve.now/CVE-2024-8255.md): Path Traversal in Ocean Data Systems Dream Report (CVSS 8.4, Delta Electronics DTN Soft)
- [CVE-2024-43954](https://cve.now/CVE-2024-43954.md): WordPress Droip plugin \<= 1.1.1 - Subscriber+ Settings Change/Data Exposure Vulnerability (CVSS 6.3, Themeum Droip)
- [CVE-2024-43944](https://cve.now/CVE-2024-43944.md): WordPress Maintenance & Coming Soon Redirect Animation plugin \<= 2.3.3 - Bypass Vulnerability vulnerability (CVSS 3.7, ilyasine Maintenance & Coming Soon Redirect Animation)
- [CVE-2024-43943](https://cve.now/CVE-2024-43943.md): WordPress Greenshift Woocommerce Addon plugin \< 1.9.8 - Subscriber+ SQL Injection vulnerability (CVSS 8.5, Wpsoul Greenshift Woocommerce Addon)
- [CVE-2024-43942](https://cve.now/CVE-2024-43942.md): WordPress Greenshift Query and Meta Addon plugin \< 3.9.2 - Subscriber+ SQL Injection vulnerability (CVSS 8.5, Wpsoul Greenshift Query and Meta Addon)
- [CVE-2024-43941](https://cve.now/CVE-2024-43941.md): WordPress Propovoice Pro plugin \<= 1.7.0.3 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, Propovoice Pro)
- [CVE-2024-43940](https://cve.now/CVE-2024-43940.md): WordPress Z Y N I T H plugin \<= 7.4.9 - Unauthenticated Plugin Settings Change vulnerability (CVSS 6.5, VIICTORY MEDIA Z Y N I T H)
- [CVE-2024-43939](https://cve.now/CVE-2024-43939.md): WordPress Z Y N I T H plugin \<= 7.4.9 - Unauthenticated Arbitrary Option Deletion vulnerability (CVSS 6.5, VIICTORY MEDIA Z Y N I T H)
- [CVE-2024-43931](https://cve.now/CVE-2024-43931.md): WordPress JobSearch WP Job Board WordPress Plugin plugin \<= 2.5.3 - PHP Object Injection vulnerability (CVSS 9.8, eyecix JobSearch)
- [CVE-2024-43922](https://cve.now/CVE-2024-43922.md): WordPress NitroPack plugin \<= 1.16.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability (CVSS 4.8, NitroPack)
- [CVE-2024-43918](https://cve.now/CVE-2024-43918.md): WordPress WBW Product Table PRO plugin \<= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability (CVSS 10.0, WBW Product Table PRO)
- [CVE-2024-43917](https://cve.now/CVE-2024-43917.md): WordPress TI WooCommerce Wishlist plugin \<= 2.8.2 - SQL Injection vulnerability (CVSS 9.3, TemplateInvaders TI WooCommerce Wishlist)
- [CVE-2024-43144](https://cve.now/CVE-2024-43144.md): WordPress Cost Calculator Builder plugin \<= 3.2.15 - SQL Injection vulnerability (CVSS 9.3, StylemixThemes Cost Calculator Builder)
- [CVE-2024-43132](https://cve.now/CVE-2024-43132.md): WordPress Docket (WooCommerce Collections / Wishlist / Watchlist) plugin \< 1.7.0 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, WPWeb Elite Docket)
- [CVE-2024-39658](https://cve.now/CVE-2024-39658.md): WordPress Salon Booking System plugin \<= 10.7 - Authenticated SQL Injection vulnerability (CVSS 7.6, Salon booking system)
- [CVE-2024-8304](https://cve.now/CVE-2024-8304.md): jpress Template Module edit path traversal (CVSS 5.1, jpress)
- [CVE-2024-8303](https://cve.now/CVE-2024-8303.md): dingfanzu CMS getBasicInfo.php sql injection (CVSS 5.3, dingfanzu CMS)
- [CVE-2024-39653](https://cve.now/CVE-2024-39653.md): WordPress VikRentCar Car Rental Management System plugin \<= 1.4.0 - SQL Injection vulnerability (CVSS 9.3, E4J s.r.l. VikRentCar)
- [CVE-2024-39638](https://cve.now/CVE-2024-39638.md): WordPress Registrations for the Events Calendar plugin \<= 2.12.2 - SQL Injection vulnerability (CVSS 8.5, Roundup WP Registrations for the Events Calendar)
- [CVE-2024-39622](https://cve.now/CVE-2024-39622.md): WordPress ListingPro theme \<= 2.9.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, CridioStudio ListingPro)
- [CVE-2024-39620](https://cve.now/CVE-2024-39620.md): WordPress ListingPro plugin \<= 2.9.4 - SQL Injection vulnerability (CVSS 8.5, CridioStudio ListingPro)
- [CVE-2024-38795](https://cve.now/CVE-2024-38795.md): WordPress ListingPro plugin \<= 2.9.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, CridioStudio ListingPro)
- [CVE-2024-38793](https://cve.now/CVE-2024-38793.md): WordPress Best Restaurant Menu by Pricelisto plugin \<= 1.4.1 - SQL Injection vulnerability (CVSS 8.5, Best Restaurant Menu by PriceListo)
- [CVE-2024-38693](https://cve.now/CVE-2024-38693.md): WordPress WP User Frontend plugin \<= 4.0.7 - SQL Injection vulnerability (CVSS 7.6, weDevs WP User Frontend)
- [CVE-2024-5057](https://cve.now/CVE-2024-5057.md): WordPress Easy Digital Downloads plugin \<= 3.2.12 - SQL Injection vulnerability (CVSS 9.3, Easy Digital Downloads)
- [CVE-2024-8302](https://cve.now/CVE-2024-8302.md): dingfanzu CMS chpwd.php sql injection (CVSS 5.3, dingfanzu CMS)
- [CVE-2024-1056](https://cve.now/CVE-2024-1056.md): Funnel Kit Funnel Builder PRO \<= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow\_iframe\_tag\_in\_post (CVSS 6.4, FunnelKit Funnel Builder Pro)
- [CVE-2024-8301](https://cve.now/CVE-2024-8301.md): dingfanzu CMS checkin.php sql injection (CVSS 6.9, dingfanzu CMS)
- [CVE-2024-8297](https://cve.now/CVE-2024-8297.md): kitsada8621 Digital Library Management System jwt\_refresh\_token\_middleware.go JwtRefreshAuth neutralization for logs (CVSS 6.9, kitsada8621 Digital Library Management System)
- [CVE-2024-3679](https://cve.now/CVE-2024-3679.md): Premium SEO Pack – WP SEO Plugin \<= 1.6.002 - Unauthenticated Information Exposure (CVSS 5.3, calinvingan Premium SEO Pack – WP SEO Plugin)
- [CVE-2024-1384](https://cve.now/CVE-2024-1384.md): Premium Portfolio Features for Phlox theme \<= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, averta Premium Portfolio Features for Phlox theme)
- [CVE-2024-8296](https://cve.now/CVE-2024-8296.md): FeehiCMS index.php insert unrestricted upload (CVSS 5.3, FeehiCMS · feehi/cms)
- [CVE-2024-2541](https://cve.now/CVE-2024-2541.md): Popup Builder \<= 4.3.6 - Sensitive Information Exposure via Imported Subscribers CSV File (CVSS 5.3, popupbuilder Popup Builder – Create highly converting, mobi…)
- [CVE-2024-8295](https://cve.now/CVE-2024-8295.md): FeehiCMS index.php createBanner unrestricted upload (CVSS 5.3, FeehiCMS · feehi/cms)
- [CVE-2024-8294](https://cve.now/CVE-2024-8294.md): FeehiCMS index.php update unrestricted upload (CVSS 5.3, FeehiCMS · feehi/cms)
- [CVE-2024-7895](https://cve.now/CVE-2024-7895.md): Beaver Builder (Lite Version) \<= 2.8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-6551](https://cve.now/CVE-2024-6551.md): GiveWP \<= 3.15.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-29723](https://cve.now/CVE-2024-29723.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29724](https://cve.now/CVE-2024-29724.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29725](https://cve.now/CVE-2024-29725.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29726](https://cve.now/CVE-2024-29726.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29727](https://cve.now/CVE-2024-29727.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29728](https://cve.now/CVE-2024-29728.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29729](https://cve.now/CVE-2024-29729.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29730](https://cve.now/CVE-2024-29730.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2024-29731](https://cve.now/CVE-2024-29731.md): Multiple vulnerabilities in SportsNET (CVSS 9.8, SportsNET)
- [CVE-2021-4442](https://cve.now/CVE-2021-4442.md): tcp: add sanity tests to TCP\_QUEUE\_SEQ (no CVSS, Linux)
- [CVE-2024-43986](https://cve.now/CVE-2024-43986.md): WordPress E-cab taxi booking manager plugin \<=1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, MagePeople Team Taxi Booking Manager for WooCommerce)
- [CVE-2024-5624](https://cve.now/CVE-2024-5624.md): Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL (CVSS 5.1, B&R Industrial Automation B&R APROL)
- [CVE-2024-5623](https://cve.now/CVE-2024-5623.md): Untrusted search path vulnerability in B&R APROL (CVSS 5.4, B&R Industrial Automation B&R APROL)
- [CVE-2024-5622](https://cve.now/CVE-2024-5622.md): Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL (CVSS 7.3, B&R Industrial Automation B&R APROL)
- [CVE-2024-38304](https://cve.now/CVE-2024-38304.md): Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. (CVSS 3.8, Dell PowerEdge Platform)
- [CVE-2024-4428](https://cve.now/CVE-2024-4428.md): Sensetive Data Exposure in Menulux Managment Portal (CVSS 6.9, Menulux Information Technologies Managment Portal)
- [CVE-2024-43700](https://cve.now/CVE-2024-43700.md): xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow (CVSS 7.0, Philip Hazel xfpt)
- [CVE-2024-7132](https://cve.now/CVE-2024-7132.md): CoBlocks \< 3.1.13 - Editor+ Stored XSS (CVSS 4.8, Page Builder Gutenberg Blocks)
- [CVE-2024-6927](https://cve.now/CVE-2024-6927.md): Viral Signup \<= 2.1 - Admin+ Stored XSS (CVSS 4.8, Viral Signup)
- [CVE-2024-5417](https://cve.now/CVE-2024-5417.md): Gutentor \< 3.3.6 - Contributor+ Stored XSS (CVSS 5.4, Gutentor)
- [CVE-2024-7607](https://cve.now/CVE-2024-7607.md): Front End Users \<= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection (CVSS 8.8, rustaurius Front End Users)
- [CVE-2024-5987](https://cve.now/CVE-2024-5987.md): WP Accessibility Helper \<= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 5.4, vol4ikman WP Accessibility Helper)
- [CVE-2024-3944](https://cve.now/CVE-2024-3944.md): WP To Do \<= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments (CVSS 4.4, delower186 WP To Do)
- [CVE-2024-7606](https://cve.now/CVE-2024-7606.md): Front End Users \<= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, rustaurius Front End Users)
- [CVE-2024-38303](https://cve.now/CVE-2024-38303.md): Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. (CVSS 5.3, Dell PowerEdge Platform)
- [CVE-2024-7418](https://cve.now/CVE-2024-7418.md): The Post Grid \<= 7.7.11 - Authenticated (Contributor+) Information Disclosure (CVSS 4.3, techlabpro1 The Post Grid – Shortcode, Gutenberg Blocks and…)
- [CVE-2024-7856](https://cve.now/CVE-2024-7856.md): MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar \<= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2022-2440](https://cve.now/CVE-2022-2440.md): Theme Editor \<= 2.8 - Authenticated (Admin+) PHAR Deserialization (CVSS 7.2, mndpsingh287 Theme Editor)
- [CVE-2024-5857](https://cve.now/CVE-2024-5857.md): Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free \<= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion (CVSS 5.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2024-41918](https://cve.now/CVE-2024-41918.md): 'Rakuten Ichiba App' for Android 12.4.0 and earlier and 'Rakuten Ichiba App' for iOS 11.7.0 and earlier are vulnerable to improper authoriza (CVSS 3.1, Rakuten Group 'Rakuten Ichiba App' for Android · Rakuten Gr…)
- [CVE-2024-7857](https://cve.now/CVE-2024-7857.md): Media Library Folders \<= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection (CVSS 6.5, maxfoundry Media Library Folders)
- [CVE-2024-41345](https://cve.now/CVE-2024-41345.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php (CVSS 6.1)
- [CVE-2024-41346](https://cve.now/CVE-2024-41346.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/submit.php (CVSS 6.1)
- [CVE-2024-41347](https://cve.now/CVE-2024-41347.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/settings.php (CVSS 6.1)
- [CVE-2024-41348](https://cve.now/CVE-2024-41348.md): openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/alsearch.php (CVSS 6.1)
- [CVE-2024-41349](https://cve.now/CVE-2024-41349.md): unmark 1.9.2 is vulnerable to Cross Site Scripting (XSS) via application/views/marks/add\_by\_url.php. (CVSS 6.1)
- [CVE-2024-41350](https://cve.now/CVE-2024-41350.md): bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1\_2\_3/php/imageUp.php (CVSS 6.1)
- [CVE-2024-41351](https://cve.now/CVE-2024-41351.md): bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1\_2\_3/php/getContent.php (CVSS 6.1)
- [CVE-2024-41358](https://cve.now/CVE-2024-41358.md): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\\admin\\import-export\\import-load-data.php. (CVSS 6.1)
- [CVE-2024-41361](https://cve.now/CVE-2024-41361.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\manageFilesFolders.php (CVSS 9.8)
- [CVE-2024-41364](https://cve.now/CVE-2024-41364.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\trackEdit.php (CVSS 9.8)
- [CVE-2024-41366](https://cve.now/CVE-2024-41366.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\userScripts.php (CVSS 9.8)
- [CVE-2024-41367](https://cve.now/CVE-2024-41367.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\api\\playlist\\appendFileToPlaylist.p (CVSS 9.8)
- [CVE-2024-41368](https://cve.now/CVE-2024-41368.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\inc.setWlanIpMail.php (CVSS 9.8)
- [CVE-2024-41369](https://cve.now/CVE-2024-41369.md): RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\\inc.setWifi.php (CVSS 9.8)
- [CVE-2024-41370](https://cve.now/CVE-2024-41370.md): Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php. (CVSS 9.8)
- [CVE-2024-41371](https://cve.now/CVE-2024-41371.md): Organizr v1.90 is vulnerable to Cross Site Scripting (XSS) via api.php. (CVSS 6.1)
- [CVE-2024-41372](https://cve.now/CVE-2024-41372.md): Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php. (CVSS 9.8)
- [CVE-2024-44716](https://cve.now/CVE-2024-44716.md): A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-44717](https://cve.now/CVE-2024-44717.md): A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-44776](https://cve.now/CVE-2024-44776.md): An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a craft (CVSS 6.1)
- [CVE-2024-44777](https://cve.now/CVE-2024-44777.md): A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute (CVSS 7.4)
- [CVE-2024-44778](https://cve.now/CVE-2024-44778.md): A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execu (CVSS 7.4)
- [CVE-2024-44779](https://cve.now/CVE-2024-44779.md): A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to exe (CVSS 7.4)
- [CVE-2024-44919](https://cve.now/CVE-2024-44919.md): A cross-site scripting (XSS) vulnerability in the component admin\_ads.php of SeaCMS v12.9 allows attackers to execute arbitrary web scripts (CVSS 5.4)
- [CVE-2024-44930](https://cve.now/CVE-2024-44930.md): Serilog before v2.1.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by (CVSS 6.5, Serilog.Enrichers.ClientInfo)
- [CVE-2024-45435](https://cve.now/CVE-2024-45435.md): Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. (CVSS 9.8)
- [CVE-2024-45436](https://cve.now/CVE-2024-45436.md): extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory. (CVSS 9.1, github.com/ollama/ollama)
- [CVE-2024-45440](https://cve.now/CVE-2024-45440.md): core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash\_salt is file\_get\_co (CVSS 5.3, Drupal core · drupal/drupal +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.