CVEs published August 30, 2024
62 CVEs were published on August 30, 2024: 4 critical, 14 high.
- Published
- 62
- Critical
- 4
- High
- 14
- Medium
- 41
- Low
- 1
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- SourceCodester Computer Laboratory Management System
- 3
- Gether Technology 6SHR System
- 2
- HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and T…
- 2
- Lightdash
- 2
- Linux
- 2
- master-nan Sweet-CMS
- 2
- MuffinGroup Betheme
- 2
- OpenRapid RapidCMS
- 2
- SourceCodester Electric Billing Management System
- 2
- SourceCodester Music Gallery Site
- 2
Critical 4
- CVE-2024-8016The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Executiontheeventscalendar The Events Calendar Pro
- CVE-2024-3673Web Directory Free < 1.7.3 - Unauthenticated LFIWeb Directory Free
- CVE-2024-45488One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies.
- CVE-2024-45490An issue was discovered in libexpat before 2.6.3.
High 14
- CVE-2024-6586Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards.Lightdash
- CVE-2024-38868Incorrect AuthorizationManageEngine Endpoint Central
- CVE-2024-6204SQL injectionManageEngine Exchange Reporter Plus
- CVE-2024-8252Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusionhornero Clean Login
- CVE-2024-39300Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier.ELECOM CO. WAB-I1750-PS
- CVE-2024-2694Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object InjectionMuffinGroup Betheme
- CVE-2024-5784Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Referencethemeum Tutor LMS Pro
- CVE-2024-8330Gether Technology 6SHR System - Unrestricted File UploadGether Technology 6SHR System
- CVE-2024-8329Gether Technology 6SHR System - SQL InjectionGether Technology 6SHR System
- CVE-2024-8327HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - SQL injectionHWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and T…
- CVE-2024-8234** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in theZyxel NWA1100-N firmware
- CVE-2024-44916Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin
- CVE-2024-45491An issue was discovered in libexpat before 2.6.3.
- CVE-2024-45492An issue was discovered in libexpat before 2.6.3.
Medium, low and unrated 44
- CVE-2024-8006NULL pointer dereference in libpcap before 1.10.5 with remote packet capture supportThe Tcpdump Group libpcap
- CVE-2024-45304OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contractsOpenZeppelin cairo-contracts
- CVE-2023-7256Double-free in libpcap before 1.10.5 with remote packet capture support.The Tcpdump Group libpcap
- CVE-2024-6585Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash versLightdash
- CVE-2024-8348SourceCodester Computer Laboratory Management System Master.php delete_category sql injectionSourceCodester Computer Laboratory Management System
- CVE-2024-8347SourceCodester Computer Laboratory Management System Master.php delete_record sql injectionSourceCodester Computer Laboratory Management System
- CVE-2024-8285Kroxylicious: missing upstream kafka tls hostname verificationkroxylicious · Red Hat Streams for Apache Kafka +1
- CVE-2024-8346SourceCodester Computer Laboratory Management System SystemSettings.php update_settings_info sql injectionSourceCodester Computer Laboratory Management System
- CVE-2024-21658Insufficient control of region value length in discourse-calendardiscourse-calendar
- CVE-2024-8345SourceCodester Music Gallery Site Users.php sql injectionSourceCodester Music Gallery Site
- CVE-2024-45047Potential mXSS vulnerability due to improper HTML escaping in sveltesveltejs svelte · svelte
- CVE-2024-8344Campcodes Supplier Management System edit_area.php sql injectionCampcodes Supplier Management System
- CVE-2024-8235Libvirt: crash of virtinterfaced via virconnectlistinterfaces()libvirt · Red Hat Enterprise Linux
- CVE-2024-8343SourceCodester Sentiment Based Movie Rating System User Registration Users.php sql injectionSourceCodester Sentiment Based Movie Rating System
- CVE-2024-8342SourceCodester Petshop Management System add_client.php unrestricted uploadSourceCodester Petshop Management System
- CVE-2024-8341SourceCodester Petshop Management System add_user.php unrestricted uploadSourceCodester Petshop Management System
- CVE-2024-8340SourceCodester Electric Billing Management System Actions.php sql injectionSourceCodester Electric Billing Management System
- CVE-2024-8339SourceCodester Electric Billing Management System Connection Code ?page=tracks sql injectionSourceCodester Electric Billing Management System
- CVE-2024-8338HFO4 shudong-share File Extension fileReceive.php unrestricted uploadHFO4 shudong-share
- CVE-2024-8337SourceCodester Contact Manager with Export to VCF index.html cross site scriptingSourceCodester Contact Manager with Export to VCF
- CVE-2024-8336SourceCodester Music Gallery Site Master.php sql injectionSourceCodester Music Gallery Site
- CVE-2024-8335OpenRapid RapidCMS runlogon.php sql injectionOpenRapid RapidCMS
- CVE-2024-8334master-nan Sweet-CMS log.go LogHandler neutralization for logsmaster-nan Sweet-CMS
- CVE-2024-8260OPA SMB Force-AuthenticationStyra OPA · github.com/open-policy-agent/opa
- CVE-2024-8332master-nan Sweet-CMS index sql injectionmaster-nan Sweet-CMS
- CVE-2024-8331OpenRapid RapidCMS user-move-run.php sql injectionOpenRapid RapidCMS
- CVE-2022-48944sched: Fix yet more sched_fork() racesLinux
- CVE-2024-7858Media Library Folders <= 8.2.3 - Missing Authorization on Various Functionsmaxfoundry Media Library Folders
- CVE-2024-8274WP Booking Calendar <= 10.5 - Reflected Cross-Site Scriptingwpdevelop Booking Calendar
- CVE-2024-7122Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetswpvibes Addon Elements for Elementor
- CVE-2024-44944netfilter: ctnetlink: use helper function to calculate expect IDLinux
- CVE-2024-8319Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functionsthemefic Tourfic – Travel Booking, Hotel Booking & Car Rent…
- CVE-2024-34577Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing ELECOM CO. WRC-X3000GS2-B · ELECOM CO. WRC-X3000GS2-W +2
- CVE-2024-42412Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi.ELECOM CO. WAB-I1750-PS · ELECOM CO. WAB-M1775-PS +3
- CVE-2024-5879HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widgethubspotdev HubSpot All-In-One Marketing – Forms, Popups, Li…
- CVE-2024-3998Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeMuffinGroup Betheme
- CVE-2024-4401Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameterswpvibes Addon Elements for Elementor
- CVE-2024-5024MemberPress <= 1.11.29 - Reflected Cross-Site Scripting via mepr_screenname and mepr_key ParametersMemberpress
- CVE-2024-5061Enfold <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class ParametersKriesi Enfold - Responsive Multi-Purpose Theme
- CVE-2024-8328HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - Reflected XSSHWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and T…
- CVE-2024-44682ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters.
- CVE-2024-44683Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php.
- CVE-2024-44684TpMeCMS 1.3.3.2 is vulnerable to Cross Site Scripting (XSS) in /h.php/page?ref=addtabs via the "Title," "Images," and "Content" fields.
- CVE-2024-44918A cross-site scripting (XSS) vulnerability in the component admin_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web s