# CVEs published 2024-08-30

62 CVEs were published on August 30, 2024: 4 critical, 14 high. Days are UTC.

- [CVE-2024-8006](https://cve.now/CVE-2024-8006.md): NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support (CVSS 4.4, The Tcpdump Group libpcap)
- [CVE-2024-45304](https://cve.now/CVE-2024-45304.md): OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts (CVSS 5.3, OpenZeppelin cairo-contracts)
- [CVE-2023-7256](https://cve.now/CVE-2023-7256.md): Double-free in libpcap before 1.10.5 with remote packet capture support. (CVSS 4.4, The Tcpdump Group libpcap)
- [CVE-2024-6586](https://cve.now/CVE-2024-6586.md): Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. (CVSS 7.3, Lightdash)
- [CVE-2024-6585](https://cve.now/CVE-2024-6585.md): Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash vers (CVSS 5.4, Lightdash)
- [CVE-2024-8348](https://cve.now/CVE-2024-8348.md): SourceCodester Computer Laboratory Management System Master.php delete\_category sql injection (CVSS 5.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-8347](https://cve.now/CVE-2024-8347.md): SourceCodester Computer Laboratory Management System Master.php delete\_record sql injection (CVSS 5.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-8285](https://cve.now/CVE-2024-8285.md): Kroxylicious: missing upstream kafka tls hostname verification (CVSS 5.9, kroxylicious · Red Hat Streams for Apache Kafka +1)
- [CVE-2024-8346](https://cve.now/CVE-2024-8346.md): SourceCodester Computer Laboratory Management System SystemSettings.php update\_settings\_info sql injection (CVSS 5.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-38868](https://cve.now/CVE-2024-38868.md): Incorrect Authorization (CVSS 7.6, ManageEngine Endpoint Central)
- [CVE-2024-21658](https://cve.now/CVE-2024-21658.md): Insufficient control of region value length in discourse-calendar (CVSS 4.3, discourse-calendar)
- [CVE-2024-6204](https://cve.now/CVE-2024-6204.md): SQL injection (CVSS 8.3, ManageEngine Exchange Reporter Plus)
- [CVE-2024-8345](https://cve.now/CVE-2024-8345.md): SourceCodester Music Gallery Site Users.php sql injection (CVSS 5.3, SourceCodester Music Gallery Site)
- [CVE-2024-45047](https://cve.now/CVE-2024-45047.md): Potential mXSS vulnerability due to improper HTML escaping in svelte (CVSS 5.4, sveltejs svelte · svelte)
- [CVE-2024-8344](https://cve.now/CVE-2024-8344.md): Campcodes Supplier Management System edit\_area.php sql injection (CVSS 5.3, Campcodes Supplier Management System)
- [CVE-2024-8235](https://cve.now/CVE-2024-8235.md): Libvirt: crash of virtinterfaced via virconnectlistinterfaces() (CVSS 6.2, libvirt · Red Hat Enterprise Linux)
- [CVE-2024-8343](https://cve.now/CVE-2024-8343.md): SourceCodester Sentiment Based Movie Rating System User Registration Users.php sql injection (CVSS 6.9, SourceCodester Sentiment Based Movie Rating System)
- [CVE-2024-8342](https://cve.now/CVE-2024-8342.md): SourceCodester Petshop Management System add\_client.php unrestricted upload (CVSS 5.3, SourceCodester Petshop Management System)
- [CVE-2024-8341](https://cve.now/CVE-2024-8341.md): SourceCodester Petshop Management System add\_user.php unrestricted upload (CVSS 5.3, SourceCodester Petshop Management System)
- [CVE-2024-8340](https://cve.now/CVE-2024-8340.md): SourceCodester Electric Billing Management System Actions.php sql injection (CVSS 6.9, SourceCodester Electric Billing Management System)
- [CVE-2024-8339](https://cve.now/CVE-2024-8339.md): SourceCodester Electric Billing Management System Connection Code ?page=tracks sql injection (CVSS 5.3, SourceCodester Electric Billing Management System)
- [CVE-2024-8338](https://cve.now/CVE-2024-8338.md): HFO4 shudong-share File Extension fileReceive.php unrestricted upload (CVSS 5.3, HFO4 shudong-share)
- [CVE-2024-8337](https://cve.now/CVE-2024-8337.md): SourceCodester Contact Manager with Export to VCF index.html cross site scripting (CVSS 5.3, SourceCodester Contact Manager with Export to VCF)
- [CVE-2024-8336](https://cve.now/CVE-2024-8336.md): SourceCodester Music Gallery Site Master.php sql injection (CVSS 5.3, SourceCodester Music Gallery Site)
- [CVE-2024-8335](https://cve.now/CVE-2024-8335.md): OpenRapid RapidCMS runlogon.php sql injection (CVSS 5.3, OpenRapid RapidCMS)
- [CVE-2024-8334](https://cve.now/CVE-2024-8334.md): master-nan Sweet-CMS log.go LogHandler neutralization for logs (CVSS 5.3, master-nan Sweet-CMS)
- [CVE-2024-8260](https://cve.now/CVE-2024-8260.md): OPA SMB Force-Authentication (CVSS 6.1, Styra OPA · github.com/open-policy-agent/opa)
- [CVE-2024-8332](https://cve.now/CVE-2024-8332.md): master-nan Sweet-CMS index sql injection (CVSS 5.3, master-nan Sweet-CMS)
- [CVE-2024-8331](https://cve.now/CVE-2024-8331.md): OpenRapid RapidCMS user-move-run.php sql injection (CVSS 5.3, OpenRapid RapidCMS)
- [CVE-2022-48944](https://cve.now/CVE-2022-48944.md): sched: Fix yet more sched\_fork() races (no CVSS, Linux)
- [CVE-2024-7858](https://cve.now/CVE-2024-7858.md): Media Library Folders \<= 8.2.3 - Missing Authorization on Various Functions (CVSS 6.3, maxfoundry Media Library Folders)
- [CVE-2024-8252](https://cve.now/CVE-2024-8252.md): Clean Login \<= 1.14.5 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, hornero Clean Login)
- [CVE-2024-8274](https://cve.now/CVE-2024-8274.md): WP Booking Calendar \<= 10.5 - Reflected Cross-Site Scripting (CVSS 6.1, wpdevelop Booking Calendar)
- [CVE-2024-7122](https://cve.now/CVE-2024-7122.md): Elementor Addon Elements \<= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-44944](https://cve.now/CVE-2024-44944.md): netfilter: ctnetlink: use helper function to calculate expect ID (no CVSS, Linux)
- [CVE-2024-8319](https://cve.now/CVE-2024-8319.md): Tourfic \<= 2.11.20 - Cross-Site Request Forgery in Multiple Functions (CVSS 4.3, themefic Tourfic – Travel Booking, Hotel Booking & Car Rent…)
- [CVE-2024-8016](https://cve.now/CVE-2024-8016.md): The Events Calendar Pro \<= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution (CVSS 9.1, theeventscalendar The Events Calendar Pro)
- [CVE-2024-39300](https://cve.now/CVE-2024-39300.md): Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. (CVSS 8.1, ELECOM CO. WAB-I1750-PS)
- [CVE-2024-34577](https://cve.now/CVE-2024-34577.md): Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing (CVSS 4.6, ELECOM CO. WRC-X3000GS2-B · ELECOM CO. WRC-X3000GS2-W +2)
- [CVE-2024-42412](https://cve.now/CVE-2024-42412.md): Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. (CVSS 6.1, ELECOM CO. WAB-I1750-PS · ELECOM CO. WAB-M1775-PS +3)
- [CVE-2024-3673](https://cve.now/CVE-2024-3673.md): Web Directory Free \< 1.7.3 - Unauthenticated LFI (CVSS 9.1, Web Directory Free)
- [CVE-2024-5879](https://cve.now/CVE-2024-5879.md): HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics \<= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget (CVSS 6.4, hubspotdev HubSpot All-In-One Marketing – Forms, Popups, Li…)
- [CVE-2024-2694](https://cve.now/CVE-2024-2694.md): Betheme \<= 27.5.6 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, MuffinGroup Betheme)
- [CVE-2024-3998](https://cve.now/CVE-2024-3998.md): Betheme | Responsive Multipurpose WordPress & WooCommerce Theme \<= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, MuffinGroup Betheme)
- [CVE-2024-4401](https://cve.now/CVE-2024-4401.md): Elementor Addon Elements \<= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae\_slider\_animation Parameters (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-5784](https://cve.now/CVE-2024-5784.md): Tutor LMS Pro \<= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 7.1, themeum Tutor LMS Pro)
- [CVE-2024-5024](https://cve.now/CVE-2024-5024.md): MemberPress \<= 1.11.29 - Reflected Cross-Site Scripting via mepr\_screenname and mepr\_key Parameters (CVSS 6.1, Memberpress)
- [CVE-2024-5061](https://cve.now/CVE-2024-5061.md): Enfold \<= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper\_class and class Parameters (CVSS 6.4, Kriesi Enfold - Responsive Multi-Purpose Theme)
- [CVE-2024-8330](https://cve.now/CVE-2024-8330.md): Gether Technology 6SHR System - Unrestricted File Upload (CVSS 8.8, Gether Technology 6SHR System)
- [CVE-2024-8329](https://cve.now/CVE-2024-8329.md): Gether Technology 6SHR System - SQL Injection (CVSS 8.8, Gether Technology 6SHR System)
- [CVE-2024-8328](https://cve.now/CVE-2024-8328.md): HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - Reflected XSS (CVSS 5.4, HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and T…)
- [CVE-2024-8327](https://cve.now/CVE-2024-8327.md): HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - SQL injection (CVSS 8.8, HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and T…)
- [CVE-2024-8234](https://cve.now/CVE-2024-8234.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* A command injection vulnerability in the functions formSysCmd(), formUpgradeCert(), and formDelcert() in the (CVSS 7.5, Zyxel NWA1100-N firmware)
- [CVE-2024-44682](https://cve.now/CVE-2024-44682.md): ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters. (CVSS 6.1)
- [CVE-2024-44683](https://cve.now/CVE-2024-44683.md): Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php. (CVSS 6.1)
- [CVE-2024-44684](https://cve.now/CVE-2024-44684.md): TpMeCMS 1.3.3.2 is vulnerable to Cross Site Scripting (XSS) in /h.php/page?ref=addtabs via the "Title," "Images," and "Content" fields. (CVSS 6.1)
- [CVE-2024-44916](https://cve.now/CVE-2024-44916.md): Vulnerability in admin\_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are written to the data/admin (CVSS 7.2)
- [CVE-2024-44918](https://cve.now/CVE-2024-44918.md): A cross-site scripting (XSS) vulnerability in the component admin\_datarelate.php of SeaCMS v12.9 allows attackers to execute arbitrary web s (CVSS 3.5)
- [CVE-2024-45488](https://cve.now/CVE-2024-45488.md): One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. (CVSS 9.8)
- [CVE-2024-45490](https://cve.now/CVE-2024-45490.md): An issue was discovered in libexpat before 2.6.3. (CVSS 9.8)
- [CVE-2024-45491](https://cve.now/CVE-2024-45491.md): An issue was discovered in libexpat before 2.6.3. (CVSS 7.3)
- [CVE-2024-45492](https://cve.now/CVE-2024-45492.md): An issue was discovered in libexpat before 2.6.3. (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.