CVEs published in August 2024
2,982 vulnerabilities, 327 critical, 21 exploited.
- owasp defectdojoAn issue in OWASP DefectDojo before v.1.5.3.1 allows a remote attacker to escalate privileges via...8.8 High
- code-projects college management system, college management system project management system +1 morecode-projects College Management System Login Page login.php sql injection6.9 Medium
- angeljudesuarez tailoring management systemitsourcecode Tailoring Management System incedit.php sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System Master.php cross site scripting5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System SystemSettings.php update_settings_info cross site scripting5.3 Medium
- oretnom23 car driving school management systemSourcecodester Car Driving School Management System Master.php save_package sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System Master.php delete_enrollment sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System Master.php delete_package sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System User.php delete_users sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System view_package.php sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System manage_package.php sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System view_details.php sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System manage_user.php sql injection5.3 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System manag_package.php save_package cross-site request forgery6.9 Medium
- oretnom23 car driving school management systemSourceCodester Car Driving School Management System index.php save_users cross-site request forgery6.9 Medium
- freebsdOpenSSH pre-authentication async signal safety issue8.1 High
- remyandrade file manager app, sourcecodester file management app +1 moreSourceCodester File Manager App Add File cross site scripting5.3 Medium
- freebsdNFS client accepts file names containing path separators5.3 Medium
- freebsdktrace(2) fails to detach when executing a setuid binary7.5 High
- freebsdpf incorrectly matches different ICMPv6 states in the state table6.3 Medium
- projectsendprojectsend Password Reset Token functions.php generate_random_string random values6.3 Medium
- projectsendprojectsend process.php get_preview resource injection6.9 Medium
- gila cms, gilacms gila cms +1 moreGila CMS HTTP POST Request page cross site scripting5.3 Medium
- enphase envoy, iq gateway, iq gateway firmware +2 moreUnauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.42259.3 Critical
- enphase envoy, iq gateway firmware +1 moreURL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.42258.7 High
- enphase envoy, iq gateway firmware +1 moreInsecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.42258.6 High
- enphase envoyUpload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x8.6 High
- enphase envoy, iq gateway firmware +1 moreURL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x8.6 High
- enphase envoy, iq gateway firmware +1 moreCommand Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x7.1 High
- tipsandtricks-hq wp estore, unknown wp-cart-for-digital-products, wp easycart shopping cart and ecommerce store +2 moreWP eStore < 8.5.6 - Reflected XSS in Product Editing5.4 Medium
- cyberfoxdigital christmasify!, christmasify\! +1 moreChristmasify! <= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- b&r industrial automation automation runtimeIP Forwarding enabled in B&R Automation Runtime5.3 Medium
- b&r industrial automation automation runtimeDiffie-Hellman groups with insufficient strength used in SSL/TLS stack of B&R Automation Runtime8.3 High
- wpopal opal membershipOpal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- wpopal opal membershipOpal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure4.3 Medium
- wpweb woocommerce - social login, woocommerce social login +1 moreWooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover9.8 Critical
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Agreement Text3.3 Low
- wpfeedback visual website collaboration, atarim – visual feedback, review & ai collaboration +1 moreVisual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update5.4 Medium
- awesomemotive easy digital downloads, smub easy digital downloads – ecommerce payments and subscriptions made easy +1 moreEasy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings4.4 Medium
- openfgaOpenFGA Authorization Bypass7.5 High
s2n-tlscrates.ios2n-tls's mTLS API ordering may skip client authentication6.3 Medium- litestar-org litestarLitestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow8.3 High
- openhab, openhab openhab-webui +1 moreCometVisu Backend for openHAB affected by RCE through path traversal9.8 Critical
- openhab, openhab openhab-webui, webui +2 morePath traversal (CometVisu)5.3 Medium
- openhab openhab-webui, web interface, webui +2 moreCometVisu Backend for openHAB affected by SSRF/XSS10.0 Critical
- openhab, openhab openhab-webui, webui +2 moreCometVisu Backend for openHAB has a sensitive information disclosure vulnerability6.5 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.2 Medium
- amd 1st gen amd epyc™ processors, 1st gen amd epyc processors, 2nd gen amd epyc™ processors +65 more +67 moreImproper validation in a model specific register (MSR) could allow a malicious program with ring0...7.5 High
- aio-libs aiohttpIn aiohttp, compressed files as symlinks are not protected from path traversal4.8 Medium
- ibm aspera sharesIBM Aspera Shares session fixation6.3 Medium
- Show moreLoading…