CVEs published in August 2024
2,982 vulnerabilities, 327 critical, 21 exploited.
- lang-learn-guy learning with textsLearning with Texts (LWT) 2.0.3 is vulnerable to Cross Site Scripting (XSS). The application has...6.1 Medium
- squirrellysquirrelly Code Injection vulnerability9.8 Critical
- salesforce docusign api package for salesforceAn issue was discovered in the Docusign API package 8.142.14 for Salesforce. The...8.1 High
- apache tomcat, netapp ontap tools +1 moreApache Tomcat: Denial of Service8.6 High
- kemptechnologies loadmasterBuffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a...7.5 High
- linux, linux kernel +1 moreriscv/purgatory: align riscv_kernel_entry5.5 Medium
- linux, linux kernel +1 moredrm/nouveau: prime: fix refcount underflow5.5 Medium
- linux, linux kernel +1 morenet/mlx5: Always drain health in shutdown callback4.7 Medium
- linux, linux kernel +1 mores390/fpu: Re-add exception handling in load_fpu_state()5.5 Medium
- linux, linux kernel +1 morenet/mlx5e: Fix CT entry update leaks of modify header context9.8 Critical
- linux, linux kernel +1 moredrm/vmwgfx: Fix a deadlock in dma buf fence polling5.5 Medium
- linux, linux kernel +1 morenet: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex5.5 Medium
- bladex springbladechillzhuang SpringBlade list sql injection5.3 Medium
- genexis tilgin home gatewayGenexis Tilgin Home Gateway cross site scripting5.3 Medium
- apache helix, apache software foundation helix front (ui), helix front\/ui\/ +2 moreApache Helix Front (UI): Helix front hard-coded secret in the express-session7.5 High
- linux, linux kernel +1 morenet: usb: qmi_wwan: fix memory leak for not ip packets5.5 Medium
- kanisterio kanisterKanister has a potential risk which can be leveraged to make a cluster-level privilege escalation8.8 High
- apache hertzbeatGHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import8.8 High
- apache hertzbeatGHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}7.5 High
- zendesk samsonGHSL-2023-136_Samson8.8 High
- casbin casdoorGHSL-2024-036: Reflected XSS in QrCodePage.js6.1 Medium
- casbin casdoorGHSL-2024-035: Casdoor CORS misconfiguration8.1 High
- khojKhoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)5.4 Medium
- usememos memosGHSL-2024-034: memos CORS Misconfiguration in server.go8.1 High
- ibm global configuration managementIBM Global Configuration Management incorrect ownership assignment6.5 Medium
- github enterprise serverAn XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when...9.5 Critical
- github enterprise serverIncorrect Authorization allows read access to issues in GitHub Enterprise Server5.9 Medium
- github enterprise serverAn Incorrect Authorization vulnerability was identified in GitHub Enterprise Server, allowing an...5.3 Medium
- microsoft azure managed instance for apache cassandraAzure Managed Instance for Apache Cassandra Elevation of Privilege Vulnerability9.6 Critical
- grafana, grafana enterprise +1 moreGrafana plugin data sources vulnerable to access control bypass4.4 Medium
- blackberry cylanceoptics, cylanceoptics for windows +1 moreVulnerability in CylanceOPTICS Windows Installer Package Impacts CylanceOPTICS for Windows7.1 High
- discourse discourse-placeholder-theme-componentDiscourse Placeholder Forms has a XSS stopped by CSP6.3 Medium
- joomial project cms, joomla joomla\! +1 more[20240802] - Core - Cache Poisoning in Pagination9.1 Critical
- joomla joomla\!, joomla! project cms +1 more[20240803] - Core - XSS in HTML Mail Templates6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240801] - Core - Inadequate validation of internal URLs6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240805] - Core - XSS vectors in Outputfilter::strip* methods6.1 Medium
- joomla joomla\!, joomla! project cms +1 more[20240804] - Core - Improper ACL for backend profile view7.5 High
- ghostGhost's improper authentication allows access to member information and actions6.5 Medium
- lf-edge ekuiperLF Edge eKuiper has a SQL Injection in sqlKvStore8.8 High
- megacord megabotRemote Code Execution Vulnerability in MEGABOT9.8 Critical
- apolloconfig apolloPotential unauthorized access issue in apollo-portal4.3 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Improper Access Control vulnerability5.4 Medium
- umbraco cms, umbraco-cms +1 moreUmbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information4.3 Medium
- matrix-org matrix-js-sdk, matrix javascript sdk +1 moreA room with itself as a its predecessor will freeze matrix-js-sdk4.1 Medium
- clastix capsuleCapsule tenant owner with "patch namespace" permission can hijack system namespaces8.5 High
- demozx gf cmsdemozx gf_cms JWT Authentication auth.go init hard-coded credentials6.9 Medium
- 3ds 3dexperience, dassault systèmes 3dswymer, dassault 3dswymer 3dexperience 2022 +2 more +4 moreURL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x8.1 High
- 3ds 3dexperience, dassault systèmes enovia collaborative industry innovator, enovia collaborative industry innovator +2 moreReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x8.7 High
- 3ds 3dexperience, dassault systèmes 3dswymer, dassault 3dswymer 3dexperience 2022 +2 more +4 moreReflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x7.7 High
- go-tribe gotribe-adminGo-Tribe gotribe-admin Log routes.go InitRoutes deserialization5.1 Medium
- Show moreLoading…