Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2024

167 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2024-7339
    37Monitor

    TVT DVR TD-2104TS-CL queryDevInfo information disclosure

    MediumCVSS 6.9Proof of conceptEPSS 32%

    provision-isr · sh-4050a5-5l\(mm\) firmwareAug 1, 2024

  • CVE-2024-6529
    28Monitor

    Ultimate Classified Listings < 1.4 - Reflected XSS

    HighCVSS 7.1Proof of conceptEPSS 0%

    webcodingplace · ultimate classified listingsAug 1, 2024

  • CVE-2024-6242
    32Monitor

    Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices

    HighCVSS 7.3No exploitEPSS 11%

    rockwell automation · controllogix® 5580 (1756-l8z)Aug 1, 2024

  • CVE-2024-39646
    24Monitor

    WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 0%

    kunalnagar · custom 404 proAug 1, 2024

  • CVE-2024-42461
    36Monitor

    In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    elliptic project · ellipticAug 2, 2024

  • CVE-2024-38878
    30Monitor

    A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivi

    MediumCVSS 6.9No exploitEPSS 11%

    siemens · omnivise t3000 application serverAug 2, 2024

  • CVE-2024-41127
    38Monitor

    Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    monkeytype · monkeytypeAug 2, 2024

  • CVE-2024-7029
    46Plan

    Command Injection in AVTech AVM1203 (IP Camera)

    HighCVSS 8.7Proof of conceptEPSS 38%

    avtech · avm1203 firmwareAug 2, 2024

  • CVE-2024-7314
    55Plan

    anji-plus AJ-Report Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    anji-plus · reportAug 2, 2024

  • CVE-2024-33896
    29Monitor

    Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper paramet

    HighCVSS 7.2Proof of conceptEPSS 4%

    hms-networks · ewon cosy\+ firmwareAug 2, 2024

  • CVE-2024-7463
    37Monitor

    TOTOLINK CP900 cstecgi.cgi UploadCustomModule buffer overflow

    HighCVSS 8.7No exploitEPSS 10%

    totolink · cp900 firmwareAug 4, 2024

  • CVE-2024-7464
    27Monitor

    TOTOLINK CP900 Telnet Service setTelnetCfg command injection

    MediumCVSS 5.3No exploitEPSS 19%

    totolink · cp900 firmwareAug 4, 2024

  • CVE-2024-7467
    28Monitor

    Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injection

    MediumCVSS 5.3No exploitEPSS 23%

    raisecom · msg2300 firmwareAug 4, 2024

  • CVE-2024-7468
    28Monitor

    Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injection

    MediumCVSS 5.3No exploitEPSS 24%

    raisecom · msg2300 firmwareAug 4, 2024

  • CVE-2024-7469
    28Monitor

    Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injection

    MediumCVSS 5.3No exploitEPSS 24%

    raisecom · msg2300 firmwareAug 5, 2024

  • CVE-2024-7470
    28Monitor

    Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface vpn_template_style.php sslvpn_config_mod os command injection

    MediumCVSS 5.3No exploitEPSS 24%

    raisecom · msg2300 firmwareAug 5, 2024

  • CVE-2024-39713
    35Monitor

    A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

    HighCVSS 8.6Proof of conceptEPSS 3%

    rocket.chat · rocket.chatAug 5, 2024

  • CVE-2024-38856
    99Now

    Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · ofbizAug 5, 2024

  • CVE-2023-31355
    24Monitor

    Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC seed potentially allo

    MediumCVSS 6.0Proof of conceptEPSS 0%

    amd · epyc 7203 firmwareAug 5, 2024

  • CVE-2024-21978
    31Monitor

    Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially leading to data leakag

    HighCVSS 7.9Proof of conceptEPSS 0%

    amd · epyc 7203 firmwareAug 5, 2024

  • CVE-2024-21980
    31Monitor

    Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a guest's memory or UMC

    HighCVSS 7.9Proof of conceptEPSS 0%

    amd · epyc 7203 firmwareAug 5, 2024

  • CVE-2024-40498
    39Monitor

    SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbitrary code via the re

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Aug 5, 2024

  • CVE-2024-42008
    47Plan

    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote att

    CriticalCVSS 9.3Proof of conceptEPSS 34%

    roundcube · webmailAug 5, 2024

  • CVE-2024-42009
    92Now

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of

    CriticalCVSS 9.3KEVWeaponizedEPSS 82%

    roundcube · webmailAug 5, 2024

  • CVE-2024-42010
    50Plan

    mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in ren

    HighCVSS 7.5No exploitEPSS 66%

    Aug 5, 2024

  • CVE-2024-41958
    28Monitor

    Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

    HighCVSS 7.2Proof of conceptEPSS 1%

    mailcow · mailcow\Aug 5, 2024

  • CVE-2024-6781
    49Plan

    Calibre Arbitrary File Read

    HighCVSS 7.5Proof of conceptEPSS 62%

    calibre-ebook · calibreAug 6, 2024

  • CVE-2024-6782
    64This week

    Calibre Remote Code Execution

    CriticalCVSS 9.8WeaponizedEPSS 84%

    calibre · calibreAug 6, 2024

  • CVE-2024-6886
    50Plan

    Inproper Sanitation of field leading to stored XSS

    CriticalCVSS 10.0Proof of conceptEPSS 32%

    gitea · gitea open source git serverAug 6, 2024

  • CVE-2024-7008
    32Monitor

    Calibre Reflected Cross-Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 25%

    calibre-ebook · calibreAug 6, 2024

  • CVE-2024-7009
    32Monitor

    Calibre SQL Injection

    HighCVSS 7.1No exploitEPSS 13%

    calibre-ebook · calibreAug 6, 2024

  • CVE-2024-6651
    29Monitor

    WordPress File Upload < 4.24.8 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 15%

    iptanus · wordpress file uploadAug 6, 2024

  • CVE-2024-36424
    22Monitor

    K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of a NULL pointer deref

    MediumCVSS 5.5Proof of conceptEPSS 0%

    k7computing · k7 ultimate securityAug 6, 2024

  • CVE-2024-39225
    43Plan

    GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,

    CriticalCVSS 9.8No exploitEPSS 14%

    gl-inet · mt6000 firmwareAug 6, 2024

  • CVE-2024-39226
    45Plan

    GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16,

    CriticalCVSS 9.8No exploitEPSS 20%

    gl-inet · mt6000 firmwareAug 6, 2024

  • CVE-2024-28739
    34Monitor

    An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.

    HighCVSS 7.2No exploitEPSS 18%

    koha · kohaAug 6, 2024

  • CVE-2024-38206
    30Monitor

    Microsoft Copilot Studio Information Disclosure Vulnerability

    MediumCVSS 6.5No exploitEPSS 12%

    microsoft · copilot studioAug 6, 2024

  • CVE-2024-43044
    44Plan

    Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by

    HighCVSS 8.8Proof of conceptEPSS 28%

    jenkins · jenkinsAug 7, 2024

  • CVE-2024-7061
    31Monitor

    Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking.

    HighCVSS 7.8No exploitEPSS 0%

    okta · verifyAug 7, 2024

  • CVE-2024-6892
    24Monitor

    Journyx Reflected Cross Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 0%

    journyx · journyxAug 7, 2024

  • CVE-2024-6893
    40Plan

    Journyx Unauthenticated XML External Entities Injection

    HighCVSS 7.5Proof of conceptEPSS 32%

    journyx · journyxAug 7, 2024

  • CVE-2024-7150
    35Monitor

    Slider by 10Web – Responsive Image Slider <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter

    HighCVSS 8.8No exploitEPSS 0%

    10web · sliderAug 8, 2024

  • CVE-2024-42365
    40Plan

    Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

    HighCVSS 8.8WeaponizedEPSS 4%

    asterisk · asteriskAug 8, 2024

  • CVE-2024-30188
    34Monitor

    Apache DolphinScheduler: Resource File Read And Write Vulnerability

    HighCVSS 8.1Proof of conceptEPSS 5%

    apache · dolphinschedulerAug 12, 2024

  • CVE-2024-38200
    32Monitor

    Microsoft Office Spoofing Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 20%

    microsoft · 365 appsAug 12, 2024

  • CVE-2024-41570
    40Plan

    An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network t

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    havocframework · havocAug 12, 2024

  • CVE-2024-42370
    33Monitor

    Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow

    HighCVSS 8.3Proof of conceptEPSS 0%

    litestar-org · litestarAug 12, 2024

  • CVE-2024-7694
    59Plan

    TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload

    HighCVSS 7.2KEVWeaponizedEPSS 1%

    teamt5 · threatsonar anti-ransomwareAug 12, 2024

  • CVE-2024-27442
    31Monitor

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

    HighCVSS 7.8No exploitEPSS 0%

    zimbra · collaborationAug 12, 2024

  • CVE-2024-27443
    61This week

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0.

    MediumCVSS 6.1KEVWeaponizedEPSS 24%

    zimbra · collaborationAug 12, 2024

  • CVE-2024-36877
    32Monitor

    Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7

    HighCVSS 8.2Proof of conceptEPSS 0%

    Aug 12, 2024

  • CVE-2024-41651
    32Monitor

    An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.

    HighCVSS 8.1Proof of conceptEPSS 1%

    prestashop · prestashopAug 12, 2024

  • CVE-2024-7399
    97Now

    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attack

    CriticalCVSS 9.8KEVWeaponizedEPSS 91%

    samsung · magicinfo 9 serverAug 12, 2024

  • CVE-2024-40892
    28Monitor

    Firewalla BTLE Weak Credentials

    HighCVSS 7.1Proof of conceptEPSS 0%

    firewalla · box softwareAug 12, 2024

  • CVE-2024-41710
    70This week

    A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (

    HighCVSS 7.2KEVWeaponizedEPSS 41%

    mitel · 6970 firmwareAug 12, 2024

  • CVE-2024-6768
    28Monitor

    Denial of Service in CLFS.sys

    MediumCVSS 6.8Proof of conceptEPSS 2%

    microsoft · windows 10Aug 12, 2024

  • CVE-2024-43360
    41Plan

    ZoneMinder Time-based SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    zoneminder · zoneminderAug 12, 2024

  • CVE-2024-7094
    50Plan

    JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 37%

    rabilal · js help desk – ai-powered support & ticketing systemAug 12, 2024

  • CVE-2024-41730
    62This week

    Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

    CriticalCVSS 9.8No exploitEPSS 75%

    sap · business objects business intelligence platformAug 13, 2024

  • CVE-2024-7715
    29Monitor

    D-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injection

    MediumCVSS 5.3No exploitEPSS 26%

    d-link · dns-120Aug 13, 2024

  • CVE-2024-43160
    41Plan

    WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 4%

    berqwp · berqwpAug 13, 2024

  • CVE-2024-38063
    60This week

    Windows TCP/IP Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 70%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38106
    60This week

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 6%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38107
    61This week

    Windows Power Dependency Coordinator Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38127
    31Monitor

    Windows Hyper-V Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38143
    17Monitor

    Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability

    MediumCVSS 4.2Proof of conceptEPSS 1%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38144
    45Plan

    Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 32%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38148
    40Plan

    Windows Secure Channel Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 31%

    microsoft · windows 11 21h2Aug 13, 2024

  • CVE-2024-38178
    72This week

    Scripting Engine Memory Corruption Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 41%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38189
    67This week

    Microsoft Project Remote Code Execution Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 8%

    microsoft · 365 appsAug 13, 2024

  • CVE-2024-38193
    70This week

    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 28%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-38197
    31Monitor

    Microsoft Teams for iOS Spoofing Vulnerability

    MediumCVSS 6.5No exploitEPSS 16%

    microsoft · teamsAug 13, 2024

  • CVE-2024-38213
    60This week

    Windows Mark of the Web Security Feature Bypass Vulnerability

    MediumCVSS 6.5KEVWeaponizedEPSS 13%

    microsoft · windows 10 1507Aug 13, 2024

  • CVE-2024-7593
    99Now

    Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated a

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    ivanti · virtual traffic managerAug 13, 2024

  • CVE-2024-28986
    94Now

    SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    solarwinds · web help deskAug 13, 2024

  • CVE-2024-37399
    38Monitor

    A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, re

    HighCVSS 7.5No exploitEPSS 27%

    ivanti · avalancheAug 13, 2024

  • CVE-2024-38653
    58Plan

    XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

    HighCVSS 7.5Proof of conceptEPSS 91%

    ivanti · avalancheAug 13, 2024

  • CVE-2024-7808
    27Monitor

    code-projects Job Portal logindbc.php sql injection

    MediumCVSS 6.9Proof of conceptEPSS 1%

    fabian · job portalAug 14, 2024

  • CVE-2024-7815
    20Monitor

    CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting

    MediumCVSS 5.1Proof of conceptEPSS 1%

    online railway reservation system project · online railway reservation systemAug 15, 2024

  • CVE-2024-7828
    39Monitor

    D-Link DNS-1550-04 photocenter_mgr.cgi cgi_set_cover buffer overflow

    HighCVSS 8.7No exploitEPSS 16%

    dlink · dns-120 firmwareAug 15, 2024

  • CVE-2024-7262
    68This week

    Arbitrary Code Execution in WPS Office

    CriticalCVSS 9.3KEVWeaponizedEPSS 2%

    kingsoft · wps officeAug 15, 2024

  • CVE-2024-42948
    33Monitor

    Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function.

    HighCVSS 7.5No exploitEPSS 10%

    tenda · fh1201 firmwareAug 15, 2024

  • CVE-2024-32231
    25Monitor

    Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.

    MediumCVSS 6.3Proof of conceptEPSS 1%

    stashapp · stashAug 15, 2024

  • CVE-2024-34739
    31Monitor

    In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the c

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidAug 15, 2024

  • CVE-2024-34740
    31Monitor

    In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer ove

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidAug 15, 2024

  • CVE-2024-34741
    31Monitor

    In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be visible on the screensa

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidAug 15, 2024

  • CVE-2024-6460
    40Plan

    Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    tradedoubler · growAug 16, 2024

  • CVE-2024-42758
    21Monitor

    A Cross-site Scripting (XSS) vulnerability exists in version v2024-01-05 of the indexmenu plugin when is used and enabled in Dokuwiki (Open

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Aug 16, 2024

  • CVE-2024-7646
    43Plan

    A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the `networking.k8s.io` or `ex

    HighCVSS 8.8Proof of conceptEPSS 27%

    kubernetes · ingress-nginxAug 16, 2024

  • CVE-2024-42849
    26Monitor

    An issue in Silverpeas v.6.4.2 and lower allows a remote attacker to cause a denial of service via the password change function.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    silverpeas · silverpeasAug 16, 2024

  • CVE-2024-42850
    39Monitor

    An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    silverpeas · silverpeasAug 16, 2024

  • CVE-2024-7703
    25Monitor

    ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting

    MediumCVSS 6.4Proof of conceptEPSS 1%

    reputeinfosystems · armember – membership plugin, content restriction, member levels, user profile & user signupAug 17, 2024

  • CVE-2024-44083
    30Monitor

    ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there is a section that has many jumps linked, and the final jump corresponds to the

    HighCVSS 7.5Proof of conceptEPSS 1%

    hex-rays · ida proAug 19, 2024

  • CVE-2024-6330
    40Plan

    GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    geomywp · geo my wordpressAug 19, 2024

  • CVE-2024-7922
    27Monitor

    D-Link DNS-1550-04 myMusic.cgi cgi_write_playlist command injection

    MediumCVSS 5.3No exploitEPSS 19%

    dell · dns-120 firmwareAug 19, 2024

  • CVE-2024-42657
    30Monitor

    An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encry

    HighCVSS 7.5Proof of conceptEPSS 0%

    nepstech · ntpl-xpon1gfevn firmwareAug 19, 2024

  • CVE-2024-42658
    39Monitor

    An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the cookie's para

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    nepstech · ntpl-xpon1gfevn firmwareAug 19, 2024

  • CVE-2024-43400
    21Monitor

    XWiki Platform allows XSS through XClass name in string properties

    MediumCVSS 5.4Proof of conceptEPSS 0%

    xwiki · xwikiAug 19, 2024

  • CVE-2024-23729
    24Monitor

    The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript

    MediumCVSS 6.1Proof of conceptEPSS 0%

    heytap · internet browserAug 19, 2024

  • CVE-2024-42812
    44Plan

    In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi.

    CriticalCVSS 9.8No exploitEPSS 15%

    dlink · dir-860l firmwareAug 19, 2024