Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2024

167 records · 21 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2024-35538
    21Monitor

    Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specify

    MediumCVSS 5.3Proof of conceptEPSS 0%

    typecho · typechoAug 19, 2024

  • CVE-2024-35539
    26Monitor

    Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    typecho · typechoAug 19, 2024

  • CVE-2024-7928
    26Monitor

    FastAdmin lang path traversal

    MediumCVSS 5.3Proof of conceptEPSS 16%

    fastadmin · fastadminAug 19, 2024

  • CVE-2024-5932
    62This week

    GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution

    CriticalCVSS 9.8WeaponizedEPSS 76%

    givewp · givewpAug 19, 2024

  • CVE-2024-43202
    40Plan

    Apache DolphinScheduler: Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    apache · dolphinschedulerAug 20, 2024

  • CVE-2024-21689
    33Monitor

    This High severity RCE (Remote Code Execution) vulnerability CVE-2024-21689  was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, a

    HighCVSS 8.0Proof of conceptEPSS 2%

    atlassian · bambooAug 20, 2024

  • CVE-2024-6379
    24Monitor

    Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    MediumCVSS 6.1No exploitEPSS 0%

    3ds · 3dexperienceAug 20, 2024

  • CVE-2024-35540
    37Monitor

    A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted

    CriticalCVSS 9.0Proof of conceptEPSS 2%

    typecho · typechoAug 20, 2024

  • CVE-2024-42919
    39Monitor

    eScan Management Console 14.0.1400.2281 is vulnerable to Incorrect Access Control via acteScanAVReport.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    escanav · escan management consoleAug 20, 2024

  • CVE-2024-7854
    40Plan

    Woo Inquiry <= 0.1 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    sjhoo · woo inquiryAug 21, 2024

  • CVE-2024-28000
    59Plan

    WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    litespeedtech · litespeed cacheAug 21, 2024

  • CVE-2024-40453
    39Monitor

    squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varNa

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    squirrelly · squirrellyAug 21, 2024

  • CVE-2024-5723
    47Plan

    Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 40%

    centreon · centreon webAug 21, 2024

  • CVE-2024-5725
    49Plan

    Centreon initCurveList SQL Injection Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 47%

    centreon · centreon webAug 21, 2024

  • CVE-2024-5762
    53Plan

    Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 71%

    zen-cart · zen cartAug 21, 2024

  • CVE-2023-29929
    30Monitor

    Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service v

    HighCVSS 7.5Proof of conceptEPSS 0%

    Aug 21, 2024

  • CVE-2024-6386
    43Plan

    WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

    HighCVSS 8.8Proof of conceptEPSS 25%

    wpml · wpmlAug 21, 2024

  • CVE-2024-7965
    71This week

    Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption

    HighCVSS 8.8KEVWeaponizedEPSS 18%

    google · chromeAug 21, 2024

  • CVE-2024-7966
    35Monitor

    Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer proce

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeAug 21, 2024

  • CVE-2024-7971
    74This week

    Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page.

    CriticalCVSS 9.6KEVWeaponizedEPSS 21%

    google · chromeAug 21, 2024

  • CVE-2024-28987
    94Now

    SolarWinds Web Help Desk Hardcoded Credential Vulnerability

    CriticalCVSS 9.1KEVWeaponizedEPSS 93%

    solarwinds · web help deskAug 21, 2024

  • CVE-2024-39717
    59Plan

    The Versa Director GUI provides an option to customize the look and feel of the user interface.

    HighCVSS 7.2KEVWeaponizedEPSS 4%

    versa-networks · versa directorAug 22, 2024

  • CVE-2024-40766
    75This week

    An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized

    CriticalCVSS 9.8KEVWeaponizedEPSS 18%

    sonicwall · sonicosAug 23, 2024

  • CVE-2024-42756
    39Monitor

    An issue in Netgear DGN1000WW v.1.1.00.45 allows a remote attacker to execute arbitrary code via the Diagnostics page

    HighCVSS 8.8No exploitEPSS 13%

    netgear · dgn1000ww firmwareAug 23, 2024

  • CVE-2024-32501
    45Plan

    A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13,

    CriticalCVSS 9.8No exploitEPSS 19%

    centreon · centreon webAug 23, 2024

  • CVE-2024-42852
    24Monitor

    Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Aug 23, 2024

  • CVE-2024-7954
    66This week

    SPIP porte_plume Plugin Arbitrary PHP Execution

    CriticalCVSS 9.8WeaponizedEPSS 90%

    spip · spipAug 23, 2024

  • CVE-2024-42845
    33Monitor

    An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to ex

    HighCVSS 8.0Proof of conceptEPSS 2%

    Aug 23, 2024

  • CVE-2024-40111
    19Monitor

    A persistent (stored) cross-site scripting (XSS) vulnerability has been identified in Automad 2.0.0-alpha.4.

    MediumCVSS 4.8Proof of conceptEPSS 0%

    automad · automadAug 23, 2024

  • CVE-2024-8129
    28Monitor

    D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injection

    MediumCVSS 5.3No exploitEPSS 22%

    dlink · dns-1550-04 firmwareAug 24, 2024

  • CVE-2024-8132
    28Monitor

    D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection

    MediumCVSS 5.3No exploitEPSS 23%

    dlink · dns-1550-04 firmwareAug 24, 2024

  • CVE-2024-45244
    21Monitor

    Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

    MediumCVSS 5.3Proof of conceptEPSS 0%

    hyperledger · fabricAug 24, 2024

  • CVE-2024-7313
    24Monitor

    Shield Security < 20.0.6 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 1%

    getshieldsecurity · shield securityAug 26, 2024

  • CVE-2024-45241
    34Monitor

    A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated at

    HighCVSS 7.5Proof of conceptEPSS 13%

    Aug 26, 2024

  • CVE-2024-45256
    60This week

    An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite database

    CriticalCVSS 9.8WeaponizedEPSS 5%

    Aug 26, 2024

  • CVE-2023-26315
    41Plan

    Xiaomi router has a command injection vulnerability after authorization

    HighCVSS 8.8No exploitEPSS 19%

    mi · ax9000 firmwareAug 26, 2024

  • CVE-2024-43283
    30Monitor

    WordPress Contest Gallery plugin <= 23.1.2 - Unauthenticated Comment UserID And IP address Disclosure vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    contest-gallery · contest galleryAug 26, 2024

  • CVE-2024-45265
    39Monitor

    A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL c

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    skyss · arfa-cmsAug 26, 2024

  • CVE-2024-8181
    46Plan

    Flowise Authentication Bypass

    HighCVSS 8.1Proof of conceptEPSS 45%

    flowiseai · flowiseAug 27, 2024

  • CVE-2024-8182
    34Monitor

    Flowise Denial of Service

    HighCVSS 7.5No exploitEPSS 13%

    flowiseai · flowiseAug 27, 2024

  • CVE-2024-45264
    35Monitor

    A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a

    HighCVSS 8.8Proof of conceptEPSS 0%

    skyss · arfa-cmsAug 27, 2024

  • CVE-2024-43788
    24Monitor

    DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 0%

    webpack.js · webpackAug 27, 2024

  • CVE-2022-39996
    19Monitor

    Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to

    MediumCVSS 4.8Proof of conceptEPSS 0%

    teldat · rs123 firmwareAug 27, 2024

  • CVE-2024-42905
    44Plan

    Beijing Digital China Cloud Technology Co., Ltd.

    CriticalCVSS 9.8No exploitEPSS 15%

    Aug 28, 2024

  • CVE-2024-45058
    32Monitor

    Privilege escalation in i-Educar

    HighCVSS 8.1Proof of conceptEPSS 1%

    portabilis · i-educarAug 28, 2024

  • CVE-2024-8193
    35Monitor

    Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeAug 28, 2024

  • CVE-2024-8198
    35Monitor

    Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeAug 28, 2024

  • CVE-2024-45436
    31Monitor

    extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.

    HighCVSS 7.5Proof of conceptEPSS 2%

    ollama · ollamaAug 28, 2024

  • CVE-2024-45440
    24Monitor

    core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_co

    MediumCVSS 5.3Proof of conceptEPSS 9%

    drupal · drupalAug 29, 2024

  • CVE-2024-7856
    38Monitor

    MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion

    HighCVSS 8.1Proof of conceptEPSS 19%

    sonaar · mp3 audio player for music\, radio \& podcastAug 29, 2024

  • CVE-2024-5057
    40Plan

    WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    awesomemotive · easy digital downloadsAug 29, 2024

  • CVE-2024-38793
    35Monitor

    WordPress Best Restaurant Menu by Pricelisto plugin <= 1.4.1 - SQL Injection vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    pricelisto · great restaurant menu wpAug 29, 2024

  • CVE-2024-43144
    40Plan

    WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    stylemixthemes · cost calculator builderAug 29, 2024

  • CVE-2024-43917
    60This week

    WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 22%

    templateinvaders · ti woocommerce wishlistAug 29, 2024

  • CVE-2024-43918
    39Monitor

    WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    woobewoo · product tableAug 29, 2024

  • CVE-2024-43965
    40Plan

    WordPress SendGrid for WordPress plugin <= 1.4 - SQL Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    smackcoders · sendgridAug 29, 2024

  • CVE-2024-35133
    33Monitor

    IBM Security Verify Access HTTP open redirect

    HighCVSS 8.2Proof of conceptEPSS 1%

    ibm · security verify accessAug 29, 2024

  • CVE-2024-41358
    24Monitor

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    phpipam · phpipamAug 29, 2024

  • CVE-2024-6670
    97Now

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    progress · whatsup goldAug 29, 2024

  • CVE-2024-6671
    45Plan

    WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    progress · whatsup goldAug 29, 2024

  • CVE-2024-45488
    54Plan

    One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies.

    CriticalCVSS 9.8Proof of conceptEPSS 50%

    Aug 29, 2024

  • CVE-2024-3673
    38Monitor

    Web Directory Free < 1.7.3 - Unauthenticated LFI

    CriticalCVSS 9.1Proof of conceptEPSS 5%

    salephpscripts · web directory freeAug 30, 2024

  • CVE-2024-8252
    36Monitor

    Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion

    HighCVSS 8.8Proof of conceptEPSS 3%

    codection · clean loginAug 30, 2024

  • CVE-2024-45047
    24Monitor

    Potential mXSS vulnerability due to improper HTML escaping in svelte

    MediumCVSS 6.1No exploitEPSS 0%

    svelte · svelteAug 30, 2024

  • CVE-2024-6586
    30Monitor

    Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards.

    HighCVSS 7.3Proof of conceptEPSS 1%

    lightdash · lightdashAug 30, 2024

  • CVE-2022-4539
    21Monitor

    Web Application Firewall <= 2.1.2 - IP Address Spoofing to Protection Mechanism Bypass

    MediumCVSS 5.3Proof of conceptEPSS 0%

    miniorange · web application firewallAug 31, 2024

  • CVE-2024-44946
    22Monitor

    kcm: Serialise kcm_sendmsg() for the same socket.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelAug 31, 2024