SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
VOLUME 24ISSUE 33
@RISK: The Consensus Security Vulnerability Alert
Internet Storm Center Spotlight
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Mapping Threats with DNSTwist and the Internet Storm Center [Guest Diary]
Published: 2024-08-20
Last Updated: 2024-08-21 00:17:41 UTC
by Guy Bruneau (Version: 1)
[This is a Guest Diary by Michael Tigges, an ISC intern as part of the SANS.edu BACS program]
On July 16, 2024, I received notification of a suspicious tunnel being opened via SSH in relation to the medical image viewing software "MicroDICOM". MicroDICOM is a medical imagery software and processing engine commonly used to examine x-ray’s, MRIs, and ultrasounds. This was atypical for this application-- while it contained the capabilities to perform network sharing, this application reused private keys and generally engaged in unsafe practices for a method that might connect to an organizational resource. Furthermore, all files were connecting back to the same IP address, 209.127.37.48. Upon investigation, we were able to determine that this application was not, in fact, the application it purported to be, but instead part of large phishing campaign that appeared to prey on a recent Common Vulnerability & Exploit (CVE) notification from the Cybersecurity & Infrastructure Security Agency (CISA).
On July 11, 2024, CISA released ICS Medical Advisory 'ICSMA-24-163-01'. This advisory raised two CVEs to public attention:
CVE-2024-33606 (CVSS 8.8) for the improper authorization for custom URL scheme.
CVE-2024-28877 (CVSS 8.8) for a stack buffer overflow.
The combination of these CVE's necessitates an immediate update to this application, and in fact, proper security due diligence would be to mitigate this as soon as possible with updating/patching. As such, a large portion of the MicroDICOM users were likely looking to update their software.
Behavioral Analysis
Armed with this context, we can focus on our binary analysis. I retrieved the payload from the host system that fired the alert. Our application, `MicroDicom-2024.2+2.exe` was much larger than the original application at 179 MB, versus the typical 10MB to 12.5MB that the original application is. Our first hint aside from the obvious non-matching file hash and size that we may be dealing with adversarial behavior came through the certificate utilized by this application, "Helping businesses Limited". (Bonus: This is a commonly abused signature! More on that at the end.)
Further examination of the application in a sandbox revealed the presence of several artifacts of interest inconsistent with the general behavior of this service. The first, `UpdaterSvc.exe` is a service registered on the target system upon installation of the suspicious MicroDICOM application. This service is quite simple, and process hierarchy reveals that this is responsible for the invocation of our second artifact of interest, 7655.bat. This, in turn, is responsible for the construction and execution of our SSH tunnel. Armed with this knowledge, we can begin enumeration in earnest to find some more information regarding potential attack vectors for our MicroDICOM application.
Read the full entry:
Where are we with CVE-2024-38063: Microsoft IPv6 Vulnerability
Published: 2024-08-20
Last Updated: 2024-08-20 14:06:39 UTC
by Johannes Ullrich (Version: 1)
I recorded a quick live stream with a quick update on CVE-2024-38063. The video focuses on determining the exploitability, particularly whether your systems are reachable by IPv6.
After recording this video, Stephen Sims pointed me to a thread on X published yesterday. It goes over some of the possible exploit paths. The main takeaway is that it will likely take multiple packets to successfully exploit this issue, and exploitation will likely not be reliable. Some of the discussion also reminds me of a recent IPv4 issue in FreeBSD.
The FreeBSD issue was caused by ICMP error messages sent in response to crafted ICMP requests. ICMP options included in the response caused a buffer overflow. Something similar may be happening here. If I read the X thread correctly, multiple queued errors are required in the case of CVE-2024-38063.
See this "Packet Tuesday" video about the FreeBSD issue: https://www.youtube.com/watch?v=Bgmfl17AQWA
Read the full entry:
https://isc.sans.edu/diary/Where+are+we+with+CVE202438063+Microsoft+IPv6+Vulnerability/31186/
Internet Storm Center Entries
Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python (2024.08.19)
[Guest Diary] 7 minutes and 4 steps to a quick win: A write-up on custom tools (2024.08.16)
Wireshark 4.4.0rc1's Custom Columns (2024.08.15)
https://isc.sans.edu/diary/Wireshark+440rc1s+Custom+Columns/31174/
Recent CVEs
The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.
CVE-2024-38063 - Windows TCP/IP Remote Code Execution Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38063
ISC Diary: https://isc.sans.edu/diary/31186
ISC Podcast: https://isc.sans.edu/podcastdetail/9098
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063
CVE-2024-7593 - Ivanti vTM versions prior to 22.2R1 and 22.7R2 are vulnerable to remote unauthenticated attackers bypassing admin panel authentication due to improper implementation of an authentication algorithm.
Product: Ivanti vTM
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7593
ISC Podcast: https://isc.sans.edu/podcastdetail/9098
NVD References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593
CVE-2024-7569 - Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier have an information disclosure vulnerability that allows attackers to obtain the OIDC client secret.
Product: Ivanti ITSM
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7569
NVD References:
CVE-2024-7569 - CVE-2024-7570
CVE-2024-38652 - Ivanti Avalanche 6.3.1 allows a remote attacker to achieve denial of service by deleting arbitrary files through path traversal in the skin management component.
Product: Ivanti Avalanche
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38652
NVD References:
CVE-2024-38652 - CVE-2024-38653-
CVE-2024-38652-CVE-2024-38653-
CVE-2024-36136 - CVE-2024-37399-
CVE-2024-28986 - SolarWinds Web Help Desk has a Java Deserialization Remote Code Execution vulnerability, potentially allowing attackers to run commands on the host machine.
Product: Solarwinds Web Help Desk
CVSS Score: 9.8
** KEV since 2024-08-15 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-28986
NVD References:
- https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28986
CVE-2024-4577 - PHP versions 8.1.*, 8.2.*, and 8.3.* on Windows using Apache and PHP-CGI are vulnerable to character substitution leading to potential source code exposure and arbitrary code execution.
Product: PHP
CVSS Score: 0
** KEV since 2024-06-12 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-4577
ISC Podcast: https://isc.sans.edu/podcastdetail/9106
CVE-2024-38106 - Windows Kernel Elevation of Privilege Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 7.0
** KEV since 2024-08-13 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38106
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38106
CVE-2024-38107 - Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 7.8
** KEV since 2024-08-13 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38107
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38107
CVE-2024-38178 - Scripting Engine Memory Corruption Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 7.5
** KEV since 2024-08-13 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38178
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38178
CVE-2024-38189 - Microsoft Project Remote Code Execution Vulnerability
Product: Microsoft 365 Apps
CVSS Score: 8.8
** KEV since 2024-08-13 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38189
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38189
CVE-2024-38193 - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 7.8
** KEV since 2024-08-13 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38193
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193
CVE-2024-38213 - Windows Mark of the Web Security Feature Bypass Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 6.5
** KEV since 2024-08-13 **
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38213
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38213
CVE-2024-41940 - SINEC NMS (All versions < V3.0) allows authenticated attackers to execute OS commands with elevated privileges due to inadequate user input validation in the privileged command queue.
Product: Siemens SINEC NMS
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-41940
NVD References: https://cert-portal.siemens.com/productcert/html/ssa-784301.html
CVE-2024-38108 - Azure Stack Hub Spoofing Vulnerability
Product: Microsoft Azure Stack Hub
CVSS Score: 9.3
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38108
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38108
CVE-2024-38140 - Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38140
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38140
CVE-2024-38159 & CVE-2024-38160 - Windows Network Virtualization Remote Code Execution Vulnerabilities
Product: Microsoft Windows 10 1607
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38159
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38160
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38159
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38160
CVE-2024-38199 - Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
Product: Microsoft Windows 10 1507
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38199
NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38199
CVE-2024-7748 - SourceCodester Accounts Manager App 1.0 is vulnerable to a critical issue in the file /endpoint/delete-account.php, allowing for remote sql injection attacks using the account argument.
Product: Rems Accounts Manager App
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7748
NVD References:
- https://github.com/joinia/webray.com.cn/blob/main/Accounts-Manager-App/Accounts-Manager-Appsql.md
- https://vuldb.com/?ctiid.274367
CVE-2024-20082 - MediaTek Modem is vulnerable to memory corruption, allowing for remote code execution without user interaction.
Product: MediaTek Modem
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-20082
NVD References: https://corp.mediatek.com/product-security-bulletin/August-2024
CVE-2024-7731 & CVE-2024-7732 - Dr.ID Access Control System from SECOM is vulnerable to SQL injection due to improper validation of a specific page parameter, putting database contents at risk for unauthorized access, modifications, and deletions.
Product: SECOM Dr.ID Access Control System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7731
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7732
NVD References:
-https://www.twcert.org.tw/en/cp-139-8006-036f5-2.html
- https://www.twcert.org.tw/tw/cp-132-8005-c3c94-1.html
CVE-2024-39397 - Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier have an Unrestricted Upload of File with Dangerous Type vulnerability allowing for arbitrary code execution by an attacker.
Product: Adobe Magento 2.4.7
CVSS Score: 9.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-39397
NVD References: https://helpx.adobe.com/security/products/magento/apsb24-61.html
CVE-2024-5914 - Palo Alto Networks Cortex XSOAR CommonScripts Pack is vulnerable to command injection, enabling attackers to execute arbitrary commands within integration containers.
Product: Palo Alto Networks Cortex XSOAR CommonScripts Pack
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5914
NVD References: https://security.paloaltonetworks.com/CVE-2024-5914
CVE-2024-42360 - SequenceServer had a vulnerability in its HTTP endpoints that allowed for injection and execution of unwanted shell commands, which has been fixed in version 3.1.2.
Product: Wurmlab SequenceServer
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42360
NVD References:
- https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba
- https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h
CVE-2024-7794 - Itsoucecode Vehicle Management System 1.0 is vulnerable to a critical SQL injection flaw in the mybill.php file, allowing for remote attacks.
Product: Adrianmercurio Vehicle Management System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7794
NVD References:
- https://github.com/ppp-src/ha/issues/5
- https://vuldb.com/?ctiid.274562
CVE-2024-7797 & CVE-2024-7798 - SourceCodester Simple Online Bidding System 1.0 is vulnerable to critical SQL injection flaws in the /bidding/admin/ajax.php?action=login endpoint, allowing remote attackers to manipulate the username argument and launch attacks.
Product: Oretnom23 Simple Online Bidding System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7797
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7798
NVD References:
- https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql.md
-https://vuldb.com/?ctiid.274650
- https://vuldb.com/?id.274650
- https://vuldb.com/?submit.390290
- https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql2.md
- https://vuldb.com/?ctiid.274651
CVE-2024-7808 - Job Portal 1.0 is vulnerable to SQL injection via the argument email in logindbc.php, allowing for remote attacks due to a critical vulnerability.
Product: Fabianros Job Portal
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7808
NVD References:
- https://github.com/XYgit-99/cve/issues/1
- https://vuldb.com/?ctiid.274704
CVE-2024-7811 - SourceCodester Daily Expenses Monitoring App 1.0 is vulnerable to SQL injection in the /endpoint/delete-expense.php file, allowing for remote attacks due to the manipulation of the expense argument.
Product: Rems Daily Expenses Monitoring App
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7811
NVD References:
- https://vuldb.com/?ctiid.274707
CVE-2024-7828 - D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 is vulnerable to a critical buffer overflow in the function cgi_set_cover within the file /cgi-bin/photocenter_mgr.cgi, allowing for remote exploitation but affecting only products no longer supported by the vendor.
Product: D-Link DNS-120 and others
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7828
NVD References:
- https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_set_cover.md
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
- https://vuldb.com/?ctiid.274726
CVE-2024-7829 - D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 are vulnerable to a critical buffer overflow in the function cgi_del_photo, which can be exploited remotely, but the vulnerability is unsupported as the products are end-of-life.
Product: D-Link DNS-120 and others
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7829
NVD References:
- https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_del_photo.md
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
- https://vuldb.com/?ctiid.274727
CVE-2024-7830 - D-Link DNS-120 and other models up to 20240814 have a critical vulnerability in the cgi_move_photo function that allows for remote buffer overflow due to unsupported status from the vendor.
Product: D-Link DNS-120 and others
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7830
NVD References:
- https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_move_photo.md
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
- https://vuldb.com/?ctiid.274728
CVE-2024-7831 - D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 are vulnerable to a critical buffer overflow in the cgi_get_cooliris function of the file /cgi-bin/photocenter_mgr.cgi when assigned, but since the products are no longer supported, this vulnerability has been deemed unaddressed and the products should be replaced.
Product: D-Link DNS-120 and others
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7831
NVD References:
- https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_cooliris.md
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
- https://vuldb.com/?ctiid.274729
CVE-2024-7833 - D-Link DI-8100 16.07 is susceptible to a critical command injection vulnerability in the function upgrade_filter_asp of the file upgrade_filter.asp, allowing remote attackers to execute malicious commands.
Product: D-Link DI-8100
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7833
NVD References:
- https://github.com/aLtEr6/pdf/blob/main/3.pdf
- https://vuldb.com/?ctiid.274731
CVE-2024-42843 - Projectworlds Online Examination System v1.0 is vulnerable to SQL Injection via the subject parameter in feed.php.
Product: Projectworlds Online Examination System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42843
NVD References: https://github.com/ganzhi-qcy/cve/issues/6
CVE-2024-42947 - Tenda FH1201 v1.2.0.14 (408) is vulnerable to remote attackers executing arbitrary commands through a crafted HTTP request in the handler function of /goform/telnet.
Product: Tenda FH1201
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42947
NVD References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/telnet.md
CVE-2024-42978 - Tenda FH1206 v02.03.01.35 is vulnerable to remote code execution via crafted HTTP requests in the handler function of /goform/telnet.
Product: Tenda FH1206
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42978
NVD References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/telnet.md
CVE-2024-42634 - Tenda AC9 v15.03.06.42 is vulnerable to a Command Injection flaw in formWriteFacMac, allowing attackers to execute root-level OS commands.
Product: Tenda AC9
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42634
NVD References: https://github.com/goldds96/Report/blob/main/Tenda/AC9/CI.md
CVE-2024-42966 - TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain sensitive login credentials through a crafted request to /cgi-bin/ExportSettings.sh.
Product: Totolink N350Rt
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42966
NVD References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/N350R/ExportSettings.md
CVE-2024-42967 - TOTOLINK LR350 V9.3.5u.6369_B20220309 is vulnerable to incorrect access control, enabling attackers to access the apmib configuration file containing sensitive login credentials.
Product: Totolink Lr350
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42967
NVD References: https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/LR350/ExportSettings.md
CVE-2024-23168 - Xiexe XSOverlay before build 647 allows non-local websites to execute arbitrary code via malicious commands sent to the WebSocket API.
Product: Xiexe XSOverlay
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-23168
NVD References:
- https://github.com/Xiexe/XSOverlay-Issue-Tracker
- https://store.steampowered.com/news/app/1173510?emclan=103582791465938574&emgid=7792991106417394332
CVE-2024-27730 - Friendica v.2023.12 is vulnerable to insecure permissions, allowing remote attackers to access sensitive information and run arbitrary code through the calendar event cid parameter.
Product: Friendica
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27730
NVD References:
- https://github.com/friendica/friendica/pull/13927
- https://leo.oliver.nz/posts/2024/05/friendica-cve-disclosures/
CVE-2024-42472 - Flatpak is a Linux application sandboxing and distribution framework that prior to versions 1.14.0 and 1.15.10 allowed malicious or compromised Flatpak apps to access and write files outside their intended scope.
Product: Flatpak
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42472
NVD References:
- https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c
- https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5
- https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72
- https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a
- https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75
- https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97
- https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788
- https://github.com/flatpak/flatpak/commit/db3a785241fda63bf53f0ec12bb519aa5210de19
- https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87
CVE-2024-42757 - Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page.
Product: Asus RT-N15U
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42757
NVD References: https://github.com/Nop3z/CVE/blob/main/Asus/FW_RT_N15U_30043763754/FW_RT_N15U_30043763754%20RCE.md
CVE-2024-7838 - Itsourcode Online Food Ordering System 1.0 is vulnerable to remote SQL injection through the file /addcategory.php, allowing for potential exploitation by unauthorized users.
Product: Kevinwong Online Food Ordering System
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7838
NVD References:
- https://github.com/ppp-src/a/issues/1
- https://vuldb.com/?ctiid.274742
CVE-2024-7839 - Itsourcecode Billing System 1.0 is vulnerable to remote SQL injection via the owners_id argument in addbill.php, as publicly disclosed exploit.
Product: Angeljudesuarez Billing System
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7839
NVD References:
- https://github.com/ppp-src/a/issues/2
- https://vuldb.com/?ctiid.274743
CVE-2024-42637 - H3C R3010 v100R002L02 contains a hardcoded password vulnerability in /etc/shadow, allowing attackers to log in as root.
Product: H3C R3010
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42637
NVD References:
CVE-2024-42639 - H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.
Product: H3C GR1100-P
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42639
NVD References:
CVE-2024-42850 - An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements.
Product: Silverpeas
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42850
NVD References:
CVE-2024-6500 - The InPost for WooCommerce and InPost PL plugins are vulnerable to unauthorized data access and deletion on Windows servers due to missing capability checks.
Product: InPost, InPost for WooCommerce
Active Installations: InPost PL: 7,000+; woo-InPost has been closed since August 8
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6500
NVD References:
- https://plugins.trac.wordpress.org/browser/woo-inpost/trunk/classes/class-helper.php#L140
- https://plugins.trac.wordpress.org/browser/woo-inpost/trunk/classes/class-helper.php#L216
CVE-2024-7907 - TOTOLINK X6000R 9.4.0cu.852_20230719 allows remote attackers to execute commands via a command injection vulnerability in the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi.
Product: TOTOLINK X6000R
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7907
NVD References:
- https://github.com/BeaCox/IoT_vuln/tree/main/totolink/x6000R/setSyslogCfg_injection
- https://vuldb.com/?ctiid.275033
CVE-2024-7908 - TOTOLINK EX1200L 9.3.5u.6146_B20201023 is vulnerable to a critical stack-based buffer overflow in the function setDefResponse of the file /www/cgi-bin/cstecgi.cgi, allowing for remote attacks due to a manipulated IpAddress argument, with the vendor failing to respond to an early disclosure.
Product: TOTOLINK EX1200L
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7908
NVD References:
- https://github.com/BeaCox/IoT_vuln/tree/main/totolink/EX1200L/setDefResponse_bof
- https://vuldb.com/?ctiid.275034
CVE-2024-7909 - TOTOLINK EX1200L 9.3.5u.6146_B20201023 is vulnerable to a critical stack-based buffer overflow in the setLanguageCfg function of /www/cgi-bin/cstecgi.cgi, allowing for remote attacks; vendor was notified but did not respond.
Product: TOTOLINK EX1200L
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7909
NVD References:
- https://github.com/BeaCox/IoT_vuln/tree/main/totolink/EX1200L/setLanguageCfg_bof
- https://vuldb.com/?ctiid.275035
CVE-2024-7911 - SourceCodester Simple Online Bidding System 1.0 is vulnerable to a critical file inclusion exploit in the /simple-online-bidding-system/bidding/index.php file, allowing for remote attacks.
Product: Oretnom23 Simple Online Bidding System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7911
NVD References:
- https://github.com/Wsstiger/cve/blob/main/simple_include.md
- https://vuldb.com/?ctiid.275037
CVE-2024-7913 - Itsourcecode Billing System 1.0 is vulnerable to a critical SQL injection flaw in /addclient1.php, allowing remote attackers to manipulate arguments and disclose sensitive information.
Product: Angeljudesuarez Billing System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7913
NVD References:
- https://github.com/ppp-src/a/issues/4
- https://vuldb.com/?ctiid.275039
CVE-2024-44076 - In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access.
Product: Microcks
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-44076
NVD References:
- https://github.com/microcks/microcks/compare/1.9.1-fix-1...1.10.0
CVE-2024-44083 - Hex-Rays IDA Pro through 8.4 experiences crashes in ida64.dll when a section contains multiple linked jumps, culminating in the final jump invoking the payload entry point, though this is typically an inconvenience rather than a security concern.
Product: Hex-Rays IDA Pro
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-44083
NVD References: https://github.com/Azvanzed/IdaMeme
CVE-2024-6330 - The GEO my WP WordPress plugin allows unauthenticated attackers to include arbitrary files in PHP's execution context, leading to Remote Code Execution.
Product: GEO my WP WordPress plugin
Active Installations: 5,000+
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6330
NVD References: https://wpscan.com/vulnerability/95b532e0-1ffb-421e-b9c0-de03f89491d7/
CVE-2024-43399 - MobSF has a vulnerability allowing attackers to extract files to any location on the server before version 4.0.7.
Product: Opensecurity Mobile Security Framework
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43399
NVD References:
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-4hh3-vj32-gr6j
CVE-2024-7922 - D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 is vulnerable to command injection via the function cgi_audio_search/cgi_create_playlist/cgi_get_album_all_tracks/cgi_get_alltracks_editlist/cgi_get_artist_all_album/cgi_get_genre_all_tracks/cgi_get_tracks_list/cgi_set_airplay_content/cgi_write_playlist of the file /cgi-bin/myMusic.cgi.
Product: D-Link DNS-120 and others
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7922
NVD References:
- https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_create_playlist.md
- https://github.com/BuaaIOTTeam/Iot_Dlink_NAS/blob/main/DNS_cgi_get_tracks_list.md
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383
- https://vuldb.com/?ctiid.275108
CVE-2024-37099 - Deserialization of Untrusted Data vulnerability in Liquid Web GiveWP allows Object Injection.This issue affects GiveWP: from n/a through 3.14.1.
Product: Liquid Web GiveWP
Active Installations: 100,000+
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-37099
NVD References: https://patchstack.com/database/vulnerability/give/wordpress-givewp-plugin-3-14-1-unauthenticated-php-object-injection-vulnerability?_s_id=cve
CVE-2024-42658 - Wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 is vulnerable to remote attackers retrieving sensitive information through the cookie's parameter.
Product: Nepstech NTPL-XPON1GFEVN
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42658
NVD References:
- https://github.com/sudo-subho/CVE-2024-42658
- https://www.linkedin.com/in/subhodeep-baroi-397629252/
CVE-2024-43240 - Ultimate Membership Pro is vulnerable to Privilege Escalation due to Improper Privilege Management, impacting versions up to 12.6.
Product: azzaroco Ultimate Membership Pro
Active Installations: 100+
CVSS Score: 9.4
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43240
CVE-2024-43242 - Ultimate Membership Pro is vulnerable to deserialization of untrusted data which allows object injection, affecting versions from n/a through 12.6.
Product: azzaroco Ultimate Membership Pro
Active Installations: 100+
CVSS Score: 9.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43242
CVE-2024-43245 - Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4.
Product: eyecix JobSearch
Active Installations: unknown
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43245
CVE-2024-43249 - Bit Form Pro allows Command Injection through an Unrestricted Upload of File with Dangerous Type vulnerability.
Product: Bit Apps Bit Form Pro
Active Installations:
CVSS Score: 9.9
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43249
CVE-2024-43252 - Deserialization of Untrusted Data vulnerability in Crew HRM allows Object Injection.This issue affects Crew HRM: from n/a through 1.1.1.
Product: Crew HRM
Active Installations: 80+
CVSS Score: 9.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43252
NVD References: https://patchstack.com/database/vulnerability/hr-management/wordpress-crew-hrm-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cve
CVE-2024-43261 - Compute Links by Hamed Naderfar is vulnerable to PHP Remote File Inclusion from versions n/a through 1.2.1.
Product: Hamed Naderfar Compute Links
Active Installations: unknown
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43261
NVD References: https://patchstack.com/database/vulnerability/compute-links/wordpress-compute-links-plugin-1-2-1-remote-file-inclusion-vulnerability?_s_id=cve
CVE-2024-42813 - TRENDnet TEW-752DRU FW1.03B01 is vulnerable to a buffer overflow in gena.cgi, allowing attackers to crash the device or execute arbitrary commands.
Product: TRENDnet TEW-752DRU
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42813
NVD References: https://gist.github.com/XiaoCurry/204680035c1efffa27d14956820ad928
CVE-2024-43311 - Geek Code Lab Login As Users allows Privilege Escalation due to Improper Privilege Management from n/a through 1.4.2.
Product: Geek Code Lab Login As Users
Active Installations: 300+
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43311
NVD References: https://patchstack.com/database/vulnerability/login-as-users/wordpress-login-as-users-plugin-1-4-2-broken-authentication-vulnerability?_s_id=cve
CVE-2024-43354 - Deserialization of Untrusted Data vulnerability in myCred allows Object Injection.This issue affects myCred: from n/a through 2.7.2.
Product: myCred
Active Installations: 10,000+
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43354
NVD References: https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-7-2-php-object-injection-vulnerability?_s_id=cve
CVE-2024-5932 - The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input, allowing attackers to execute remote code and delete files.
Product: GiveWP Donation Plugin
Active Installations: 100,000+
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5932
NVD References:
- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/login-register.php#L235
- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/process-donation.php#L420
- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/tecnickcom/tcpdf/tcpdf.php#L7861
- https://plugins.trac.wordpress.org/changeset/3132247/
CVE-2024-7777 - The Contact Form by Bit Form for WordPress is vulnerable to arbitrary file read and deletion, allowing authenticated attackers to potentially achieve remote code execution.
Product: Bit Form The Contact Form
Active Installations: 6,000+
CVSS Score: 9.0 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7777
NVD References:
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L829
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L852
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L875
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L898
CVE-2024-6847 - The Chatbot with ChatGPT WordPress plugin before 2.4.5 is vulnerable to SQL injection via unauthenticated user-submitted messages.
Product: ChatGPT Chatbot
Active Installations: 30+
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6847
NVD References: https://wpscan.com/vulnerability/baa860bb-3b7d-438a-ad54-92bf8e21e851/
CVE-2024-43202 - Apache DolphinScheduler is vulnerable to remote code execution before version 3.2.2, users should update to the latest version to fix the issue.
Product: Apache DolphinScheduler
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43202
NVD References:
- https://github.com/apache/dolphinscheduler/pull/15758
- https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5
- https://lists.apache.org/thread/qbhk9wqyxhrn4z7m4m343wqxpwg926nh
- https://www.cve.org/CVERecord?id=CVE-2023-49109
CVE-2024-42558 - Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_room.php.
Product: Hotel Management System admin_modify_room
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42558
NVD References: https://gist.github.com/topsky979/9651b4977e86f5b1bcae7a8959ff3342
CVE-2024-42559 - Hotel Management System has a vulnerability in its login component that allows attackers to authenticate without a valid password.
Product: Hotel Management System commit 79d688
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42559
NVD References: https://gist.github.com/topsky979/99d2ebf7b5598ef227262ba1b2bb392f/edit
CVE-2024-42562 - Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at preview.php.
Product: Pharmacy Management System commit a2efc8
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42562
NVD References: https://gist.github.com/topsky979/2dcca275bcc18e8058cefef714a2f61b
CVE-2024-42565 - ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete.
Product: ERP commit 44bd04
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42565
NVD References: https://gist.github.com/topsky979/648f2cd4f5e58560cbc9308d06e2f876
CVE-2024-42567, CVE-2024-42569, CVE-2024-42570, CVE-2024-42571, CVE-2024-42574, CVE-2024-4257 - School Management System commit bae5aa was discovered to contain SQL injection vulnerabilities
Product: School Management System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42567
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42569
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42570
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42571
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42574
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42575
NVD References: https://gist.github.com/topsky979/20a81dbf47d371e1dabe08f350c8185d
NVD References: https://gist.github.com/topsky979/1d9ebca101fc5e30040436d70e522102
NVD References: https://gist.github.com/topsky979/5c8e289fa66702fd3acbed558ee449dd
NVD References: https://gist.github.com/topsky979/7064f8bbd3977ee665a098efcd0170c0
NVD References: https://gist.github.com/topsky979/2fddc00b33b038cd778c1e4fb1936a15
CVE-2024-42581 - A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Product: Warehouse Inventory System v2.0
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42581
NVD References: https://gist.github.com/topsky979/2bd26343ccdff7c759f62d332c8caff6
CVE-2024-33872 - Keyfactor Command versions 10.5.x before 10.5.1 and 11.5.x before 11.5.1 are vulnerable to SQL Injection leading to code execution and privilege escalation.
Product: Keyfactor Command
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-33872
NVD References: https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE-2024-30949 - Newlib v.4.3.0 allows an attacker to execute arbitrary code through a vulnerability in the _gettimeofday function.
Product: Newlib
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-30949
NVD References:
- https://gist.github.com/visitorckw/6b26e599241ea80210ea136b28441661
- https://inbox.sourceware.org/newlib/20231129035714.469943-1-visitorckw%40gmail.com/
CVE-2024-43404 - MEGABOT prior to version 1.5.0 has a remote code execution vulnerability through the `/math` command in Discord.
Product: MEGABOT
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43404
NVD References:
- https://github.com/NicPWNs/MEGABOT/commit/71e79e5581ea36313700385b112d863053fb7ed6
- https://github.com/NicPWNs/MEGABOT/issues/137
- https://github.com/NicPWNs/MEGABOT/pull/138
- https://github.com/NicPWNs/MEGABOT/releases/tag/v1.5.0
- https://github.com/NicPWNs/MEGABOT/security/advisories/GHSA-vhxp-4hwq-w3p2
CVE-2024-27185 - The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
Product: Joomla! CMS versions 3.0.0-3.10.16-elts, 4.0.0-4.4.6, 5.0.0-5.1.2
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27185
NVD References: https://developer.joomla.org/security-centre/942-20240802-core-cache-poisoning-in-pagination.html
CVE-2024-38175 - Azure Managed Instance for Apache Cassandra has an improper access control vulnerability allowing an authenticated attacker to elevate privileges over a network.
Product: Microsoft Azure Managed Instance for Apache Cassandra
CVSS Score: 9.6
NVD:
CVE-2024-42658 - Wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 is vulnerable to remote attackers retrieving sensitive information through the cookie's parameter.
Product: Nepstech NTPL-XPON1GFEVN
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42658
NVD References:
- https://github.com/sudo-subho/CVE-2024-42658
CVE-2024-43240 - Ultimate Membership Pro is vulnerable to Privilege Escalation due to Improper Privilege Management, impacting versions up to 12.6.
Product: azzaroco Ultimate Membership ProActive Installations: 100+CVSS Score: 9.4NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43240NVD References: https://patchstack.com/database/vulnerability/indeed-membership-pro/wordpress-indeed-ultimate-membership-pro-plugin-12-6-unauthenticated-privilege-escalation-vulnerability?_s_id=cveCVE-2024-43242 - Ultimate Membership Pro is vulnerable to deserialization of untrusted data which allows object injection, affecting versions from n/a through 12.6.Product: azzaroco Ultimate Membership ProActive Installations: 100+CVSS Score: 9.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43242NVD References: https://patchstack.com/database/vulnerability/indeed-membership-pro/wordpress-indeed-ultimate-membership-pro-plugin-12-6-unauthenticated-php-object-injection-vulnerability?_s_id=cveCVE-2024-43245 - Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4.Product: eyecix JobSearchActive Installations: unknownCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43245NVD References: https://patchstack.com/database/vulnerability/wp-jobsearch/wordpress-jobsearch-plugin-2-3-4-unauthenticated-account-takeover-vulnerability?_s_id=cveCVE-2024-43249 - Bit Form Pro allows Command Injection through an Unrestricted Upload of File with Dangerous Type vulnerability.Product: Bit Apps Bit Form ProActive Installations:CVSS Score: 9.9NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43249NVD References: https://patchstack.com/database/vulnerability/bitformpro/wordpress-bit-form-pro-plugin-2-6-4-authenticated-arbitrary-file-upload-vulnerability?_s_id=cveCVE-2024-43252 - Deserialization of Untrusted Data vulnerability in Crew HRM allows Object Injection.This issue affects Crew HRM: from n/a through 1.1.1.Product: Crew HRMActive Installations: 80+CVSS Score: 9.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43252NVD References: https://patchstack.com/database/vulnerability/hr-management/wordpress-crew-hrm-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cveCVE-2024-43261 - Compute Links by Hamed Naderfar is vulnerable to PHP Remote File Inclusion from versions n/a through 1.2.1.Product: Hamed Naderfar Compute LinksActive Installations: unknownCVSS Score: 9.6NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43261NVD References: https://patchstack.com/database/vulnerability/compute-links/wordpress-compute-links-plugin-1-2-1-remote-file-inclusion-vulnerability?_s_id=cveCVE-2024-42813 - TRENDnet TEW-752DRU FW1.03B01 is vulnerable to a buffer overflow in gena.cgi, allowing attackers to crash the device or execute arbitrary commands.Product: TRENDnet TEW-752DRUCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42813NVD References: https://gist.github.com/XiaoCurry/204680035c1efffa27d14956820ad928CVE-2024-43311 - Geek Code Lab Login As Users allows Privilege Escalation due to Improper Privilege Management from n/a through 1.4.2.Product: Geek Code Lab Login As UsersActive Installations: 300+CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43311NVD References: https://patchstack.com/database/vulnerability/login-as-users/wordpress-login-as-users-plugin-1-4-2-broken-authentication-vulnerability?_s_id=cveCVE-2024-43354 - Deserialization of Untrusted Data vulnerability in myCred allows Object Injection.This issue affects myCred: from n/a through 2.7.2.Product: myCredActive Installations: 10,000+CVSS Score: 9.8 AtRiskScore 30NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43354NVD References: https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-7-2-php-object-injection-vulnerability?_s_id=cveCVE-2024-5932 - The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input, allowing attackers to execute remote code and delete files.Product: GiveWP Donation PluginActive Installations: 100,000+CVSS Score: 10.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5932NVD References: - https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/login-register.php#L235- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/process-donation.php#L420- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/src/DonorDashboards/Tabs/EditProfileTab/AvatarRoute.php#L51- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/tecnickcom/tcpdf/tcpdf.php#L7861- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/vendor-prefixed/fakerphp/faker/src/Faker/ValidGenerator.php#L80- https://plugins.trac.wordpress.org/changeset/3132247/- https://www.wordfence.com/blog/2024/08/4998-bounty-awarded-and-100000-wordpress-sites-protected-against-unauthenticated-remote-code-execution-vulnerability-patched-in-givewp-wordpress-plugin/- https://www.wordfence.com/threat-intel/vulnerabilities/id/93e2d007-8157-42c5-92ad-704dc80749a3?source=cveCVE-2024-7777 - The Contact …
CVE-2024-43245 - Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4.
Product: eyecix JobSearch
Active Installations: unknown
CVSS Score: 9.8
CVE-2024-43249 - Bit Form Pro allows Command Injection through an Unrestricted Upload of File with Dangerous Type vulnerability.
Product: Bit Apps Bit Form Pro
Active Installations:
CVSS Score: 9.9
CVE-2024-43252 - Deserialization of Untrusted Data vulnerability in Crew HRM allows Object Injection.This issue affects Crew HRM: from n/a through 1.1.1.
Product: Crew HRM
Active Installations: 80+
CVSS Score: 9.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43252
NVD References: https://patchstack.com/database/vulnerability/hr-management/wordpress-crew-hrm-plugin-1-1-1-php-object-injection-vulnerability?_s_id=cve
CVE-2024-43261 - Compute Links by Hamed Naderfar is vulnerable to PHP Remote File Inclusion from versions n/a through 1.2.1.
Product: Hamed Naderfar Compute Links
Active Installations: unknown
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43261
NVD References: https://patchstack.com/database/vulnerability/compute-links/wordpress-compute-links-plugin-1-2-1-remote-file-inclusion-vulnerability?_s_id=cve
CVE-2024-42813 - TRENDnet TEW-752DRU FW1.03B01 is vulnerable to a buffer overflow in gena.cgi, allowing attackers to crash the device or execute arbitrary commands.
Product: TRENDnet TEW-752DRU
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42813
NVD References: https://gist.github.com/XiaoCurry/204680035c1efffa27d14956820ad928
CVE-2024-43311 - Geek Code Lab Login As Users allows Privilege Escalation due to Improper Privilege Management from n/a through 1.4.2.
Product: Geek Code Lab Login As Users
Active Installations: 300+
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43311
NVD References: https://patchstack.com/database/vulnerability/login-as-users/wordpress-login-as-users-plugin-1-4-2-broken-authentication-vulnerability?_s_id=cve
CVE-2024-43354 - Deserialization of Untrusted Data vulnerability in myCred allows Object Injection.This issue affects myCred: from n/a through 2.7.2.
Product: myCred
Active Installations: 10,000+
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43354
NVD References: https://patchstack.com/database/vulnerability/mycred/wordpress-mycred-plugin-2-7-2-php-object-injection-vulnerability?_s_id=cve
CVE-2024-5932 - The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input, allowing attackers to execute remote code and delete files.
Product: GiveWP Donation Plugin
Active Installations: 100,000+
CVSS Score: 10.0
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5932
NVD References:
- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/login-register.php#L235
- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/includes/process-donation.php#L420
- https://plugins.trac.wordpress.org/browser/give/tags/3.12.0/vendor/tecnickcom/tcpdf/tcpdf.php#L7861
CVE-2024-7777 - The Contact Form by Bit Form for WordPress is vulnerable to arbitrary file read and deletion, allowing authenticated attackers to potentially achieve remote code execution.
Product: Bit Form The Contact Form
Active Installations: 6,000+
CVSS Score: 9.0 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-7777
NVD References:
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L829
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L852
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L875
- https://plugins.trac.wordpress.org/browser/bit-form/tags/2.13.3/includes/Admin/AdminAjax.php#L898
CVE-2024-6847 - The Chatbot with ChatGPT WordPress plugin before 2.4.5 is vulnerable to SQL injection via unauthenticated user-submitted messages.
Product: ChatGPT Chatbot
Active Installations: 30+
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-6847
NVD References: https://wpscan.com/vulnerability/baa860bb-3b7d-438a-ad54-92bf8e21e851/
CVE-2024-43202 - Apache DolphinScheduler is vulnerable to remote code execution before version 3.2.2, users should update to the latest version to fix the issue.
Product: Apache DolphinScheduler
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43202
NVD References:
- https://github.com/apache/dolphinscheduler/pull/15758
- https://lists.apache.org/thread/nlmdp7q7l7o3l27778vxc5px24ncr5r5
- https://lists.apache.org/thread/qbhk9wqyxhrn4z7m4m343wqxpwg926nh
CVE-2024-42558 - Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_room.php.
Product: Hotel Management System admin_modify_room
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42558
NVD References: https://gist.github.com/topsky979/9651b4977e86f5b1bcae7a8959ff3342
CVE-2024-42559 - Hotel Management System has a vulnerability in its login component that allows attackers to authenticate without a valid password.
Product: Hotel Management System commit 79d688
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42559
NVD References: https://gist.github.com/topsky979/99d2ebf7b5598ef227262ba1b2bb392f/edit
CVE-2024-42562 - Pharmacy Management System commit a2efc8 was discovered to contain a SQL injection vulnerability via the invoice_number parameter at preview.php.
Product: Pharmacy Management System commit a2efc8
CVSS Score: 9.8 AtRiskScore 30
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42562
NVD References: https://gist.github.com/topsky979/2dcca275bcc18e8058cefef714a2f61b
CVE-2024-42565 - ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete.
Product: ERP commit 44bd04
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42565
NVD References: https://gist.github.com/topsky979/648f2cd4f5e58560cbc9308d06e2f876
CVE-2024-42567, CVE-2024-42569, CVE-2024-42570, CVE-2024-42571, CVE-2024-42574, CVE-2024-4257 - School Management System commit bae5aa was discovered to contain SQL injection vulnerabilities
Product: School Management System
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42567
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42569
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42570
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42571
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42574
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42575
NVD References: https://gist.github.com/topsky979/20a81dbf47d371e1dabe08f350c8185d
NVD References: https://gist.github.com/topsky979/1d9ebca101fc5e30040436d70e522102
NVD References: https://gist.github.com/topsky979/5c8e289fa66702fd3acbed558ee449dd
NVD References: https://gist.github.com/topsky979/7064f8bbd3977ee665a098efcd0170c0
NVD References: https://gist.github.com/topsky979/2fddc00b33b038cd778c1e4fb1936a15
CVE-2024-42581 - A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.
Product: Warehouse Inventory System v2.0
CVSS Score: 9.6
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-42581
NVD References: https://gist.github.com/topsky979/2bd26343ccdff7c759f62d332c8caff6
CVE-2024-33872 - Keyfactor Command versions 10.5.x before 10.5.1 and 11.5.x before 11.5.1 are vulnerable to SQL Injection leading to code execution and privilege escalation.
Product: Keyfactor Command
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-33872
NVD References: https://trust.keyfactor.com/?itemUid=d73921fd-bc9e-4e35-a974-cfb628e6a226&source=click
CVE-2024-30949 - Newlib v.4.3.0 allows an attacker to execute arbitrary code through a vulnerability in the _gettimeofday function.
Product: Newlib
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-30949
NVD References:
- https://gist.github.com/visitorckw/6b26e599241ea80210ea136b28441661
- https://inbox.sourceware.org/newlib/20231129035714.469943-1-visitorckw%40gmail.com/
CVE-2024-43404 - MEGABOT prior to version 1.5.0 has a remote code execution vulnerability through the `/math` command in Discord.
Product: MEGABOT
CVSS Score: 9.8
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-43404
NVD References:
- https://github.com/NicPWNs/MEGABOT/commit/71e79e5581ea36313700385b112d863053fb7ed6
- https://github.com/NicPWNs/MEGABOT/issues/137
- https://github.com/NicPWNs/MEGABOT/pull/138
- https://github.com/NicPWNs/MEGABOT/releases/tag/v1.5.0
- https://github.com/NicPWNs/MEGABOT/security/advisories/GHSA-vhxp-4hwq-w3p2
CVE-2024-27185 - The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
Product: Joomla! CMS versions 3.0.0-3.10.16-elts, 4.0.0-4.4.6, 5.0.0-5.1.2
CVSS Score: 9.1
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-27185
NVD References: https://developer.joomla.org/security-centre/942-20240802-core-cache-poisoning-in-pagination.html
CVE-2024-38175 - Azure Managed Instance for Apache Cassandra has an improper access control vulnerability allowing an authenticated attacker to elevate privileges over a network.
Product: Microsoft Azure Managed Instance for Apache CassandraCVSS Score: 9.6NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-38175NVD References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38175…
Sponsors
SANS
Webcast: SANS 2024 Multicloud Survey: Securing Multiple Clouds Amid Constant Changes | August 28, 11:00AM ET | Kenneth G. Hartman and Simon Vernon share crucial insights into securing multiple cloud environments, exploring the latest survey results, best practices, and impact of different architecture strategies on security implementation. Reserve your seat today:
SANS
Webcast: SANS 2024 Multicloud Survey: Securing Multiple Clouds Amid Constant Changes | August 28, 11:00AM ET | Kenneth G. Hartman and Simon Vernon share crucial insights into securing multiple cloud environments, exploring the latest survey results, best practices, and impact of different architecture strategies on security implementation. Reserve your seat today:
SANS
Webcast: SANS 2024 Multicloud Survey: Securing Multiple Clouds Amid Constant Changes | August 28, 11:00AM ET | Kenneth G. Hartman and Simon Vernon share crucial insights into securing multiple cloud environments, exploring the latest survey results, best practices, and impact of different architecture strategies on security implementation. Reserve your seat today:
SANS
Webcast: SANS 2024 Multicloud Survey: Securing Multiple Clouds Amid Constant Changes | August 28, 11:00AM ET | Kenneth G. Hartman and Simon Vernon share crucial insights into securing multiple cloud environments, exploring the latest survey results, best practices, and impact of different architecture strategies on security implementation. Reserve your seat today: