August 2024
3,024 CVEs published, −7% on July 2024 and +19% on August 2023. CISA added 19 to KEV.
2024 month by month
- Critical
- 33111% of the 2,944 with a CVSS score
- Added to CISA KEV
- 1921 of this month's CVEs are in KEV, listed a median 17 days after publication
- Vendors
- 1,2365,321 products
- Top weakness
- XSSCWE-79 · 517 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Ofono410122new
- 2Ооо «ред Софт»Ред Ос33893new
- 3LinuxLinux, Linux Kernel3021nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»25852new
- 5Ао "нппкт"Осон Основа Оnyx23032new
- 6CanonicalUbuntu, Wpa_supplicant1462nonenew
- 7MicrosoftWindows Server 2022, Windows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022 (Server Core Installation)144108new
- 8Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 81210nonenew
- 9SourcecodesterSimple Realtime Quiz System, Car Driving School Management System, Clinics Patient Management System1140nonenew
- 10AdobeMagento, Magento Open Source, Commerce901nonenew
- 11Oretnom23Simple Realtime Quiz System, Car Driving School Management System, Clinic\'s Patient Management System682nonenew
- 12GoogleGoogle Chrome, Chrome, Android6532new
- 13GoGithub.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost, Github.com/cosmwasm/wasmd624nonenew
- 14TendaFH1206 Firmware, AX1806 Firmware, FH1201 Firmware5914nonenew
- 15Ао «ивк»Альт Сп 10, Альт 8 Сп585nonenew
- 16IntelIntel Oneapi Base Toolkit, Oneapi Base Toolkit, Intel 600 Series Chipset550nonenew
- 17PackagistMagento/community-edition, Magento/project-community-edition, Shopware/platform491nonenew
- 18Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Кобальт, Rosa Virtualization495nonenew
- 19UnknownWp-cart-for-digital-products, Woocommerce Customers Manager, Chatbot With Chatgpt WordPress445nonenew
- 20JanobeSchool Event Management System, School Attendence Monitoring System, Credit Card4218nonenew
- 21TotolinkX5000R Firmware, EX1200L, AC1200 T84211nonenew
- 22PyPIMage-ai, Django, Ckan401nonenew
- 23ItsourcecodeTailoring Management System, Airline Reservation System, Project Expense Monitoring System380nonenew
- 24LopalopaMusic Management System, Responsive School Management System, Live Membership System388nonenew
- 25SamsungAndroid, Notes, Wear OS3401new
Severity
How this month's CVEs score on CVSS; 80 have no score yet. Severity is not exploitation.
- Critical331
- High1,035
- Medium1,467
- Low111
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS517
- CWE-89SQL Injection286
- CWE-787Out-of-bounds Write158
- CWE-352CSRF121
- CWE-476NULL Pointer Dereference106
- CWE-22Path Traversal96
- CWE-284Improper Access Control91
- CWE-416Use After Free85
- CWE-125Out-of-bounds Read83
- CWE-200Information Exposure81
- CWE-78OS Command Injection69
- CWE-12168
- CWE-862Missing Authorization66
- CWE-434Unrestricted File Upload61
- CWE-20Improper Input Validation57
- CWE-94Code Injection54
- CWE-120Buffer Overflow51
- CWE-77Command Injection50
- CWE-122Heap Buffer Overflow39
- CWE-269Improper Privilege Mgmt37
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins84222% of sector-tagged CVEs
- Operating Systems72619% of sector-tagged CVEs
- Enterprise Software60116% of sector-tagged CVEs
- OSS Libraries3138% of sector-tagged CVEs
- Networking Infrastructure2496% of sector-tagged CVEs
- Hardware Firmware1825% of sector-tagged CVEs
- Consumer Software1554% of sector-tagged CVEs
- 8 smaller sectors581
- Not yet classified201
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 352CSRF | 476NULL Pointer Dereference | 22Path Traversal | 284Improper Access Control | 416Use After Free | 125Out-of-bounds Read | 200Information Exposure |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 8 | 1 | 26 | 87 | 3 | 2 | 38 | 12 | 1 | |
| Ооо «ред Софт» | 4 | 19 | 63 | 3 | 40 | 12 | 1 | |||
| Linux | 9 | 84 | 33 | 9 | ||||||
| Ооо «русбитех-астра» | 3 | 1 | 25 | 50 | 2 | 25 | 6 | |||
| Ао «нппкт» | 3 | 17 | 40 | 2 | 29 | 7 | ||||
| Canonical Ltd. | 4 | 36 | 16 | 5 | ||||||
| Microsoft Corp | 6 | 10 | 3 | 7 | 23 | 12 | 1 | |||
| Sourcecodester | 32 | 65 | 5 | 2 | ||||||
| Red Hat Inc. | 1 | 23 | 6 | 2 | ||||||
| Microsoft | 4 | 4 | 3 | 8 | 14 | 10 | 1 | |||
| Adobe | 14 | 15 | 3 | 5 | 2 | 1 | 8 | 19 | ||
| Oretnom23 | 9 | 49 | 5 | 1 |
CVEs published in August 2024
53 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2024-28986SolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilityKEV9.8
- CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering codeKEV9.8
- CVE-2024-40766An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the ...KEV9.8
- CVE-2024-6670WhatsUp Gold HasErrors SQL Injection Authentication Bypass VulnerabilityKEV9.8
- CVE-2024-7593Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.KEV9.8
- CVE-2024-7971Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)KEV9.6
- CVE-2024-42009A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desa...KEV9.3
- CVE-2024-28987SolarWinds Web Help Desk Hardcoded Credential VulnerabilityKEV9.1
- CVE-2024-38189Microsoft Project Remote Code Execution VulnerabilityKEV8.8
- CVE-2024-7399Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.KEV8.8
- CVE-2024-7965Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)KEV8.8
- CVE-2024-38107Windows Power Dependency Coordinator Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-38193Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-7262Arbitrary Code Execution in WPS OfficeKEV7.8
- CVE-2024-38178Scripting Engine Memory Corruption VulnerabilityKEV7.5
- CVE-2024-39717The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Cent...KEV7.2
- CVE-2024-41710A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with ad...KEV7.2
- CVE-2024-7694TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File UploadKEV7.2
- CVE-2024-38106Windows Kernel Elevation of Privilege VulnerabilityKEV7.0
- CVE-2024-38213Windows Mark of the Web Security Feature Bypass VulnerabilityKEV6.5
- CVE-2024-27443An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, bec...KEV6.1
- CVE-2024-37099WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerability10.0
- CVE-2024-42489Pro Macros Remote Code Execution via Viewpdf and similar macros10.0
- CVE-2024-28000WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability9.8
- CVE-2024-29729Multiple vulnerabilities in SportsNET9.8
- CVE-2024-29731Multiple vulnerabilities in SportsNET9.8
- CVE-2024-33964SQL injection in Janobe products9.8
- CVE-2024-41570An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.9.8
- CVE-2024-43354WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability9.8
- CVE-2024-7332TOTOLINK CP450 Telnet Service product.ini hard-coded password9.8
- CVE-2024-6915JFrog Artifactory Cache Poisoning9.3
- CVE-2024-7856MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion9.1
- CVE-2024-7827Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter8.8
- CVE-2024-7969Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)8.8
- CVE-2024-34740In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege w...7.8
- CVE-2024-6141Windscribe Directory Traversal Local Privilege Escalation Vulnerability7.8
- CVE-2024-7358Point B Ltd Getscreen Agent Installation getscreen.msi temp file7.8
- CVE-2024-28077A denial-of-service issue was discovered on certain GL-iNet devices. Some websites can detect devices exposed to the external network through DDNS, and consequently obtain the IP addresses and port...7.5
- CVE-2024-42485Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint7.5
- CVE-2024-6781Calibre Arbitrary File Read7.5
- CVE-2024-7885Undertow: improper state management in proxy protocol parsing causes information leakage7.5
- CVE-2024-43313WordPress FormFacade plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1
- CVE-2024-31798Identical Hardcoded Root Password for All Devices in GNCC's GC2 Indoor Security Camera 1080P allows an attacker with physical access to retrieve the root password for all similar devices6.8
- CVE-2024-39649WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerability6.5
- CVE-2024-43318WordPress E2Pdf – Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) vulnerability6.5
- CVE-2024-7055FFmpeg pnmdec.c pnm_decode_frame heap-based overflow6.3
- CVE-2024-7495itsourcecode Laravel Accounting System HomeController.php unrestricted upload6.3
- CVE-2024-42787A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execut...6.1
- CVE-2024-44684TpMeCMS 1.3.3.2 is vulnerable to Cross Site Scripting (XSS) in /h.php/page?ref=addtabs via the "Title," "Images," and "Content" fields.6.1
- CVE-2024-41820Cluster-level privilege escalation in kubean6.0
- CVE-2024-7437SimpleMachines SMF Delete User index.php resource injection5.4
- CVE-2024-45440core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.5.3
- CVE-2024-43336WordPress WP User Manager – User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) vulnerability4.3