Skip to content
OpenAdvisories

Archive

August 2024

Vulnerabilities first published in this month (UTC), newest first.

← July 2024 2024 / August September 2024 →
  1. 1129
  2. 266
  3. 321
  4. 413
  5. 5103
  6. 6160
  7. 7118
  8. 8112
  9. 966
  10. 1016
  11. 1122
  12. 12119
  13. 13226
  14. 14206
  15. 15122
  16. 1656
  17. 17135
  18. 1866
  19. 1972
  20. 20147
  21. 21177
  22. 22129
  23. 2378
  24. 2428
  25. 2524
  26. 26142
  27. 2767
  28. 2875
  29. 29135
  30. 3070
  31. 3118
All Critical High Medium Low Exploited only Public exploit

97 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-6782 Public exploit Scanner template EPSS 84%

    Calibre Remote Code Execution

    Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.

    Calibre Calibre calibre calibre Debian Ubuntu
  • Medium 5.5
    CVE-2024-36424 Public exploit

    K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of…

  • Medium 6.6
    CVE-2024-41958 Public exploit

    Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

    mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows an authenticated attacker to bypass the 2FA protection, enabling unauthorized a…

    mailcow mailcow-dockerized
  • High 7.9
    CVE-2024-21980 Public exploit

    Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to potentially overwrite a …

    AMD 3rd Gen AMD EPYC™ Processors AMD EPYC™ Embedded 7003 4th Gen AMD EPYC™ Processors
  • Medium 6.0
    CVE-2024-21978 Public exploit

    Improper input validation in SEV-SNP could allow a malicious hypervisor to read or overwrite guest memory potentially l…

    AMD 3rd Gen AMD EPYC™ Processors AMD EPYC™ Embedded 7003 4th Gen AMD EPYC™ Processors
  • Medium 6.0
    CVE-2023-31355 Public exploit

    Improper restriction of write operations in SNP firmware could allow a malicious hypervisor to overwrite a guest's UMC …

    AMD 3rd Gen AMD EPYC™ Processors AMD EPYC™ Embedded 7003 4th Gen AMD EPYC™ Processors
  • High 8.1
    CVE-2024-38856 Exploited Public exploit Scanner template EPSS 99%

    Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

    Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of …

    Apache Software Foundation Apache OFBiz
    KEV Aug 27, 2024
  • High 8.6
    CVE-2024-39713 Public exploit Scanner template

    Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

    A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.

    RocketChat Rocket.Chat rocket.chat npm
  • Critical 9.8
    CVE-2024-40498 Public exploit

    SQL Injection vulnerability in PuneethReddyHC Online Shopping sysstem advanced v.1.0 allows an attacker to execute arbi…

  • Critical 9.3
    CVE-2024-42008 Public exploit EPSS 34%

    A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.…

    roundcube roundcube Debian Ubuntu
  • Critical 9.3
    CVE-2024-42009 Exploited Public exploit Scanner template EPSS 83%

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to ste…

    roundcube roundcube Debian Ubuntu
    KEV Jun 9, 2025
  • High 8.8
    CVE-2024-7029 Public exploit Scanner template EPSS 43%

    Command Injection in AVTech AVM1203 (IP Camera)

    Commands can be injected over the network and executed without authentication.

    AVTECH AVM1203 (IP Camera)
  • High 8.4
    CVE-2024-41127 Public exploit

    Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its `ci-failure-comment.yml` GitHub Workflow, enabling attackers to gain `pull-requests` write access.

    Monkeytype is a minimalistic and customizable typing test. Monkeytype is vulnerable to Poisoned Pipeline Execution through Code Injection in its ci-failure-comment.yml GitHub Workflow, enabling attackers to gain pull-requests write access. The ci-failure-comm…

    monkeytypegame monkeytype
  • High 7.2
    CVE-2024-33896 Public exploit

    Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection du…

  • Medium 5.3
    CVE-2024-42461 Public exploit

    Elliptic allows BER-encoded signatures

    In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

    reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm
  • High 7.1
    CVE-2024-6529 Public exploit

    Ultimate Classified Listings < 1.4 - Reflected XSS

    The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

    Web / CMS
  • Medium 5.3
    CVE-2024-7339 Public exploit Scanner template EPSS 32%

    TVT DVR TD-2104TS-CL queryDevInfo information disclosure

    A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to inf…

    TVT DVR TD-2104TS-CL Provision-ISR DVR SH-4050A5-5L(MM) DVR TD-2108TS-HP