Web Application Detections Published in August 2024

Hitesh Kadu
Hitesh Kadu, Senior, Web Application Security Signatures Engineer
- 5 min read

In August, Qualys released QIDs targeting vulnerabilities in several widely-used software products, including JetBrains TeamCity, WordPress, LiteLLM, phpMyBackupPro, Apache OFBiz, Apache Superset, Automation Anywhere Automation 360, Microsoft IIS, Zabbix, nuxt/icon, Laravel, Jenkins, Nginx, SolarWinds Web Help Desk and OpenSSL. Customers can get more details about the following QIDs in our knowledge base. Customers should review their reports for these detections. If any of the following are reported against their applications scanned, customers should follow the steps mentioned in the solution to ensure their systems are protected against the identified vulnerabilities.

QIDTitle
150929WordPress Form Vibes Plugin: SQL Injection Vulnerability (CVE-2024-5325)
150951WordPress ERP Plugin: SQL Injection Vulnerability (CVE-2024-6666)
152002WordPress Popup Builder Plugin: Unauthorized Modification and Loss of Data Vulnerability (CVE-2024-2544)
152028WordPress UsersWP Plugin: Unauthenticated SQL Injection Vulnerability (CVE-2024-6265)
152031WordPress InstaWP Connect Plugin: Authentication Bypass Vulnerability (CVE-2024-6397)
152032WordPress Quiz Maker Plugin: Time-Based SQL Injection Vulnerability (CVE-2024-6028)
152039WordPress Profile-Builder Plugin: Privilege Escalation Vulnerability (CVE-2024-6695)
152053WordPress IQ Testimonials Plugin: Unauthenticated Arbitrary File Upload Vulnerability (CVE-2024-6314)
152054WordPress SEOPress Plugin: Unauthenticated Object Injection Vulnerability (CVE-2024-5488)
152058WordPress Brizy Page Builder Plugin: Arbitrary File Uploads Vulnerability(CVE-2024-3242)
152059WordPress Nested Pages Plugin: Cross-Site Request Forgery(CVE-2024-5943)
152063WordPress ContentLock Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-6024)
152065WordPress Flipbox Builder Plugin: PHP Object Injection Vulnerability(CVE-2024-6152)
152066WordPress Media. net Ads Manager Plugin: Arbitrary File Upload Vulnerability(CVE-2024-6431)
152067WordPress IMGspider Plugin: Arbitrary File Upload Vulnerability (CVE-2024-6319)
152068WordPress Unlimited Elements For Elementor Plugin: Time-based SQL Injection Vulnerability (CVE-2024-6166)
152069WordPress Squirrly SEO Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6497)
152070litellm Server-Side Request Forgery Vulnerability (CVE-2024-38514)
152071phpMyBackupPro v2.3 Multiple Cross-Site Scripting Vulnerabilities
152072Apache OFBiz Incorrect Authorization Vulnerability (CVE-2024-38856)
152073Apache Superset Arbitrary File Read Vulnerability (CVE-2024-34693)
152074Automation Anywhere Automation 360 Server-Side Request Forgery (SSRF) Vulnerability (CVE-2024-6922)
152075WordPress Advanced File Manager Plugin: Sensitive Information Exposure Vulnerability (CVE-2024-5598)
152076WordPress Cookie Consent Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-4869)
152077WordPress Tournamatch Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-5644)
152078WordPress WooCommerce Social Login Plugin: Unauthorized Modification of Data Vulnerability (CVE-2024-6636)
152079WordPress Laposta Plugin: Unauthenticated Full Path Disclosure Vulnerability (CVE-2024-6574)
152080WordPress WooCommerce Social Login Plugin: Authentication Bypass Vulnerability (CVE-2024-6635)
152081WordPress WooCommerce Social Login Plugin: Unauthenticated Privilege Escalation Vulnerability (CVE-2024-6637)
152082Apache Superset SQL Injection Vulnerability (CVE-2024-39887)
152083WordPress Gutenberg Forms Plugin: Arbitrary File Upload Vulnerability (CVE-2024-6313)
152084WordPress aThemes Starter Sites Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6897)
152085WordPress Happy Addons for Elementor Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6627)
152086WordPress WooCommerce Product Table Lite Plugin: Unauthorized Post Title Modification Vulnerability (CVE-2024-6458)
152087WordPress WPBakery Visual Composer Plugin: Local File Inclusion Vulnerability (CVE-2024-5709)
152089WordPress Master Currency Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-6634)
152090WordPress CRM Perks Forms Plugin: Arbitrary File Upload Vulnerability (CVE-2024-7484)
152091WordPress Ebook Store Plugin: Full Path Disclosure Vulnerability (CVE-2024-6567)
152092WordPress Sync Post With Other Site Plugin: Unauthorized Modification of Data Vulnerability (CVE-2024-6709)
152093WordPress Email Subscribers Plugin: SQL Injection Vulnerability (CVE-2024-5756)
152094WordPress wpDiscuz Plugin: HTML Injection Vulnerability (CVE-2024-6704)
152095WordPress Forminator Plugin: Sensitive Information Exposure Vulnerability (CVE-2024-7389)
152096WordPress UsersWP Plugin: Sensitive Information Exposure Vulnerability (CVE-2024-6477)
152097WordPress JetFormBuilder Plugin: Privilege Escalation Vulnerability (CVE-2024-7291)
152098Microsoft IIS Tilde Character Information Disclosure Vulnerability
152099WordPress Filester Plugin: Unauthorized Modification of Data Vulnerability (CVE-2024-7031)
152101WordPress Business Directory Plugin: CSV Injection Vulnerability (CVE-2023-5527)
152106WordPress Chatbot by Collect.chat Plugin: Cross-Site Scripting Vulnerability (CVE-2024-6498)
152107WordPress Traffic Manager Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-7485)
152108WordPress YayExtra Plugin: Arbitrary File Upload Vulnerability (CVE-2024-7257)
152109WordPress Slider By 10Web Plugin: Time-based SQL Injection Vulnerability (CVE-2024-7150)
152110WordPress WooCommerce Social Login Plugin: Authentication Bypass Vulnerability (CVE-2024-7503)
152111WordPress LearnPress Plugin: Time-based SQL Injection Vulnerability (CVE-2024-7548)
152112WordPress JS Help Desk Plugin: PHP Code Injection Vulnerability (CVE-2024-7094)
152113WordPress Christmasify! Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-7574)
152114WordPress InPost for WooCommerce Plugin: Unauthorized Access Vulnerability (CVE-2024-6500)
152115WordPress PDF Builder for WPForms Plugin: Full Path Disclosure Vulnerability (CVE-2024-7414)
152116Zabbix Improper Authorization Vulnerability (CVE-2024-22114)
152117Zabbix Remote Code Execution Vulnerability (CVE-2024-22116)
152118Zabbix Improper Authorization Vulnerability (CVE-2024-22121)
152119Zabbix Untrusted Pointer Dereference Vulnerability (CVE-2024-36461)
152120WordPress LiteSpeed Cache Plugin: Incorrect Privilege Assignment Vulnerability (CVE-2024-28000)
152121nuxt/icon Server-Side Request Forgery Vulnerability (CVE-2024-42352)
152122Laravel Environment Configuration File Detected
152123WordPress Horizontal Scrolling Announcements Plugin: SQL Injection Vulnerability (CVE-2023-5000)
152124Jenkins Arbitrary File Read Vulnerability (CVE-2024-43044)
152125Jenkins Improper Authorization Vulnerability (CVE-2024-43045)
152126WordPress Reveal Template Plugin: Full Path Disclosure Vulnerability (CVE-2024-7416)
152127WordPress affiliate-toolkit Plugin: Full Path Disclosure Vulnerability (CVE-2024-6562)
152128WordPress Zephyr Project Manager Plugin: Stored Cross-Site Scripting Vulnerability (CVE-2024-7356)
152131JetBrains TeamCity Cross-Site Scripting (XSS) Vulnerabilities (CVE-2024-43807,CVE-2024-43808,CVE-2024-43809,CVE-2024-43810)
152132JetBrains TeamCity Cross-Site Scripting (XSS) Vulnerabilities (CVE-2024-43807,CVE-2024-43808,CVE-2024-43809,CVE-2024-43810)
152133WordPress Cost Calculator Builder Plugin: SQL Injection Vulnerability (CVE-2024-43144)
152135WordPress Opti Marketing Plugin: SQL Injection Vulnerability (CVE-2024-6928)
152136WordPress Viral Signup Plugin: SQL Injection Vulnerability (CVE-2024-6926)
152137WordPress GeoDirectory Plugin: SQL Injection Vulnerability (CVE-2024-43145)
152138WordPress BerqWP Plugin: Arbitrary File Upload Vulnerability (CVE-2024-43160)
152160SolarWinds Web Help Desk Java Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2024-28986)
152161SolarWinds Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987)
520027Nginx HTTP/3 QUIC Multiple Vulnerabilities
520028Open Secure Sockets Layer (OpenSSL) Buffer Overread Vulnerability (CVE-2024-5535)
Share your Comments

Comments

Your email address will not be published. Required fields are marked *