---
title: "Security digest: August 5, 2024"
url: https://erroneo.us/security/2024-08-05/
description: "August 5, 2024 vulnerability digest: 1 brief (Apache OFBiz: Unauthenticated RCE (CVE-2024-38856)); 1 CISA KEV addition (Microsoft); 7 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2024-08-05
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 5, 2024

1 editorial brief, 1 known exploited (cisa kev) addition and 7 critical advisories.

## Take stock

- Act now: Apache OFBiz: Unauthenticated RCE (CVE-2024-38856) . Anyone running Apache OFBiz 18.12.15 or earlier, or a product built on OFBiz, especially with the web interface reachable from untrusted networks.
- Do you run any of these? Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-08-26.
- Go: 3 critical advisories ( github.com/IceWhaleTech/CasaOS , code.gitea.io/gitea , github.com/rudderlabs/rudder-server ). Check with govulncheck ./... .
- npm: 2 critical advisories ( nuxt , nextchat ). Check with npm audit (or: npm ls <package>) .
- Maven: 2 critical advisories ( com.xuxueli:xxl-rpc-core , org.redisson:redisson ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [Apache OFBiz: Unauthenticated RCE (CVE-2024-38856)](https://erroneo.us/security/briefs/apache-ofbiz-pre-auth-rce-cve-2024-38856/index.md): Any internet-reachable OFBiz older than 18.12.16 should be treated as compromised-until-proven-otherwise and upgraded immediately; this bug class has been exploited repeatedly.

## Known exploited (CISA KEV)

- [CVE-2018-0824](https://erroneo.us/security/cve/CVE-2018-0824/index.md) Microsoft Windows: Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability (CISA due 2024-08-26)

## Critical advisories

- [CVE-2024-34344](https://erroneo.us/security/cve/CVE-2024-34344/index.md) Nuxt vulnerable to remote code execution via the browser when running the test locally — npm nuxt >= 3.4.0, < 3.12.4 → 3.12.4
- [CVE-2023-49785](https://erroneo.us/security/cve/CVE-2023-49785/index.md) NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint — npm nextchat <= 2.11.2 → no fix
- [CVE-2023-45146](https://erroneo.us/security/cve/CVE-2023-45146/index.md) XXL-RPC Deserialization of Untrusted Data vulnerability — Maven com.xuxueli:xxl-rpc-core <= 1.7.0 → no fix
- [CVE-2023-37469](https://erroneo.us/security/cve/CVE-2023-37469/index.md) CasaOS Command Injection vulnerability — Go github.com/IceWhaleTech/CasaOS < 0.4.4 → 0.4.4
- [CVE-2023-42809](https://erroneo.us/security/cve/CVE-2023-42809/index.md) Redisson vulnerable to Deserialization of Untrusted Data — Maven org.redisson:redisson < 3.22.0 → 3.22.0
- [CVE-2024-6886](https://erroneo.us/security/cve/CVE-2024-6886/index.md) Gitea Cross-site Scripting Vulnerability — Go code.gitea.io/gitea < 1.22.1 → 1.22.1
- [CVE-2023-30625](https://erroneo.us/security/cve/CVE-2023-30625/index.md) rudder-server is vulnerable to SQL injection — Go github.com/rudderlabs/rudder-server < 1.3.0-rc.1 → 1.3.0-rc.1

---
Source page: https://erroneo.us/security/2024-08-05/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt