# CVEs published 2024-07-17

86 CVEs were published on July 17, 2024: 15 critical, 23 high. Days are UTC.

- [CVE-2024-39682](https://cve.now/CVE-2024-39682.md): WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt (CVSS 6.4, XjSv Cooked)
- [CVE-2024-39681](https://cve.now/CVE-2024-39681.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes (CVSS 5.4, XjSv Cooked)
- [CVE-2024-39680](https://cve.now/CVE-2024-39680.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save (CVSS 5.4, XjSv Cooked)
- [CVE-2024-39679](https://cve.now/CVE-2024-39679.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template Reset (CVSS 4.3, XjSv Cooked)
- [CVE-2024-39678](https://cve.now/CVE-2024-39678.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs (CVSS 4.3, XjSv Cooked)
- [CVE-2024-32981](https://cve.now/CVE-2024-32981.md): Cross-site Scripting vulnerability with encoded payload in silverstripe/framework (CVSS 5.4, silverstripe-framework · silverstripe/framework)
- [CVE-2024-29885](https://cve.now/CVE-2024-29885.md): Reports are still accessible even when \`canView()\` returns false in silverstripe/reports (CVSS 4.3, silverstripe-reports · silverstripe/reports)
- [CVE-2024-28796](https://cve.now/CVE-2024-28796.md): IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM ClearQuest)
- [CVE-2024-40633](https://cve.now/CVE-2024-40633.md): Customer data leak via adjustments API endpoint in Sylius (CVSS 5.3, Sylius · sylius/sylius)
- [CVE-2024-40636](https://cve.now/CVE-2024-40636.md): Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness (CVSS 5.3, SteeltoeOSS security-advisories · Steeltoe.Discovery.Eur… +3)
- [CVE-2024-40641](https://cve.now/CVE-2024-40641.md): Unsigned code template execution through workflows in projectdiscovery/nuclei (CVSS 7.4, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2024-40640](https://cve.now/CVE-2024-40640.md): Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac (CVSS 2.9, matrix-org vodozemac · vodozemac)
- [CVE-2023-42010](https://cve.now/CVE-2023-42010.md): IBM Sterling B2B Integrator Standard Edition information disclosure (CVSS 3.1, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2024-38870](https://cve.now/CVE-2024-38870.md): Stored XSS (CVSS 3.5, ManageEngine OpManager, OpManager Plus, OpManager MSP, OpMa…)
- [CVE-2024-20396](https://cve.now/CVE-2024-20396.md): A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive… (CVSS 5.3, Cisco Webex Teams)
- [CVE-2024-20395](https://cve.now/CVE-2024-20395.md): A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access… (CVSS 6.4, Cisco Webex Teams)
- [CVE-2024-20400](https://cve.now/CVE-2024-20400.md): A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to… (CVSS 4.7, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2024-20429](https://cve.now/CVE-2024-20429.md): A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote… (CVSS 6.5, Cisco Secure Email)
- [CVE-2024-20416](https://cve.now/CVE-2024-20416.md): A vulnerability in the upload module of Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker… (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20323](https://cve.now/CVE-2024-20323.md): A vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection… (CVSS 7.5, Cisco Intelligent Node Manager · Cisco Intelligent Node Sof…)
- [CVE-2024-20296](https://cve.now/CVE-2024-20296.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote… (CVSS 4.7, Cisco Identity Services Engine Software)
- [CVE-2024-20435](https://cve.now/CVE-2024-20435.md): A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary… (CVSS 8.8, Cisco Secure Web Appliance)
- [CVE-2024-20419](https://cve.now/CVE-2024-20419.md): A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote… (CVSS 10.0, Cisco Smart Software Manager On-Prem)
- [CVE-2024-20401](https://cve.now/CVE-2024-20401.md): A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated… (CVSS 9.8, Cisco Secure Email)
- [CVE-2024-6830](https://cve.now/CVE-2024-6830.md): SourceCodester Simple Inventory Management System Order action.php sql injection (CVSS 5.3, SourceCodester Simple Inventory Management System)
- [CVE-2023-4976](https://cve.now/CVE-2023-4976.md): FlashBlade Authentication Mechanism Vulnerability (CVSS 9.3, PureStorage FlashBlade)
- [CVE-2023-7272](https://cve.now/CVE-2023-7272.md): Eclipse Parsson stack overflow with deeply nested objects (CVSS 8.6, Eclipse Foundation Parsson · org.eclipse.parsson:parsson)
- [CVE-2024-29120](https://cve.now/CVE-2024-29120.md): Apache StreamPark: Information leakage vulnerability (CVSS 5.9, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2024-6834](https://cve.now/CVE-2024-6834.md): Imperative Local Command Injection allows Activity Masking (CVSS 9.0, Open Mainframe Project Zowe)
- [CVE-2024-6833](https://cve.now/CVE-2024-6833.md): Zowe CLI Auto-Init Leaks Credentials Locally (CVSS 5.9, Open Mainframe Project Zowe · @zowe/cli)
- [CVE-2024-23471](https://cve.now/CVE-2024-23471.md): SolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23470](https://cve.now/CVE-2024-23470.md): SolarWinds Access Rights Manager (ARM) UserScriptHumster Exposed Dangerous Method Remote Command Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-28074](https://cve.now/CVE-2024-28074.md): SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23467](https://cve.now/CVE-2024-23467.md): SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23466](https://cve.now/CVE-2024-23466.md): SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23465](https://cve.now/CVE-2024-23465.md): SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability (CVSS 8.3, SolarWinds Access Rights Manager)
- [CVE-2024-23469](https://cve.now/CVE-2024-23469.md): SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23475](https://cve.now/CVE-2024-23475.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23472](https://cve.now/CVE-2024-23472.md): SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-28993](https://cve.now/CVE-2024-28993.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-28992](https://cve.now/CVE-2024-28992.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-23468](https://cve.now/CVE-2024-23468.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-23474](https://cve.now/CVE-2024-23474.md): SolarWinds Access Rights Manager (ARM) deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure… (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-5471](https://cve.now/CVE-2024-5471.md): Agent takeover (CVSS 8.8, ManageEngine DDI Central)
- [CVE-2024-27311](https://cve.now/CVE-2024-27311.md): Arbitrary file writing (CVSS 5.5, ManageEngine DDI Central)
- [CVE-2024-31411](https://cve.now/CVE-2024-31411.md): Apache StreamPipes: Potential remote code execution (RCE) via file upload (CVSS 6.0, Apache Software Foundation Apache StreamPipes · org.apac… +1)
- [CVE-2024-31979](https://cve.now/CVE-2024-31979.md): Apache StreamPipes: Possibility of SSRF in pipeline element installation process (CVSS 7.5, Apache Software Foundation Apache StreamPipes · streampi… +1)
- [CVE-2024-30471](https://cve.now/CVE-2024-30471.md): Apache StreamPipes: Potential creation of multiple identical accounts (CVSS 5.3, Apache Software Foundation Apache StreamPipes · streampi… +1)
- [CVE-2024-36491](https://cve.now/CVE-2024-36491.md): FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. (CVSS 9.8, Century Systems Co. FutureNet NXR-1300 series · Century… +20)
- [CVE-2024-36475](https://cve.now/CVE-2024-36475.md): FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. (CVSS 7.2, Century Systems Co. FutureNet NXR-1300 series · Century… +20)
- [CVE-2024-31070](https://cve.now/CVE-2024-31070.md): Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century… (CVSS 9.1, Century Systems Co. FutureNet NXR-1300 series · Century… +20)
- [CVE-2024-40617](https://cve.now/CVE-2024-40617.md): Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). (CVSS 6.5, Fujitsu Limited FUJITSU Network Edgiot GW1500)
- [CVE-2024-29737](https://cve.now/CVE-2024-29737.md): Apache StreamPark (incubating): maven build params could trigger remote command execution (CVSS 8.8, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2023-52291](https://cve.now/CVE-2023-52291.md): Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution (CVSS 8.8, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2024-39877](https://cve.now/CVE-2024-39877.md): Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler (CVSS 8.8, Apache Software Foundation apache-airflow · airflow +1)
- [CVE-2024-39863](https://cve.now/CVE-2024-39863.md): Apache Airflow: Potential XSS Vulnerability (CVSS 8.1, Apache Software Foundation apache-airflow · apache-airflow)
- [CVE-2024-5582](https://cve.now/CVE-2024-5582.md): Schema & Structured Data for WP & AMP \<= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute (CVSS 6.4, magazine3 Schema & Structured Data for WP & AMP)
- [CVE-2024-6220](https://cve.now/CVE-2024-6220.md): 简数采集器 (Keydatas) \<= 2.5.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, zhengdon 简数采集器)
- [CVE-2024-5703](https://cve.now/CVE-2024-5703.md): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \<= 5.7.26 - Missing Authorization (CVSS 4.3, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-5251](https://cve.now/CVE-2024-5251.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-6467](https://cve.now/CVE-2024-6467.md): BookingPress Appointment Booking \<= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation (CVSS 8.8, reputeinfosystems Appointment Booking Calendar Plugin and S…)
- [CVE-2024-6669](https://cve.now/CVE-2024-6669.md): AI ChatBot for WordPress – WPBot \<= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2024-5253](https://cve.now/CVE-2024-5253.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-6660](https://cve.now/CVE-2024-6660.md): BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin \<= 1.1.5 - Missing Authorization to Authenticated… (CVSS 8.8, reputeinfosystems Appointment Booking Calendar Plugin and S…)
- [CVE-2024-5252](https://cve.now/CVE-2024-5252.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-5255](https://cve.now/CVE-2024-5255.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-5254](https://cve.now/CVE-2024-5254.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-6033](https://cve.now/CVE-2024-6033.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event… (CVSS 4.3, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2024-41010](https://cve.now/CVE-2024-41010.md): bpf: Fix too early release of tcx\_entry (CVSS 7.8, Linux)
- [CVE-2024-41009](https://cve.now/CVE-2024-41009.md): bpf: Fix overrunning reservations in ringbuf (CVSS 7.8, Linux)
- [CVE-2024-6808](https://cve.now/CVE-2024-6808.md): itsourcecode Simple Task List signUp.php insertUserRecord sql injection (CVSS 6.9, itsourcecode Simple Task List)
- [CVE-2024-6807](https://cve.now/CVE-2024-6807.md): SourceCodester Student Study Center Desk Management System HTTP POST Request Users.php cross site scripting (CVSS 4.8, SourceCodester Student Study Center Desk Management System)
- [CVE-2024-6803](https://cve.now/CVE-2024-6803.md): itsourcecode Document Management System insert.php sql injection (CVSS 5.3, itsourcecode Document Management System)
- [CVE-2024-6535](https://cve.now/CVE-2024-6535.md): Skupper: potential authentication bypass to skupper console via forged cookies (CVSS 5.3, skupper · Red Hat Service Interconnect 1.4 for RHEL +3)
- [CVE-2024-6802](https://cve.now/CVE-2024-6802.md): SourceCodester Computer Laboratory Management System Master.php sql injection (CVSS 5.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-6801](https://cve.now/CVE-2024-6801.md): SourceCodester Online Student Management System add-students.php unrestricted upload (CVSS 5.3, SourceCodester Online Student Management System)
- [CVE-2024-6595](https://cve.now/CVE-2024-6595.md): Uncontrolled Search Path Element in GitLab (CVSS 3.0, GitLab)
- [CVE-2023-43971](https://cve.now/CVE-2023-43971.md): Cross Site Scripting vulnerability in ACG-faka v1.1.7 allows a remote attacker to execute arbitrary code via the encode parameter in… (CVSS 6.1)
- [CVE-2024-38446](https://cve.now/CVE-2024-38446.md): NATO NCI ANET 3.4.1 mishandles report ownership. (CVSS 6.5)
- [CVE-2024-38447](https://cve.now/CVE-2024-38447.md): NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs… (CVSS 8.1)
- [CVE-2024-39124](https://cve.now/CVE-2024-39124.md): In Roundup before 2.4.0, classhelpers (\_generic.help.html) allow XSS. (CVSS 6.1, roundup)
- [CVE-2024-39125](https://cve.now/CVE-2024-39125.md): Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. (CVSS 5.4, roundup)
- [CVE-2024-39126](https://cve.now/CVE-2024-39126.md): Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. (CVSS 5.4, roundup)
- [CVE-2024-40119](https://cve.now/CVE-2024-40119.md): Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF)… (CVSS 8.8)
- [CVE-2024-40402](https://cve.now/CVE-2024-40402.md): A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. (CVSS 6.3)
- [CVE-2024-40492](https://cve.now/CVE-2024-40492.md): Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function. (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.