CVEs published July 1, 2024
121 CVEs were published on July 1, 2024: 26 critical, 43 high. 3 are now in CISA KEV.
- Published
- 121
- Critical
- 26
- High
- 43
- Medium
- 52
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 41
Most affected products
- Qualcomm Snapdragon
- 15
- Splunk Enterprise · Splunk Cloud Platform
- 12
- Apache Software Foundation Apache HTTP Server
- 8
- FlowiseAI Flowise · flowise
- 6
- Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- 4
- CocoaPods
- 3
- Splunk Enterprise
- 3
- CHANGING Mobile One Time Password
- 2
- geoserver · org.geoserver.web:gs-web-app +1
- 2
- JetBrains TeamCity
- 2
Critical 26
- CVE-2024-39309ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerabilityparse-community parse-server · parse-server
- CVE-2024-38368Trunk's 'Claim your pod' could be used to obtain un-used podsCocoaPods
- CVE-2024-28200N-central Authentication BypassN-able N-central
- CVE-2024-5322N-central Authentication Bypass via Session RebindingN-able N-central
- CVE-2024-38366CoacoaPods trunk RCE in email verification system rfc-822CocoaPods
- CVE-2024-38513Fiber Session Middleware Token Injection Vulnerabilitygofiber fiber · github.com/gofiber/fiber +2
- CVE-2024-38476Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirectApache Software Foundation Apache HTTP Server
- CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.Apache Software Foundation Apache HTTP Server
- CVE-2024-36401Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoservergeoserver · org.geoserver.web:gs-web-app +2
- CVE-2024-6425Incorrect Provision of Specified Functionality vulnerability in MESbookMESbook
- CVE-2024-6424Server-Side Request Forgery vulnerability in MESbookMESbook
- CVE-2024-20081In gnss service, there is a possible out of bounds write due to improper input validation.MediaTek MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2024-20080In gnss service, there is a possible escalation of privilege due to improper certificate validation.MediaTek MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2024-20079In gnss service, there is a possible out of bounds write due to improper input validation.MediaTek MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT…
- CVE-2024-20078In venc, there is a possible out of bounds write due to type confusion.MediaTek MT6768, MT6779, MT8321, MT8385, MT8755, MT8765, MT…
- CVE-2024-37762MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.
- CVE-2024-38993rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty.
- CVE-2024-38996ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function.ag-grid-enterprise · ag-grid-community
- CVE-2024-38999jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure.requirejs
- CVE-2024-39008robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep.fast-loops
- CVE-2024-390132o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend.
- CVE-2024-39014ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set.
- CVE-2024-39015cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request.
- CVE-2024-39017agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents.
- CVE-2024-39236Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.gradio
- CVE-2024-39251An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive
High 43
- CVE-2024-38367CoacoaPods trunk sessions verification step could be manipulated for owner session hijackingCocoaPods
- CVE-2024-37298Potential memory exhaustion attack due to sparse slice deserializationgorilla schema · github.com/gorilla/schema
- CVE-2024-39573Apache HTTP Server: mod_rewrite proxy handler substitutionApache Software Foundation Apache HTTP Server
- CVE-2024-38477Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious requestApache Software Foundation Apache HTTP Server
- CVE-2024-38474Apache HTTP Server weakness with encoded question marks in backreferencesApache Software Foundation Apache HTTP Server
- CVE-2024-38473Apache HTTP Server proxy encoding problemApache Software Foundation Apache HTTP Server
- CVE-2024-38472Apache HTTP Server on WIndows UNC SSRFApache Software Foundation Apache HTTP Server
- CVE-2024-21586Junos OS: SRX Series and NFX Series: Specific valid traffic leads to a PFE crashJuniper Networks Junos OS
- CVE-2024-36982Denial of Service through null pointer reference in “cluster/config” REST endpointSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36991Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on WindowsSplunk Enterprise
- CVE-2024-36985Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk EnterpriseSplunk Enterprise
- CVE-2024-36984Remote Code Execution through Serialized Session Payload in Splunk Enterprise on WindowsSplunk Enterprise
- CVE-2024-36983Command Injection using External LookupsSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36421GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsFlowiseAI Flowise · flowise
- CVE-2024-36420GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-fileFlowiseAI Flowise · flowise
- CVE-2024-6376ejson shell parser in MongoDB Compass maybe bypassedMongoDB Compass · @mongodb-js/connection-form
- CVE-2024-23380Use After Free in GraphicsQualcomm Snapdragon
- CVE-2024-23373Use After Free in GraphicsQualcomm Snapdragon
- CVE-2024-23372Integer Overflow or Wraparound in GraphicsQualcomm Snapdragon
- CVE-2024-23368Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPCQualcomm Snapdragon
- CVE-2024-21469Permissions, Privileges, and Access Control issues in TZ Secure OSQualcomm Snapdragon
- CVE-2024-21465Buffer Over-read in Trusted Execution EnvironmentQualcomm Snapdragon
- CVE-2024-21462Buffer Over-read in TZ Secure OSQualcomm Snapdragon
- CVE-2024-21461Double Free in HLOSQualcomm Snapdragon
- CVE-2024-21460Use of Insufficiently Random Values in CoreQualcomm Snapdragon
- CVE-2023-43554Improper Restriction of Operations withing the Bounds of a Memory Buffer in DSP ServicesQualcomm Snapdragon
- CVE-2024-24749Classpath resource disclosure in GWC Web Resource API on Windows / Tomcatgeoserver · org.geoserver.web:gs-web-app +1
- CVE-2024-6387Openssh: regresshion - race condition in ssh allows rce/dosOpenSSH · Red Hat Enterprise Linux +2
- CVE-2024-4007Hard coded default credential contained in install packageABB ASPECT Enterprise · ABB NEXUS Series +1
- CVE-2024-0153Mali GPU Firmware allows improper GPU processing operationsArm Valhall GPU Firmware · Arm 5th Gen GPU Architecture Fir…
- CVE-2024-20076In Modem, there is a possible system crash due to incorrect error handling.MediaTek MT2731, MT6739, MT6761, MT6762, MT6763, MT6765, MT…
- CVE-2024-20077In Modem, there is a possible system crash due to incorrect error handling.MediaTek MT2731, MT6739, MT6761, MT6762, MT6763, MT6765, MT…
- CVE-2024-3123CHANGING Mobile One Time Password - Arbitrary File UploadCHANGING Mobile One Time Password
- CVE-2024-23736Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/
- CVE-2024-32229FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column.
- CVE-2024-32230FFmpeg 7.0 is vulnerable to Buffer Overflow.
- CVE-2024-37765Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
- CVE-2024-38991akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto.@akbr/patch-into
- CVE-2024-38992airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView.@airvertco/frappejs
- CVE-2024-38994amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend.@amoy/common
- CVE-2024-39003amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue.
- CVE-2024-39016che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign.
- CVE-2024-39249Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.
Medium, low and unrated 52
- CVE-2024-39314toy-blog administrative token leaked through the command line parameterKisaragiEffective toy-blog
- CVE-2024-39313toy-blog Improper Input Validation vulnerabilityKisaragiEffective toy-blog
- CVE-2024-39310WordPress Basil Theme Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability XjSv Basil
- CVE-2024-39305Envoy Proxy use after free when route hash policy is configured with cookie attributesenvoyproxy envoy
- CVE-2024-39303Weblate vulnerabler to improper sanitization of project backupsWeblateOrg weblate · weblate
- CVE-2024-37146GHSL-2023-248: Flowise xss in /api/v1/credentials/idFlowiseAI Flowise · flowise
- CVE-2024-37145GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idFlowiseAI Flowise · flowise
- CVE-2024-36423GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/idFlowiseAI Flowise · flowise
- CVE-2024-36387Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2Apache Software Foundation Apache HTTP Server
- CVE-2024-39879In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settingsJetBrains TeamCity
- CVE-2024-39878In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App ConnectionJetBrains TeamCity
- CVE-2024-36997Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpointSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36993Persistent Cross-site Scripting (XSS) in Web BulletinSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36995Low-privileged user could create experimental itemsSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36990Denial of Service (DoS) on the datamodel/web REST endpointSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36992Persistent Cross-site Scripting (XSS) in Dashboard ElementsSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36986Risky command safeguards bypass through Search ID query in Analytics WorkspaceSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36996Information Disclosure of user namesSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36994Persistent Cross-site Scripting (XSS) in Dashboard ElementsSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36989Low-privileged user could create notifications in Splunk Web Bulletin MessagesSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-36987Insecure File Upload in the indexing/preview REST endpointSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-20399Cisco NX-OS Software CLI Command Injection VulnerabilityCisco NX-OS Software
- CVE-2024-36422GHSL-2023-245: Flowise xss in api/v1/chatflows/idFlowiseAI Flowise · flowise
- CVE-2024-6375Missing authorization check may lead to shard key refinementMongoDB Server
- CVE-2024-34696 GeoServer's Server Status shows sensitive environmental variables and Java propertiesgeoserver · org.geoserver.web:gs-web-app +1
- CVE-2024-21482Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux Boot LoaderQualcomm Snapdragon
- CVE-2024-21466Integer Underflow (Wrap or Wraparound) in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-21458Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2024-21457Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2024-21456Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2024-6050Reflected XSS in SOWA OPACSOKRATES-software SOWA OPAC
- CVE-2024-39430In faceid servive, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2024-39429In faceid servive, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2024-39428In trusty service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2024-39427In trusty service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2024-6130Form Maker by 10Web < 1.15.26 - Admin+ Stored XSSForm Maker by 10Web
- CVE-2024-4934Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSSQuiz and Survey Master
- CVE-2024-3122CHANGING Mobile One Time Password - Arbitrary File ReadingCHANGING Mobile One Time Password
- CVE-2024-38480"Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attackKakao piccoma "Piccoma" App for Android · Kakao piccoma "Pi…
- CVE-2024-23737Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipula
- CVE-2024-32228FFmpeg 7.0 is vulnerable to Buffer Overflow.
- CVE-2024-37763MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can vie
- CVE-2024-37764MachForm up to version 19 is affected by an authenticated stored cross-site scripting.
- CVE-2024-38953phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.
- CVE-2024-38987aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep.@aofl/cli-lib
- CVE-2024-38990Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep.
- CVE-2024-38997adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults.@adolph_dudu/ratio-swiper
- CVE-2024-39000adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse.
- CVE-2024-39001ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply.@ag-grid-enterprise/charts · ag-grid-community +1
- CVE-2024-39002rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone.
- CVE-2024-39018harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query".@cat5th/key-serializer
- CVE-2024-39853adolph_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse.