CVEs published July 2, 2024
135 CVEs were published on July 2, 2024: 10 critical, 39 high. 1 is now in CISA KEV.
- Published
- 135
- Critical
- 10
- High
- 39
- Medium
- 82
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 27
Most affected products
- Samsung Mobile Devices
- 26
- Kiloview P1/P2
- 10
- Dell PowerScale OneFS
- 7
- OpenHarmony
- 7
- Johnson Controls American Dynamics Illustra Essentials Gen
- 4
- aimeos ai-admin-graphql · aimeos/ai-admin-graphql
- 2
- Delinea Centrify PAS
- 2
- SourceCodester Home Owners Collection Management System
- 2
- stylemix Cost Calculator Builder
- 2
- thimpress LearnPress – WordPress LMS Plugin for Create and…
- 2
Critical 10
- CVE-2024-4708mySCADA myPRO Use of Hard-coded PasswordmySCADA myPRO
- CVE-2023-24531Output of "go env" does not sanitize values in cmd/goGo toolchain cmd/go · toolchain
- CVE-2024-36404GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressionsgeotools · org.geotools:gt-app-schema +2
- CVE-2024-32755American Dynamics Illustra Essentials Gen 4 - Log Filter Input ValidationJohnson Controls American Dynamics Illustra Essentials Gen
- CVE-2023-41921Download of Code Without Integrity Check in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2023-41920Authentication Bypass by Primary Weakness in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2023-41919Use of Hard-coded Credentials in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2023-41918Missing Authentication for Critical Function in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2023-41917Improper input validation in Kiloview P1/P2 devices allows for remote code executionKiloview P1/P2
- CVE-2024-6172Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribeicegram Email Subscribers & Newsletters – Email Marketing,…
High 39
- CVE-2024-24791Denial of service due to improper 100-continue handling in net/httpGo standard library net/http · stdlib
- CVE-2022-30636Limited directory traversal vulnerability on Windows in golang.org/x/cryptogolang.org/x/crypto/acme/autocert · golang.org/x/crypto
- CVE-2024-39323aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin accountaimeos ai-admin-graphql · aimeos/ai-admin-graphql
- CVE-2024-4467Qemu-kvm: 'qemu-img info' leads to host file read/writeqemu · Red Hat Advanced Virtualization for RHEL +2
- CVE-2024-5865Arbitrary File Reading in Centrify PASDelinea Centrify PAS
- CVE-2024-3826Broken SAML ValidationAkana API Platform
- CVE-2024-4897Remote Code Execution in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-38519yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitizationyt-dlp · ytdl-org youtube-dl
- CVE-2024-34122T5 Acrobat Vulnerability - Exploitable crash in DecodeTileAdobe Acrobat for Edge
- CVE-2024-34595Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activitiSamsung Mobile Devices
- CVE-2024-34593Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to exSamsung Mobile Devices
- CVE-2024-34587Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attSamsung Mobile Devices
- CVE-2024-34585Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.Samsung Mobile Devices
- CVE-2024-20895Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP featuresSamsung Mobile Devices
- CVE-2024-20891Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged acSamsung Mobile Devices
- CVE-2024-20888Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities.Samsung Mobile Devices
- CVE-2024-4836LFI in sites managed by Edito CMSEdito CMS
- CVE-2024-37077Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-37185Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-36260Arkcompiler Ets Runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-36243Arkcompiler Ets Runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2024-37030Arkcompiler Ets Runtime has a use after free vulnerabilityOpenHarmony
- CVE-2023-41926Insufficiently protected credentials in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2023-41923Weak Password Requirements in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2023-41922Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2024-37479WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.8.1 - Contributor+ Local File Inclusion vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2024-5767Sitetweet <= 0.2 - Stored XSS via CSRFsitetweet
- CVE-2024-5606Quiz And Survey Master < 9.0.2 - Contributor+ SQLiQuiz and Survey Master
- CVE-2024-5349LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusionchoijun LA-Studio Element Kit for Elementor
- CVE-2024-4679Folder Permission Vulnerability in JP1/Extensible SNMP AgentHitachi JP1/Extensible SNMP Agent for Windows · Hitachi… +1
- CVE-2022-25478Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read
- CVE-2022-25480Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read
- CVE-2023-51776Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code.
- CVE-2024-22106Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cau
- CVE-2024-25086Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code.
- CVE-2024-25088Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code.
- CVE-2024-26314Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary co
- CVE-2024-39206An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due
- CVE-2024-39894OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an Obs
Medium, low and unrated 86
- CVE-2024-6453itsourcecode Farm Management System sql injectionitsourcecode Farm Management System
- CVE-2024-39326SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a SkillNationalSecurityAgency skills-service
- CVE-2024-39325aimeos/ai-controller-frontend doesn't reset payment status in basketaimeos ai-controller-frontend · aimeos/ai-controller-fronte…
- CVE-2024-39322aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required recordsaimeos ai-admin-jsonadm · aimeos/ai-admin-jsonadm
- CVE-2024-39324aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own servicesaimeos ai-admin-graphql · aimeos/ai-admin-graphql
- CVE-2024-39315Pomerium exposed OAuth2 access and ID tokens in user info endpoint responsepomerium · github.com/pomerium/pomerium
- CVE-2024-6452linlinjava litemall AdminGoodscontroller.java sql injectionlinlinjava litemall
- CVE-2024-38537Inclusion of Untrusted polyfill.io Code Vulnerability in fides.jsethyca fides · ethyca-fides
- CVE-2024-6382Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.MongoDB Rust Driver · mongodb
- CVE-2024-6381MongoDB C Driver bson_strfreev may be susceptible to integer overflowMongoDB libbson
- CVE-2024-5866Arbitrary Directory Listing in Centrify PASDelinea Centrify PAS
- CVE-2024-39316Rack ReDoS Vulnerability in HTTP Accept Headers Parsingrack
- CVE-2024-32932American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interfaceJohnson Controls American Dynamics Illustra Essentials Gen
- CVE-2024-32757American Dynamics Illustra Essentials Gen 4 - Linux Credential LeakJohnson Controls American Dynamics Illustra Essentials Gen
- CVE-2024-32756American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - LinuxJohnson Controls American Dynamics Illustra Essentials Gen
- CVE-2024-6441ORIPA LoaderXML.java deserializationORIPA
- CVE-2024-6264Post Meta Data Manager <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scriptinggandhihitesh9 Post Meta Data Manager
- CVE-2024-6099LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registrationthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-6088LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypassthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-4268Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocksultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…
- CVE-2024-6440SourceCodester Home Owners Collection Management System sql injectionSourceCodester Home Owners Collection Management System
- CVE-2024-6439SourceCodester Home Owners Collection Management System unrestricted uploadSourceCodester Home Owners Collection Management System
- CVE-2024-6438Hitout Carsale OrderController.java sql injectionHitout Carsale
- CVE-2024-6012Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creationstylemix Cost Calculator Builder
- CVE-2024-6011Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scriptingstylemix Cost Calculator Builder
- CVE-2024-34601Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launcSamsung Mobile GalaxyStore
- CVE-2024-34600Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copySamsung Mobile Samsung Flow
- CVE-2024-34599Improper input validation in Tips prior to version 6.2.9.4 in Android 14 allows local attacker to send broadcast with Tips' privilege.Samsung Mobile Tips
- CVE-2024-34597Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandSamsung Mobile Samsung Health
- CVE-2024-34596Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the Samsung Mobile SmartThings
- CVE-2024-34594Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address.Samsung Mobile Devices
- CVE-2024-34592Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporSamsung Mobile Devices
- CVE-2024-34591Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackersSamsung Mobile Devices
- CVE-2024-34590Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackersSamsung Mobile Devices
- CVE-2024-34589Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporarSamsung Mobile Devices
- CVE-2024-34588Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporarSamsung Mobile Devices
- CVE-2024-34586Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy.Samsung Mobile Devices
- CVE-2024-34583Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier.Samsung Mobile Devices
- CVE-2024-20901Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-ofSamsung Mobile Devices
- CVE-2024-20900Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authenticSamsung Mobile Devices
- CVE-2024-20899Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to Samsung Mobile Devices
- CVE-2024-20898Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers Samsung Mobile Devices
- CVE-2024-20897Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to Samsung Mobile Devices
- CVE-2024-20896Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get seSamsung Mobile Devices
- CVE-2024-20894Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authenticatSamsung Mobile Devices
- CVE-2024-20893Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruptionSamsung Mobile Devices
- CVE-2024-20892Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors.Samsung Mobile Devices
- CVE-2024-20890Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior.Samsung Mobile Devices
- CVE-2024-20889Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices.Samsung Mobile Devices
- CVE-2024-5260Sina Extension for Elementor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parametershaonsina Sina Extension for Elementor
- CVE-2024-36278Arkcompiler Ets Runtime has a type confusion vulnerabilityOpenHarmony
- CVE-2024-31071Arkcompiler Ets Runtime has a type confusion vulnerabilityOpenHarmony
- CVE-2024-38857Reflected links in visuals facilitate phishing attacksCheckmk
- CVE-2023-41928Remote server offers deprecated TLS protocol in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2023-41927Weak TLS Cipher Suites Supported in Kiloview P1/P2 devicesKiloview P1/P2
- CVE-2024-5544Media Library Assistant <= 3.17 - Reflected Cross-Site Scriptingdglingren Media Library Assistant
- CVE-2024-5545Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorizationstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2024-3513Ultimate Blocks – WordPress Blocks Plugin <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attributeultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…
- CVE-2024-5504Rife Elementor Extensions & Templates <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widgetapollo13themes Rife Extensions & Templates for Elementor
- CVE-2024-37126Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2024-37134Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2024-37133Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2024-37132Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability.Dell PowerScale OneFS
- CVE-2024-32854Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2024-32853Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability.Dell PowerScale OneFS
- CVE-2024-32852Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability.Dell PowerScale OneFS
- CVE-2024-5219Easy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scriptingsupsysticcom Easy Google Maps
- CVE-2024-0158Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2024-4627Rank Math SEO < 1.0.219 - Authenticated Stored XSSRank Math SEO
- CVE-2024-3999EazyDocs < 2.5.0 - Admin+ Stored XSSEazyDocs
- CVE-2024-1427The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tagtechlabpro1 The Post Grid – Shortcode, Gutenberg Blocks and…
- CVE-2024-5419Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attributevoidthemes Void Contact Form 7 Widget For Elementor Page Bu…
- CVE-2024-5938Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodesur Boot Store
- CVE-2024-2819File Permission Vulnerability in Hitachi Ops Center Common ServicesHitachi Ops Center Common Services
- CVE-2022-25477Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read
- CVE-2022-25479Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read
- CVE-2023-51777Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error.
- CVE-2023-51778Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error and Denial of
- CVE-2024-22102Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error.
- CVE-2024-22103Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error and Denial of
- CVE-2024-22104Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error and Denial of
- CVE-2024-22105Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error.
- CVE-2024-25087Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error.
- CVE-2024-39119idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close.
- CVE-2024-39143A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious propert
- CVE-2024-39891In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to