# CVEs published 2024-07-02

135 CVEs were published on July 2, 2024: 10 critical, 39 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-4708](https://cve.now/CVE-2024-4708.md): mySCADA myPRO Use of Hard-coded Password (CVSS 9.3, mySCADA myPRO)
- [CVE-2024-6453](https://cve.now/CVE-2024-6453.md): itsourcecode Farm Management System sql injection (CVSS 5.3, itsourcecode Farm Management System)
- [CVE-2024-24791](https://cve.now/CVE-2024-24791.md): Denial of service due to improper 100-continue handling in net/http (CVSS 7.5, Go standard library net/http · stdlib)
- [CVE-2024-39326](https://cve.now/CVE-2024-39326.md): SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill (CVSS 4.4, NationalSecurityAgency skills-service)
- [CVE-2024-39325](https://cve.now/CVE-2024-39325.md): aimeos/ai-controller-frontend doesn't reset payment status in basket (CVSS 5.3, aimeos ai-controller-frontend · aimeos/ai-controller-fronte…)
- [CVE-2024-39322](https://cve.now/CVE-2024-39322.md): aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records (CVSS 5.5, aimeos ai-admin-jsonadm · aimeos/ai-admin-jsonadm)
- [CVE-2024-39324](https://cve.now/CVE-2024-39324.md): aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services (CVSS 3.8, aimeos ai-admin-graphql · aimeos/ai-admin-graphql)
- [CVE-2024-39315](https://cve.now/CVE-2024-39315.md): Pomerium exposed OAuth2 access and ID tokens in user info endpoint response (CVSS 5.7, pomerium · github.com/pomerium/pomerium)
- [CVE-2024-6452](https://cve.now/CVE-2024-6452.md): linlinjava litemall AdminGoodscontroller.java sql injection (CVSS 5.3, linlinjava litemall)
- [CVE-2023-24531](https://cve.now/CVE-2023-24531.md): Output of "go env" does not sanitize values in cmd/go (CVSS 9.8, Go toolchain cmd/go · toolchain)
- [CVE-2022-30636](https://cve.now/CVE-2022-30636.md): Limited directory traversal vulnerability on Windows in golang.org/x/crypto (CVSS 7.5, golang.org/x/crypto/acme/autocert · golang.org/x/crypto)
- [CVE-2024-38537](https://cve.now/CVE-2024-38537.md): Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js (CVSS 0.0, ethyca fides · ethyca-fides)
- [CVE-2024-6382](https://cve.now/CVE-2024-6382.md): Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands. (CVSS 6.4, MongoDB Rust Driver · mongodb)
- [CVE-2024-6381](https://cve.now/CVE-2024-6381.md): MongoDB C Driver bson\_strfreev may be susceptible to integer overflow (CVSS 4.0, MongoDB libbson)
- [CVE-2024-39323](https://cve.now/CVE-2024-39323.md): aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account (CVSS 7.1, aimeos ai-admin-graphql · aimeos/ai-admin-graphql)
- [CVE-2024-5866](https://cve.now/CVE-2024-5866.md): Arbitrary Directory Listing in Centrify PAS (CVSS 5.0, Delinea Centrify PAS)
- [CVE-2024-39316](https://cve.now/CVE-2024-39316.md): Rack ReDoS Vulnerability in HTTP Accept Headers Parsing (CVSS 6.5, rack)
- [CVE-2024-4467](https://cve.now/CVE-2024-4467.md): Qemu-kvm: 'qemu-img info' leads to host file read/write (CVSS 7.8, qemu · Red Hat Advanced Virtualization for RHEL +2)
- [CVE-2024-5865](https://cve.now/CVE-2024-5865.md): Arbitrary File Reading in Centrify PAS (CVSS 7.7, Delinea Centrify PAS)
- [CVE-2024-3826](https://cve.now/CVE-2024-3826.md): Broken SAML Validation (CVSS 8.6, Akana API Platform)
- [CVE-2024-4897](https://cve.now/CVE-2024-4897.md): Remote Code Execution in parisneo/lollms-webui (CVSS 8.4, parisneo/lollms-webui)
- [CVE-2024-32932](https://cve.now/CVE-2024-32932.md): American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface (CVSS 6.8, Johnson Controls American Dynamics Illustra Essentials Gen)
- [CVE-2024-32757](https://cve.now/CVE-2024-32757.md): American Dynamics Illustra Essentials Gen 4 - Linux Credential Leak (CVSS 6.8, Johnson Controls American Dynamics Illustra Essentials Gen)
- [CVE-2024-32756](https://cve.now/CVE-2024-32756.md): American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - Linux (CVSS 6.8, Johnson Controls American Dynamics Illustra Essentials Gen)
- [CVE-2024-38519](https://cve.now/CVE-2024-38519.md): yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization (CVSS 7.8, yt-dlp · ytdl-org youtube-dl)
- [CVE-2024-34122](https://cve.now/CVE-2024-34122.md): T5 Acrobat Vulnerability - Exploitable crash in DecodeTile (CVSS 7.8, Adobe Acrobat for Edge)
- [CVE-2024-36404](https://cve.now/CVE-2024-36404.md): GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions (CVSS 9.8, geotools · org.geotools:gt-app-schema +2)
- [CVE-2024-32755](https://cve.now/CVE-2024-32755.md): American Dynamics Illustra Essentials Gen 4 - Log Filter Input Validation (CVSS 9.1, Johnson Controls American Dynamics Illustra Essentials Gen)
- [CVE-2024-6441](https://cve.now/CVE-2024-6441.md): ORIPA LoaderXML.java deserialization (CVSS 5.3, ORIPA)
- [CVE-2024-6264](https://cve.now/CVE-2024-6264.md): Post Meta Data Manager \<= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gandhihitesh9 Post Meta Data Manager)
- [CVE-2024-6099](https://cve.now/CVE-2024-6099.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.8.1 - Unauthenticated Bypass to User Registration (CVSS 5.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-6088](https://cve.now/CVE-2024-6088.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass (CVSS 5.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-4268](https://cve.now/CVE-2024-4268.md): Ultimate Blocks – WordPress Blocks Plugin \<= 3.1.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Multiple Blocks (CVSS 6.4, ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…)
- [CVE-2024-6440](https://cve.now/CVE-2024-6440.md): SourceCodester Home Owners Collection Management System sql injection (CVSS 5.3, SourceCodester Home Owners Collection Management System)
- [CVE-2024-6439](https://cve.now/CVE-2024-6439.md): SourceCodester Home Owners Collection Management System unrestricted upload (CVSS 5.3, SourceCodester Home Owners Collection Management System)
- [CVE-2024-6438](https://cve.now/CVE-2024-6438.md): Hitout Carsale OrderController.java sql injection (CVSS 5.3, Hitout Carsale)
- [CVE-2024-6012](https://cve.now/CVE-2024-6012.md): Cost Calculator Builder \<= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation (CVSS 4.3, stylemix Cost Calculator Builder)
- [CVE-2024-6011](https://cve.now/CVE-2024-6011.md): Cost Calculator Builder \<= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, stylemix Cost Calculator Builder)
- [CVE-2024-34601](https://cve.now/CVE-2024-34601.md): Improper verification of intent by broadcast receiver vulnerability in GalaxyStore prior to version 4.5.81.0 allows local attackers to launc (CVSS 5.9, Samsung Mobile GalaxyStore)
- [CVE-2024-34600](https://cve.now/CVE-2024-34600.md): Improper verification of intent by broadcast receiver vulnerability in Samsung Flow prior to version 4.9.13.0 allows local attackers to copy (CVSS 4.4, Samsung Mobile Samsung Flow)
- [CVE-2024-34599](https://cve.now/CVE-2024-34599.md): Improper input validation in Tips prior to version 6.2.9.4 in Android 14 allows local attacker to send broadcast with Tips&#39; privilege. (CVSS 4.0, Samsung Mobile Tips)
- [CVE-2024-34597](https://cve.now/CVE-2024-34597.md): Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sand (CVSS 4.4, Samsung Mobile Samsung Health)
- [CVE-2024-34596](https://cve.now/CVE-2024-34596.md): Improper authentication in SmartThings prior to version 1.8.17 allows remote attackers to bypass the expiration date for members set by the (CVSS 5.9, Samsung Mobile SmartThings)
- [CVE-2024-34595](https://cve.now/CVE-2024-34595.md): Improper access control in clickAdapterItem of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activiti (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2024-34594](https://cve.now/CVE-2024-34594.md): Exposure of sensitive information in proc file system prior to SMR Jul-2024 Release 1 allows local attackers to read kernel memory address. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2024-34593](https://cve.now/CVE-2024-34593.md): Improper input validation in parsing and distributing RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to ex (CVSS 7.5, Samsung Mobile Devices)
- [CVE-2024-34592](https://cve.now/CVE-2024-34592.md): Improper input validation in parsing RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger tempor (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2024-34591](https://cve.now/CVE-2024-34591.md): Improper input validation in parsing an item data from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2024-34590](https://cve.now/CVE-2024-34590.md): Improper input validation혻in parsing an item type from RTCP SDES packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2024-34589](https://cve.now/CVE-2024-34589.md): Improper input validation in parsing RTCP RR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporar (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2024-34588](https://cve.now/CVE-2024-34588.md): Improper input validation혻in parsing RTCP SR packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote attackers to trigger temporar (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2024-34587](https://cve.now/CVE-2024-34587.md): Improper input validation in parsing application information from RTCP packet in librtp.so prior to SMR Jul-2024 Release 1 allows remote att (CVSS 7.5, Samsung Mobile Devices)
- [CVE-2024-34586](https://cve.now/CVE-2024-34586.md): Improper access control in KnoxCustomManagerService prior to SMR Jul-2024 Release 1 allows local attackers to configure Knox privacy policy. (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2024-34585](https://cve.now/CVE-2024-34585.md): Improper access control in launchApp of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2024-34583](https://cve.now/CVE-2024-34583.md): Improper access control in system property prior to SMR Jul-2024 Release 1 allows local attackers to get device identifier. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20901](https://cve.now/CVE-2024-20901.md): Improper input validation in copying data to buffer cache in libsaped prior to SMR Jul-2024 Release 1 allows local attackers to write out-of (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2024-20900](https://cve.now/CVE-2024-20900.md): Improper authentication in MTP application prior to SMR Jul-2024 Release 1 allows local attackers to enter MTP mode without proper authentic (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20899](https://cve.now/CVE-2024-20899.md): Use of implicit intent for sensitive communication in RCS function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20898](https://cve.now/CVE-2024-20898.md): Use of implicit intent for sensitive communication in SoftphoneClient in IMS service prior to SMR Jul-2024 Release 1 allows local attackers (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20897](https://cve.now/CVE-2024-20897.md): Use of implicit intent for sensitive communication in FCM function in IMS service prior to SMR Jul-2024 Release 1 allows local attackers to (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20896](https://cve.now/CVE-2024-20896.md): Use of implicit intent for sensitive communication in Configuration message prior to SMR Jul-2024 Release 1 allows local attackers to get se (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2024-20895](https://cve.now/CVE-2024-20895.md): Improper access control in Dar service prior to SMR Jul-2024 Release 1 allows local attackers to bypass restriction for calling SDP features (CVSS 7.7, Samsung Mobile Devices)
- [CVE-2024-20894](https://cve.now/CVE-2024-20894.md): Improper handling of exceptional conditions in Secure Folder prior to SMR Jul-2024 Release 1 allows physical attackers to bypass authenticat (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2024-20893](https://cve.now/CVE-2024-20893.md): Improper input validation in libmediaextractorservice.so prior to SMR Jul-2024 Release 1 allows local attackers to trigger memory corruption (CVSS 6.1, Samsung Mobile Devices)
- [CVE-2024-20892](https://cve.now/CVE-2024-20892.md): Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. (CVSS 6.5, Samsung Mobile Devices)
- [CVE-2024-20891](https://cve.now/CVE-2024-20891.md): Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged ac (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2024-20890](https://cve.now/CVE-2024-20890.md): Improper input validation in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to trigger abnormal behavior. (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2024-20889](https://cve.now/CVE-2024-20889.md): Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows adjacent attackers to pair with devices. (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2024-20888](https://cve.now/CVE-2024-20888.md): Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2024-4836](https://cve.now/CVE-2024-4836.md): LFI in sites managed by Edito CMS (CVSS 7.5, Edito CMS)
- [CVE-2024-5260](https://cve.now/CVE-2024-5260.md): Sina Extension for Elementor \<= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via read\_more\_text Parameter (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2024-37077](https://cve.now/CVE-2024-37077.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 8.2, OpenHarmony)
- [CVE-2024-37185](https://cve.now/CVE-2024-37185.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 8.2, OpenHarmony)
- [CVE-2024-36260](https://cve.now/CVE-2024-36260.md): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (CVSS 8.2, OpenHarmony)
- [CVE-2024-36278](https://cve.now/CVE-2024-36278.md): Arkcompiler Ets Runtime has a type confusion vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-36243](https://cve.now/CVE-2024-36243.md): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (CVSS 8.2, OpenHarmony)
- [CVE-2024-37030](https://cve.now/CVE-2024-37030.md): Arkcompiler Ets Runtime has a use after free vulnerability (CVSS 8.2, OpenHarmony)
- [CVE-2024-31071](https://cve.now/CVE-2024-31071.md): Arkcompiler Ets Runtime has a type confusion vulnerability (CVSS 3.3, OpenHarmony)
- [CVE-2024-38857](https://cve.now/CVE-2024-38857.md): Reflected links in visuals facilitate phishing attacks (CVSS 4.3, Checkmk)
- [CVE-2023-41928](https://cve.now/CVE-2023-41928.md): Remote server offers deprecated TLS protocol in Kiloview P1/P2 devices (CVSS 5.3, Kiloview P1/P2)
- [CVE-2023-41927](https://cve.now/CVE-2023-41927.md): Weak TLS Cipher Suites Supported in Kiloview P1/P2 devices (CVSS 5.3, Kiloview P1/P2)
- [CVE-2023-41926](https://cve.now/CVE-2023-41926.md): Insufficiently protected credentials in Kiloview P1/P2 devices (CVSS 8.8, Kiloview P1/P2)
- [CVE-2023-41923](https://cve.now/CVE-2023-41923.md): Weak Password Requirements in Kiloview P1/P2 devices (CVSS 7.2, Kiloview P1/P2)
- [CVE-2023-41922](https://cve.now/CVE-2023-41922.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kiloview P1/P2 devices (CVSS 7.2, Kiloview P1/P2)
- [CVE-2023-41921](https://cve.now/CVE-2023-41921.md): Download of Code Without Integrity Check in Kiloview P1/P2 devices (CVSS 9.8, Kiloview P1/P2)
- [CVE-2023-41920](https://cve.now/CVE-2023-41920.md): Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices (CVSS 9.8, Kiloview P1/P2)
- [CVE-2023-41919](https://cve.now/CVE-2023-41919.md): Use of Hard-coded Credentials in Kiloview P1/P2 devices (CVSS 9.8, Kiloview P1/P2)
- [CVE-2023-41918](https://cve.now/CVE-2023-41918.md): Missing Authentication for Critical Function in Kiloview P1/P2 devices (CVSS 10.0, Kiloview P1/P2)
- [CVE-2023-41917](https://cve.now/CVE-2023-41917.md): Improper input validation in Kiloview P1/P2 devices allows for remote code execution (CVSS 10.0, Kiloview P1/P2)
- [CVE-2024-37479](https://cve.now/CVE-2024-37479.md): WordPress LA-Studio Element Kit for Elementor plugin \<= 1.3.8.1 - Contributor+ Local File Inclusion vulnerability (CVSS 8.5, LA-Studio Element Kit for Elementor)
- [CVE-2024-5544](https://cve.now/CVE-2024-5544.md): Media Library Assistant \<= 3.17 - Reflected Cross-Site Scripting (CVSS 6.1, dglingren Media Library Assistant)
- [CVE-2024-5545](https://cve.now/CVE-2024-5545.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.9 - Missing Authorization (CVSS 5.3, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2024-3513](https://cve.now/CVE-2024-3513.md): Ultimate Blocks – WordPress Blocks Plugin \<= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via title tag attribute (CVSS 6.4, ultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…)
- [CVE-2024-5504](https://cve.now/CVE-2024-5504.md): Rife Elementor Extensions & Templates \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget (CVSS 6.4, apollo13themes Rife Extensions & Templates for Elementor)
- [CVE-2024-37126](https://cve.now/CVE-2024-37126.md): Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2024-37134](https://cve.now/CVE-2024-37134.md): Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2024-37133](https://cve.now/CVE-2024-37133.md): Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2024-37132](https://cve.now/CVE-2024-37132.md): Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an incorrect privilege assignment vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2024-32854](https://cve.now/CVE-2024-32854.md): Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2024-32853](https://cve.now/CVE-2024-32853.md): Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2024-32852](https://cve.now/CVE-2024-32852.md): Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. (CVSS 5.9, Dell PowerScale OneFS)
- [CVE-2024-5219](https://cve.now/CVE-2024-5219.md): Easy Google Maps \<= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, supsysticcom Easy Google Maps)
- [CVE-2024-6172](https://cve.now/CVE-2024-6172.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.25 - Unauthenticated SQL Injection via unsubscribe (CVSS 9.8, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-0158](https://cve.now/CVE-2024-0158.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2024-5767](https://cve.now/CVE-2024-5767.md): Sitetweet \<= 0.2 - Stored XSS via CSRF (CVSS 8.8, sitetweet)
- [CVE-2024-5606](https://cve.now/CVE-2024-5606.md): Quiz And Survey Master \< 9.0.2 - Contributor+ SQLi (CVSS 8.8, Quiz and Survey Master)
- [CVE-2024-4627](https://cve.now/CVE-2024-4627.md): Rank Math SEO \< 1.0.219 - Authenticated Stored XSS (CVSS 5.5, Rank Math SEO)
- [CVE-2024-3999](https://cve.now/CVE-2024-3999.md): EazyDocs \< 2.5.0 - Admin+ Stored XSS (CVSS 4.8, EazyDocs)
- [CVE-2024-1427](https://cve.now/CVE-2024-1427.md): The Post Grid \<= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag (CVSS 6.4, techlabpro1 The Post Grid – Shortcode, Gutenberg Blocks and…)
- [CVE-2024-5349](https://cve.now/CVE-2024-5349.md): LA-Studio Element Kit for Elementor \<= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, choijun LA-Studio Element Kit for Elementor)
- [CVE-2024-5419](https://cve.now/CVE-2024-5419.md): Void Contact Form 7 Widget For Elementor Page Builder \<= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7\_redirect\_page Attribute (CVSS 6.4, voidthemes Void Contact Form 7 Widget For Elementor Page Bu…)
- [CVE-2024-5938](https://cve.now/CVE-2024-5938.md): Boot Store \<= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (CVSS 6.4, sur Boot Store)
- [CVE-2024-2819](https://cve.now/CVE-2024-2819.md): File Permission Vulnerability in Hitachi Ops Center Common Services (CVSS 5.1, Hitachi Ops Center Common Services)
- [CVE-2024-4679](https://cve.now/CVE-2024-4679.md): Folder Permission Vulnerability in JP1/Extensible SNMP Agent (CVSS 7.8, Hitachi JP1/Extensible SNMP Agent for Windows · Hitachi… +1)
- [CVE-2022-25477](https://cve.now/CVE-2022-25477.md): Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read (CVSS 5.5)
- [CVE-2022-25478](https://cve.now/CVE-2022-25478.md): Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read (CVSS 7.8)
- [CVE-2022-25479](https://cve.now/CVE-2022-25479.md): Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read (CVSS 6.1)
- [CVE-2022-25480](https://cve.now/CVE-2022-25480.md): Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read (CVSS 7.8)
- [CVE-2023-51776](https://cve.now/CVE-2023-51776.md): Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code. (CVSS 7.8)
- [CVE-2023-51777](https://cve.now/CVE-2023-51777.md): Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error. (CVSS 5.5)
- [CVE-2023-51778](https://cve.now/CVE-2023-51778.md): Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue screen error and Denial of (CVSS 5.5)
- [CVE-2024-22102](https://cve.now/CVE-2024-22102.md): Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error. (CVSS 5.5)
- [CVE-2024-22103](https://cve.now/CVE-2024-22103.md): Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue screen error and Denial of (CVSS 4.4)
- [CVE-2024-22104](https://cve.now/CVE-2024-22104.md): Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error and Denial of (CVSS 5.5)
- [CVE-2024-22105](https://cve.now/CVE-2024-22105.md): Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue screen error. (CVSS 5.5)
- [CVE-2024-22106](https://cve.now/CVE-2024-22106.md): Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cau (CVSS 8.8)
- [CVE-2024-25086](https://cve.now/CVE-2024-25086.md): Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code. (CVSS 7.8)
- [CVE-2024-25087](https://cve.now/CVE-2024-25087.md): Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error. (CVSS 5.5)
- [CVE-2024-25088](https://cve.now/CVE-2024-25088.md): Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code. (CVSS 7.8)
- [CVE-2024-26314](https://cve.now/CVE-2024-26314.md): Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary co (CVSS 7.8)
- [CVE-2024-39119](https://cve.now/CVE-2024-39119.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info\_deal.php?mudi=rev&nohrefStr=close. (CVSS 5.4)
- [CVE-2024-39143](https://cve.now/CVE-2024-39143.md): A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious propert (CVSS 5.4)
- [CVE-2024-39206](https://cve.now/CVE-2024-39206.md): An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due (CVSS 7.5)
- [CVE-2024-39891](https://cve.now/CVE-2024-39891.md): In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to (CVSS 5.3, KEV)
- [CVE-2024-39894](https://cve.now/CVE-2024-39894.md): OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an Obs (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.