CVEs published July 3, 2024
58 CVEs were published on July 3, 2024: 3 critical, 14 high.
- Published
- 58
- Critical
- 3
- High
- 14
- Medium
- 34
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Mattermost
- 6
- discourse
- 5
- Himer
- 5
- MESbook
- 2
- playSMS
- 2
- WPQA Builder
- 2
- aliakro Snippet Shortcodes
- 1
- Apache Software Foundation Apache Tomcat · org.apache.to… +1
- 1
- Checkmk
- 1
- Cloud Foundry haproxy-boshrelease
- 1
Critical 3
- CVE-2024-37082When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTPCloud Foundry haproxy-boshrelease
- CVE-2024-39223An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback fungithub.com/ginuerzh/gost
- CVE-2024-39844In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.
High 14
- CVE-2024-34750Apache Tomcat: HTTP/2 excess header handling DoSApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2024-35227Discourse vulnerable to DoS through Oneboxdiscourse
- CVE-2024-32937An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1Grandstream GXP2135
- CVE-2024-5672Red Lion Europe: mbNET.mini vulnerable to OS command injectionRed Lion Europe mbNET.mini · Helmholz REX
- CVE-2024-6427Uncontrolled Resource Consumption vulnerability in MESbookMESbook
- CVE-2024-6426Information exposure vulnerability vulnerability in MESbookMESbook
- CVE-2024-39830Timing attack during remote cluster token comparison when shared channels are enabledMattermost
- CVE-2024-2376WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRFWPQA Builder
- CVE-2023-52168The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite
- CVE-2023-52169The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the i
- CVE-2024-29509Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle.
- CVE-2024-29511Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and
- CVE-2024-33871An issue was discovered in Artifex Ghostscript before 10.03.1.
- CVE-2024-38453The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key.
Medium, low and unrated 41
- CVE-2024-6284Improper IPv4 and IPv6 byte order storage in github.com/google/nftableshttps://github.com/google/nftables · github.com/google/nfta…
- CVE-2024-6383MongoDB C Driver bson_string_append may be vulnerable to a buffer overflowMongoDB libbson
- CVE-2024-39683ZITADEL Vulnerable to Session Information Leakagezitadel · github.com/zitadel/zitadel
- CVE-2024-37157Discourse vulnerable to Server-Side Request Forgery via FastImagediscourse
- CVE-2024-36122Discourse doesn't limit reviewable user serializer payloaddiscourse
- CVE-2024-36113Discourse missing authorization checks for suspending admins/moderatorsdiscourse
- CVE-2024-35234Discourse vulnerable to stored-dom XSS via Facebook Oneboxesdiscourse
- CVE-2024-5821Local File Inclusion (LFI) in stitionai/devikastitionai/devika
- CVE-2024-31223Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URLethyca fides · ethyca-fides
- CVE-2024-3332bt: host/smp: DoS caused by null pointer dereferencezephyrproject-rtos Zephyr
- CVE-2024-6126Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv optioncockpit · Red Hat Enterprise Linux
- CVE-2024-6052XSS in SQL check parametersCheckmk
- CVE-2024-6471SourceCodester Online Tours & Travels Management sms_setting.php sql injectionSourceCodester Online Tours & Travels Management
- CVE-2024-6470playSMS Template injectionplaySMS
- CVE-2024-6469playSMS Template injectionplaySMS
- CVE-2024-6428Limited DoS due to permitting creating users with user-defined IDsMattermost
- CVE-2024-39353RemoteClusterFrame payloads are audit logged in fullMattermost
- CVE-2024-39361Creating posts with user-defined IDs permitted in CreatePost APIMattermost
- CVE-2024-39807Channel IDs of archived/restored channels leaked via webhook eventsMattermost
- CVE-2024-36257Lack of permission check when updating the profile picture of a remote user (shared channels enabled)Mattermost
- CVE-2024-6263WP Lightbox 2 <= 3.0.6.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingsmub WP Lightbox
- CVE-2024-6340Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-4482The Plus Addons for Elementor <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-2375WPQA < 6.1.1 - Contributor+ Stored XSSWPQA Builder
- CVE-2024-2235 Himer - Social Questions and Answers < 2.1.1 - Bypass Poll Voting Restrictions via CSRFHimer
- CVE-2024-2234 Himer - Social Questions and Answers < 2.1.1 - Contributor+ Stored XSSHimer
- CVE-2024-2233 Himer - Social Questions and Answers < 2.1.1 - Multiple CSRF on the Group SectionHimer
- CVE-2024-2231 Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDORHimer
- CVE-2024-2040 Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRFHimer
- CVE-2024-4543Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgeryaliakro Snippet Shortcodes
- CVE-2024-32673Improper Validation of Array Index vulnerability in Samsung Open Source Walrus Webassembly runtime engine allows a segmentation fault issue.Samsung Open Source Walrus
- CVE-2024-29506Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.
- CVE-2024-29507Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- CVE-2024-29508Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_
- CVE-2024-29510Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
- CVE-2024-33869An issue was discovered in Artifex Ghostscript before 10.03.1.
- CVE-2024-33870An issue was discovered in Artifex Ghostscript before 10.03.1.
- CVE-2024-37726Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges
- CVE-2024-39220BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-
- CVE-2024-39248A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload i
- CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection