CVEs published July 4, 2024
38 CVEs were published on July 4, 2024: 5 critical, 16 high.
- Published
- 38
- Critical
- 5
- High
- 16
- Medium
- 15
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Livemesh Addons by Elementor
- 4
- github.com/gogs/gogs · gogs.io/gogs
- 3
- wbolt IMGspider – 图片采集抓取插件
- 2
- Apache Software Foundation Apache HTTP Server
- 1
- Automattic Newspack Ads
- 1
- Automattic Newspack Campaigns
- 1
- cedcommerce One Click Order Re-Order
- 1
- deeplake
- 1
- gogs.io/gogs · github.com/gogs/gogs
- 1
- hfs
- 1
Critical 5
- CVE-2024-39165QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload
- CVE-2024-39930The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.github.com/gogs/gogs · gogs.io/gogs
- CVE-2024-39931Gogs through 0.13.0 allows deletion of internal files.github.com/gogs/gogs · gogs.io/gogs
- CVE-2024-39932Gogs through 0.13.0 allows argument injection during the previewing of changes.github.com/gogs/gogs · gogs.io/gogs
- CVE-2024-39943rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if hfs
High 16
- CVE-2024-37471WordPress Woffice Core plugin <= 5.4.8 - Site Wide Reflected Cross Site Scripting (XSS) vulnerabilityWofficeIO Woffice Core
- CVE-2024-37472WordPress Woffice theme <= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityWofficeIO Woffice
- CVE-2024-6506Information exposure vulnerability in the MRW plug-inMRW plugin
- CVE-2024-6507Deep Lake Kaggle command injectiondeeplake
- CVE-2024-5943Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusionkylephillips Nested Pages
- CVE-2024-3904Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions Mitsubishi Electric MELIPC Series MI5122-VW
- CVE-2024-1182Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS SuitMitsubishi Electric Iconics Digital Solutions GENESIS64… +7
- CVE-2024-6319IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'wbolt IMGspider – 图片采集抓取插件
- CVE-2024-6318IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'wbolt IMGspider – 图片采集抓取插件
- CVE-2024-2385Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via WidgetsLivemesh Addons by Elementor
- CVE-2024-38345A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0.Sola Plugins Sola Testimonials
- CVE-2024-39933Gogs through 0.13.0 allows argument injection during the tagging of a new release.gogs.io/gogs · github.com/gogs/gogs
- CVE-2024-39934Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because
- CVE-2024-39935jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificat
- CVE-2024-39936An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6
- CVE-2024-39937supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.
Medium, low and unrated 17
- CVE-2024-6511y_project RuoYi Content-Type isJsonRequest cross site scriptingy_project RuoYi
- CVE-2024-37474WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerabilityAutomattic Newspack Ads
- CVE-2024-37476WordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerabilityAutomattic Newspack Campaigns
- CVE-2024-22277VMware Cloud Director Availability contains an HTML injection vulnerability.VMware Cloud Director Availability
- CVE-2024-32754Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive InformationJohnson Controls Kantech KT1 Door Controller, Rev01 · Jo… +1
- CVE-2024-1574Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of Mitsubishi ElecMitsubishi Electric Iconics Digital Solutions GENESIS64… +13
- CVE-2024-1573Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97.Mitsubishi Electric Iconics Digital Solutions GENESIS64… +11
- CVE-2024-39884Apache HTTP Server: source code disclosure with handlers configured via AddTypeApache Software Foundation Apache HTTP Server
- CVE-2024-6434Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Serviceleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-5641One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingcedcommerce One Click Order Re-Order
- CVE-2024-3639Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts GridLivemesh Addons by Elementor
- CVE-2024-2926Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various WidgetsLivemesh Addons by Elementor
- CVE-2024-3638Elementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider WidgetsLivemesh Addons by Elementor
- CVE-2024-38471Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring aTP-LINK Archer AX3000 · TP-LINK Archer AXE75 +3
- CVE-2024-38344A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4.Sola Plugins WP Tweet Walls
- CVE-2024-39211Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_emai
- CVE-2024-39929Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking