# CVEs published 2024-07-04

38 CVEs were published on July 4, 2024: 5 critical, 16 high. Days are UTC.

- [CVE-2024-6511](https://cve.now/CVE-2024-6511.md): y\_project RuoYi Content-Type isJsonRequest cross site scripting (CVSS 5.3, y\_project RuoYi)
- [CVE-2024-37471](https://cve.now/CVE-2024-37471.md): WordPress Woffice Core plugin \<= 5.4.8 - Site Wide Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WofficeIO Woffice Core)
- [CVE-2024-37472](https://cve.now/CVE-2024-37472.md): WordPress Woffice theme \<= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WofficeIO Woffice)
- [CVE-2024-37474](https://cve.now/CVE-2024-37474.md): WordPress Newspack Ads plugin \<= 1.47.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic Newspack Ads)
- [CVE-2024-37476](https://cve.now/CVE-2024-37476.md): WordPress Newspack Campaigns plugin \<= 2.31.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic Newspack Campaigns)
- [CVE-2024-22277](https://cve.now/CVE-2024-22277.md): VMware Cloud Director Availability contains an HTML injection vulnerability. (CVSS 6.4, VMware Cloud Director Availability)
- [CVE-2024-6506](https://cve.now/CVE-2024-6506.md): Information exposure vulnerability in the MRW plug-in (CVSS 8.2, MRW plugin)
- [CVE-2024-6507](https://cve.now/CVE-2024-6507.md): Deep Lake Kaggle command injection (CVSS 8.1, deeplake)
- [CVE-2024-5943](https://cve.now/CVE-2024-5943.md): Nested Pages \<= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion (CVSS 8.8, kylephillips Nested Pages)
- [CVE-2024-32754](https://cve.now/CVE-2024-32754.md): Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information (CVSS 3.1, Johnson Controls Kantech KT1 Door Controller, Rev01 · Jo… +1)
- [CVE-2024-3904](https://cve.now/CVE-2024-3904.md): Incorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on MELIPC Series MI5122-VW firmware versions (CVSS 8.8, Mitsubishi Electric MELIPC Series MI5122-VW)
- [CVE-2024-1574](https://cve.now/CVE-2024-1574.md): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in the licensing feature of Mitsubishi Elec (CVSS 6.7, Mitsubishi Electric Iconics Digital Solutions GENESIS64… +13)
- [CVE-2024-1573](https://cve.now/CVE-2024-1573.md): Missing Authentication for Critical Function vulnerability in the mobile monitoring feature of Mitsubishi Electric GENESIS64 versions 10.97. (CVSS 5.9, Mitsubishi Electric Iconics Digital Solutions GENESIS64… +11)
- [CVE-2024-1182](https://cve.now/CVE-2024-1182.md): Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suit (CVSS 7.0, Mitsubishi Electric Iconics Digital Solutions GENESIS64… +7)
- [CVE-2024-39884](https://cve.now/CVE-2024-39884.md): Apache HTTP Server: source code disclosure with handlers configured via AddType (CVSS 6.2, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-6319](https://cve.now/CVE-2024-6319.md): IMGspider \<= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload' (CVSS 8.8, wbolt IMGspider – 图片采集抓取插件)
- [CVE-2024-6434](https://cve.now/CVE-2024-6434.md): Premium Addons for Elementor \<= 4.10.35 - Regular Expressions Denial of Service (CVSS 3.1, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-6318](https://cve.now/CVE-2024-6318.md): IMGspider \<= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload\_img\_file' (CVSS 8.8, wbolt IMGspider – 图片采集抓取插件)
- [CVE-2024-5641](https://cve.now/CVE-2024-5641.md): One Click Order Re-Order \<= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, cedcommerce One Click Order Re-Order)
- [CVE-2024-3639](https://cve.now/CVE-2024-3639.md): Elementor Addons by Livemesh \<= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-2926](https://cve.now/CVE-2024-2926.md): Elementor Addons by Livemesh \<= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-3638](https://cve.now/CVE-2024-3638.md): Elementor Addons by Livemesh \<= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-2385](https://cve.now/CVE-2024-2385.md): Elementor Addons by Livemesh \<= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets (CVSS 8.8, Livemesh Addons by Elementor)
- [CVE-2024-38471](https://cve.now/CVE-2024-38471.md): Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a (CVSS 6.8, TP-LINK Archer AX3000 · TP-LINK Archer AXE75 +3)
- [CVE-2024-38345](https://cve.now/CVE-2024-38345.md): A cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0. (CVSS 8.1, Sola Plugins Sola Testimonials)
- [CVE-2024-38344](https://cve.now/CVE-2024-38344.md): A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. (CVSS 5.4, Sola Plugins WP Tweet Walls)
- [CVE-2024-39165](https://cve.now/CVE-2024-39165.md): QR/demoapp/qr\_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload (CVSS 9.8)
- [CVE-2024-39211](https://cve.now/CVE-2024-39211.md): Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user\_emai (CVSS 5.3)
- [CVE-2024-39929](https://cve.now/CVE-2024-39929.md): Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime\_filename extension-blocking (CVSS 5.4)
- [CVE-2024-39930](https://cve.now/CVE-2024-39930.md): The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. (CVSS 9.9, github.com/gogs/gogs · gogs.io/gogs)
- [CVE-2024-39931](https://cve.now/CVE-2024-39931.md): Gogs through 0.13.0 allows deletion of internal files. (CVSS 9.9, github.com/gogs/gogs · gogs.io/gogs)
- [CVE-2024-39932](https://cve.now/CVE-2024-39932.md): Gogs through 0.13.0 allows argument injection during the previewing of changes. (CVSS 9.9, github.com/gogs/gogs · gogs.io/gogs)
- [CVE-2024-39933](https://cve.now/CVE-2024-39933.md): Gogs through 0.13.0 allows argument injection during the tagging of a new release. (CVSS 7.7, gogs.io/gogs · github.com/gogs/gogs)
- [CVE-2024-39934](https://cve.now/CVE-2024-39934.md): Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because (CVSS 7.8)
- [CVE-2024-39935](https://cve.now/CVE-2024-39935.md): jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authenticated user (with certificat (CVSS 8.8)
- [CVE-2024-39936](https://cve.now/CVE-2024-39936.md): An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6 (CVSS 8.6)
- [CVE-2024-39937](https://cve.now/CVE-2024-39937.md): supOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files. (CVSS 8.6)
- [CVE-2024-39943](https://cve.now/CVE-2024-39943.md): rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if (CVSS 9.9, hfs)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.