CVEs published July 5, 2024
64 CVEs were published on July 5, 2024: 9 critical, 28 high.
- Published
- 64
- Critical
- 9
- High
- 28
- Medium
- 20
- Low
- 1
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Linux
- 14
- ABB ASPECT-Enterprise · ABB NEXUS Series +1
- 2
- Apache Software Foundation Apache CloudStack
- 2
- D-Link DAR-7000
- 1
- dahlia fedify · @fedify/fedify
- 1
- Ecommerce-CodeIgniter-Bootstrap
- 1
- evmos · github.com/evmos/evmos +18
- 1
- HCL Software Nomad server on Domino
- 1
- mastodon
- 1
- matrix-org matrix-appservice-irc · matrix-appservice-irc
- 1
Critical 9
- CVE-2024-38346Apache CloudStack: Unauthenticated cluster service port leads to remote executionApache Software Foundation Apache CloudStack
- CVE-2024-39864Apache CloudStack: Integration API service uses dynamic port when disabledApache Software Foundation Apache CloudStack
- CVE-2024-6209unauthorized file accessABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-6298remote code executionABB ASPECT-Enterprise · ABB NEXUS Series +1
- CVE-2024-27709SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of th
- CVE-2024-27710An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authenti
- CVE-2024-27712An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Acc
- CVE-2024-3776814Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.
- CVE-2024-39028An issue was discovered in SeaCMS <=12.9 which allows remote attackers to execute arbitrary code via admin_ping.php.
High 28
- CVE-2024-5753Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vannavanna-ai/vanna · vanna
- CVE-2024-39696Evmos vulnerable to exploit of smart contract account and vestingevmos · github.com/evmos/evmos +18
- CVE-2024-39689Certifi removes GLOBALTRUST root certificatepython-certifi · certifi
- CVE-2024-34361Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)pi-hole
- CVE-2024-39687Fedify vulnerable to allowing access to internal network resourcesdahlia fedify · @fedify/fedify
- CVE-2024-39321Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakestraefik · github.com/traefik/traefik/v2 +2
- CVE-2024-37903Mastodon has improper authorship check on audience extension for existing postsmastodon
- CVE-2024-39483KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright maskedLinux
- CVE-2024-39482bcache: fix variable length array abuse in btree_iterLinux
- CVE-2024-39481media: mc: Fix graph walk in media_pipeline_startLinux
- CVE-2024-39480kdb: Fix buffer overflow during tab-completeLinux
- CVE-2024-39479drm/i915/hwmon: Get rid of devmLinux
- CVE-2024-39478crypto: starfive - Do not free stack bufferLinux
- CVE-2024-39477mm/hugetlb: do not call vma_add_reservation upon ENOMEMLinux
- CVE-2024-39472xfs: fix log recovery buffer allocation for the legacy h_size fixupLinux
- CVE-2023-52340The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading
- CVE-2024-27711An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up p
- CVE-2024-27713An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Res
- CVE-2024-27715An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted re
- CVE-2024-33862A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers toOPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2024-36041KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on
- CVE-2024-37767Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET req
- CVE-2024-37769Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.
- CVE-2024-39022idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys_deal.php?mudi=deal
- CVE-2024-39023idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info_deal.php?mudi=add&nohrefStr=close
- CVE-2024-39027SeaCMS v12.9 has an unauthorized SQL injection vulnerability.
- CVE-2024-39182An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an
- CVE-2024-39210Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php.
Medium, low and unrated 27
- CVE-2024-39691Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access tomatrix-org matrix-appservice-irc · matrix-appservice-irc
- CVE-2024-6505Qemu-kvm: virtio-net: queue index out-of-bounds access in software rssqemu · Red Hat Enterprise Linux
- CVE-2024-6526CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scriptingEcommerce-CodeIgniter-Bootstrap
- CVE-2024-23588A denial of service vulnerability affects HCL Nomad server on DominoHCL Software Nomad server on Domino
- CVE-2024-6525D-Link DAR-7000 decodmail.php deserializationD-Link DAR-7000
- CVE-2024-6524ShopXO Uploader.php server-side request forgeryShopXO · shopxo/shopxo
- CVE-2024-6523ZKTeco BioTime system-group-add cross site scriptingZKTeco BioTime
- CVE-2024-39485media: v4l: async: Properly re-initialise notifier entry in unregisterLinux
- CVE-2024-39484mmc: davinci: Don't strip remove function when driver is builtinLinux
- CVE-2024-39476md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDINGLinux
- CVE-2024-39475fbdev: savage: Handle err return when savagefb_check_var failedLinux
- CVE-2024-39474mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAILLinux
- CVE-2024-39473ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extensionLinux
- CVE-2024-23997Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.
- CVE-2024-23998goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.
- CVE-2024-27716Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the messag
- CVE-2024-27717Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to esca
- CVE-2024-29318Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascri
- CVE-2024-29319Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file.
- CVE-2024-32498An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3.nova · cinder +1
- CVE-2024-34481drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page.
- CVE-2024-39019idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData_deal.php?mudi=del
- CVE-2024-39020idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData_deal.php?mudi=rev&nohrefStr=c
- CVE-2024-39021idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData_deal.php?mudi=del
- CVE-2024-39150vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet.
- CVE-2024-39174A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts
- CVE-2024-39178MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uu