# CVEs published 2024-07-05

64 CVEs were published on July 5, 2024: 9 critical, 28 high. Days are UTC.

- [CVE-2024-5753](https://cve.now/CVE-2024-5753.md): Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna (CVSS 7.5, vanna-ai/vanna · vanna)
- [CVE-2024-39696](https://cve.now/CVE-2024-39696.md): Evmos vulnerable to exploit of smart contract account and vesting (CVSS 8.8, evmos · github.com/evmos/evmos +18)
- [CVE-2024-39691](https://cve.now/CVE-2024-39691.md): Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to (CVSS 4.3, matrix-org matrix-appservice-irc · matrix-appservice-irc)
- [CVE-2024-39689](https://cve.now/CVE-2024-39689.md): Certifi removes GLOBALTRUST root certificate (CVSS 7.5, python-certifi · certifi)
- [CVE-2024-34361](https://cve.now/CVE-2024-34361.md): Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE) (CVSS 8.6, pi-hole)
- [CVE-2024-39687](https://cve.now/CVE-2024-39687.md): Fedify vulnerable to allowing access to internal network resources (CVSS 7.2, dahlia fedify · @fedify/fedify)
- [CVE-2024-39321](https://cve.now/CVE-2024-39321.md): Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes (CVSS 7.5, traefik · github.com/traefik/traefik/v2 +2)
- [CVE-2024-37903](https://cve.now/CVE-2024-37903.md): Mastodon has improper authorship check on audience extension for existing posts (CVSS 8.2, mastodon)
- [CVE-2024-6505](https://cve.now/CVE-2024-6505.md): Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss (CVSS 6.8, qemu · Red Hat Enterprise Linux)
- [CVE-2024-38346](https://cve.now/CVE-2024-38346.md): Apache CloudStack: Unauthenticated cluster service port leads to remote execution (CVSS 9.8, Apache Software Foundation Apache CloudStack)
- [CVE-2024-39864](https://cve.now/CVE-2024-39864.md): Apache CloudStack: Integration API service uses dynamic port when disabled (CVSS 9.8, Apache Software Foundation Apache CloudStack)
- [CVE-2024-6526](https://cve.now/CVE-2024-6526.md): CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting (CVSS 5.3, Ecommerce-CodeIgniter-Bootstrap)
- [CVE-2024-23588](https://cve.now/CVE-2024-23588.md): A denial of service vulnerability affects HCL Nomad server on Domino (CVSS 5.3, HCL Software Nomad server on Domino)
- [CVE-2024-6525](https://cve.now/CVE-2024-6525.md): D-Link DAR-7000 decodmail.php deserialization (CVSS 5.1, D-Link DAR-7000)
- [CVE-2024-6524](https://cve.now/CVE-2024-6524.md): ShopXO Uploader.php server-side request forgery (CVSS 5.3, ShopXO · shopxo/shopxo)
- [CVE-2024-6209](https://cve.now/CVE-2024-6209.md): unauthorized file access (CVSS 9.4, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-6298](https://cve.now/CVE-2024-6298.md): remote code execution (CVSS 9.4, ABB ASPECT-Enterprise · ABB NEXUS Series +1)
- [CVE-2024-6523](https://cve.now/CVE-2024-6523.md): ZKTeco BioTime system-group-add cross site scripting (CVSS 5.3, ZKTeco BioTime)
- [CVE-2024-39485](https://cve.now/CVE-2024-39485.md): media: v4l: async: Properly re-initialise notifier entry in unregister (no CVSS, Linux)
- [CVE-2024-39484](https://cve.now/CVE-2024-39484.md): mmc: davinci: Don't strip remove function when driver is builtin (no CVSS, Linux)
- [CVE-2024-39483](https://cve.now/CVE-2024-39483.md): KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked (CVSS 7.1, Linux)
- [CVE-2024-39482](https://cve.now/CVE-2024-39482.md): bcache: fix variable length array abuse in btree\_iter (CVSS 7.8, Linux)
- [CVE-2024-39481](https://cve.now/CVE-2024-39481.md): media: mc: Fix graph walk in media\_pipeline\_start (CVSS 7.8, Linux)
- [CVE-2024-39480](https://cve.now/CVE-2024-39480.md): kdb: Fix buffer overflow during tab-complete (CVSS 8.4, Linux)
- [CVE-2024-39479](https://cve.now/CVE-2024-39479.md): drm/i915/hwmon: Get rid of devm (CVSS 7.8, Linux)
- [CVE-2024-39478](https://cve.now/CVE-2024-39478.md): crypto: starfive - Do not free stack buffer (CVSS 7.8, Linux)
- [CVE-2024-39477](https://cve.now/CVE-2024-39477.md): mm/hugetlb: do not call vma\_add\_reservation upon ENOMEM (CVSS 7.8, Linux)
- [CVE-2024-39476](https://cve.now/CVE-2024-39476.md): md/raid5: fix deadlock that raid5d() wait for itself to clear MD\_SB\_CHANGE\_PENDING (no CVSS, Linux)
- [CVE-2024-39475](https://cve.now/CVE-2024-39475.md): fbdev: savage: Handle err return when savagefb\_check\_var failed (no CVSS, Linux)
- [CVE-2024-39474](https://cve.now/CVE-2024-39474.md): mm/vmalloc: fix vmalloc which may return null if called with \_\_GFP\_NOFAIL (no CVSS, Linux)
- [CVE-2024-39473](https://cve.now/CVE-2024-39473.md): ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension (no CVSS, Linux)
- [CVE-2024-39472](https://cve.now/CVE-2024-39472.md): xfs: fix log recovery buffer allocation for the legacy h\_size fixup (CVSS 7.3, Linux)
- [CVE-2023-52340](https://cve.now/CVE-2023-52340.md): The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max\_size threshold that can be consumed easily, e.g., leading (CVSS 7.5)
- [CVE-2024-23997](https://cve.now/CVE-2024-23997.md): Lukas Bach yana =\<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts. (CVSS 6.1)
- [CVE-2024-23998](https://cve.now/CVE-2024-23998.md): goanother Another Redis Desktop Manager =\<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue. (CVSS 5.0)
- [CVE-2024-27709](https://cve.now/CVE-2024-27709.md): SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of th (CVSS 9.8)
- [CVE-2024-27710](https://cve.now/CVE-2024-27710.md): An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the authenti (CVSS 9.8)
- [CVE-2024-27711](https://cve.now/CVE-2024-27711.md): An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the Sin-up p (CVSS 8.8)
- [CVE-2024-27712](https://cve.now/CVE-2024-27712.md): An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the User Acc (CVSS 9.8)
- [CVE-2024-27713](https://cve.now/CVE-2024-27713.md): An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via the HTTP Res (CVSS 8.8)
- [CVE-2024-27715](https://cve.now/CVE-2024-27715.md): An issue in Eskooly Free Online School management Software v.3.0 and before allows a remote attacker to escalate privileges via a crafted re (CVSS 8.2)
- [CVE-2024-27716](https://cve.now/CVE-2024-27716.md): Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the messag (CVSS 5.4)
- [CVE-2024-27717](https://cve.now/CVE-2024-27717.md): Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to esca (CVSS 6.5)
- [CVE-2024-29318](https://cve.now/CVE-2024-29318.md): Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascri (CVSS 5.4)
- [CVE-2024-29319](https://cve.now/CVE-2024-29319.md): Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. (CVSS 3.8)
- [CVE-2024-32498](https://cve.now/CVE-2024-32498.md): An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. (CVSS 6.5, nova · cinder +1)
- [CVE-2024-33862](https://cve.now/CVE-2024-33862.md): A buffer-management vulnerability in OPC Foundation OPCFoundation.NetStandard.Opc.Ua.Core before 1.05.374.54 could allow remote attackers to (CVSS 7.5, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2024-34481](https://cve.now/CVE-2024-34481.md): drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page. (CVSS 6.1)
- [CVE-2024-36041](https://cve.now/CVE-2024-36041.md): KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on (CVSS 7.3)
- [CVE-2024-37767](https://cve.now/CVE-2024-37767.md): Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET req (CVSS 7.5)
- [CVE-2024-37768](https://cve.now/CVE-2024-37768.md): 14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id. (CVSS 9.1)
- [CVE-2024-37769](https://cve.now/CVE-2024-37769.md): Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request. (CVSS 8.8)
- [CVE-2024-39019](https://cve.now/CVE-2024-39019.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/idcProData\_deal.php?mudi=del (CVSS 5.4)
- [CVE-2024-39020](https://cve.now/CVE-2024-39020.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/vpsApiData\_deal.php?mudi=rev&nohrefStr=c (CVSS 6.3)
- [CVE-2024-39021](https://cve.now/CVE-2024-39021.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApiData\_deal.php?mudi=del (CVSS 5.4)
- [CVE-2024-39022](https://cve.now/CVE-2024-39022.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/infoSys\_deal.php?mudi=deal (CVSS 8.8)
- [CVE-2024-39023](https://cve.now/CVE-2024-39023.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/info\_deal.php?mudi=add&nohrefStr=close (CVSS 8.8)
- [CVE-2024-39027](https://cve.now/CVE-2024-39027.md): SeaCMS v12.9 has an unauthorized SQL injection vulnerability. (CVSS 7.5)
- [CVE-2024-39028](https://cve.now/CVE-2024-39028.md): An issue was discovered in SeaCMS \<=12.9 which allows remote attackers to execute arbitrary code via admin\_ping.php. (CVSS 9.8)
- [CVE-2024-39150](https://cve.now/CVE-2024-39150.md): vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet. (CVSS 5.9)
- [CVE-2024-39174](https://cve.now/CVE-2024-39174.md): A cross-site scripting (XSS) vulnerability in the Publish Article function of yzmcms v7.1 allows attackers to execute arbitrary web scripts (CVSS 6.1)
- [CVE-2024-39178](https://cve.now/CVE-2024-39178.md): MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu\_uu (CVSS 5.4)
- [CVE-2024-39182](https://cve.now/CVE-2024-39182.md): An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an (CVSS 7.5)
- [CVE-2024-39210](https://cve.now/CVE-2024-39210.md): Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.