# CVEs published 2024-07-08

62 CVEs were published on July 8, 2024: 2 critical, 34 high. Days are UTC.

- [CVE-2024-28882](https://cve.now/CVE-2024-28882.md): OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the vali (CVSS 4.3, OpenVPN)
- [CVE-2024-3653](https://cve.now/CVE-2024-3653.md): Undertow: learningpushhandler can lead to remote memory dos attacks (CVSS 5.3, undertow · Red Hat build of Quarkus 3.8.6.redhat +19)
- [CVE-2024-5971](https://cve.now/CVE-2024-5971.md): Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket (CVSS 7.5, undertow · Red Hat build of Apache Camel 3.20.7 for Spr… +14)
- [CVE-2024-38372](https://cve.now/CVE-2024-38372.md): Undici vulnerable to data leak when using response.arrayBuffer() (CVSS 2.0, nodejs undici · undici)
- [CVE-2024-6227](https://cve.now/CVE-2024-6227.md): Infinite Loop in aimhubio/aim (CVSS 7.5, aimhubio/aim · aim)
- [CVE-2024-6580](https://cve.now/CVE-2024-6580.md): /n software IPWorks SSH insufficient file access verification (CVSS 2.3, /n software IPWorks SSH SFTPServer)
- [CVE-2024-6409](https://cve.now/CVE-2024-6409.md): Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9 (CVSS 7.0, OpenSSH · Red Hat Enterprise Linux +1)
- [CVE-2024-4882](https://cve.now/CVE-2024-4882.md): URL Redirection to Arbitrary Site Exists in Sitefinity (CVSS 5.3, Progress Software Sitefinity)
- [CVE-2024-39896](https://cve.now/CVE-2024-39896.md): Directus allows SSO User Enumeration (CVSS 7.5, directus)
- [CVE-2024-1305](https://cve.now/CVE-2024-1305.md): tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use (CVSS 9.8, OpenVPN tap-windows6 · OpenVPN-GUI)
- [CVE-2024-39895](https://cve.now/CVE-2024-39895.md): Directus GraphQL Field Duplication Denial of Service (DoS) (CVSS 6.5, directus · @directus/env)
- [CVE-2024-39701](https://cve.now/CVE-2024-39701.md): Directus Incorrectly handles \_in\` filter (CVSS 6.3, directus)
- [CVE-2024-39312](https://cve.now/CVE-2024-39312.md): Botan has an Authorization Error due to Name Constraint Decoding Bug (CVSS 5.3, randombit botan)
- [CVE-2024-34702](https://cve.now/CVE-2024-34702.md): Botan has a Denial of Service Due to Excessive Name Constraints (CVSS 5.3, randombit botan)
- [CVE-2024-23562](https://cve.now/CVE-2024-23562.md): HCL Domino is susceptible to an information disclosure vulnerability (CVSS 5.3, HCL Software Domino Server)
- [CVE-2024-39699](https://cve.now/CVE-2024-39699.md): Directus has a Blind SSRF On File Import (CVSS 5.0, directus · @directus/api)
- [CVE-2023-47677](https://cve.now/CVE-2023-47677.md): A cross-site request forgery (csrf) vulnerability exists in the boa CSRF protection functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 8.8, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-34435](https://cve.now/CVE-2023-34435.md): A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2024-21778](https://cve.now/CVE-2024-21778.md): A heap-based buffer overflow vulnerability exists in the configuration file mib\_init\_value\_array functionality of Realtek rtl819x Jungle SDK (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-46685](https://cve.now/CVE-2023-46685.md): A hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4\_A\_v3411b\_2T2R\_LEV\_09\_170623. (CVSS 9.8, LevelOne WBR-6013)
- [CVE-2023-49593](https://cve.now/CVE-2023-49593.md): Leftover debug code exists in the boa formSysCmd functionality of LevelOne WBR-6013 RER4\_A\_v3411b\_2T2R\_LEV\_09\_170623. (CVSS 7.2, LevelOne WBR-6013)
- [CVE-2023-49073](https://cve.now/CVE-2023-49073.md): A stack-based buffer overflow vulnerability exists in the boa formFilter functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-48270](https://cve.now/CVE-2023-48270.md): A stack-based buffer overflow vulnerability exists in the boa formDnsv6 functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-45742](https://cve.now/CVE-2023-45742.md): An integer overflow vulnerability exists in the boa updateConfigIntoFlash functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-49595](https://cve.now/CVE-2023-49595.md): A stack-based buffer overflow vulnerability exists in the boa rollback\_control\_code functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-45215](https://cve.now/CVE-2023-45215.md): A stack-based buffer overflow vulnerability exists in the boa setRepeaterSsid functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-47856](https://cve.now/CVE-2023-47856.md): A stack-based buffer overflow vulnerability exists in the boa set\_RadvdPrefixParam functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50240](https://cve.now/CVE-2023-50240.md): Two stack-based buffer overflow vulnerabilities exist in the boa set\_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11 (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50239](https://cve.now/CVE-2023-50239.md): Two stack-based buffer overflow vulnerabilities exist in the boa set\_RadvdInterfaceParam functionality of Realtek rtl819x Jungle SDK v3.4.11 (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-41251](https://cve.now/CVE-2023-41251.md): A stack-based buffer overflow vulnerability exists in the boa formRoute functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50244](https://cve.now/CVE-2023-50244.md): Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50243](https://cve.now/CVE-2023-50243.md): Two stack-based buffer overflow vulnerabilities exist in the boa formIpQoS functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50383](https://cve.now/CVE-2023-50383.md): Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50382](https://cve.now/CVE-2023-50382.md): Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50381](https://cve.now/CVE-2023-50381.md): Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-50330](https://cve.now/CVE-2023-50330.md): A stack-based buffer overflow vulnerability exists in the boa getInfo functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2023-49867](https://cve.now/CVE-2023-49867.md): A stack-based buffer overflow vulnerability exists in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. (CVSS 7.2, LevelOne WBR-6013 · Realtek rtl819x Jungle SDK)
- [CVE-2024-6564](https://cve.now/CVE-2024-6564.md): Buffer overflow in Rensas RCAR (CVSS 6.7, Renesas rcar\_gen3\_v2.5)
- [CVE-2024-39695](https://cve.now/CVE-2024-39695.md): Exiv2 has an out-of-bounds read in AsfVideo::streamProperties (CVSS 5.3, exiv2)
- [CVE-2024-6563](https://cve.now/CVE-2024-6563.md): Buffer Overflow Arbitrary Write (CVSS 7.5, Renesas rcar\_gen3\_v2.5)
- [CVE-2024-39677](https://cve.now/CVE-2024-39677.md): NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities (CVSS 5.9, nhibernate-core · NHibernate)
- [CVE-2024-39308](https://cve.now/CVE-2024-39308.md): RailsAdmin Cross-site Scripting vulnerability in the list view (CVSS 6.8, railsadminteam rails\_admin · rails\_admin)
- [CVE-2024-25639](https://cve.now/CVE-2024-25639.md): Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients (CVSS 5.9, khoj-ai khoj)
- [CVE-2024-4341](https://cve.now/CVE-2024-4341.md): IDOR in ExtremePacs's Extreme XDS (CVSS 6.5, ExtremePacs Extreme XDS)
- [CVE-2024-39742](https://cve.now/CVE-2024-39742.md): IBM MQ Container authentication bypass (CVSS 8.1, IBM MQ Operator)
- [CVE-2024-39743](https://cve.now/CVE-2024-39743.md): IBM MQ Container denial of service (CVSS 5.9, IBM MQ Operator)
- [CVE-2024-6163](https://cve.now/CVE-2024-6163.md): local IP restriction of internal HTTP endpoints (CVSS 5.3, Checkmk)
- [CVE-2024-37999](https://cve.now/CVE-2024-37999.md): A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). (CVSS 7.8, Siemens Medicalis Workflow Orchestrator)
- [CVE-2024-27903](https://cve.now/CVE-2024-27903.md): OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary (CVSS 7.2, OpenVPN)
- [CVE-2024-24974](https://cve.now/CVE-2024-24974.md): The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker (CVSS 7.5, OpenVPN)
- [CVE-2024-27459](https://cve.now/CVE-2024-27459.md): The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute a (CVSS 7.2, OpenVPN GUI)
- [CVE-2024-37389](https://cve.now/CVE-2024-37389.md): Apache NiFi: Improper Neutralization of Input in Parameter Context Description (CVSS 4.6, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2024-34603](https://cve.now/CVE-2024-34603.md): Improper access control in Samsung Message prior to SMR Jul-2024 Release 1 allows local attackers to access location data. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-34602](https://cve.now/CVE-2024-34602.md): Use of implicit intent for sensitive communication in Samsung Messages prior to SMR Jul-2024 Release 1 allows local attackers to get sensiti (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2024-37528](https://cve.now/CVE-2024-37528.md): IBM Cloud Pak for Business Automation cross-site scripting (CVSS 4.8, IBM Cloud Pak for Business Automation)
- [CVE-2024-31897](https://cve.now/CVE-2024-31897.md): IBM Cloud Pak for Business Automation server-side request forgery (CVSS 4.3, IBM Cloud Pak for Business Automation)
- [CVE-2024-38330](https://cve.now/CVE-2024-38330.md): IBM i privilege escalation (CVSS 7.0, IBM i)
- [CVE-2024-39723](https://cve.now/CVE-2024-39723.md): IBM FlashSystem denial of service (CVSS 4.6, IBM Storage Virtualize)
- [CVE-2024-5711](https://cve.now/CVE-2024-5711.md): Stored XSS in stitionai/devika (CVSS 8.1, stitionai/devika)
- [CVE-2024-31504](https://cve.now/CVE-2024-31504.md): Buffer Overflow vulnerability in SILA Embedded Solutions GmbH freemodbus v.2018-09-12 allows a remtoe attacker to cause a denial of service (CVSS 7.5)
- [CVE-2024-39202](https://cve.now/CVE-2024-39202.md): D-Link DIR-823X firmware - 240126 was discovered to contain a remote command execution (RCE) vulnerability via the dhcpd\_startip parameter a (CVSS 7.6)
- [CVE-2024-39203](https://cve.now/CVE-2024-39203.md): A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.