CVEs published July 9, 2024
473 CVEs were published on July 9, 2024: 34 critical, 257 high. 3 are now in CISA KEV.
- Published
- 473
- Critical
- 34
- High
- 257
- Medium
- 172
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 232
Most affected products
- Microsoft Windows
- 66
- Google Android
- 36
- Microsoft SQL Server
- 32
- easyappointments
- 15
- Mozilla Firefox · Mozilla Thunderbird
- 15
- Siemens SINEMA Remote Connect Server
- 14
- Microsoft Windows Server
- 12
- ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…
- 5
- Joomla! Project Joomla! CMS
- 5
- Microsoft Windows Server · Microsoft Windows
- 5
Critical 34
- CVE-2024-38089Microsoft Defender for IoT Elevation of Privilege VulnerabilityMicrosoft Defender for IoT
- CVE-2024-38076Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38074Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38077Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-6611Incorrect handling of SameSite cookiesMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6602Memory corruption in NSSMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6527SQL Injection in MegaBIPJan Syski MegaBIP
- CVE-2024-39872A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-3596RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.IETF RFC
- CVE-2023-38055A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38054A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38053A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38052A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38051A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38050A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38049A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38048A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0easyappointments
- CVE-2024-37424WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerabilityAutomattic Newspack Blocks
- CVE-2024-37420WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerabilityWPZita Zita Elementor Site Library
- CVE-2023-3287A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0easyappointments
- CVE-2024-37418WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerabilityandy_moyle Church Admin
- CVE-2024-37112WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerabilityMembership Software WishList Member X
- CVE-2024-3604OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injectionphotoweblog OSM – OpenStreetMap
- CVE-2024-6314IQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Uploadrmac0001 IQ Testimonials
- CVE-2024-6313Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Uploadnikolaystrikhar Gutenberg Forms – WordPress Form Builder Pl…
- CVE-2024-37555WordPress Generate PDF using Contact Form 7 plugin <= 4.1.2 - CSRF to Arbitrary File Upload vulnerabilityZealousWeb Generate PDF using Contact Form
- CVE-2024-28751ifm: Hardcoded telnet credentials in Smart PLCifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…
- CVE-2024-28747ifm: Use of Hard-coded Credentialsifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…
- CVE-2024-5488SEOPress < 7.9 - Unauthenticated Object InjectionSEOPress
- CVE-2024-6365Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Executionwoobewoo Product Table for WooCommerce by WBW
- CVE-2024-36526ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
- CVE-2024-37870SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to execut
- CVE-2024-37873SQL injection vulnerability in view_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote
- CVE-2024-39071Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.
High 257
- CVE-2024-21417Windows Text Services Framework Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-35154IBM WebSphere Application Server code executionIBM WebSphere Application Server
- CVE-2024-39883Heap-based Buffer Overflow in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-39882Out-of-bounds Read in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-39881Out-of-bounds Write in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-39880Stack-based Buffer Overflow in Delta Electronics CNCSoft-G2Delta Electronics CNCSoft-G2
- CVE-2024-34726In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code.Google Android
- CVE-2024-34725In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition.Google Android
- CVE-2024-34724In _UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition.Google Android
- CVE-2024-34722In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a proGoogle Android
- CVE-2024-34720In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp, there is a possible Google Android
- CVE-2024-31339In multiple functions of StatsService.cpp, there is a possible memory corruption due to a use after free.Google Android
- CVE-2024-31335In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code.Google Android
- CVE-2024-31332In multiple locations, there is a possible way to bypass a restriction on adding new Wi-Fi connections due to a missing permission check.Google Android
- CVE-2024-31331In setMimeGroup of PackageManagerService.java, there is a possible way to hide the service from Settings due to a logic error in the code.Google Android
- CVE-2024-31320In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation dGoogle Android
- CVE-2024-31326In multiple locations, there is a possible way in which policy migration code will never be executed due to a logic error in the code.Google Android
- CVE-2024-31325In multiple locations, there is a possible way to reveal images across users data due to a logic error in the code.Google Android
- CVE-2024-31324In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode firsGoogle Android
- CVE-2024-31323In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking.Google Android
- CVE-2024-31319In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a conGoogle Android
- CVE-2024-31318In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permissioGoogle Android
- CVE-2024-31317In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to uGoogle Android
- CVE-2024-31316In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatchGoogle Android
- CVE-2024-31313In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2024-31310In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabled Autofill service app in the Autofill Google Android
- CVE-2024-23711In DevmemXIntUnreserveRange of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code.Google Android
- CVE-2024-23698In RGXFWChangeOSidPriority of rgxfwutils.c, there is a possible arbitrary code execution due to a missing bounds check.Google Android
- CVE-2024-23697In RGXCreateHWRTData_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free.Google Android
- CVE-2024-23696In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free.Google Android
- CVE-2024-23695In CacheOpPMRExec of cache_km.c, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2023-21114In multiple locations, there is a possible permission bypass due to a confused deputy.Google Android
- CVE-2023-21113In multiple locations, there is a possible permission bypass due to a confused deputy.Google Android
- CVE-2024-34139Adobe Bridge has an integer overflow vulnerability when parsing SVG fileAdobe Bridge
- CVE-2024-20781Adobe Indesign TIF File Parsing Heap Memory CorruptionAdobe InDesign Desktop
- CVE-2024-20785Adobe Indesign 2024 TIFF File Parsing Memory Corruption Remote Code Execution vulnerabilityAdobe InDesign Desktop
- CVE-2024-20783Adobe Indesign 2024 RLE File Parsing Heap Memory CorruptionAdobe InDesign Desktop
- CVE-2024-20782Adobe Indesign WMF File Parsing Out Of Bound WriteAdobe InDesign Desktop
- CVE-2024-34123Adobe Premiere Pro arbitrary DLL loading lead to remote code executionAdobe Premiere Pro
- CVE-2024-39698Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6electron-userland electron-builder · electron-updater
- CVE-2024-6222In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messagesDocker Desktop
- CVE-2024-38095.NET and Visual Studio Denial of Service VulnerabilityMicrosoft PowerShell · Microsoft .NET +14
- CVE-2024-38094Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-38092Azure CycleCloud Elevation of Privilege VulnerabilityMicrosoft Azure CycleCloud
- CVE-2024-38081.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio · Microsoft .NET +1
- CVE-2024-38079Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38078Xbox Wireless Adapter Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38073Windows Remote Desktop Licensing Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-38070Windows LockDown Policy (WLDP) Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38069Windows Enroll Engine Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38068Windows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38067Windows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-38066Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38057Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38053Windows Layer-2 Bridge Network Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38052Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38050Windows Workstation Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38047PowerShell Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38044DHCP Server Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-38033PowerShell Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38032Microsoft Xbox Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38031Windows Online Certificate Status Protocol (OCSP) Server Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-38028Microsoft Windows Performance Data Helper Library Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38021Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2024-38019Microsoft Windows Performance Data Helper Library Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38011Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38010Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37989Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37988Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37984Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37978Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37977Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-37975Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37973Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37972Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37971Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-35256SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-28928SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37336SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37333SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37334Microsoft OLE DB Driver for SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1
- CVE-2024-37330SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37329SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37328SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37327SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37326SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21449SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37324SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server 201… +1
- CVE-2024-37323SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37322SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37321SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37320SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37319SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21425SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server 2019 for x64-based Systems · Micros… +1
- CVE-2024-21331SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21317SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21308SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21303SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server 2022 for · Microsoft SQL Server 201… +1
- CVE-2024-20701SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-35272SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft SQL Server
- CVE-2024-35271SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-35267Azure DevOps Server Spoofing VulnerabilityMicrosoft Azure DevOps Server
- CVE-2024-35266Azure DevOps Server Spoofing VulnerabilityMicrosoft Azure DevOps Server
- CVE-2024-35261Azure Network Watcher VM Extension Elevation of Privilege VulnerabilityMicrosoft Azure Network Watcher VM Extension
- CVE-2024-30105.NET and Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft PowerShell +2
- CVE-2024-30079Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-32987Microsoft SharePoint Server Information Disclosure VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-30013Windows MultiPoint Services Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38112Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-38104Windows Fax Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38100Windows File Explorer Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2024-38091Microsoft WS-Discovery Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38085Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38080Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-38072Windows Remote Desktop Licensing Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-38071Windows Remote Desktop Licensing Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-38064Windows TCP/IP Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38062Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38061DCOM Remote Cross-Session Activation Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38060Windows Imaging Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38059Win32k Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-38054Kernel Streaming WOW Thunk Service Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38051Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38043PowerShell Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38034Windows Filtering Platform Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38025Microsoft Windows Performance Data Helper Library Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38024Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-38023Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-38022Windows Image Acquisition Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-38015Windows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-37987Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37986Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37981Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37974Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37970Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37969Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-37331SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37332SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-37318SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server 2019 for x64-based Systems · Micros… +1
- CVE-2024-21428SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21415SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21414SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21398SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21373SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21335SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21333SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-21332SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-38087SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-38088SQL Server Native Client OLE DB Provider Remote Code Execution VulnerabilityMicrosoft SQL Server
- CVE-2024-35264.NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft Visual Studio +12
- CVE-2024-30098Windows Cryptographic Services Security Feature Bypass VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-30081Windows NTLM Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-28899Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-30061Microsoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-40356PingOne MFA Integration Kit MFA bypassPing Identity PingOne MFA Integration Kit for PingFederate
- CVE-2023-40702PingOne MFA Integration Kit MFA bypassPing Identity PingOne MFA Integration Kit for PingFederate
- CVE-2023-50178An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 aFortinet FortiADC
- CVE-2024-23663An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 allFortinet FortiExtender
- CVE-2024-27782Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stoFortinet FortiAIOps
- CVE-2024-27784Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may alloFortinet FortiAIOps
- CVE-2024-27783Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remoFortinet FortiAIOps
- CVE-2024-6615Memory safety bugs fixed in Firefox 128 and Thunderbird 128Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-6609Memory corruption in NSSMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6607Leaving pointerlock by pressing the escape key could be preventedMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6606Out-of-bounds read in clipboard componentMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6605Firefox Android missed activation delay to prevent tapjackingMozilla Firefox
- CVE-2024-6604Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-6603Memory corruption in thread creationMozilla Firefox · Mozilla Thunderbird
- CVE-2024-39697phonenumber panics on parsing crafted phonenumber inputswhisperfish rust-phonenumber · phonenumber
- CVE-2024-38363Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyteairbytehq airbyte
- CVE-2024-6598Denial-of-service on KNIME Business Hub when certain jobs are executedKNIME Business Hub
- CVE-2024-22271Spring Cloud Function Web DOS VulnerabilitySpring by VMware Tanzu Spring Cloud Function Framework · or…
- CVE-2024-37952WordPress BookYourTravel theme <= 8.18.17 - Subscriber+ Privilege Escalation vulnerabilitythemeenergy BookYourTravel
- CVE-2024-37513WordPress WPCafe plugin <= 2.2.27 - Local File Inclusion vulnerabilityThemewinter WPCafe
- CVE-2024-39888A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2).Siemens Mendix Encryption
- CVE-2024-39874A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39873A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39868A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39867A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39866A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39865A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39675A vulnerability has been identified in RUGGEDCOM RMC30 (All versions < V4.3.10), RUGGEDCOM RMC30NC (All versions < V4.3.10), RUGGEDCOM RP110Siemens RUGGEDCOM RMC30 · Siemens RUGGEDCOM RMC30NC +26
- CVE-2024-39571A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1).Siemens SINEMA Remote Connect Server
- CVE-2024-39570A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 HF1).Siemens SINEMA Remote Connect Server
- CVE-2024-39568A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1).Siemens SINEMA Remote Connect Client
- CVE-2024-39567A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1).Siemens SINEMA Remote Connect Client
- CVE-2024-37997A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0Siemens JT Open · Siemens JT2Go +2
- CVE-2024-33654A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-33653A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32056A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2023-52237A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +124
- CVE-2022-45147A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versiSiemens SIMATIC PCS neo · Siemens SIMATIC STEP 7
- CVE-2024-37501WordPress Advanced Classifieds & Directory Pro plugin <= 3.1.3 - Local File Inclusion vulnerabilityPluginsWare Advanced Classifieds & Directory Pro
- CVE-2024-37497WordPress JetThemeCore plugin < 2.2.1 - Subscriber+ Arbitrary File Deletion vulnerabilityCrocoblock JetThemeCore
- CVE-2024-37484WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerabilityDylan James Zephyr Project Manager
- CVE-2024-5634Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern.Longse Technology LBH30FE200W · Zamel ZMB-01/C
- CVE-2024-5633Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the saLongse Technology LBH30FE200W · Zamel ZMB-01/C
- CVE-2024-37462WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.2 - Local File Inclusion vulnerabilityG5Theme Ultimate Bootstrap Elements for Elementor
- CVE-2024-37455WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerabilityBrainstorm Force Ultimate Addons for Elementor
- CVE-2023-3288A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0easyappointments
- CVE-2023-38047A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0.easyappointments
- CVE-2023-3289A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0easyappointments
- CVE-2023-3286A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0easyappointments
- CVE-2024-37419WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Local File Inclusion vulnerabilityCodeless Cowidgets – Elementor Addons
- CVE-2024-37268WordPress Striking theme <= 2.3.4 - Local File Inclusion vulnerabilitykaptinlin Striking
- CVE-2024-37224WordPress SP Project & Document Manager plugin <= 4.71 - Directory Traversal vulnerabilitysmartypants SP Project & Document Manager
- CVE-2024-39487bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()Linux
- CVE-2023-3285A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0easyappointments
- CVE-2024-37090SQL Injection vulnerability in multiple StylemixThemes premium themesStylemixThemes Masterstudy Elementor Widgets · StylemixThem…
- CVE-2024-37225WordPress Zoho Marketing Automation plugin <= 1.2.7 - SQL Injection vulnerabilityZoho Marketing Automation
- CVE-2024-37256WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerabilityThemeum Tutor LMS
- CVE-2024-37486WordPress Paid Memberships Pro plugin <= 3.0.5 - Authenticated SQL Injection vulnerabilityPaid Memberships Pro
- CVE-2024-37494WordPress Youzify plugin <= 1.2.5 - SQL Injection vulnerabilityKaineLabs Youzify
- CVE-2024-6069Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installationgenetechproducts Pie Register – User Registration, Profiles…
- CVE-2024-5456Panda Video <= 1.4.0 - Authenticated (Contributor+) Local File Inclusionpandavideo Panda Video
- CVE-2024-5479Easy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scriptingjevnet Easy Pixels
- CVE-2024-6320ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Uploaddwieeb ScrollTo Top
- CVE-2024-6321ScrollTo Bottom <= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Uploaddwieeb ScrollTo Bottom
- CVE-2024-6310Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Uploaddeano1987 Advanced AJAX Page Loader
- CVE-2024-6309Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Uploadpraveen-rajan Attachment File Icons
- CVE-2024-6123Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Uploadbitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
- CVE-2024-6316Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Uploadzealopensource Generate PDF using Contact Form
- CVE-2024-6317Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletionzealopensource Generate PDF using Contact Form
- CVE-2024-6180EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updatesashanjay EventON – Events Calendar
- CVE-2024-6161Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Uploadpjgalbraith Default Thumbnail Plus
- CVE-2024-28750ifm: Deleting function in Smart PLC allows command injectionsifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…
- CVE-2024-28749ifm: Writing file function in Smart PLC allows command injections ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…
- CVE-2024-28748ifm: Reading function in Smart PLC allows command injections ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…
- CVE-2024-5441Modern Events Calendar <= 7.11.0 - Authenticated (Subscriber+) Arbitrary File UploadWebnus Modern Events Calendar · webnus/ Modern Events Calen…
- CVE-2024-6166Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injectionunitecms Unlimited Elements For Elementor
- CVE-2024-39597[CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP CommerceSAP_SE SAP Commerce
- CVE-2024-39592[CVE-2024-39592] Missing Authorization check in SAP PDCESAP_SE SAP PDCE
- CVE-2024-5974Firebox Authenticated Buffer Overflow VulnerabilityWatchGuard Fireware OS
- CVE-2024-4944Mobile VPN with SSL Local Privilege Escalation VulnerabilityWatchGuard Mobile VPN with SSL Client
- CVE-2024-5793Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL InjectionFavethemes Houzez Theme - Functionality
- CVE-2024-5549Data leak through CORS misconfiguration in stitionai/devikastitionai/devika
- CVE-2023-50805A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98
- CVE-2023-50806A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98
- CVE-2023-50807A vulnerability was discovered in Samsung Wearable Processor and Modems with versions Exynos 9110, Exynos Modem 5123, Exynos Modem 5300 that
- CVE-2024-29153A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98
- CVE-2024-36676Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification emssddanbrown/bookstack
- CVE-2024-37829An issue in Outline <= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link
- CVE-2024-37871SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers
- CVE-2024-37872SQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL comman
- CVE-2024-39063Lime Survey <= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2024-39069An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack.
- CVE-2024-39171Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writin
- CVE-2024-40034idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del
- CVE-2024-40036idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=add&nohrefStr=cl
- CVE-2024-40037idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del
- CVE-2024-40039idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del
- CVE-2024-40728A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40729A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40732A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40738A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40740A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40741A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
Medium, low and unrated 182
- CVE-2024-25023IBM QRadar Suite Software information disclosureIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2024-21832PingFederate REST API Data Store InjectionPing Identity PingFederate
- CVE-2024-22377PingFederate Runtime Node Path TraversalPing Identity PingFederate
- CVE-2024-22477PingFederate OIDC Policy Management Editor Cross-Site ScriptingPing Identity PingFederate
- CVE-2024-21993Information Disclosure Vulnerability in SnapCenterNetApp SnapCenter
- CVE-2024-39900OpenSearch Dashboards Reports does not properly restrict access to private tenant resourcesopensearch-project reporting · org.opensearch.plugin:opense…
- CVE-2024-39901OpenSearch Observability does not properly restrict access to private tenant resourcesopensearch-project observability · org.opensearch.plugin:op…
- CVE-2024-34723In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logiGoogle Android
- CVE-2024-34721In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation.Google Android
- CVE-2024-31334In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code.Google Android
- CVE-2024-31327In multiple functions of MessageQueueBase.h, there is a possible out of bounds write due to a race condition.Google Android
- CVE-2024-31322In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retaininGoogle Android
- CVE-2024-31315In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notificatGoogle Android
- CVE-2024-31314In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion.Google Android
- CVE-2024-31312In multiple locations, there is a possible information leak due to a missing permission check.Google Android
- CVE-2024-31311In increment_annotation_count of stats_event.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-6501Networkmanager: denial of serviceNetworkManager · Red Hat Enterprise Linux +1
- CVE-2024-34140Adobe Bridge PDF File Parsing Memory CorruptionAdobe Bridge
- CVE-2024-39899PrivateBin allows shortening of URLs for other domainsPrivateBin · privatebin/privatebin
- CVE-2024-39684Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer OverflowTencent RapidJSON
- CVE-2024-38517Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer UnderflowTencent RapidJSON
- CVE-2024-39897Cache driver GetBlob() allows read access to any blob without access control checkproject-zot zot · zotregistry.io/zot +1
- CVE-2024-27183Extension - dj-extensions.com - XSS vulnerability in DJ-HelpfulArticles component for Joomla 1.0.0-1.1.0dj-extensions.com DJ-HelpfulArticles for Joomla
- CVE-2024-5652In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers modeDocker Desktop
- CVE-2024-38105Windows Layer-2 Bridge Network Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38101Windows Layer-2 Bridge Network Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38099Windows Remote Desktop Licensing Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-38065Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38058BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-38049Windows Distributed Transaction Coordinator Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-38048Windows Network Driver Interface Specification (NDIS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38030Windows Themes Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-38027Windows Line Printer Daemon Service Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38020Microsoft Outlook Spoofing VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2024-38017Microsoft Message Queuing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-30071Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-26184Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-38102Windows Layer-2 Bridge Network Driver Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-38086Azure Kinect SDK Remote Code Execution VulnerabilityMicrosoft Azure Kinect SDK
- CVE-2024-38056Microsoft Windows Codecs Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38055Microsoft Windows Codecs Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38041Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-38013Microsoft Windows Server Backup Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-35270Windows iSCSI Service Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-6237389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request389-ds-base · Red Hat Directory Server 12.4 for RHEL +2
- CVE-2024-21729[20240701] - Core - XSS in accessible media selection fieldJoomla! Project Joomla! CMS
- CVE-2024-21730[20240702] - Core - Self-XSS in fancyselect list field layoutJoomla! Project Joomla! CMS
- CVE-2024-26279[20240704] - Core - XSS in Wrapper extensionsJoomla! Project Joomla! CMS
- CVE-2024-26278[20240705] - Core - XSS in com_fields default field valueJoomla! Project Joomla! CMS
- CVE-2024-21731[20240703] - Core - XSS in StringHelper::truncate methodJoomla! Project Joomla! CMS
- CVE-2023-50181An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only autFortinet FortiADC
- CVE-2024-21759An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker Fortinet FortiPortal
- CVE-2024-26015An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and beFortinet FortiProxy · Fortinet FortiOS
- CVE-2023-50179An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allowFortinet FortiADC
- CVE-2024-27785An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenFortinet FortiAIOps
- CVE-2024-33509An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all vFortinet FortiWeb
- CVE-2024-6614Incorrect listing of stack framesMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6613Incorrect listing of stack framesMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6612CSP violation leakage when using devtoolsMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6610Form validation popups could block exiting full-screen modeMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6608Cursor could be moved out of the viewport using pointerlock.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-6601Race condition in permission assignmentMozilla Firefox · Mozilla Thunderbird
- CVE-2024-6600Memory corruption in WebGL APIMozilla Firefox · Mozilla Thunderbird
- CVE-2023-39328Openjpeg: denail of service via crafted image fileopenjpeg · Red Hat Enterprise Linux
- CVE-2024-2177Improper Restriction of Rendered UI Layers or Frames in GitLabGitLab
- CVE-2024-37934WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerabilitySaturday Drive Ninja Forms
- CVE-2024-37520WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerabilityRadiusTheme ShopBuilder – Elementor WooCommerce Builder Add…
- CVE-2024-39876A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39875A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39871A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39870A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39869A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1).Siemens SINEMA Remote Connect Server
- CVE-2024-39569A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 HF1).Siemens SINEMA Remote Connect Client
- CVE-2024-38867A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +38
- CVE-2024-38278A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGSiemens RUGGEDCOM RMC8388 V5.X · Siemens RUGGEDCOM RMC8… +32
- CVE-2024-37996A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0Siemens JT Open · Siemens JT2Go +2
- CVE-2024-30321A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versioSiemens SIMATIC PCS 7 · Siemens SIMATIC WinCC Runtime Pr… +1
- CVE-2023-52891A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5),Siemens SIMATIC Energy Manager Basic · Siemens SIMATIC E… +3
- CVE-2023-52238A vulnerability has been identified in RUGGEDCOM RST2228 (All versions < V5.9.0), RUGGEDCOM RST2228P (All versions < V5.9.0).Siemens RUGGEDCOM RST2228 · Siemens RUGGEDCOM RST2228P
- CVE-2023-32737A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions < V18 Update 2).Siemens SIMATIC STEP 7 Safety
- CVE-2023-32735A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions < V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions < V1Siemens SIMATIC STEP 7 Safety · Siemens SIMATIC STEP 7 +11
- CVE-2024-37499WordPress Online Booking & Scheduling Calendar for WordPress plugin <= 4.4.2 - Local File Inclusion vulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2024-37464WordPress Beaver Builder Addons by WPZOOM plugin <= 1.3.5 - Local File Inclusion vulnerabilityBeaver Builder Addons by WPZOOM
- CVE-2024-6391oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcodebobbingwide oik
- CVE-2024-4862WPBITS Addons For Elementor Page Builder <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsWPBITS Addons For Elementor Page Builder
- CVE-2024-5946Squelch Tabs and Accordions Shortcodes <= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab ShortcodeSquelch Tabs and Accordions Shortcodes
- CVE-2024-5632Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default passwLongse Technology NVR3608PGE2W · Zamel ZMB-01
- CVE-2024-5631Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and passwordLongse Technology NVR3608PGE2W · Zamel ZMB-01
- CVE-2024-37454WordPress AWSM Team – Team Showcase Plugin plugin <= 1.3.1 - Local File Inclusion vulnerabilityAWSM Innovations AWSM Team
- CVE-2024-37442WordPress Photo Gallery by Ays – Responsive Image Gallery plugin < 5.7.1 - HTML Injection vulnerabilityPhoto Gallery Team Photo Gallery by Ays
- CVE-2024-37437WordPress Elementor Website Builder plugin <= 3.22.1 - Arbitrary SVG File Download vulnerabilityElementor Website Builder
- CVE-2024-37430WordPress Patreon WordPress plugin <= 1.9.0 - Image Protection Bypass vulnerabilityPatreon WordPress
- CVE-2023-3290A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0easyappointments
- CVE-2024-37410WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.3 - Local File Inclusion vulnerabilityIdeaBox Creations PowerPack Lite for Beaver Builder
- CVE-2024-37266WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerabilityThemeum Tutor LMS
- CVE-2024-37253WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerabilityWpDirectoryKit WP Directory Kit
- CVE-2024-35777WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerabilityAutomattic WooCommerce
- CVE-2024-37502WordPress Social Login plugin <= 2.6.3 - PHP Object Injection vulnerabilitywpweb WooCommerce Social Login
- CVE-2024-3563Genesis Blocks <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributesstudiopress Genesis Blocks
- CVE-2024-5669XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptinghappydevs Happy WooCommerce FAQs – Ultimate Product FAQ Plu…
- CVE-2024-4102Pricing Table <= 2.0.1 - Missing Authorizationelfsight Pricing Table
- CVE-2024-5992Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings UpdateCliengo – Chatbot
- CVE-2024-5937Simple Alert Boxes <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcodemardojai Simple Alert Boxes
- CVE-2024-6168Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actionsaprokopenko Just Custom Fields
- CVE-2024-5457Panda Video <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingpandavideo Panda Video
- CVE-2024-3228Social Sharing Plugin – Kiwi <= 2.1.7 - Information Disclosurewpkube Social Sharing Plugin – Kiwi
- CVE-2024-3603OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodephotoweblog OSM – OpenStreetMap
- CVE-2024-5648LearnDash LMS - Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Updatestellarwp LearnDash LMS – Reports
- CVE-2024-5856Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletionwppuzzle Comment Images Reloaded
- CVE-2024-4100Pricing Table <= 2.0.1 - Cross-Site Request Forgery via ajax()elfsight Pricing Table
- CVE-2024-4868Extensions for Elementor <= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widgetpetesheppard84 Extensions for Elementor
- CVE-2024-5600Happy SCSS Compiler - Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptinghappymonkeyagency SCSS Happy Compiler – Compile SCSS to CSS…
- CVE-2024-3608Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment DeletionPickPlugins Product Designer for WooCommerce
- CVE-2024-5810WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded CredentialsWP2Speed Faster – Optimize PageSpeed Insights Score 90-100
- CVE-2024-5704XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Updatehappydevs Happy WooCommerce FAQs – Ultimate Product FAQ Plu…
- CVE-2024-6167Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actionsaprokopenko Just Custom Fields
- CVE-2024-5993Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings UpdateCliengo – Chatbot
- CVE-2024-5881Webico Slider Flatsome Addons <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcodetranbinhcse Webico Slider Flatsome Addons
- CVE-2024-37923WordPress Cliengo – Chatbot plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerabilityCliengo – Chatbot
- CVE-2024-22062Permissions and Access Control Vulnerability in ZTE ZXCLOUD IRAIZTE ZXCLOUD IRAI
- CVE-2024-6334 Easy Table of Contents < 2.0.67 - Editor+ Stored XSSEasy Table of Contents
- CVE-2024-5802URL Shortener by MyThemeShop <= 1.0.17 - Admin+ Stored XSSURL Shortener by MyThemeShop
- CVE-2024-3410DN Footer Contacts < 1.6.3 - Admin+ Stored XSSDN Footer Contacts
- CVE-2024-34692[CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable NowSAP_SE SAP Enable Now
- CVE-2024-37180[CVE-2024-37180] Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-6169Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username'unitecms Unlimited Elements For Elementor
- CVE-2024-6170Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email'unitecms Unlimited Elements For Elementor
- CVE-2024-4667Blog, Posts and Category Filter for Elementor <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widgetplugindevs Blog, Posts and Category Filter for Elementor
- CVE-2024-6171Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypassunitecms Unlimited Elements For Elementor
- CVE-2024-39596[CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable NowSAP_SE SAP Enable Now
- CVE-2024-39599[CVE-2024-39599] Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server for ABAP and ABAP P…
- CVE-2024-37171[CVE-2024-37171] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal)SAP_SE SAP Transportation Management
- CVE-2024-39600[CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for WindowsSAP_SE SAP GUI for Windows
- CVE-2024-34689[CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)SAP_SE SAP Business Workflow
- CVE-2024-37172[CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)SAP_SE SAP S/4HANA Finance
- CVE-2024-39595[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and SimulationSAP_SE SAP Business Warehouse - Business Planning and Simul…
- CVE-2024-39594[CVE-2024-39594] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and SimulationSAP_SE SAP Business Warehouse - Business Planning and Simul…
- CVE-2024-37175[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)SAP_SE SAP CRM WebClient UI
- CVE-2024-39598[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)SAP_SE SAP CRM WebClient UI
- CVE-2024-37174[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)SAP_SE SAP CRM WebClient UI
- CVE-2024-37173[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)SAP_SE SAP CRM WebClient UI
- CVE-2024-34685[CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditorSAP_SE SAP NetWeaver Knowledge Management XMLEditor
- CVE-2024-39593[CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape ManagementSAP_SE SAP Landscape Management
- CVE-2024-5855Media Hygiene <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletionslui Media Hygiene: Remove or Delete Unused Images and More!
- CVE-2024-22020A security flaw in Node.js allows a bypass of network import restrictions.NodeJS Node
- CVE-2024-34786UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Ubiquiti UniFi iOS App
- CVE-2024-5569Denial of Service via crafted zip file in jaraco/zippjaraco/zipp · zipp
- CVE-2023-48194Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \x0.
- CVE-2024-27360A vulnerability was discovered in Samsung Mobile Processors Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exy
- CVE-2024-27361A vulnerability was discovered in Samsung Mobile Processor Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exyno
- CVE-2024-27362A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they d
- CVE-2024-27363A vulnerability was discovered in Samsung Mobile Processor Exynos 850, Exynos 9610, Exynos 980, Exynos 1280, Exynos 1380, Exynos 1330, Exyno
- CVE-2024-27385A vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 rela
- CVE-2024-27386A vulnerability was discovered in the slsi_handle_nan_rx_event_log_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 rela
- CVE-2024-28067A vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle (MITM) attacker to downgrade the security mode of packets going to t
- CVE-2024-28068A vulnerability was discovered in SS in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exy
- CVE-2024-31957A vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of native
- CVE-2024-37830An issue in Outline <= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie
- CVE-2024-37865An issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to obtain sensitive information via the S3 compat
- CVE-2024-38959Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitr
- CVE-2024-38963Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" p
- CVE-2024-38970vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function.
- CVE-2024-38971vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting (XSS) in the system backend.
- CVE-2024-38972A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-39031In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar.org.silverpeas.core:silverpeas-core-rs · org.silverpeas.cor…
- CVE-2024-39072AMTT Hotel Broadband Operation System (HiBOS) v3.0.3.151204 is vulnerable to SQL injection via manager/conference/calendar_remind.php.
- CVE-2024-39118Mommy Heather Advanced Backups up to v3.5.3 allows attackers to write arbitrary files via restoring a crafted back up.
- CVE-2024-39181Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenera
- CVE-2024-40035idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add.
- CVE-2024-40038idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev
- CVE-2024-40726A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40727A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40730A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40731A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40733A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40734A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40735A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40736A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40737A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40739A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40742A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2024-40750Linksys Velop Pro 6E 1.0.8 MX6200_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during ap