# CVEs published 2024-07-09

473 CVEs were published on July 9, 2024: 34 critical, 257 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-25023](https://cve.now/CVE-2024-25023.md): IBM QRadar Suite Software information disclosure (CVSS 5.5, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-21417](https://cve.now/CVE-2024-21417.md): Windows Text Services Framework Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21832](https://cve.now/CVE-2024-21832.md): PingFederate REST API Data Store Injection (CVSS 3.5, Ping Identity PingFederate)
- [CVE-2024-22377](https://cve.now/CVE-2024-22377.md): PingFederate Runtime Node Path Traversal (CVSS 5.3, Ping Identity PingFederate)
- [CVE-2024-22477](https://cve.now/CVE-2024-22477.md): PingFederate OIDC Policy Management Editor Cross-Site Scripting (CVSS 1.8, Ping Identity PingFederate)
- [CVE-2024-35154](https://cve.now/CVE-2024-35154.md): IBM WebSphere Application Server code execution (CVSS 7.2, IBM WebSphere Application Server)
- [CVE-2024-21993](https://cve.now/CVE-2024-21993.md): Information Disclosure Vulnerability in SnapCenter (CVSS 5.7, NetApp SnapCenter)
- [CVE-2024-39883](https://cve.now/CVE-2024-39883.md): Heap-based Buffer Overflow in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-39882](https://cve.now/CVE-2024-39882.md): Out-of-bounds Read in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-39881](https://cve.now/CVE-2024-39881.md): Out-of-bounds Write in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-39880](https://cve.now/CVE-2024-39880.md): Stack-based Buffer Overflow in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-39900](https://cve.now/CVE-2024-39900.md): OpenSearch Dashboards Reports does not properly restrict access to private tenant resources (CVSS 5.4, opensearch-project reporting · org.opensearch.plugin:opense…)
- [CVE-2024-39901](https://cve.now/CVE-2024-39901.md): OpenSearch Observability does not properly restrict access to private tenant resources (CVSS 4.2, opensearch-project observability · org.opensearch.plugin:op…)
- [CVE-2024-34726](https://cve.now/CVE-2024-34726.md): In PVRSRV\_MMap of pvr\_bridge\_k.c, there is a possible arbitrary code execution due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-34725](https://cve.now/CVE-2024-34725.md): In DevmemIntUnexportCtx of devicemem\_server.c, there is a possible arbitrary code execution due to a race condition. (CVSS 7.4, Google Android)
- [CVE-2024-34724](https://cve.now/CVE-2024-34724.md): In \_UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2024-34723](https://cve.now/CVE-2024-34723.md): In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logi (CVSS 5.3, Google Android)
- [CVE-2024-34722](https://cve.now/CVE-2024-34722.md): In smp\_proc\_rand of smp\_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect implementation of a pro (CVSS 7.4, Google Android)
- [CVE-2024-34721](https://cve.now/CVE-2024-34721.md): In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation. (CVSS 6.2, Google Android)
- [CVE-2024-34720](https://cve.now/CVE-2024-34720.md): In com\_android\_internal\_os\_ZygoteCommandBuffer\_nativeForkRepeatedly of com\_android\_internal\_os\_ZygoteCommandBuffer.cpp, there is a possible (CVSS 7.4, Google Android)
- [CVE-2024-31339](https://cve.now/CVE-2024-31339.md): In multiple functions of StatsService.cpp, there is a possible memory corruption due to a use after free. (CVSS 7.8, Google Android)
- [CVE-2024-31335](https://cve.now/CVE-2024-31335.md): In DevmemIntChangeSparse2 of devicemem\_server.c, there is a possible arbitrary code execution due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2024-31334](https://cve.now/CVE-2024-31334.md): In DevmemIntFreeDefBackingPage of devicemem\_server.c, there is a possible arbitrary code execution due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2024-31332](https://cve.now/CVE-2024-31332.md): In multiple locations, there is a possible way to bypass a restriction on adding new Wi-Fi connections due to a missing permission check. (CVSS 8.4, Google Android)
- [CVE-2024-31331](https://cve.now/CVE-2024-31331.md): In setMimeGroup of PackageManagerService.java, there is a possible way to hide the service from Settings due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-31320](https://cve.now/CVE-2024-31320.md): In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation d (CVSS 7.4, Google Android)
- [CVE-2024-31327](https://cve.now/CVE-2024-31327.md): In multiple functions of MessageQueueBase.h, there is a possible out of bounds write due to a race condition. (CVSS 5.3, Google Android)
- [CVE-2024-31326](https://cve.now/CVE-2024-31326.md): In multiple locations, there is a possible way in which policy migration code will never be executed due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-31325](https://cve.now/CVE-2024-31325.md): In multiple locations, there is a possible way to reveal images across users data due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-31324](https://cve.now/CVE-2024-31324.md): In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity in portrait mode firs (CVSS 7.8, Google Android)
- [CVE-2024-31323](https://cve.now/CVE-2024-31323.md): In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjacking. (CVSS 7.8, Google Android)
- [CVE-2024-31322](https://cve.now/CVE-2024-31322.md): In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the Setting while retainin (CVSS 6.3, Google Android)
- [CVE-2024-31319](https://cve.now/CVE-2024-31319.md): In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a con (CVSS 8.4, Google Android)
- [CVE-2024-31318](https://cve.now/CVE-2024-31318.md): In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due to a missing permissio (CVSS 7.8, Google Android)
- [CVE-2024-31317](https://cve.now/CVE-2024-31317.md): In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE\_SECURE\_SETTINGS due to u (CVSS 7.8, Google Android)
- [CVE-2024-31316](https://cve.now/CVE-2024-31316.md): In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch (CVSS 7.8, Google Android)
- [CVE-2024-31315](https://cve.now/CVE-2024-31315.md): In multiple functions of ManagedServices.java, there is a possible way to hide an app with notification access in the Device & app notificat (CVSS 5.3, Google Android)
- [CVE-2024-31314](https://cve.now/CVE-2024-31314.md): In multiple functions of ShortcutService.java, there is a possible persistent DOS due to resource exhaustion. (CVSS 6.2, Google Android)
- [CVE-2024-31313](https://cve.now/CVE-2024-31313.md): In availableToWriteBytes of MessageQueueBase.h, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-31312](https://cve.now/CVE-2024-31312.md): In multiple locations, there is a possible information leak due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2024-31311](https://cve.now/CVE-2024-31311.md): In increment\_annotation\_count of stats\_event.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.3, Google Android)
- [CVE-2024-31310](https://cve.now/CVE-2024-31310.md): In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabled Autofill service app in the Autofill (CVSS 7.8, Google Android)
- [CVE-2024-23711](https://cve.now/CVE-2024-23711.md): In DevmemXIntUnreserveRange of devicemem\_server.c, there is a possible arbitrary code execution due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2024-23698](https://cve.now/CVE-2024-23698.md): In RGXFWChangeOSidPriority of rgxfwutils.c, there is a possible arbitrary code execution due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-23697](https://cve.now/CVE-2024-23697.md): In RGXCreateHWRTData\_aux of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. (CVSS 7.3, Google Android)
- [CVE-2024-23696](https://cve.now/CVE-2024-23696.md): In RGXCreateZSBufferKM of rgxta3d.c, there is a possible arbitrary code execution due to a use after free. (CVSS 8.4, Google Android)
- [CVE-2024-23695](https://cve.now/CVE-2024-23695.md): In CacheOpPMRExec of cache\_km.c, there is a possible out of bounds write due to an integer overflow. (CVSS 8.4, Google Android)
- [CVE-2023-21114](https://cve.now/CVE-2023-21114.md): In multiple locations, there is a possible permission bypass due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2023-21113](https://cve.now/CVE-2023-21113.md): In multiple locations, there is a possible permission bypass due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2024-6501](https://cve.now/CVE-2024-6501.md): Networkmanager: denial of service (CVSS 3.1, NetworkManager · Red Hat Enterprise Linux +1)
- [CVE-2024-34140](https://cve.now/CVE-2024-34140.md): Adobe Bridge PDF File Parsing Memory Corruption (CVSS 5.5, Adobe Bridge)
- [CVE-2024-34139](https://cve.now/CVE-2024-34139.md): Adobe Bridge has an integer overflow vulnerability when parsing SVG file (CVSS 7.8, Adobe Bridge)
- [CVE-2024-20781](https://cve.now/CVE-2024-20781.md): Adobe Indesign TIF File Parsing Heap Memory Corruption (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-20785](https://cve.now/CVE-2024-20785.md): Adobe Indesign 2024 TIFF File Parsing Memory Corruption Remote Code Execution vulnerability (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-20783](https://cve.now/CVE-2024-20783.md): Adobe Indesign 2024 RLE File Parsing Heap Memory Corruption (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-20782](https://cve.now/CVE-2024-20782.md): Adobe Indesign WMF File Parsing Out Of Bound Write (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2024-34123](https://cve.now/CVE-2024-34123.md): Adobe Premiere Pro arbitrary DLL loading lead to remote code execution (CVSS 7.0, Adobe Premiere Pro)
- [CVE-2024-39899](https://cve.now/CVE-2024-39899.md): PrivateBin allows shortening of URLs for other domains (CVSS 5.3, PrivateBin · privatebin/privatebin)
- [CVE-2024-39684](https://cve.now/CVE-2024-39684.md): Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow (CVSS 6.8, Tencent RapidJSON)
- [CVE-2024-38517](https://cve.now/CVE-2024-38517.md): Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Underflow (CVSS 6.8, Tencent RapidJSON)
- [CVE-2024-39897](https://cve.now/CVE-2024-39897.md): Cache driver GetBlob() allows read access to any blob without access control check (CVSS 4.3, project-zot zot · zotregistry.io/zot +1)
- [CVE-2024-27183](https://cve.now/CVE-2024-27183.md): Extension - dj-extensions.com - XSS vulnerability in DJ-HelpfulArticles component for Joomla 1.0.0-1.1.0 (CVSS 6.1, dj-extensions.com DJ-HelpfulArticles for Joomla)
- [CVE-2024-39698](https://cve.now/CVE-2024-39698.md): Code Signing Bypass on Windows in electron-updater \< 6.3.0-alpha.6 (CVSS 7.5, electron-userland electron-builder · electron-updater)
- [CVE-2024-6222](https://cve.now/CVE-2024-6222.md): In Docker Desktop before v4.29.0 an attacker who has gained access to the Docker Desktop VM through a container breakout can further escape to the host by passing extensions and dashboard related IPC messages (CVSS 7.3, Docker Desktop)
- [CVE-2024-5652](https://cve.now/CVE-2024-5652.md): In Docker Desktop on Windows before v4.31.0 allows a user in the docker-users group to cause a Windows Denial-of-Service through the exec-path Docker daemon config option in Windows containers mode (CVSS 6.1, Docker Desktop)
- [CVE-2024-38105](https://cve.now/CVE-2024-38105.md): Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38101](https://cve.now/CVE-2024-38101.md): Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38099](https://cve.now/CVE-2024-38099.md): Windows Remote Desktop Licensing Service Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows Server)
- [CVE-2024-38095](https://cve.now/CVE-2024-38095.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft PowerShell · Microsoft .NET +14)
- [CVE-2024-38094](https://cve.now/CVE-2024-38094.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 7.2, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-38092](https://cve.now/CVE-2024-38092.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Azure CycleCloud)
- [CVE-2024-38089](https://cve.now/CVE-2024-38089.md): Microsoft Defender for IoT Elevation of Privilege Vulnerability (CVSS 9.1, Microsoft Defender for IoT)
- [CVE-2024-38081](https://cve.now/CVE-2024-38081.md): .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio · Microsoft .NET +1)
- [CVE-2024-38079](https://cve.now/CVE-2024-38079.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38078](https://cve.now/CVE-2024-38078.md): Xbox Wireless Adapter Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38076](https://cve.now/CVE-2024-38076.md): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2024-38074](https://cve.now/CVE-2024-38074.md): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2024-38073](https://cve.now/CVE-2024-38073.md): Windows Remote Desktop Licensing Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38070](https://cve.now/CVE-2024-38070.md): Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38069](https://cve.now/CVE-2024-38069.md): Windows Enroll Engine Security Feature Bypass Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-38068](https://cve.now/CVE-2024-38068.md): Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38067](https://cve.now/CVE-2024-38067.md): Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38066](https://cve.now/CVE-2024-38066.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38065](https://cve.now/CVE-2024-38065.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-38058](https://cve.now/CVE-2024-38058.md): BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-38057](https://cve.now/CVE-2024-38057.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38053](https://cve.now/CVE-2024-38053.md): Windows Layer-2 Bridge Network Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38052](https://cve.now/CVE-2024-38052.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38050](https://cve.now/CVE-2024-38050.md): Windows Workstation Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38049](https://cve.now/CVE-2024-38049.md): Windows Distributed Transaction Coordinator Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2024-38048](https://cve.now/CVE-2024-38048.md): Windows Network Driver Interface Specification (NDIS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38047](https://cve.now/CVE-2024-38047.md): PowerShell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38044](https://cve.now/CVE-2024-38044.md): DHCP Server Service Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-38033](https://cve.now/CVE-2024-38033.md): PowerShell Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-38032](https://cve.now/CVE-2024-38032.md): Microsoft Xbox Remote Code Execution Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2024-38031](https://cve.now/CVE-2024-38031.md): Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38030](https://cve.now/CVE-2024-38030.md): Windows Themes Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38028](https://cve.now/CVE-2024-38028.md): Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2024-38027](https://cve.now/CVE-2024-38027.md): Windows Line Printer Daemon Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38021](https://cve.now/CVE-2024-38021.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2024-38020](https://cve.now/CVE-2024-38020.md): Microsoft Outlook Spoofing Vulnerability (CVSS 6.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2024-38019](https://cve.now/CVE-2024-38019.md): Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2024-38017](https://cve.now/CVE-2024-38017.md): Microsoft Message Queuing Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38011](https://cve.now/CVE-2024-38011.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-38010](https://cve.now/CVE-2024-38010.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37989](https://cve.now/CVE-2024-37989.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37988](https://cve.now/CVE-2024-37988.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37984](https://cve.now/CVE-2024-37984.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.4, Microsoft Windows)
- [CVE-2024-37978](https://cve.now/CVE-2024-37978.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37977](https://cve.now/CVE-2024-37977.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-37975](https://cve.now/CVE-2024-37975.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37973](https://cve.now/CVE-2024-37973.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-37972](https://cve.now/CVE-2024-37972.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37971](https://cve.now/CVE-2024-37971.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-35256](https://cve.now/CVE-2024-35256.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-28928](https://cve.now/CVE-2024-28928.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37336](https://cve.now/CVE-2024-37336.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37333](https://cve.now/CVE-2024-37333.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37334](https://cve.now/CVE-2024-37334.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-37330](https://cve.now/CVE-2024-37330.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37329](https://cve.now/CVE-2024-37329.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37328](https://cve.now/CVE-2024-37328.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37327](https://cve.now/CVE-2024-37327.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37326](https://cve.now/CVE-2024-37326.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21449](https://cve.now/CVE-2024-21449.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37324](https://cve.now/CVE-2024-37324.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server 201… +1)
- [CVE-2024-37323](https://cve.now/CVE-2024-37323.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37322](https://cve.now/CVE-2024-37322.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37321](https://cve.now/CVE-2024-37321.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37320](https://cve.now/CVE-2024-37320.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37319](https://cve.now/CVE-2024-37319.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21425](https://cve.now/CVE-2024-21425.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2019 for x64-based Systems · Micros… +1)
- [CVE-2024-21331](https://cve.now/CVE-2024-21331.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21317](https://cve.now/CVE-2024-21317.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21308](https://cve.now/CVE-2024-21308.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21303](https://cve.now/CVE-2024-21303.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server 201… +1)
- [CVE-2024-20701](https://cve.now/CVE-2024-20701.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-35272](https://cve.now/CVE-2024-35272.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio · Microsoft SQL Server)
- [CVE-2024-35271](https://cve.now/CVE-2024-35271.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-35267](https://cve.now/CVE-2024-35267.md): Azure DevOps Server Spoofing Vulnerability (CVSS 7.6, Microsoft Azure DevOps Server)
- [CVE-2024-35266](https://cve.now/CVE-2024-35266.md): Azure DevOps Server Spoofing Vulnerability (CVSS 7.6, Microsoft Azure DevOps Server)
- [CVE-2024-35261](https://cve.now/CVE-2024-35261.md): Azure Network Watcher VM Extension Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Network Watcher VM Extension)
- [CVE-2024-30105](https://cve.now/CVE-2024-30105.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft PowerShell +2)
- [CVE-2024-30079](https://cve.now/CVE-2024-30079.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30071](https://cve.now/CVE-2024-30071.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2024-32987](https://cve.now/CVE-2024-32987.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 7.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-30013](https://cve.now/CVE-2024-30013.md): Windows MultiPoint Services Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26184](https://cve.now/CVE-2024-26184.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-38112](https://cve.now/CVE-2024-38112.md): Windows MSHTML Platform Spoofing Vulnerability (CVSS 7.5, KEV, Microsoft Windows)
- [CVE-2024-38104](https://cve.now/CVE-2024-38104.md): Windows Fax Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38102](https://cve.now/CVE-2024-38102.md): Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-38100](https://cve.now/CVE-2024-38100.md): Windows File Explorer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server)
- [CVE-2024-38091](https://cve.now/CVE-2024-38091.md): Microsoft WS-Discovery Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38086](https://cve.now/CVE-2024-38086.md): Azure Kinect SDK Remote Code Execution Vulnerability (CVSS 6.4, Microsoft Azure Kinect SDK)
- [CVE-2024-38085](https://cve.now/CVE-2024-38085.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38080](https://cve.now/CVE-2024-38080.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-38077](https://cve.now/CVE-2024-38077.md): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows Server)
- [CVE-2024-38072](https://cve.now/CVE-2024-38072.md): Windows Remote Desktop Licensing Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38071](https://cve.now/CVE-2024-38071.md): Windows Remote Desktop Licensing Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38064](https://cve.now/CVE-2024-38064.md): Windows TCP/IP Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38062](https://cve.now/CVE-2024-38062.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38061](https://cve.now/CVE-2024-38061.md): DCOM Remote Cross-Session Activation Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-38060](https://cve.now/CVE-2024-38060.md): Windows Imaging Component Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-38059](https://cve.now/CVE-2024-38059.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-38056](https://cve.now/CVE-2024-38056.md): Microsoft Windows Codecs Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38055](https://cve.now/CVE-2024-38055.md): Microsoft Windows Codecs Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38054](https://cve.now/CVE-2024-38054.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38051](https://cve.now/CVE-2024-38051.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38043](https://cve.now/CVE-2024-38043.md): PowerShell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38041](https://cve.now/CVE-2024-38041.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-38034](https://cve.now/CVE-2024-38034.md): Windows Filtering Platform Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-38025](https://cve.now/CVE-2024-38025.md): Microsoft Windows Performance Data Helper Library Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2024-38024](https://cve.now/CVE-2024-38024.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-38023](https://cve.now/CVE-2024-38023.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-38022](https://cve.now/CVE-2024-38022.md): Windows Image Acquisition Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-38015](https://cve.now/CVE-2024-38015.md): Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-38013](https://cve.now/CVE-2024-38013.md): Microsoft Windows Server Backup Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-37987](https://cve.now/CVE-2024-37987.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37986](https://cve.now/CVE-2024-37986.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37981](https://cve.now/CVE-2024-37981.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37974](https://cve.now/CVE-2024-37974.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37970](https://cve.now/CVE-2024-37970.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37969](https://cve.now/CVE-2024-37969.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-37331](https://cve.now/CVE-2024-37331.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37332](https://cve.now/CVE-2024-37332.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-37318](https://cve.now/CVE-2024-37318.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2019 for x64-based Systems · Micros… +1)
- [CVE-2024-21428](https://cve.now/CVE-2024-21428.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21415](https://cve.now/CVE-2024-21415.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21414](https://cve.now/CVE-2024-21414.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21398](https://cve.now/CVE-2024-21398.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21373](https://cve.now/CVE-2024-21373.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21335](https://cve.now/CVE-2024-21335.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21333](https://cve.now/CVE-2024-21333.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-21332](https://cve.now/CVE-2024-21332.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-38087](https://cve.now/CVE-2024-38087.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-38088](https://cve.now/CVE-2024-38088.md): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-35270](https://cve.now/CVE-2024-35270.md): Windows iSCSI Service Denial of Service Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2024-35264](https://cve.now/CVE-2024-35264.md): .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.1, Microsoft .NET · Microsoft Visual Studio +12)
- [CVE-2024-30098](https://cve.now/CVE-2024-30098.md): Windows Cryptographic Services Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-30081](https://cve.now/CVE-2024-30081.md): Windows NTLM Spoofing Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2024-28899](https://cve.now/CVE-2024-28899.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-30061](https://cve.now/CVE-2024-30061.md): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (CVSS 7.3, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-6237](https://cve.now/CVE-2024-6237.md): 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request (CVSS 6.5, 389-ds-base · Red Hat Directory Server 12.4 for RHEL +2)
- [CVE-2024-21729](https://cve.now/CVE-2024-21729.md): \[20240701\] - Core - XSS in accessible media selection field (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2024-21730](https://cve.now/CVE-2024-21730.md): \[20240702\] - Core - Self-XSS in fancyselect list field layout (CVSS 5.4, Joomla! Project Joomla! CMS)
- [CVE-2024-26279](https://cve.now/CVE-2024-26279.md): \[20240704\] - Core - XSS in Wrapper extensions (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2024-26278](https://cve.now/CVE-2024-26278.md): \[20240705\] - Core - XSS in com\_fields default field value (CVSS 4.6, Joomla! Project Joomla! CMS)
- [CVE-2024-21731](https://cve.now/CVE-2024-21731.md): \[20240703\] - Core - XSS in StringHelper::truncate method (CVSS 6.1, Joomla! Project Joomla! CMS)
- [CVE-2023-40356](https://cve.now/CVE-2023-40356.md): PingOne MFA Integration Kit MFA bypass (CVSS 8.7, Ping Identity PingOne MFA Integration Kit for PingFederate)
- [CVE-2023-40702](https://cve.now/CVE-2023-40702.md): PingOne MFA Integration Kit MFA bypass (CVSS 7.7, Ping Identity PingOne MFA Integration Kit for PingFederate)
- [CVE-2023-50178](https://cve.now/CVE-2023-50178.md): An improper certificate validation vulnerability \[CWE-295\] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 a (CVSS 7.2, Fortinet FortiADC)
- [CVE-2023-50181](https://cve.now/CVE-2023-50181.md): An improper access control vulnerability \[CWE-284\] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only aut (CVSS 4.8, Fortinet FortiADC)
- [CVE-2024-23663](https://cve.now/CVE-2024-23663.md): An improper access control in Fortinet FortiExtender 4.1.1 - 4.1.9, 4.2.0 - 4.2.6, 5.3.2, 7.0.0 - 7.0.4, 7.2.0 - 7.2.4 and 7.4.0 - 7.4.2 all (CVSS 8.1, Fortinet FortiExtender)
- [CVE-2024-21759](https://cve.now/CVE-2024-21759.md): An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker (CVSS 3.9, Fortinet FortiPortal)
- [CVE-2024-27782](https://cve.now/CVE-2024-27782.md): Multiple insufficient session expiration weaknesses \[CWE-613\] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use sto (CVSS 7.7, Fortinet FortiAIOps)
- [CVE-2024-26015](https://cve.now/CVE-2024-26015.md): An incorrect parsing of numbers with different radices vulnerability \[CWE-1389\] in FortiProxy version 7.4.3 and below, version 7.2.10 and be (CVSS 3.1, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2024-27784](https://cve.now/CVE-2024-27784.md): Multiple Exposure of sensitive information to an unauthorized actor weaknesses \[CWE-200\] vulnerability in Fortinet FortiAIOps 2.0.0 may allo (CVSS 8.3, Fortinet FortiAIOps)
- [CVE-2023-50179](https://cve.now/CVE-2023-50179.md): An improper certificate validation vulnerability \[CWE-295\] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow (CVSS 4.7, Fortinet FortiADC)
- [CVE-2024-27785](https://cve.now/CVE-2024-27785.md): An improper neutralization of formula elements in a CSV File \[CWE-1236\] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authen (CVSS 5.1, Fortinet FortiAIOps)
- [CVE-2024-27783](https://cve.now/CVE-2024-27783.md): Multiple cross-site request forgery (CSRF) weaknesses \[CWE-352\] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remo (CVSS 7.2, Fortinet FortiAIOps)
- [CVE-2024-33509](https://cve.now/CVE-2024-33509.md): An improper certificate validation vulnerability \[CWE-295\] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all v (CVSS 4.4, Fortinet FortiWeb)
- [CVE-2024-6615](https://cve.now/CVE-2024-6615.md): Memory safety bugs fixed in Firefox 128 and Thunderbird 128 (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6614](https://cve.now/CVE-2024-6614.md): Incorrect listing of stack frames (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6613](https://cve.now/CVE-2024-6613.md): Incorrect listing of stack frames (CVSS 5.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6612](https://cve.now/CVE-2024-6612.md): CSP violation leakage when using devtools (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6611](https://cve.now/CVE-2024-6611.md): Incorrect handling of SameSite cookies (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6610](https://cve.now/CVE-2024-6610.md): Form validation popups could block exiting full-screen mode (CVSS 6.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6609](https://cve.now/CVE-2024-6609.md): Memory corruption in NSS (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6608](https://cve.now/CVE-2024-6608.md): Cursor could be moved out of the viewport using pointerlock. (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6607](https://cve.now/CVE-2024-6607.md): Leaving pointerlock by pressing the escape key could be prevented (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6606](https://cve.now/CVE-2024-6606.md): Out-of-bounds read in clipboard component (CVSS 8.2, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6605](https://cve.now/CVE-2024-6605.md): Firefox Android missed activation delay to prevent tapjacking (CVSS 8.8, Mozilla Firefox)
- [CVE-2024-6604](https://cve.now/CVE-2024-6604.md): Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6603](https://cve.now/CVE-2024-6603.md): Memory corruption in thread creation (CVSS 7.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6602](https://cve.now/CVE-2024-6602.md): Memory corruption in NSS (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6601](https://cve.now/CVE-2024-6601.md): Race condition in permission assignment (CVSS 4.7, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-6600](https://cve.now/CVE-2024-6600.md): Memory corruption in WebGL API (CVSS 6.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-39697](https://cve.now/CVE-2024-39697.md): phonenumber panics on parsing crafted phonenumber inputs (CVSS 8.6, whisperfish rust-phonenumber · phonenumber)
- [CVE-2024-38363](https://cve.now/CVE-2024-38363.md): Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte (CVSS 8.6, airbytehq airbyte)
- [CVE-2023-39328](https://cve.now/CVE-2023-39328.md): Openjpeg: denail of service via crafted image file (CVSS 5.5, openjpeg · Red Hat Enterprise Linux)
- [CVE-2024-6598](https://cve.now/CVE-2024-6598.md): Denial-of-service on KNIME Business Hub when certain jobs are executed (CVSS 7.1, KNIME Business Hub)
- [CVE-2024-2177](https://cve.now/CVE-2024-2177.md): Improper Restriction of Rendered UI Layers or Frames in GitLab (CVSS 6.8, GitLab)
- [CVE-2024-6527](https://cve.now/CVE-2024-6527.md): SQL Injection in MegaBIP (CVSS 9.3, Jan Syski MegaBIP)
- [CVE-2024-22271](https://cve.now/CVE-2024-22271.md): Spring Cloud Function Web DOS Vulnerability (CVSS 8.2, Spring by VMware Tanzu Spring Cloud Function Framework · or…)
- [CVE-2024-37952](https://cve.now/CVE-2024-37952.md): WordPress BookYourTravel theme \<= 8.18.17 - Subscriber+ Privilege Escalation vulnerability (CVSS 8.8, themeenergy BookYourTravel)
- [CVE-2024-37934](https://cve.now/CVE-2024-37934.md): WordPress Ninja Forms plugin \<= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability (CVSS 5.4, Saturday Drive Ninja Forms)
- [CVE-2024-37520](https://cve.now/CVE-2024-37520.md): WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin \<= 2.1.12 - Local File Inclusion vulnerability (CVSS 6.5, RadiusTheme ShopBuilder – Elementor WooCommerce Builder Add…)
- [CVE-2024-37513](https://cve.now/CVE-2024-37513.md): WordPress WPCafe plugin \<= 2.2.27 - Local File Inclusion vulnerability (CVSS 8.5, Themewinter WPCafe)
- [CVE-2024-39888](https://cve.now/CVE-2024-39888.md): A vulnerability has been identified in Mendix Encryption (All versions \>= V10.0.0 \< V10.0.2). (CVSS 7.5, Siemens Mendix Encryption)
- [CVE-2024-39876](https://cve.now/CVE-2024-39876.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 4.0, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39875](https://cve.now/CVE-2024-39875.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39874](https://cve.now/CVE-2024-39874.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 7.5, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39873](https://cve.now/CVE-2024-39873.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 7.5, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39872](https://cve.now/CVE-2024-39872.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 9.6, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39871](https://cve.now/CVE-2024-39871.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 6.3, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39870](https://cve.now/CVE-2024-39870.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 6.3, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39869](https://cve.now/CVE-2024-39869.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 6.5, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39868](https://cve.now/CVE-2024-39868.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 7.6, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39867](https://cve.now/CVE-2024-39867.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 7.6, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39866](https://cve.now/CVE-2024-39866.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 8.8, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39865](https://cve.now/CVE-2024-39865.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 SP1). (CVSS 8.8, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39675](https://cve.now/CVE-2024-39675.md): A vulnerability has been identified in RUGGEDCOM RMC30 (All versions \< V4.3.10), RUGGEDCOM RMC30NC (All versions \< V4.3.10), RUGGEDCOM RP110 (CVSS 8.8, Siemens RUGGEDCOM RMC30 · Siemens RUGGEDCOM RMC30NC +26)
- [CVE-2024-39571](https://cve.now/CVE-2024-39571.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 HF1). (CVSS 8.8, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39570](https://cve.now/CVE-2024-39570.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2 HF1). (CVSS 8.8, Siemens SINEMA Remote Connect Server)
- [CVE-2024-39569](https://cve.now/CVE-2024-39569.md): A vulnerability has been identified in SINEMA Remote Connect Client (All versions \< V3.2 HF1). (CVSS 6.6, Siemens SINEMA Remote Connect Client)
- [CVE-2024-39568](https://cve.now/CVE-2024-39568.md): A vulnerability has been identified in SINEMA Remote Connect Client (All versions \< V3.2 HF1). (CVSS 7.8, Siemens SINEMA Remote Connect Client)
- [CVE-2024-39567](https://cve.now/CVE-2024-39567.md): A vulnerability has been identified in SINEMA Remote Connect Client (All versions \< V3.2 HF1). (CVSS 7.8, Siemens SINEMA Remote Connect Client)
- [CVE-2024-38867](https://cve.now/CVE-2024-38867.md): A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions \< V9.64), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 (CVSS 5.9, Siemens SIPROTEC 5 6MD84 · Siemens SIPROTEC 5 6MD85 +38)
- [CVE-2024-38278](https://cve.now/CVE-2024-38278.md): A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions \< V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions \< V5.9.0), RUG (CVSS 6.6, Siemens RUGGEDCOM RMC8388 V5.X · Siemens RUGGEDCOM RMC8… +32)
- [CVE-2024-37997](https://cve.now/CVE-2024-37997.md): A vulnerability has been identified in JT Open (All versions \< V11.5), JT2Go (All versions \< V2406.0003), PLM XML SDK (All versions \< V7.1.0 (CVSS 7.8, Siemens JT Open · Siemens JT2Go +2)
- [CVE-2024-37996](https://cve.now/CVE-2024-37996.md): A vulnerability has been identified in JT Open (All versions \< V11.5), JT2Go (All versions \< V2406.0003), PLM XML SDK (All versions \< V7.1.0 (CVSS 3.3, Siemens JT Open · Siemens JT2Go +2)
- [CVE-2024-33654](https://cve.now/CVE-2024-33654.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-33653](https://cve.now/CVE-2024-33653.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-32056](https://cve.now/CVE-2024-32056.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2406). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-30321](https://cve.now/CVE-2024-30321.md): A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions \< V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (All versio (CVSS 5.9, Siemens SIMATIC PCS 7 · Siemens SIMATIC WinCC Runtime Pr… +1)
- [CVE-2023-52891](https://cve.now/CVE-2023-52891.md): A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \< V7.5), SIMATIC Energy Manager PRO (All versions \< V7.5), (CVSS 5.3, Siemens SIMATIC Energy Manager Basic · Siemens SIMATIC E… +3)
- [CVE-2023-52238](https://cve.now/CVE-2023-52238.md): A vulnerability has been identified in RUGGEDCOM RST2228 (All versions \< V5.9.0), RUGGEDCOM RST2228P (All versions \< V5.9.0). (CVSS 4.3, Siemens RUGGEDCOM RST2228 · Siemens RUGGEDCOM RST2228P)
- [CVE-2023-52237](https://cve.now/CVE-2023-52237.md): A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, (CVSS 7.5, Siemens RUGGEDCOM i800 · Siemens RUGGEDCOM i800NC +124)
- [CVE-2023-32737](https://cve.now/CVE-2023-32737.md): A vulnerability has been identified in SIMATIC STEP 7 Safety V18 (All versions \< V18 Update 2). (CVSS 6.3, Siemens SIMATIC STEP 7 Safety)
- [CVE-2023-32735](https://cve.now/CVE-2023-32735.md): A vulnerability has been identified in SIMATIC STEP 7 Safety V16 (All versions \< V16 Update 7), SIMATIC STEP 7 Safety V17 (All versions \< V1 (CVSS 6.5, Siemens SIMATIC STEP 7 Safety · Siemens SIMATIC STEP 7 +11)
- [CVE-2022-45147](https://cve.now/CVE-2022-45147.md): A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versi (CVSS 7.8, Siemens SIMATIC PCS neo · Siemens SIMATIC STEP 7)
- [CVE-2024-3596](https://cve.now/CVE-2024-3596.md): RADIUS Protocol under RFC2865 is vulnerable to forgery attacks. (CVSS 9.0, IETF RFC)
- [CVE-2024-37501](https://cve.now/CVE-2024-37501.md): WordPress Advanced Classifieds & Directory Pro plugin \<= 3.1.3 - Local File Inclusion vulnerability (CVSS 8.5, PluginsWare Advanced Classifieds & Directory Pro)
- [CVE-2024-37499](https://cve.now/CVE-2024-37499.md): WordPress Online Booking & Scheduling Calendar for WordPress plugin \<= 4.4.2 - Local File Inclusion vulnerability (CVSS 6.5, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2024-37497](https://cve.now/CVE-2024-37497.md): WordPress JetThemeCore plugin \< 2.2.1 - Subscriber+ Arbitrary File Deletion vulnerability (CVSS 7.7, Crocoblock JetThemeCore)
- [CVE-2024-37484](https://cve.now/CVE-2024-37484.md): WordPress Zephyr Project Manager plugin \<= 3.3.97 - Privilege Escalation vulnerability (CVSS 8.8, Dylan James Zephyr Project Manager)
- [CVE-2024-37464](https://cve.now/CVE-2024-37464.md): WordPress Beaver Builder Addons by WPZOOM plugin \<= 1.3.5 - Local File Inclusion vulnerability (CVSS 4.9, Beaver Builder Addons by WPZOOM)
- [CVE-2024-6391](https://cve.now/CVE-2024-6391.md): oik \<= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw\_button Shortcode (CVSS 6.4, bobbingwide oik)
- [CVE-2024-4862](https://cve.now/CVE-2024-4862.md): WPBITS Addons For Elementor Page Builder \<= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, WPBITS Addons For Elementor Page Builder)
- [CVE-2024-5946](https://cve.now/CVE-2024-5946.md): Squelch Tabs and Accordions Shortcodes \<= 0.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode (CVSS 6.4, Squelch Tabs and Accordions Shortcodes)
- [CVE-2024-5634](https://cve.now/CVE-2024-5634.md): Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. (CVSS 8.6, Longse Technology LBH30FE200W · Zamel ZMB-01/C)
- [CVE-2024-5633](https://cve.now/CVE-2024-5633.md): Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the sa (CVSS 7.5, Longse Technology LBH30FE200W · Zamel ZMB-01/C)
- [CVE-2024-5632](https://cve.now/CVE-2024-5632.md): Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, create a WiFi network with a default passw (CVSS 5.3, Longse Technology NVR3608PGE2W · Zamel ZMB-01)
- [CVE-2024-5631](https://cve.now/CVE-2024-5631.md): Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password (CVSS 6.0, Longse Technology NVR3608PGE2W · Zamel ZMB-01)
- [CVE-2024-37462](https://cve.now/CVE-2024-37462.md): WordPress Ultimate Bootstrap Elements for Elementor plugin \<= 1.4.2 - Local File Inclusion vulnerability (CVSS 8.5, G5Theme Ultimate Bootstrap Elements for Elementor)
- [CVE-2024-37455](https://cve.now/CVE-2024-37455.md): WordPress Ultimate Addons for elementor plugin \<= 1.36.31 - Privilege Escalation vulnerability (CVSS 8.8, Brainstorm Force Ultimate Addons for Elementor)
- [CVE-2024-37454](https://cve.now/CVE-2024-37454.md): WordPress AWSM Team – Team Showcase Plugin plugin \<= 1.3.1 - Local File Inclusion vulnerability (CVSS 6.5, AWSM Innovations AWSM Team)
- [CVE-2024-37442](https://cve.now/CVE-2024-37442.md): WordPress Photo Gallery by Ays – Responsive Image Gallery plugin \< 5.7.1 - HTML Injection vulnerability (CVSS 3.8, Photo Gallery Team Photo Gallery by Ays)
- [CVE-2024-37437](https://cve.now/CVE-2024-37437.md): WordPress Elementor Website Builder plugin \<= 3.22.1 - Arbitrary SVG File Download vulnerability (CVSS 5.5, Elementor Website Builder)
- [CVE-2024-37430](https://cve.now/CVE-2024-37430.md): WordPress Patreon WordPress plugin \<= 1.9.0 - Image Protection Bypass vulnerability (CVSS 5.3, Patreon WordPress)
- [CVE-2023-3288](https://cve.now/CVE-2023-3288.md): A BOLA vulnerability in POST /providers in EasyAppointments \< 1.5.0 (CVSS 8.5, easyappointments)
- [CVE-2023-38055](https://cve.now/CVE-2023-38055.md): A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments \< 1.5.0 (CVSS 9.6, easyappointments)
- [CVE-2023-38054](https://cve.now/CVE-2023-38054.md): A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments \< 1.5.0 (CVSS 9.9, easyappointments)
- [CVE-2023-38053](https://cve.now/CVE-2023-38053.md): A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments \< 1.5.0 (CVSS 9.9, easyappointments)
- [CVE-2023-38052](https://cve.now/CVE-2023-38052.md): A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments \< 1.5.0 (CVSS 9.9, easyappointments)
- [CVE-2023-38051](https://cve.now/CVE-2023-38051.md): A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments \< 1.5.0 (CVSS 9.9, easyappointments)
- [CVE-2023-38050](https://cve.now/CVE-2023-38050.md): A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments \< 1.5.0 (CVSS 9.1, easyappointments)
- [CVE-2023-38049](https://cve.now/CVE-2023-38049.md): A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments \< 1.5.0 (CVSS 9.9, easyappointments)
- [CVE-2023-38048](https://cve.now/CVE-2023-38048.md): A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments \< 1.5.0 (CVSS 9.9, easyappointments)
- [CVE-2023-38047](https://cve.now/CVE-2023-38047.md): A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments \< 1.5.0. (CVSS 8.5, easyappointments)
- [CVE-2023-3289](https://cve.now/CVE-2023-3289.md): A BOLA vulnerability in POST /services in EasyAppointments \< 1.5.0 (CVSS 7.7, easyappointments)
- [CVE-2023-3290](https://cve.now/CVE-2023-3290.md): A BOLA vulnerability in POST /customers in EasyAppointments \< 1.5.0 (CVSS 5.0, easyappointments)
- [CVE-2024-37424](https://cve.now/CVE-2024-37424.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Arbitrary File Upload vulnerability (CVSS 9.9, Automattic Newspack Blocks)
- [CVE-2023-3286](https://cve.now/CVE-2023-3286.md): A BOLA vulnerability in POST /secretaries in EasyAppointments \< 1.5.0 (CVSS 7.7, easyappointments)
- [CVE-2024-37420](https://cve.now/CVE-2024-37420.md): WordPress Zita Elementor Site Library plugin \<= 1.6.1 - Arbitrary Code Execution vulnerability (CVSS 9.9, WPZita Zita Elementor Site Library)
- [CVE-2023-3287](https://cve.now/CVE-2023-3287.md): A BOLA vulnerability in POST /admins in EasyAppointments \< 1.5.0 (CVSS 9.9, easyappointments)
- [CVE-2024-37419](https://cve.now/CVE-2024-37419.md): WordPress Cowidgets – Elementor Addons plugin \<= 1.1.1 - Local File Inclusion vulnerability (CVSS 7.5, Codeless Cowidgets – Elementor Addons)
- [CVE-2024-37418](https://cve.now/CVE-2024-37418.md): WordPress Church Admin plugin \<= 4.4.6 - Arbitrary File Upload vulnerability (CVSS 9.9, andy\_moyle Church Admin)
- [CVE-2024-37410](https://cve.now/CVE-2024-37410.md): WordPress PowerPack Lite for Beaver Builder plugin \<= 1.3.0.3 - Local File Inclusion vulnerability (CVSS 4.9, IdeaBox Creations PowerPack Lite for Beaver Builder)
- [CVE-2024-37268](https://cve.now/CVE-2024-37268.md): WordPress Striking theme \<= 2.3.4 - Local File Inclusion vulnerability (CVSS 8.5, kaptinlin Striking)
- [CVE-2024-37266](https://cve.now/CVE-2024-37266.md): WordPress Tutor LMS plugin \<= 2.7.1 - Path Traversal vulnerability (CVSS 4.9, Themeum Tutor LMS)
- [CVE-2024-37253](https://cve.now/CVE-2024-37253.md): WordPress WPDirectoryKit plugin \<= 1.3.6 - HTML Injection vulnerability (CVSS 2.7, WpDirectoryKit WP Directory Kit)
- [CVE-2024-37224](https://cve.now/CVE-2024-37224.md): WordPress SP Project & Document Manager plugin \<= 4.71 - Directory Traversal vulnerability (CVSS 7.5, smartypants SP Project & Document Manager)
- [CVE-2024-35777](https://cve.now/CVE-2024-35777.md): WordPress WooCommerce plugin \<= 8.9.2 - Content Injection vulnerability (CVSS 3.5, Automattic WooCommerce)
- [CVE-2024-39487](https://cve.now/CVE-2024-39487.md): bonding: Fix out-of-bounds read in bond\_option\_arp\_ip\_targets\_set() (CVSS 7.1, Linux)
- [CVE-2023-3285](https://cve.now/CVE-2023-3285.md): A BOLA vulnerability in POST /appointments in EasyAppointments \< 1.5.0 (CVSS 7.7, easyappointments)
- [CVE-2024-37090](https://cve.now/CVE-2024-37090.md): SQL Injection vulnerability in multiple StylemixThemes premium themes (CVSS 8.5, StylemixThemes Masterstudy Elementor Widgets · StylemixThem…)
- [CVE-2024-37112](https://cve.now/CVE-2024-37112.md): WordPress WishList Member X plugin \< 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerability (CVSS 10.0, Membership Software WishList Member X)
- [CVE-2024-37225](https://cve.now/CVE-2024-37225.md): WordPress Zoho Marketing Automation plugin \<= 1.2.7 - SQL Injection vulnerability (CVSS 8.5, Zoho Marketing Automation)
- [CVE-2024-37256](https://cve.now/CVE-2024-37256.md): WordPress Tutor LMS plugin \<= 2.7.1 - SQL Injection vulnerability (CVSS 7.6, Themeum Tutor LMS)
- [CVE-2024-37486](https://cve.now/CVE-2024-37486.md): WordPress Paid Memberships Pro plugin \<= 3.0.5 - Authenticated SQL Injection vulnerability (CVSS 7.6, Paid Memberships Pro)
- [CVE-2024-37494](https://cve.now/CVE-2024-37494.md): WordPress Youzify plugin \<= 1.2.5 - SQL Injection vulnerability (CVSS 8.5, KaineLabs Youzify)
- [CVE-2024-37502](https://cve.now/CVE-2024-37502.md): WordPress Social Login plugin \<= 2.6.3 - PHP Object Injection vulnerability (CVSS 5.4, wpweb WooCommerce Social Login)
- [CVE-2024-3563](https://cve.now/CVE-2024-3563.md): Genesis Blocks \<= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes (CVSS 6.4, studiopress Genesis Blocks)
- [CVE-2024-3604](https://cve.now/CVE-2024-3604.md): OSM – OpenStreetMap \<= 6.0.3 - Authenticated (Contributor+) SQL Injection (CVSS 9.9, photoweblog OSM – OpenStreetMap)
- [CVE-2024-5669](https://cve.now/CVE-2024-5669.md): XPlainer – WooCommerce Product FAQ \[WooCommerce Accordion FAQ Plugin\] \<= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, happydevs Happy WooCommerce FAQs – Ultimate Product FAQ Plu…)
- [CVE-2024-6069](https://cve.now/CVE-2024-6069.md): Pie Register - Basic \<= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8, genetechproducts Pie Register – User Registration, Profiles…)
- [CVE-2024-4102](https://cve.now/CVE-2024-4102.md): Pricing Table \<= 2.0.1 - Missing Authorization (CVSS 5.4, elfsight Pricing Table)
- [CVE-2024-5992](https://cve.now/CVE-2024-5992.md): Cliengo - Chatbot \<= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update (CVSS 6.5, Cliengo – Chatbot)
- [CVE-2024-5937](https://cve.now/CVE-2024-5937.md): Simple Alert Boxes \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode (CVSS 6.4, mardojai Simple Alert Boxes)
- [CVE-2024-6168](https://cve.now/CVE-2024-6168.md): Just Custom Fields \<= 3.3.2 - Cross-Site Request Forgery via AJAX actions (CVSS 4.3, aprokopenko Just Custom Fields)
- [CVE-2024-5456](https://cve.now/CVE-2024-5456.md): Panda Video \<= 1.4.0 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, pandavideo Panda Video)
- [CVE-2024-5457](https://cve.now/CVE-2024-5457.md): Panda Video \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pandavideo Panda Video)
- [CVE-2024-3228](https://cve.now/CVE-2024-3228.md): Social Sharing Plugin – Kiwi \<= 2.1.7 - Information Disclosure (CVSS 5.3, wpkube Social Sharing Plugin – Kiwi)
- [CVE-2024-3603](https://cve.now/CVE-2024-3603.md): OSM – OpenStreetMap \<= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, photoweblog OSM – OpenStreetMap)
- [CVE-2024-5648](https://cve.now/CVE-2024-5648.md): LearnDash LMS - Reports Free \<= 1.8.2.1 - Missing Authorization to Plugin Settings Update (CVSS 5.4, stellarwp LearnDash LMS – Reports)
- [CVE-2024-5856](https://cve.now/CVE-2024-5856.md): Comment Images Reloaded \<= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion (CVSS 4.3, wppuzzle Comment Images Reloaded)
- [CVE-2024-4100](https://cve.now/CVE-2024-4100.md): Pricing Table \<= 2.0.1 - Cross-Site Request Forgery via ajax() (CVSS 5.3, elfsight Pricing Table)
- [CVE-2024-4868](https://cve.now/CVE-2024-4868.md): Extensions for Elementor \<= 2.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget (CVSS 6.4, petesheppard84 Extensions for Elementor)
- [CVE-2024-5600](https://cve.now/CVE-2024-5600.md): Happy SCSS Compiler - Compile SCSS to CSS automatically \<= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, happymonkeyagency SCSS Happy Compiler – Compile SCSS to CSS…)
- [CVE-2024-3608](https://cve.now/CVE-2024-3608.md): Product Designer \<= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 5.3, PickPlugins Product Designer for WooCommerce)
- [CVE-2024-5810](https://cve.now/CVE-2024-5810.md): WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 \<= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials (CVSS 5.3, WP2Speed Faster – Optimize PageSpeed Insights Score 90-100)
- [CVE-2024-5704](https://cve.now/CVE-2024-5704.md): XPlainer – WooCommerce Product FAQ \[WooCommerce Accordion FAQ Plugin\] \<= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, happydevs Happy WooCommerce FAQs – Ultimate Product FAQ Plu…)
- [CVE-2024-6167](https://cve.now/CVE-2024-6167.md): Just Custom Fields \<= 3.3.2 - Missing Authorization via AJAX actions (CVSS 4.3, aprokopenko Just Custom Fields)
- [CVE-2024-5479](https://cve.now/CVE-2024-5479.md): Easy Pixels by JEVNET \<= 2.13 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, jevnet Easy Pixels)
- [CVE-2024-5993](https://cve.now/CVE-2024-5993.md): Cliengo - Chatbot \<= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update (CVSS 5.4, Cliengo – Chatbot)
- [CVE-2024-6320](https://cve.now/CVE-2024-6320.md): ScrollTo Top \<= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, dwieeb ScrollTo Top)
- [CVE-2024-6321](https://cve.now/CVE-2024-6321.md): ScrollTo Bottom \<= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, dwieeb ScrollTo Bottom)
- [CVE-2024-6310](https://cve.now/CVE-2024-6310.md): Advanced AJAX Page Loader \<= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, deano1987 Advanced AJAX Page Loader)
- [CVE-2024-6314](https://cve.now/CVE-2024-6314.md): IQ Testimonials \<= 2.2.7 - Unauthenticated Arbitrary File Upload (CVSS 9.8, rmac0001 IQ Testimonials)
- [CVE-2024-6313](https://cve.now/CVE-2024-6313.md): Gutenberg Forms \<= 2.2.9 - Unauthenticated Arbitrary File Upload (CVSS 9.8, nikolaystrikhar Gutenberg Forms – WordPress Form Builder Pl…)
- [CVE-2024-6309](https://cve.now/CVE-2024-6309.md): Attachment File Icons (AF Icons) \<= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, praveen-rajan Attachment File Icons)
- [CVE-2024-5881](https://cve.now/CVE-2024-5881.md): Webico Slider Flatsome Addons \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wbc\_image Shortcode (CVSS 6.4, tranbinhcse Webico Slider Flatsome Addons)
- [CVE-2024-6123](https://cve.now/CVE-2024-6123.md): Bit Form \<= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2024-6316](https://cve.now/CVE-2024-6316.md): Generate PDF using Contact Form 7 \<= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, zealopensource Generate PDF using Contact Form)
- [CVE-2024-6317](https://cve.now/CVE-2024-6317.md): Generate PDF using Contact Form 7 \<= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion (CVSS 8.8, zealopensource Generate PDF using Contact Form)
- [CVE-2024-6180](https://cve.now/CVE-2024-6180.md): EventON \<= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates (CVSS 7.2, ashanjay EventON – Events Calendar)
- [CVE-2024-37923](https://cve.now/CVE-2024-37923.md): WordPress Cliengo – Chatbot plugin \<= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Cliengo – Chatbot)
- [CVE-2024-6161](https://cve.now/CVE-2024-6161.md): Default Thumbnail Plus \<= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, pjgalbraith Default Thumbnail Plus)
- [CVE-2024-37555](https://cve.now/CVE-2024-37555.md): WordPress Generate PDF using Contact Form 7 plugin \<= 4.1.2 - CSRF to Arbitrary File Upload vulnerability (CVSS 9.6, ZealousWeb Generate PDF using Contact Form)
- [CVE-2024-28751](https://cve.now/CVE-2024-28751.md): ifm: Hardcoded telnet credentials in Smart PLC (CVSS 9.1, ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…)
- [CVE-2024-28750](https://cve.now/CVE-2024-28750.md): ifm: Deleting function in Smart PLC allows command injections (CVSS 7.2, ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…)
- [CVE-2024-28749](https://cve.now/CVE-2024-28749.md): ifm: Writing file function in Smart PLC allows command injections (CVSS 7.2, ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…)
- [CVE-2024-28748](https://cve.now/CVE-2024-28748.md): ifm: Reading function in Smart PLC allows command injections (CVSS 7.2, ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…)
- [CVE-2024-28747](https://cve.now/CVE-2024-28747.md): ifm: Use of Hard-coded Credentials (CVSS 9.8, ifm Smart PLC AC14xx Firmware · ifm Smart PLC AC4xxS Firmwa…)
- [CVE-2024-22062](https://cve.now/CVE-2024-22062.md): Permissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI (CVSS 6.3, ZTE ZXCLOUD IRAI)
- [CVE-2024-6334](https://cve.now/CVE-2024-6334.md): Easy Table of Contents \< 2.0.67 - Editor+ Stored XSS (CVSS 6.1, Easy Table of Contents)
- [CVE-2024-5802](https://cve.now/CVE-2024-5802.md): URL Shortener by MyThemeShop \<= 1.0.17 - Admin+ Stored XSS (CVSS 6.1, URL Shortener by MyThemeShop)
- [CVE-2024-5488](https://cve.now/CVE-2024-5488.md): SEOPress \< 7.9 - Unauthenticated Object Injection (CVSS 9.8, SEOPress)
- [CVE-2024-3410](https://cve.now/CVE-2024-3410.md): DN Footer Contacts \< 1.6.3 - Admin+ Stored XSS (CVSS 4.3, DN Footer Contacts)
- [CVE-2024-5441](https://cve.now/CVE-2024-5441.md): Modern Events Calendar \<= 7.11.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, Webnus Modern Events Calendar · webnus/ Modern Events Calen…)
- [CVE-2024-34692](https://cve.now/CVE-2024-34692.md): \[CVE-2024-34692\] Unrestricted File upload vulnerability in SAP Enable Now (CVSS 3.3, SAP\_SE SAP Enable Now)
- [CVE-2024-37180](https://cve.now/CVE-2024-37180.md): \[CVE-2024-37180\] Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.1, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-6169](https://cve.now/CVE-2024-6169.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'username' (CVSS 6.4, unitecms Unlimited Elements For Elementor)
- [CVE-2024-6170](https://cve.now/CVE-2024-6170.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'email' (CVSS 6.4, unitecms Unlimited Elements For Elementor)
- [CVE-2024-4667](https://cve.now/CVE-2024-4667.md): Blog, Posts and Category Filter for Elementor \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget (CVSS 6.4, plugindevs Blog, Posts and Category Filter for Elementor)
- [CVE-2024-6166](https://cve.now/CVE-2024-6166.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - Authenticated (Contributor+) Time-Based SQL Injection (CVSS 8.8, unitecms Unlimited Elements For Elementor)
- [CVE-2024-6171](https://cve.now/CVE-2024-6171.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.112 - IP Address Spoofing to Antispam Bypass (CVSS 5.3, unitecms Unlimited Elements For Elementor)
- [CVE-2024-39596](https://cve.now/CVE-2024-39596.md): \[CVE-2024-39596\] Missing Authorization check vulnerability in SAP Enable Now (CVSS 4.3, SAP\_SE SAP Enable Now)
- [CVE-2024-39599](https://cve.now/CVE-2024-39599.md): \[CVE-2024-39599\] Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform (CVSS 4.7, SAP\_SE SAP NetWeaver Application Server for ABAP and ABAP P…)
- [CVE-2024-37171](https://cve.now/CVE-2024-37171.md): \[CVE-2024-37171\] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal) (CVSS 5.0, SAP\_SE SAP Transportation Management)
- [CVE-2024-39600](https://cve.now/CVE-2024-39600.md): \[CVE-2024-39600\] Information Disclosure vulnerability in SAP GUI for Windows (CVSS 5.0, SAP\_SE SAP GUI for Windows)
- [CVE-2024-34689](https://cve.now/CVE-2024-34689.md): \[CVE-2024-34689\] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services) (CVSS 5.0, SAP\_SE SAP Business Workflow)
- [CVE-2024-37172](https://cve.now/CVE-2024-37172.md): \[CVE-2024-37172\] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) (CVSS 5.4, SAP\_SE SAP S/4HANA Finance)
- [CVE-2024-39595](https://cve.now/CVE-2024-39595.md): \[CVE-2024-39594\] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation (CVSS 5.4, SAP\_SE SAP Business Warehouse - Business Planning and Simul…)
- [CVE-2024-39594](https://cve.now/CVE-2024-39594.md): \[CVE-2024-39594\] Multiple Cross-Site Scripting (XSS) vulnerabilities in SAP Business Warehouse - Business Planning and Simulation (CVSS 6.1, SAP\_SE SAP Business Warehouse - Business Planning and Simul…)
- [CVE-2024-37175](https://cve.now/CVE-2024-37175.md): \[Multiple CVEs\] Multiple vulnerabilities in SAP CRM (WebClient UI) (CVSS 4.3, SAP\_SE SAP CRM WebClient UI)
- [CVE-2024-39598](https://cve.now/CVE-2024-39598.md): \[Multiple CVEs\] Multiple vulnerabilities in SAP CRM (WebClient UI) (CVSS 5.0, SAP\_SE SAP CRM WebClient UI)
- [CVE-2024-37174](https://cve.now/CVE-2024-37174.md): \[Multiple CVEs\] Multiple vulnerabilities in SAP CRM (WebClient UI) (CVSS 6.1, SAP\_SE SAP CRM WebClient UI)
- [CVE-2024-37173](https://cve.now/CVE-2024-37173.md): \[Multiple CVEs\] Multiple vulnerabilities in SAP CRM (WebClient UI) (CVSS 6.1, SAP\_SE SAP CRM WebClient UI)
- [CVE-2024-34685](https://cve.now/CVE-2024-34685.md): \[CVE-2024-34685\] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor (CVSS 6.1, SAP\_SE SAP NetWeaver Knowledge Management XMLEditor)
- [CVE-2024-39593](https://cve.now/CVE-2024-39593.md): \[CVE-2024-39593\] Information Disclosure vulnerability in SAP Landscape Management (CVSS 6.9, SAP\_SE SAP Landscape Management)
- [CVE-2024-39597](https://cve.now/CVE-2024-39597.md): \[CVE-2024-39597\] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce (CVSS 7.2, SAP\_SE SAP Commerce)
- [CVE-2024-39592](https://cve.now/CVE-2024-39592.md): \[CVE-2024-39592\] Missing Authorization check in SAP PDCE (CVSS 7.7, SAP\_SE SAP PDCE)
- [CVE-2024-6365](https://cve.now/CVE-2024-6365.md): Product Table by WBW \<= 2.0.1 - Unauthenticated Remote Code Execution (CVSS 9.8, woobewoo Product Table for WooCommerce by WBW)
- [CVE-2024-5974](https://cve.now/CVE-2024-5974.md): Firebox Authenticated Buffer Overflow Vulnerability (CVSS 8.6, WatchGuard Fireware OS)
- [CVE-2024-4944](https://cve.now/CVE-2024-4944.md): Mobile VPN with SSL Local Privilege Escalation Vulnerability (CVSS 8.6, WatchGuard Mobile VPN with SSL Client)
- [CVE-2024-5793](https://cve.now/CVE-2024-5793.md): Houzez Theme - Functionality \<= 3.2.2 - Authenticated (Seller+) SQL Injection (CVSS 8.8, Favethemes Houzez Theme - Functionality)
- [CVE-2024-5855](https://cve.now/CVE-2024-5855.md): Media Hygiene \<= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion (CVSS 4.3, slui Media Hygiene: Remove or Delete Unused Images and More!)
- [CVE-2024-22020](https://cve.now/CVE-2024-22020.md): A security flaw in Node.js allows a bypass of network import restrictions. (CVSS 6.5, NodeJS Node)
- [CVE-2024-34786](https://cve.now/CVE-2024-34786.md): UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network (CVSS 4.8, Ubiquiti UniFi iOS App)
- [CVE-2024-5569](https://cve.now/CVE-2024-5569.md): Denial of Service via crafted zip file in jaraco/zipp (CVSS 6.2, jaraco/zipp · zipp)
- [CVE-2024-5549](https://cve.now/CVE-2024-5549.md): Data leak through CORS misconfiguration in stitionai/devika (CVSS 8.1, stitionai/devika)
- [CVE-2023-48194](https://cve.now/CVE-2023-48194.md): Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \\x0. (CVSS 6.3)
- [CVE-2023-50805](https://cve.now/CVE-2023-50805.md): A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98 (CVSS 8.1)
- [CVE-2023-50806](https://cve.now/CVE-2023-50806.md): A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98 (CVSS 8.4)
- [CVE-2023-50807](https://cve.now/CVE-2023-50807.md): A vulnerability was discovered in Samsung Wearable Processor and Modems with versions Exynos 9110, Exynos Modem 5123, Exynos Modem 5300 that (CVSS 8.1)
- [CVE-2024-27360](https://cve.now/CVE-2024-27360.md): A vulnerability was discovered in Samsung Mobile Processors Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exynos 1380, Exy (CVSS 6.0)
- [CVE-2024-27361](https://cve.now/CVE-2024-27361.md): A vulnerability was discovered in Samsung Mobile Processor Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, Exyno (CVSS 5.1)
- [CVE-2024-27362](https://cve.now/CVE-2024-27362.md): A vulnerability was discovered in Samsung Mobile Processors Exynos 1280, Exynos 2200, Exynos 1330, Exynos 1380, and Exynos 2400 where they d (CVSS 4.4)
- [CVE-2024-27363](https://cve.now/CVE-2024-27363.md): A vulnerability was discovered in Samsung Mobile Processor Exynos 850, Exynos 9610, Exynos 980, Exynos 1280, Exynos 1380, Exynos 1330, Exyno (CVSS 6.0)
- [CVE-2024-27385](https://cve.now/CVE-2024-27385.md): A vulnerability was discovered in the slsi\_handle\_nan\_rx\_event\_log\_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 rela (CVSS 6.7)
- [CVE-2024-27386](https://cve.now/CVE-2024-27386.md): A vulnerability was discovered in the slsi\_handle\_nan\_rx\_event\_log\_ind function in Samsung Mobile Processor Exynos 1380 and Exynos 1480 rela (CVSS 6.7)
- [CVE-2024-28067](https://cve.now/CVE-2024-28067.md): A vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle (MITM) attacker to downgrade the security mode of packets going to t (CVSS 5.3)
- [CVE-2024-28068](https://cve.now/CVE-2024-28068.md): A vulnerability was discovered in SS in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exy (CVSS 5.3)
- [CVE-2024-29153](https://cve.now/CVE-2024-29153.md): A vulnerability was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with versions Exynos 9820, Exynos 9825, Exynos 98 (CVSS 8.1)
- [CVE-2024-31957](https://cve.now/CVE-2024-31957.md): A vulnerability was discovered in Samsung Mobile Processors Exynos 2200 and Exynos 2400 where they lack a check for the validation of native (CVSS 6.2)
- [CVE-2024-36526](https://cve.now/CVE-2024-36526.md): ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. (CVSS 9.8)
- [CVE-2024-36676](https://cve.now/CVE-2024-36676.md): Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification em (CVSS 7.5, ssddanbrown/bookstack)
- [CVE-2024-37829](https://cve.now/CVE-2024-37829.md): An issue in Outline \<= v0.76.1 allows attackers to execute a session hijacking attack via user interaction with a crafted magic sign-in link (CVSS 8.8)
- [CVE-2024-37830](https://cve.now/CVE-2024-37830.md): An issue in Outline \<= v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie (CVSS 4.3)
- [CVE-2024-37865](https://cve.now/CVE-2024-37865.md): An issue in S3Browser v.11.4.5 and v.10.9.9 and fixed in v.11.5.7 allows a remote attacker to obtain sensitive information via the S3 compat (CVSS 5.9)
- [CVE-2024-37870](https://cve.now/CVE-2024-37870.md): SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to execut (CVSS 9.8)
- [CVE-2024-37871](https://cve.now/CVE-2024-37871.md): SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers (CVSS 8.2)
- [CVE-2024-37872](https://cve.now/CVE-2024-37872.md): SQL injection vulnerability in process.php in Itsourcecode Billing System in PHP 1.0 allows remote attackers to execute arbitrary SQL comman (CVSS 8.1)
- [CVE-2024-37873](https://cve.now/CVE-2024-37873.md): SQL injection vulnerability in view\_payslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote (CVSS 9.1)
- [CVE-2024-38959](https://cve.now/CVE-2024-38959.md): Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitr (CVSS 6.1)
- [CVE-2024-38963](https://cve.now/CVE-2024-38963.md): Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" p (CVSS 6.1)
- [CVE-2024-38970](https://cve.now/CVE-2024-38970.md): vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function. (CVSS 4.9)
- [CVE-2024-38971](https://cve.now/CVE-2024-38971.md): vaeThink 1.0.2 is vulnerable to stored Cross Site Scripting (XSS) in the system backend. (CVSS 5.4)
- [CVE-2024-38972](https://cve.now/CVE-2024-38972.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-39031](https://cve.now/CVE-2024-39031.md): In Silverpeas Core \<= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. (CVSS 5.4, org.silverpeas.core:silverpeas-core-rs · org.silverpeas.cor…)
- [CVE-2024-39063](https://cve.now/CVE-2024-39063.md): Lime Survey \<= 6.5.12 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 8.8)
- [CVE-2024-39069](https://cve.now/CVE-2024-39069.md): An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack. (CVSS 7.8)
- [CVE-2024-39071](https://cve.now/CVE-2024-39071.md): Fujian Kelixun \<=7.6.6.4391 is vulnerable to SQL Injection in send\_event.php. (CVSS 9.8)
- [CVE-2024-39072](https://cve.now/CVE-2024-39072.md): AMTT Hotel Broadband Operation System (HiBOS) v3.0.3.151204 is vulnerable to SQL injection via manager/conference/calendar\_remind.php. (CVSS 5.5)
- [CVE-2024-39118](https://cve.now/CVE-2024-39118.md): Mommy Heather Advanced Backups up to v3.5.3 allows attackers to write arbitrary files via restoring a crafted back up. (CVSS 5.5)
- [CVE-2024-39171](https://cve.now/CVE-2024-39171.md): Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writin (CVSS 8.8)
- [CVE-2024-39181](https://cve.now/CVE-2024-39181.md): Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenera (CVSS 6.5)
- [CVE-2024-40034](https://cve.now/CVE-2024-40034.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel\_deal.php?mudi=del (CVSS 8.8)
- [CVE-2024-40035](https://cve.now/CVE-2024-40035.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel\_deal.php?mudi=add. (CVSS 5.9)
- [CVE-2024-40036](https://cve.now/CVE-2024-40036.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup\_deal.php?mudi=add&nohrefStr=cl (CVSS 8.8)
- [CVE-2024-40037](https://cve.now/CVE-2024-40037.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore\_deal.php?mudi=del (CVSS 8.8)
- [CVE-2024-40038](https://cve.now/CVE-2024-40038.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore\_deal.php?mudi=rev (CVSS 5.3)
- [CVE-2024-40039](https://cve.now/CVE-2024-40039.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup\_deal.php?mudi=del (CVSS 8.8)
- [CVE-2024-40726](https://cve.now/CVE-2024-40726.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40727](https://cve.now/CVE-2024-40727.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 5.4)
- [CVE-2024-40728](https://cve.now/CVE-2024-40728.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 7.1)
- [CVE-2024-40729](https://cve.now/CVE-2024-40729.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 7.1)
- [CVE-2024-40730](https://cve.now/CVE-2024-40730.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40731](https://cve.now/CVE-2024-40731.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40732](https://cve.now/CVE-2024-40732.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 7.1)
- [CVE-2024-40733](https://cve.now/CVE-2024-40733.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40734](https://cve.now/CVE-2024-40734.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40735](https://cve.now/CVE-2024-40735.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40736](https://cve.now/CVE-2024-40736.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40737](https://cve.now/CVE-2024-40737.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40738](https://cve.now/CVE-2024-40738.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 7.1)
- [CVE-2024-40739](https://cve.now/CVE-2024-40739.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40740](https://cve.now/CVE-2024-40740.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 7.1)
- [CVE-2024-40741](https://cve.now/CVE-2024-40741.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 7.1)
- [CVE-2024-40742](https://cve.now/CVE-2024-40742.md): A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-40750](https://cve.now/CVE-2024-40750.md): Linksys Velop Pro 6E 1.0.8 MX6200\_1.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during ap (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.