CVEs published July 10, 2024
122 CVEs were published on July 10, 2024: 9 critical, 47 high. 3 are now in CISA KEV.
- Published
- 122
- Critical
- 9
- High
- 47
- Medium
- 59
- Low
- 3
- Unrated
- 4
- Now in CISA KEV
- 3
- Fix available
- 59
Most affected products
- Juniper Networks Junos OS
- 11
- Linux
- 6
- Juniper Networks Junos OS Evolved
- 5
- django
- 4
- Webmin
- 4
- glpi-project glpi
- 3
- IBM Security QRadar EDR
- 3
- ServiceNow Now Platform
- 3
- Advanced File Manager Shortcodes
- 2
- Checkmk
- 2
Critical 9
- CVE-2024-37310EVerest has an integer overflow in the "v2g_incoming_v2gtp" function everest-core
- CVE-2024-6235Sensitive information disclosureNetScaler Console
- CVE-2024-5910Expedition: Missing Authentication Leads to Admin Account TakeoverPalo Alto Networks Expedition
- CVE-2024-37113WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Database Backup Download vulnerabilityMembership Software WishList Member X
- CVE-2024-5217Incomplete Input Validation in GlideExpression ScriptServiceNow Now Platform
- CVE-2024-4879Jelly Template Injection Vulnerability in ServiceNow UI MacrosServiceNow Now Platform
- CVE-2024-6422Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet accessPepperl+Fuchs OIT1500-F113-B12-CB · Pepperl+Fuchs OIT200… +2
- CVE-2024-25077An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices.
- CVE-2024-3777014Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function.
High 47
- CVE-2024-6447FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameterfullservices FULL – Cliente
- CVE-2024-39518Junos OS: MX240, MX480, MX960 platforms using MPC10E: Memory leak will be observed when subscribed to a specific subscription on Junos Telemetry InterfaceJuniper Networks Junos OS
- CVE-2024-6036Denial of Service in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-39565Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.Juniper Networks Junos OS
- CVE-2024-39562Junos OS Evolved: A high rate of SSH connections causes a Denial of ServiceJuniper Networks Junos OS Evolved
- CVE-2024-6037Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-39555Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to resetJuniper Networks Junos OS
- CVE-2024-6286Local Privilege escalation allows a low-privileged user to gain SYSTEM privilegesCitrix Workspace app for Windows
- CVE-2024-6151Local Privilege escalation allows a low-privileged user to gain SYSTEM privilegesCitrix Windows Virtual Delivery Agent
- CVE-2024-6236Denial of ServiceNetSclaer NetScaler Console · NetScaler Agent +1
- CVE-2024-39693Next.js Denial of Service (DoS) conditionvercel next.js · next
- CVE-2024-38354Cross-site Scripting in Hackmd.io Notes lead by HTML Injectionhackmdio codimd
- CVE-2024-37149GLPI allows remote code execution through the plugin loaderglpi-project glpi
- CVE-2024-37148GLPI allows account takeover via SQL Injection in AJAX scriptsglpi-project glpi
- CVE-2024-32469Decidim has cross-site scripting (XSS) in the paginationdecidim
- CVE-2024-5491Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2024-5911PAN-OS: File Upload Vulnerability in the Panorama Web InterfacePalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-37110WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Settings & Users Data Dump vulnerabilityMembership Software WishList Member X
- CVE-2024-37115WordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerabilityAutomattic Newspack Blocks
- CVE-2024-32759Johnson Controls Software House C●CURE 9000 installer password strengthJohnson Controls Software House C•CURE
- CVE-2024-3325JasperReports Server Driver upload vulnerabilityJaspersoft JasperReport Servers
- CVE-2024-288281-Click compromize via CSRFCheckmk
- CVE-2024-28827Privilege escalation in Windows agentCheckmk
- CVE-2024-3799Shell command injection in PhonieboxPhoniebox
- CVE-2024-3798Insecure handling of GET argument in PhonieboxPhoniebox
- CVE-2024-6421Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT ProductsPepperl+Fuchs OIT1500-F113-B12-CB · Pepperl+Fuchs OIT200… +2
- CVE-2024-39492mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdownLinux
- CVE-2024-36451Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003.Webmin
- CVE-2024-39927Out-of-bounds write vulnerability exists in Ricoh MFPs and printers.Ricoh Company IM C3510/C3010 · Ricoh Company IM C6010/C5… +4
- CVE-2024-21521All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toStr@discordjs/opus
- CVE-2024-21524All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling Tnode-stringbuilder
- CVE-2024-21526All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyspeaker
- CVE-2024-21522All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().audify
- CVE-2024-21525All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcnode-twain
- CVE-2024-21523All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fuimages
- CVE-2024-6411ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalationmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-5792Houzez CRM <= 1.4.2 - Authenticated (Seller+) SQL InjectionHouzez CRM
- CVE-2023-7062Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory TraversalAdvanced File Manager Shortcodes
- CVE-2023-7061Advanced File Manager Shortcode <= 2.5.3 - Authenticated (Contributor+) Arbitrary File UploadAdvanced File Manager Shortcodes
- CVE-2024-32670Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially identSamsung Galaxy SmartTag2
- CVE-2024-6433Local File Inclusion in stitionai/devikastitionai/devika
- CVE-2024-38875An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7.django
- CVE-2024-39614An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.django
- CVE-2024-40329idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=backup
- CVE-2024-40331idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL_deal.php?mudi=backup
- CVE-2024-40333idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak_deal.php?mudi=del&dataID=2
- CVE-2024-40334idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataI
Medium, low and unrated 66
- CVE-2024-39517Junos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configuredJuniper Networks Junos OS
- CVE-2024-39514Junos OS and Junos OS Evolved: Receiving specific traffic on devices with EVPN-VPWS with IGMP-snooping enabled will cause the rpd to crashJuniper Networks Junos OS
- CVE-2024-39513Junos OS Evolved: Execution of a specific CLI command will cause a crash in the AFT managerJuniper Networks Junos OS Evolved
- CVE-2024-39512Junos OS Evolved: User is not logged out when the console cable is disconnectedJuniper Networks Junos OS Evolved
- CVE-2024-6652itsourcecode Gym Management System manage_member.php sql injectionitsourcecode Gym Management System
- CVE-2024-39511Junos OS: The 802.1X Authentication Daemon crashes on running a specific commandJuniper Networks Junos OS
- CVE-2024-39561Junos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express PathJuniper Networks Junos OS
- CVE-2024-39560Junos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crashJuniper Networks Junos OS
- CVE-2024-39559Junos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabledJuniper Networks Junos OS Evolved
- CVE-2024-39558Junos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRRJuniper Networks Junos OS
- CVE-2024-39557Junos OS Evolved: MAC table changes cause a memory leakJuniper Networks Junos OS Evolved
- CVE-2024-39556Junos OS and Junos OS Evolved: Loading a malicious certificate from the CLI may result in a stack-based overflowJuniper Networks Junos OS
- CVE-2024-39554Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crashJuniper Networks Junos OS
- CVE-2024-6650SourceCodester Employee and Visitor Gate Pass Logging System Master.php save_designation cross site scriptingSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-6149Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5Citrix Workspace app for HTML5
- CVE-2024-6148Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5Citrix Workspace app for HTML5
- CVE-2024-6150A non-admin user can cause short-term disruption in Target VM availability in Citrix ProvisioningCitrix Provisioning
- CVE-2024-38353CodiMD - Missing Image Access Controls and Unauthorized Image Accesshackmdio codimd
- CVE-2024-27095Decidim cross-site scripting (XSS) in the admin paneldecidim · decidim-admin
- CVE-2024-5492Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websitesNetSclaer NetScaler ADC
- CVE-2024-5913PAN-OS: Improper Input Validation Vulnerability in PAN-OSPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2024-5912Cortex XDR Agent: Improper File Signature Verification ChecksPalo Alto Networks Cortex XDR Agent
- CVE-2024-37147GLPI allows Authenticated File Upload to Restricted Ticketsglpi-project glpi
- CVE-2024-6649SourceCodester Employee and Visitor Gate Pass Logging System Users.php save_users cross-site request forgerySourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-27090Decidim vulnerable to data disclosure through the embed featuredecidim
- CVE-2024-6647Croogo Setting Theme unrestricted uploadCroogo
- CVE-2024-37205WordPress affiliate-toolkit plugin <= 3.4.4 - Sensitive Data Exposure via Log File vulnerabilitySERVIT Software Solutions affiliate-toolkit
- CVE-2024-37270WordPress TrustedLogin Vendor plugin < 1.1.1 - Sensitive Data Exposure vulnerabilityTrustedLogin Vendor
- CVE-2024-37498WordPress Tablesome plugin <= 1.0.33 - Sensitive Data Exposure via API vulnerabilityPauple Table & Contact Form 7 Database – Tablesome
- CVE-2024-37504WordPress FileBird Document Library plugin <= 2.0.6 - Sensitive Data Exposure vulnerabilityNinja Team FileBird Document Library
- CVE-2024-6646Netgear WN604 Web Interface downloadFile.php information disclosureNetgear WN604
- CVE-2024-6645WuKongOpenSource Wukong_nocode AviatorScript ExpressionUtil.java deserializationWuKongOpenSource Wukong_nocode
- CVE-2024-6644zmops ArgusDBM AviatorScript CalculateAlarm.java getDefaultClassLoader deserializationzmops ArgusDBM
- CVE-2024-5178Incomplete Input Validation in SecurelyAccess APIServiceNow Now Platform
- CVE-2024-20456A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass theCisco IOS XR Software
- CVE-2023-33860IBM Security ReaQta information disclosureIBM Security QRadar EDR
- CVE-2023-33859IBM Security ReaQta information disclosureIBM Security QRadar EDR
- CVE-2023-35006IBM Security ReaQta HTML injectionIBM Security QRadar EDR
- CVE-2024-6556SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosurewpmudev SmartCrawl SEO checker, analyzer & optimizer
- CVE-2024-5664MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer ShortcodeMP3 Audio Player – Music Player, Podcast Player & Radio by…
- CVE-2023-6813Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wleLogin by Auth0 · auth0/wordpress
- CVE-2024-39493crypto: qat - Fix ADF_DEV_RESET_SYNC memory leakLinux
- CVE-2024-39491ALSA: hda: cs35l56: Fix lifetime of cs_dsp instanceLinux
- CVE-2024-39490ipv6: sr: fix missing sk_buff release in seg6_input_coreLinux
- CVE-2024-39489ipv6: sr: fix memleak in seg6_hmac_init_algoLinux
- CVE-2024-39488arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRYLinux
- CVE-2024-36453Cross-site scripting vulnerability exists in session_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820.Webmin
- CVE-2024-36452Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003.Webmin
- CVE-2024-36450Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910.Webmin
- CVE-2024-39886TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel.DREAM TRAIN INTERNET TONE store App
- CVE-2024-6410ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Referencemetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-6550Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosuretyxla Gravity Forms: Multiple Form Instances
- CVE-2023-32467Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability.Dell PowerSwitch Z9664F-ON BIOS
- CVE-2023-32472Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability.Dell PowerSwitch Z9664F-ON BIOS
- CVE-2024-38301Dell Alienware Command Center, version 5.7.3.0 and prior, contains an improper access control vulnerability.Dell Alienware Command Center
- CVE-2024-5677Featured Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Uploadaumkub Featured Image Generator
- CVE-2024-4866UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetscodersaiful UltraAddons for Elementor
- CVE-2024-22018A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.NodeJS Node
- CVE-2024-25076An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices.
- CVE-2024-39329An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.django
- CVE-2024-39330An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.django
- CVE-2024-40328idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline_deal.php?mudi=del&dataType=
- CVE-2024-40332idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord
- CVE-2024-40336idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.'
- CVE-2024-40412Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub_42E410 function.
- CVE-2024-40417A vulnerability was found in Tenda AX1806 1.0.0.1.