# CVEs published 2024-07-10

122 CVEs were published on July 10, 2024: 9 critical, 47 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-6447](https://cve.now/CVE-2024-6447.md): FULL \<= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter (CVSS 7.2, fullservices FULL – Cliente)
- [CVE-2024-39518](https://cve.now/CVE-2024-39518.md): Junos OS: MX240, MX480, MX960 platforms using MPC10E: Memory leak will be observed when subscribed to a specific subscription on Junos Telemetry Interface (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39517](https://cve.now/CVE-2024-39517.md): Junos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configured (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-39514](https://cve.now/CVE-2024-39514.md): Junos OS and Junos OS Evolved: Receiving specific traffic on devices with EVPN-VPWS with IGMP-snooping enabled will cause the rpd to crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-39513](https://cve.now/CVE-2024-39513.md): Junos OS Evolved: Execution of a specific CLI command will cause a crash in the AFT manager (CVSS 5.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39512](https://cve.now/CVE-2024-39512.md): Junos OS Evolved: User is not logged out when the console cable is disconnected (CVSS 6.6, Juniper Networks Junos OS Evolved)
- [CVE-2024-6652](https://cve.now/CVE-2024-6652.md): itsourcecode Gym Management System manage\_member.php sql injection (CVSS 5.3, itsourcecode Gym Management System)
- [CVE-2024-39511](https://cve.now/CVE-2024-39511.md): Junos OS: The 802.1X Authentication Daemon crashes on running a specific command (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2024-6036](https://cve.now/CVE-2024-6036.md): Denial of Service in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-39565](https://cve.now/CVE-2024-39565.md): Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device. (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2024-39562](https://cve.now/CVE-2024-39562.md): Junos OS Evolved: A high rate of SSH connections causes a Denial of Service (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39561](https://cve.now/CVE-2024-39561.md): Junos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express Path (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2024-39560](https://cve.now/CVE-2024-39560.md): Junos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-6037](https://cve.now/CVE-2024-6037.md): Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-39559](https://cve.now/CVE-2024-39559.md): Junos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabled (CVSS 5.9, Juniper Networks Junos OS Evolved)
- [CVE-2024-39558](https://cve.now/CVE-2024-39558.md): Junos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRR (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-39557](https://cve.now/CVE-2024-39557.md): Junos OS Evolved: MAC table changes cause a memory leak (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39556](https://cve.now/CVE-2024-39556.md): Junos OS and Junos OS Evolved: Loading a malicious certificate from the CLI may result in a stack-based overflow (CVSS 6.4, Juniper Networks Junos OS)
- [CVE-2024-39555](https://cve.now/CVE-2024-39555.md): Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to reset (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39554](https://cve.now/CVE-2024-39554.md): Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2024-6650](https://cve.now/CVE-2024-6650.md): SourceCodester Employee and Visitor Gate Pass Logging System Master.php save\_designation cross site scripting (CVSS 5.1, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-6149](https://cve.now/CVE-2024-6149.md): Redirection of users to a vulnerable URL in Citrix Workspace app for HTML5 (CVSS 4.8, Citrix Workspace app for HTML5)
- [CVE-2024-6148](https://cve.now/CVE-2024-6148.md): Bypass of GACS Policy Configuration settings in Citrix Workspace app for HTML5 (CVSS 5.3, Citrix Workspace app for HTML5)
- [CVE-2024-6150](https://cve.now/CVE-2024-6150.md): A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning (CVSS 4.8, Citrix Provisioning)
- [CVE-2024-6286](https://cve.now/CVE-2024-6286.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.5, Citrix Workspace app for Windows)
- [CVE-2024-6151](https://cve.now/CVE-2024-6151.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.5, Citrix Windows Virtual Delivery Agent)
- [CVE-2024-6236](https://cve.now/CVE-2024-6236.md): Denial of Service (CVSS 7.1, NetSclaer NetScaler Console · NetScaler Agent +1)
- [CVE-2024-39693](https://cve.now/CVE-2024-39693.md): Next.js Denial of Service (DoS) condition (CVSS 7.5, vercel next.js · next)
- [CVE-2024-38353](https://cve.now/CVE-2024-38353.md): CodiMD - Missing Image Access Controls and Unauthorized Image Access (CVSS 5.3, hackmdio codimd)
- [CVE-2024-38354](https://cve.now/CVE-2024-38354.md): Cross-site Scripting in Hackmd.io Notes lead by HTML Injection (CVSS 8.1, hackmdio codimd)
- [CVE-2024-37310](https://cve.now/CVE-2024-37310.md): EVerest has an integer overflow in the "v2g\_incoming\_v2gtp" function (CVSS 9.1, everest-core)
- [CVE-2024-37149](https://cve.now/CVE-2024-37149.md): GLPI allows remote code execution through the plugin loader (CVSS 7.2, glpi-project glpi)
- [CVE-2024-37148](https://cve.now/CVE-2024-37148.md): GLPI allows account takeover via SQL Injection in AJAX scripts (CVSS 8.1, glpi-project glpi)
- [CVE-2024-32469](https://cve.now/CVE-2024-32469.md): Decidim has cross-site scripting (XSS) in the pagination (CVSS 7.1, decidim)
- [CVE-2024-6235](https://cve.now/CVE-2024-6235.md): Sensitive information disclosure (CVSS 9.4, NetScaler Console)
- [CVE-2024-27095](https://cve.now/CVE-2024-27095.md): Decidim cross-site scripting (XSS) in the admin panel (CVSS 5.4, decidim · decidim-admin)
- [CVE-2024-5492](https://cve.now/CVE-2024-5492.md): Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites (CVSS 5.1, NetSclaer NetScaler ADC)
- [CVE-2024-5491](https://cve.now/CVE-2024-5491.md): Denial of Service (CVSS 7.2, NetScaler ADC · NetScaler Gateway)
- [CVE-2024-5913](https://cve.now/CVE-2024-5913.md): PAN-OS: Improper Input Validation Vulnerability in PAN-OS (CVSS 6.1, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-5912](https://cve.now/CVE-2024-5912.md): Cortex XDR Agent: Improper File Signature Verification Checks (CVSS 6.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2024-5911](https://cve.now/CVE-2024-5911.md): PAN-OS: File Upload Vulnerability in the Panorama Web Interface (CVSS 7.0, Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1)
- [CVE-2024-5910](https://cve.now/CVE-2024-5910.md): Expedition: Missing Authentication Leads to Admin Account Takeover (CVSS 9.3, KEV, Palo Alto Networks Expedition)
- [CVE-2024-37147](https://cve.now/CVE-2024-37147.md): GLPI allows Authenticated File Upload to Restricted Tickets (CVSS 4.3, glpi-project glpi)
- [CVE-2024-6649](https://cve.now/CVE-2024-6649.md): SourceCodester Employee and Visitor Gate Pass Logging System Users.php save\_users cross-site request forgery (CVSS 6.9, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-27090](https://cve.now/CVE-2024-27090.md): Decidim vulnerable to data disclosure through the embed feature (CVSS 5.3, decidim)
- [CVE-2024-6647](https://cve.now/CVE-2024-6647.md): Croogo Setting Theme unrestricted upload (CVSS 5.1, Croogo)
- [CVE-2024-37110](https://cve.now/CVE-2024-37110.md): WordPress WishList Member X plugin \< 3.26.7 - Unauthenticated Settings & Users Data Dump vulnerability (CVSS 7.5, Membership Software WishList Member X)
- [CVE-2024-37113](https://cve.now/CVE-2024-37113.md): WordPress WishList Member X plugin \< 3.26.7 - Unauthenticated Database Backup Download vulnerability (CVSS 9.8, Membership Software WishList Member X)
- [CVE-2024-37115](https://cve.now/CVE-2024-37115.md): WordPress Newspack Blocks plugin \<= 3.0.8 - Sensitive Data Exposure vulnerability (CVSS 7.5, Automattic Newspack Blocks)
- [CVE-2024-37205](https://cve.now/CVE-2024-37205.md): WordPress affiliate-toolkit plugin \<= 3.4.4 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, SERVIT Software Solutions affiliate-toolkit)
- [CVE-2024-37270](https://cve.now/CVE-2024-37270.md): WordPress TrustedLogin Vendor plugin \< 1.1.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, TrustedLogin Vendor)
- [CVE-2024-37498](https://cve.now/CVE-2024-37498.md): WordPress Tablesome plugin \<= 1.0.33 - Sensitive Data Exposure via API vulnerability (CVSS 5.3, Pauple Table & Contact Form 7 Database – Tablesome)
- [CVE-2024-37504](https://cve.now/CVE-2024-37504.md): WordPress FileBird Document Library plugin \<= 2.0.6 - Sensitive Data Exposure vulnerability (CVSS 5.3, Ninja Team FileBird Document Library)
- [CVE-2024-32759](https://cve.now/CVE-2024-32759.md): Johnson Controls Software House C●CURE 9000 installer password strength (CVSS 7.7, Johnson Controls Software House C•CURE)
- [CVE-2024-6646](https://cve.now/CVE-2024-6646.md): Netgear WN604 Web Interface downloadFile.php information disclosure (CVSS 6.9, Netgear WN604)
- [CVE-2024-3325](https://cve.now/CVE-2024-3325.md): JasperReports Server Driver upload vulnerability (CVSS 8.6, Jaspersoft JasperReport Servers)
- [CVE-2024-6645](https://cve.now/CVE-2024-6645.md): WuKongOpenSource Wukong\_nocode AviatorScript ExpressionUtil.java deserialization (CVSS 5.3, WuKongOpenSource Wukong\_nocode)
- [CVE-2024-6644](https://cve.now/CVE-2024-6644.md): zmops ArgusDBM AviatorScript CalculateAlarm.java getDefaultClassLoader deserialization (CVSS 5.3, zmops ArgusDBM)
- [CVE-2024-5217](https://cve.now/CVE-2024-5217.md): Incomplete Input Validation in GlideExpression Script (CVSS 9.2, KEV, ServiceNow Now Platform)
- [CVE-2024-5178](https://cve.now/CVE-2024-5178.md): Incomplete Input Validation in SecurelyAccess API (CVSS 6.9, ServiceNow Now Platform)
- [CVE-2024-4879](https://cve.now/CVE-2024-4879.md): Jelly Template Injection Vulnerability in ServiceNow UI Macros (CVSS 9.3, KEV, ServiceNow Now Platform)
- [CVE-2024-20456](https://cve.now/CVE-2024-20456.md): A vulnerability in the boot process of Cisco IOS XR Software could allow an authenticated, local attacker with high privileges to bypass the (CVSS 6.7, Cisco IOS XR Software)
- [CVE-2023-33860](https://cve.now/CVE-2023-33860.md): IBM Security ReaQta information disclosure (CVSS 5.3, IBM Security QRadar EDR)
- [CVE-2023-33859](https://cve.now/CVE-2023-33859.md): IBM Security ReaQta information disclosure (CVSS 5.3, IBM Security QRadar EDR)
- [CVE-2023-35006](https://cve.now/CVE-2023-35006.md): IBM Security ReaQta HTML injection (CVSS 5.4, IBM Security QRadar EDR)
- [CVE-2024-28828](https://cve.now/CVE-2024-28828.md): 1-Click compromize via CSRF (CVSS 8.8, Checkmk)
- [CVE-2024-28827](https://cve.now/CVE-2024-28827.md): Privilege escalation in Windows agent (CVSS 8.8, Checkmk)
- [CVE-2024-3799](https://cve.now/CVE-2024-3799.md): Shell command injection in Phoniebox (CVSS 8.7, Phoniebox)
- [CVE-2024-3798](https://cve.now/CVE-2024-3798.md): Insecure handling of GET argument in Phoniebox (CVSS 8.7, Phoniebox)
- [CVE-2024-6556](https://cve.now/CVE-2024-6556.md): SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer \<= 3.10.8 - Unauthenticated Full Path Disclosure (CVSS 5.3, wpmudev SmartCrawl SEO checker, analyzer & optimizer)
- [CVE-2024-6422](https://cve.now/CVE-2024-6422.md): Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access (CVSS 9.8, Pepperl+Fuchs OIT1500-F113-B12-CB · Pepperl+Fuchs OIT200… +2)
- [CVE-2024-6421](https://cve.now/CVE-2024-6421.md): Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products (CVSS 7.5, Pepperl+Fuchs OIT1500-F113-B12-CB · Pepperl+Fuchs OIT200… +2)
- [CVE-2024-5664](https://cve.now/CVE-2024-5664.md): MP3 Audio Player for Music, Radio & Podcast by Sonaar \<= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar\_audioplayer Shortcode (CVSS 6.4, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2023-6813](https://cve.now/CVE-2023-6813.md): Login by Auth0 \<= 4.6.0 - Reflected Cross-Site Scripting via wle (CVSS 6.1, Login by Auth0 · auth0/wordpress)
- [CVE-2024-39493](https://cve.now/CVE-2024-39493.md): crypto: qat - Fix ADF\_DEV\_RESET\_SYNC memory leak (no CVSS, Linux)
- [CVE-2024-39492](https://cve.now/CVE-2024-39492.md): mailbox: mtk-cmdq: Fix pm\_runtime\_get\_sync() warning in mbox shutdown (CVSS 7.0, Linux)
- [CVE-2024-39491](https://cve.now/CVE-2024-39491.md): ALSA: hda: cs35l56: Fix lifetime of cs\_dsp instance (no CVSS, Linux)
- [CVE-2024-39490](https://cve.now/CVE-2024-39490.md): ipv6: sr: fix missing sk\_buff release in seg6\_input\_core (CVSS 6.2, Linux)
- [CVE-2024-39489](https://cve.now/CVE-2024-39489.md): ipv6: sr: fix memleak in seg6\_hmac\_init\_algo (no CVSS, Linux)
- [CVE-2024-39488](https://cve.now/CVE-2024-39488.md): arm64: asm-bug: Add .align 2 to the end of \_\_BUG\_ENTRY (no CVSS, Linux)
- [CVE-2024-36453](https://cve.now/CVE-2024-36453.md): Cross-site scripting vulnerability exists in session\_login.cgi of Webmin versions prior to 1.970 and Usermin versions prior to 1.820. (CVSS 6.1, Webmin)
- [CVE-2024-36452](https://cve.now/CVE-2024-36452.md): Cross-site request forgery vulnerability exists in ajaxterm module of Webmin versions prior to 2.003. (CVSS 3.1, Webmin)
- [CVE-2024-36451](https://cve.now/CVE-2024-36451.md): Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. (CVSS 8.8, Webmin)
- [CVE-2024-36450](https://cve.now/CVE-2024-36450.md): Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. (CVSS 5.4, Webmin)
- [CVE-2024-39927](https://cve.now/CVE-2024-39927.md): Out-of-bounds write vulnerability exists in Ricoh MFPs and printers. (CVSS 8.2, Ricoh Company IM C3510/C3010 · Ricoh Company IM C6010/C5… +4)
- [CVE-2024-39886](https://cve.now/CVE-2024-39886.md): TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. (CVSS 3.7, DREAM TRAIN INTERNET TONE store App)
- [CVE-2024-21521](https://cve.now/CVE-2024-21521.md): All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toStr (CVSS 7.5, @discordjs/opus)
- [CVE-2024-21524](https://cve.now/CVE-2024-21524.md): All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling T (CVSS 8.2, node-stringbuilder)
- [CVE-2024-21526](https://cve.now/CVE-2024-21526.md): All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels property (CVSS 7.5, speaker)
- [CVE-2024-21522](https://cve.now/CVE-2024-21522.md): All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder(). (CVSS 7.5, audify)
- [CVE-2024-21525](https://cve.now/CVE-2024-21525.md): All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourc (CVSS 8.3, node-twain)
- [CVE-2024-21523](https://cve.now/CVE-2024-21523.md): All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different fu (CVSS 7.5, images)
- [CVE-2024-6410](https://cve.now/CVE-2024-6410.md): ProfileGrid \<= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-6411](https://cve.now/CVE-2024-6411.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation (CVSS 8.8, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-6550](https://cve.now/CVE-2024-6550.md): Gravity Forms: Multiple Form Instances \<= 1.1.1 - Unauthenticated Full Path Disclosure (CVSS 5.3, tyxla Gravity Forms: Multiple Form Instances)
- [CVE-2023-32467](https://cve.now/CVE-2023-32467.md): Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. (CVSS 5.7, Dell PowerSwitch Z9664F-ON BIOS)
- [CVE-2023-32472](https://cve.now/CVE-2023-32472.md): Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability. (CVSS 5.7, Dell PowerSwitch Z9664F-ON BIOS)
- [CVE-2024-38301](https://cve.now/CVE-2024-38301.md): Dell Alienware Command Center, version 5.7.3.0 and prior, contains an improper access control vulnerability. (CVSS 6.7, Dell Alienware Command Center)
- [CVE-2024-5792](https://cve.now/CVE-2024-5792.md): Houzez CRM \<= 1.4.2 - Authenticated (Seller+) SQL Injection (CVSS 8.8, Houzez CRM)
- [CVE-2023-7062](https://cve.now/CVE-2023-7062.md): Advanced File Manager Shortcodes \<= 2.4 - Authenticated (Contributor+) Directory Traversal (CVSS 8.8, Advanced File Manager Shortcodes)
- [CVE-2024-5677](https://cve.now/CVE-2024-5677.md): Featured Image Generator \<= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload (CVSS 4.3, aumkub Featured Image Generator)
- [CVE-2024-4866](https://cve.now/CVE-2024-4866.md): UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) \<= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, codersaiful UltraAddons for Elementor)
- [CVE-2023-7061](https://cve.now/CVE-2023-7061.md): Advanced File Manager Shortcode \<= 2.5.3 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, Advanced File Manager Shortcodes)
- [CVE-2024-22018](https://cve.now/CVE-2024-22018.md): A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. (CVSS 2.9, NodeJS Node)
- [CVE-2024-32670](https://cve.now/CVE-2024-32670.md): Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially ident (CVSS 7.0, Samsung Galaxy SmartTag2)
- [CVE-2024-6433](https://cve.now/CVE-2024-6433.md): Local File Inclusion in stitionai/devika (CVSS 7.5, stitionai/devika)
- [CVE-2024-25076](https://cve.now/CVE-2024-25076.md): An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. (CVSS 6.8)
- [CVE-2024-25077](https://cve.now/CVE-2024-25077.md): An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. (CVSS 9.8)
- [CVE-2024-37770](https://cve.now/CVE-2024-37770.md): 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. (CVSS 9.1)
- [CVE-2024-38875](https://cve.now/CVE-2024-38875.md): An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7. (CVSS 7.5, django)
- [CVE-2024-39329](https://cve.now/CVE-2024-39329.md): An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. (CVSS 5.3, django)
- [CVE-2024-39330](https://cve.now/CVE-2024-39330.md): An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. (CVSS 4.3, django)
- [CVE-2024-39614](https://cve.now/CVE-2024-39614.md): An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. (CVSS 7.5, django)
- [CVE-2024-40328](https://cve.now/CVE-2024-40328.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/memberOnline\_deal.php?mudi=del&dataType= (CVSS 6.3)
- [CVE-2024-40329](https://cve.now/CVE-2024-40329.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak\_deal.php?mudi=backup (CVSS 8.8)
- [CVE-2024-40331](https://cve.now/CVE-2024-40331.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/dbBakMySQL\_deal.php?mudi=backup (CVSS 8.8)
- [CVE-2024-40332](https://cve.now/CVE-2024-40332.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord\_deal.php?mudi=delRecord (CVSS 6.8)
- [CVE-2024-40333](https://cve.now/CVE-2024-40333.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/softBak\_deal.php?mudi=del&dataID=2 (CVSS 8.8)
- [CVE-2024-40334](https://cve.now/CVE-2024-40334.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile\_deal.php?mudi=upFileDel&dataI (CVSS 8.8)
- [CVE-2024-40336](https://cve.now/CVE-2024-40336.md): idccms v1.35 is vulnerable to Cross Site Scripting (XSS) within the 'Image Advertising Management.' (CVSS 6.1)
- [CVE-2024-40412](https://cve.now/CVE-2024-40412.md): Tenda AX12 v1.0 v22.03.01.46 contains a stack overflow in the deviceList parameter of the sub\_42E410 function. (CVSS 6.8)
- [CVE-2024-40417](https://cve.now/CVE-2024-40417.md): A vulnerability was found in Tenda AX1806 1.0.0.1. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.