CVEs published July 11, 2024
80 CVEs were published on July 11, 2024: 6 critical, 31 high.
- Published
- 80
- Critical
- 6
- High
- 31
- Medium
- 40
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 54
Most affected products
- Juniper Networks Junos OS
- 16
- Juniper Networks Junos OS Evolved
- 13
- GitLab
- 4
- OISF suricata
- 4
- witmy my-springsecurity-plus
- 4
- Gallagher Controller 6000 and Controller
- 3
- Schneider Electric EcoStruxure Foxboro DCS Core Control Ser…
- 3
- Bible Text
- 1
- Bootstrap · bootstrap-sass
- 1
- code-projects Simple Task List
- 1
Critical 6
- CVE-2024-6407CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to thSchneider Electric Wiser Home Controller WHC-5918A
- CVE-2024-6385Improper Access Control in GitLabGitLab
- CVE-2024-6624JSON API User <= 3.9.3 - Unauthenticated Privilege Escalationparorrey JSON API User
- CVE-2024-6397InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to AdminInstaWP Connect – 1-click WP Staging & Migration
- CVE-2024-40618Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in NAVER Whale browser
- CVE-2024-36435An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules).
High 31
- CVE-2024-6468Vault Vulnerable to Denial of Service When Setting a Proxy Protocol BehaviorHashiCorp Vault · github.com/hashicorp/vault
- CVE-2024-39552Junos OS and Junos OS Evolved: Malformed BGP UPDATE causes RPD crashJuniper Networks Junos OS
- CVE-2024-39551Junos OS: SRX Series and MX Series with SPC3 and MS-MPC/MIC: Receipt of specific packets in H.323 ALG causes traffic dropJuniper Networks Junos OS
- CVE-2024-39549Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to a memory leakJuniper Networks Junos OS
- CVE-2024-39548Junos OS Evolved: Receipt of specific packets in the aftmand process will lead to a memory leakJuniper Networks Junos OS Evolved
- CVE-2024-39546Junos OS Evolved: Local low-privilege user can gain root permissions leading to privilege escalationJuniper Networks Junos OS Evolved
- CVE-2024-39545Junos OS: SRX Series, MX Series with SPC3 and NFX350: When VPN tunnels parameters are not configured in specific way the iked process will crashJuniper Networks Junos OS
- CVE-2024-39542Junos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crashJuniper Networks Junos OS
- CVE-2024-39540Junos OS: SRX Series, and MX Series with SPC3: Specific valid TCP traffic can cause a pfe crashJuniper Networks Junos OS
- CVE-2024-39531Junos OS Evolved: ACX 7000 Series: Protocol specific DDoS configuration affects other protocolsJuniper Networks Junos OS Evolved
- CVE-2024-39530Junos OS: Attempting to access specific sensors on platforms not supporting these will lead to a chassisd crashJuniper Networks Junos OS
- CVE-2024-39529Junos OS: SRX Series: If DNS traceoptions are configured in a DGA or tunnel detection scenario specific DNS traffic leads to a PFE crashJuniper Networks Junos OS
- CVE-2024-39524Junos OS Evolved: CLI parameter processing issue allows privilege escalationJuniper Networks Junos OS Evolved
- CVE-2024-39523Junos OS Evolved: CLI parameter processing issue allows privilege escalationJuniper Networks Junos OS Evolved
- CVE-2024-39522Junos OS Evolved: CLI parameter processing issue allows privilege escalationJuniper Networks Junos OS Evolved
- CVE-2024-39521Junos OS Evolved: CLI parameter processing issue allows privilege escalationJuniper Networks Junos OS Evolved
- CVE-2024-39520Junos OS Evolved: CLI parameter processing issue allows privilege escalationJuniper Networks Junos OS Evolved
- CVE-2024-39904Code Execution Vulnerability via Local File Path Traversal in Vnotevnotex vnote
- CVE-2024-32753TYCO Illustra Pro Gen 4 - JQuery versionJohnson Controls TYCO Illustra Pro4 Fixed cameras · John… +3
- CVE-2024-38536Suricata http/range: NULL-ptr deref when http.memcap is reachedOISF suricata
- CVE-2024-38535Suricata http2: oom from duplicate headersOISF suricata
- CVE-2024-28872Incorrect TLS certificate validation can lead to escalated privilegesISC Stork
- CVE-2024-38534Suricata modbus: txs without responses are never freedOISF suricata
- CVE-2024-6035Stored XSS in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-2602CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote codeSchneider Electric FoxRTU Station
- CVE-2024-5681CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kerneSchneider Electric EcoStruxure Foxboro DCS Core Control Ser…
- CVE-2024-5680CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local Schneider Electric EcoStruxure Foxboro DCS Core Control Ser…
- CVE-2024-5679CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor witSchneider Electric EcoStruxure Foxboro DCS Core Control Ser…
- CVE-2024-6666WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_idwedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…
- CVE-2024-1845VikRentCar Car Rental Management System < 1.3.2 - Cross Site Request ForgeryVikRentCar Car Rental Management System
- CVE-2024-22280VMSA-2024-0017: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280)VMware Aria Automation
Medium, low and unrated 43
- CVE-2024-6392Image Optimizer, Resizer and CDN – Sirv <= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings UpdateImage Optimizer, Resizer and CDN – Sirv
- CVE-2024-6485XSS in Bootstrap button componentBootstrap · bootstrap-sass
- CVE-2024-39553Junos OS Evolved: Receipt of arbitrary data when sampling service is enabled, leads to partial Denial of Service (DoS).Juniper Networks Junos OS Evolved
- CVE-2024-6681witmy my-springsecurity-plus dept sql injectionwitmy my-springsecurity-plus
- CVE-2024-39550Junos OS: MX Series with SPC3 line card: Port flaps causes rtlogd memory leak leading to Denial of ServiceJuniper Networks Junos OS
- CVE-2024-39543Junos OS and Junos OS Evolved: Receipt of a large RPKI-RTR PDU packet can cause rpd to crashJuniper Networks Junos OS
- CVE-2024-39541Junos OS and Junos OS Evolved: Inconsistent information in the TE database can lead to an rpd crashJuniper Networks Junos OS
- CVE-2024-39539Junos OS: MX Series: Continuous subscriber logins will lead to a memory leak and eventually an FPC crashJuniper Networks Junos OS
- CVE-2024-39538Junos OS Evolved: ACX7000 Series: When multicast traffic with a specific (S,G) is received evo-pfemand crashesJuniper Networks Junos OS Evolved
- CVE-2024-39537Junos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the networkJuniper Networks Junos OS Evolved
- CVE-2024-39536Junos OS and Junos OS Evolved: Flaps of BFD sessions with authentication cause a ppmd memory leakJuniper Networks Junos OS
- CVE-2024-39535Junos OS Evolved: ACX 7000 Series: When specific traffic is received in a VPLS scenario evo-pfemand crashesJuniper Networks Junos OS Evolved
- CVE-2024-39533Junos OS: QFX5000 Series and EX4600 Series: Output firewall filter is not applied if certain match criteria are usedJuniper Networks Junos OS
- CVE-2024-39532Junos OS and Junos OS Evolved: Confidential information in logs can be accessed by another userJuniper Networks Junos OS
- CVE-2024-39528Junos OS and Junos OS Evolved: Concurrent deletion of a routing-instance and receipt of an SNMP request cause an RPD crashJuniper Networks Junos OS
- CVE-2024-6680witmy my-springsecurity-plus build sql injectionwitmy my-springsecurity-plus
- CVE-2024-39519Junos OS Evolved: ACX 7000 Series: Multicast traffic is looped in a multihoming EVPN MPLS scenarioJuniper Networks Junos OS Evolved
- CVE-2024-39905Red-DiscordBot vulnerable to Incorrect Authorization in commands APICog-Creators Red-DiscordBot · red-discordbot
- CVE-2024-39317Wagtail regular expression denial-of-service via search query parsingwagtail
- CVE-2024-6679witmy my-springsecurity-plus role sql injectionwitmy my-springsecurity-plus
- CVE-2024-37151Suricata defrag: IP ID reuse can lead to policy bypassOISF suricata
- CVE-2024-6528CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulneraSchneider Electric Modicon Controllers M241 / M251 · Sch… +1
- CVE-2024-38433Nuvoton - CWE-305: Authentication Bypass by Primary WeaknessNuvoton NPCM7xx (Poleg) BootBlock
- CVE-2024-2880Improper Access Control in GitLabGitLab
- CVE-2024-5257Improper Access Control in GitLabGitLab
- CVE-2024-5470Improper Access Control in GitLabGitLab
- CVE-2024-6256Feeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingsmub Feeds for YouTube
- CVE-2024-6138Secure Copy Content Protection < 4.0.9 - Admin+ Stored XSSSecure Copy Content Protection and Content Locking
- CVE-2024-6026Slider by 10Web < 1.2.56 - Editor+ Stored XSSSlider by 10Web
- CVE-2024-6025Quiz and Survey Master < 9.0.5 - Contributor+ Stored XSSQuiz and Survey Master
- CVE-2024-5444Bible Text <= 0.2 - Contributor+ Stored XSSBible Text
- CVE-2024-4655Ultimate Blocks < 3.1.9 - Contributor+ Stored XSSUltimate Blocks
- CVE-2024-0619Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Updatetomlister Payflex Payment Gateway
- CVE-2024-6554Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosurewpmudev Branda – White Label & Branding, Free Login Page Cu…
- CVE-2024-23317External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the ControGallagher Controller 6000 and Controller
- CVE-2024-23194Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to Gallagher Command Centre
- CVE-2024-22387External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticateGallagher Controller 6000 and Controller
- CVE-2024-23485Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7Gallagher Controller 6000 and Controller
- CVE-2016-15039mhuertos phpLDAPadmin ajax_functions.js makeHttpRequest request smugglingmhuertos phpLDAPadmin
- CVE-2024-6210Duplicator <= 1.5.9 - Full Path Disclosuresmub Duplicator – Backups & Migration Plugin – Cloud Backup…
- CVE-2024-6676witmy my-springsecurity-plus user sql injectionwitmy my-springsecurity-plus
- CVE-2024-6653code-projects Simple Task List Login loginForm.php sql injectioncode-projects Simple Task List
- CVE-2022-29946NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused bygithub.com/nats-io/nats-server · github.com/nats-io/nats… +1