# CVEs published 2024-07-11

80 CVEs were published on July 11, 2024: 6 critical, 31 high. Days are UTC.

- [CVE-2024-6392](https://cve.now/CVE-2024-6392.md): Image Optimizer, Resizer and CDN – Sirv \<= 7.2.7 - Authenticated(Subscriber+) Missing Authorization to Plugin Settings Update (CVSS 5.4, Image Optimizer, Resizer and CDN – Sirv)
- [CVE-2024-6468](https://cve.now/CVE-2024-6468.md): Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior (CVSS 7.5, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2024-6485](https://cve.now/CVE-2024-6485.md): XSS in Bootstrap button component (CVSS 6.4, Bootstrap · bootstrap-sass)
- [CVE-2024-39553](https://cve.now/CVE-2024-39553.md): Junos OS Evolved: Receipt of arbitrary data when sampling service is enabled, leads to partial Denial of Service (DoS). (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-6681](https://cve.now/CVE-2024-6681.md): witmy my-springsecurity-plus dept sql injection (CVSS 5.3, witmy my-springsecurity-plus)
- [CVE-2024-39552](https://cve.now/CVE-2024-39552.md): Junos OS and Junos OS Evolved: Malformed BGP UPDATE causes RPD crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39551](https://cve.now/CVE-2024-39551.md): Junos OS: SRX Series and MX Series with SPC3 and MS-MPC/MIC: Receipt of specific packets in H.323 ALG causes traffic drop (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39550](https://cve.now/CVE-2024-39550.md): Junos OS: MX Series with SPC3 line card: Port flaps causes rtlogd memory leak leading to Denial of Service (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-39549](https://cve.now/CVE-2024-39549.md): Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to a memory leak (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39548](https://cve.now/CVE-2024-39548.md): Junos OS Evolved: Receipt of specific packets in the aftmand process will lead to a memory leak (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39546](https://cve.now/CVE-2024-39546.md): Junos OS Evolved: Local low-privilege user can gain root permissions leading to privilege escalation (CVSS 7.3, Juniper Networks Junos OS Evolved)
- [CVE-2024-39545](https://cve.now/CVE-2024-39545.md): Junos OS: SRX Series, MX Series with SPC3 and NFX350: When VPN tunnels parameters are not configured in specific way the iked process will crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39543](https://cve.now/CVE-2024-39543.md): Junos OS and Junos OS Evolved: Receipt of a large RPKI-RTR PDU packet can cause rpd to crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-39542](https://cve.now/CVE-2024-39542.md): Junos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39541](https://cve.now/CVE-2024-39541.md): Junos OS and Junos OS Evolved: Inconsistent information in the TE database can lead to an rpd crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-39540](https://cve.now/CVE-2024-39540.md): Junos OS: SRX Series, and MX Series with SPC3: Specific valid TCP traffic can cause a pfe crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39539](https://cve.now/CVE-2024-39539.md): Junos OS: MX Series: Continuous subscriber logins will lead to a memory leak and eventually an FPC crash (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2024-39538](https://cve.now/CVE-2024-39538.md): Junos OS Evolved: ACX7000 Series: When multicast traffic with a specific (S,G) is received evo-pfemand crashes (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39537](https://cve.now/CVE-2024-39537.md): Junos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the network (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39536](https://cve.now/CVE-2024-39536.md): Junos OS and Junos OS Evolved: Flaps of BFD sessions with authentication cause a ppmd memory leak (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2024-39535](https://cve.now/CVE-2024-39535.md): Junos OS Evolved: ACX 7000 Series: When specific traffic is received in a VPLS scenario evo-pfemand crashes (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39533](https://cve.now/CVE-2024-39533.md): Junos OS: QFX5000 Series and EX4600 Series: Output firewall filter is not applied if certain match criteria are used (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2024-39532](https://cve.now/CVE-2024-39532.md): Junos OS and Junos OS Evolved: Confidential information in logs can be accessed by another user (CVSS 6.3, Juniper Networks Junos OS)
- [CVE-2024-39531](https://cve.now/CVE-2024-39531.md): Junos OS Evolved: ACX 7000 Series: Protocol specific DDoS configuration affects other protocols (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39530](https://cve.now/CVE-2024-39530.md): Junos OS: Attempting to access specific sensors on platforms not supporting these will lead to a chassisd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39529](https://cve.now/CVE-2024-39529.md): Junos OS: SRX Series: If DNS traceoptions are configured in a DGA or tunnel detection scenario specific DNS traffic leads to a PFE crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-39528](https://cve.now/CVE-2024-39528.md): Junos OS and Junos OS Evolved: Concurrent deletion of a routing-instance and receipt of an SNMP request cause an RPD crash (CVSS 5.7, Juniper Networks Junos OS)
- [CVE-2024-39524](https://cve.now/CVE-2024-39524.md): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (CVSS 7.8, Juniper Networks Junos OS Evolved)
- [CVE-2024-39523](https://cve.now/CVE-2024-39523.md): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (CVSS 7.8, Juniper Networks Junos OS Evolved)
- [CVE-2024-6680](https://cve.now/CVE-2024-6680.md): witmy my-springsecurity-plus build sql injection (CVSS 5.3, witmy my-springsecurity-plus)
- [CVE-2024-39522](https://cve.now/CVE-2024-39522.md): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (CVSS 7.8, Juniper Networks Junos OS Evolved)
- [CVE-2024-39521](https://cve.now/CVE-2024-39521.md): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (CVSS 7.8, Juniper Networks Junos OS Evolved)
- [CVE-2024-39520](https://cve.now/CVE-2024-39520.md): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (CVSS 7.8, Juniper Networks Junos OS Evolved)
- [CVE-2024-39519](https://cve.now/CVE-2024-39519.md): Junos OS Evolved: ACX 7000 Series: Multicast traffic is looped in a multihoming EVPN MPLS scenario (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-39905](https://cve.now/CVE-2024-39905.md): Red-DiscordBot vulnerable to Incorrect Authorization in commands API (CVSS 5.3, Cog-Creators Red-DiscordBot · red-discordbot)
- [CVE-2024-39904](https://cve.now/CVE-2024-39904.md): Code Execution Vulnerability via Local File Path Traversal in Vnote (CVSS 8.8, vnotex vnote)
- [CVE-2024-32753](https://cve.now/CVE-2024-32753.md): TYCO Illustra Pro Gen 4 - JQuery version (CVSS 7.0, Johnson Controls TYCO Illustra Pro4 Fixed cameras · John… +3)
- [CVE-2024-39317](https://cve.now/CVE-2024-39317.md): Wagtail regular expression denial-of-service via search query parsing (CVSS 6.5, wagtail)
- [CVE-2024-6679](https://cve.now/CVE-2024-6679.md): witmy my-springsecurity-plus role sql injection (CVSS 5.3, witmy my-springsecurity-plus)
- [CVE-2024-38536](https://cve.now/CVE-2024-38536.md): Suricata http/range: NULL-ptr deref when http.memcap is reached (CVSS 7.5, OISF suricata)
- [CVE-2024-38535](https://cve.now/CVE-2024-38535.md): Suricata http2: oom from duplicate headers (CVSS 7.5, OISF suricata)
- [CVE-2024-28872](https://cve.now/CVE-2024-28872.md): Incorrect TLS certificate validation can lead to escalated privileges (CVSS 8.9, ISC Stork)
- [CVE-2024-38534](https://cve.now/CVE-2024-38534.md): Suricata modbus: txs without responses are never freed (CVSS 7.5, OISF suricata)
- [CVE-2024-37151](https://cve.now/CVE-2024-37151.md): Suricata defrag: IP ID reuse can lead to policy bypass (CVSS 5.3, OISF suricata)
- [CVE-2024-6035](https://cve.now/CVE-2024-6035.md): Stored XSS in gaizhenbiao/chuanhuchatgpt (CVSS 7.4, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-6407](https://cve.now/CVE-2024-6407.md): CWE-200: Information Exposure vulnerability exists that could cause disclosure of credentials when a specially crafted message is sent to th (CVSS 9.8, Schneider Electric Wiser Home Controller WHC-5918A)
- [CVE-2024-6528](https://cve.now/CVE-2024-6528.md): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnera (CVSS 5.4, Schneider Electric Modicon Controllers M241 / M251 · Sch… +1)
- [CVE-2024-2602](https://cve.now/CVE-2024-2602.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code (CVSS 7.3, Schneider Electric FoxRTU Station)
- [CVE-2024-5681](https://cve.now/CVE-2024-5681.md): CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kerne (CVSS 7.8, Schneider Electric EcoStruxure Foxboro DCS Core Control Ser…)
- [CVE-2024-5680](https://cve.now/CVE-2024-5680.md): CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local (CVSS 7.1, Schneider Electric EcoStruxure Foxboro DCS Core Control Ser…)
- [CVE-2024-5679](https://cve.now/CVE-2024-5679.md): CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor wit (CVSS 7.1, Schneider Electric EcoStruxure Foxboro DCS Core Control Ser…)
- [CVE-2024-38433](https://cve.now/CVE-2024-38433.md): Nuvoton - CWE-305: Authentication Bypass by Primary Weakness (CVSS 6.7, Nuvoton NPCM7xx (Poleg) BootBlock)
- [CVE-2024-2880](https://cve.now/CVE-2024-2880.md): Improper Access Control in GitLab (CVSS 2.7, GitLab)
- [CVE-2024-5257](https://cve.now/CVE-2024-5257.md): Improper Access Control in GitLab (CVSS 4.9, GitLab)
- [CVE-2024-5470](https://cve.now/CVE-2024-5470.md): Improper Access Control in GitLab (CVSS 3.8, GitLab)
- [CVE-2024-6385](https://cve.now/CVE-2024-6385.md): Improper Access Control in GitLab (CVSS 9.6, GitLab)
- [CVE-2024-6666](https://cve.now/CVE-2024-6666.md): WP ERP \<= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor\_id (CVSS 8.8, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)
- [CVE-2024-6624](https://cve.now/CVE-2024-6624.md): JSON API User \<= 3.9.3 - Unauthenticated Privilege Escalation (CVSS 9.8, parorrey JSON API User)
- [CVE-2024-6256](https://cve.now/CVE-2024-6256.md): Feeds for YouTube (YouTube video, channel, and gallery plugin) \<= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, smub Feeds for YouTube)
- [CVE-2024-6138](https://cve.now/CVE-2024-6138.md): Secure Copy Content Protection \< 4.0.9 - Admin+ Stored XSS (CVSS 6.5, Secure Copy Content Protection and Content Locking)
- [CVE-2024-6026](https://cve.now/CVE-2024-6026.md): Slider by 10Web \< 1.2.56 - Editor+ Stored XSS (CVSS 6.1, Slider by 10Web)
- [CVE-2024-6025](https://cve.now/CVE-2024-6025.md): Quiz and Survey Master \< 9.0.5 - Contributor+ Stored XSS (CVSS 6.5, Quiz and Survey Master)
- [CVE-2024-5444](https://cve.now/CVE-2024-5444.md): Bible Text \<= 0.2 - Contributor+ Stored XSS (CVSS 5.4, Bible Text)
- [CVE-2024-4655](https://cve.now/CVE-2024-4655.md): Ultimate Blocks \< 3.1.9 - Contributor+ Stored XSS (CVSS 6.3, Ultimate Blocks)
- [CVE-2024-1845](https://cve.now/CVE-2024-1845.md): VikRentCar Car Rental Management System \< 1.3.2 - Cross Site Request Forgery (CVSS 8.0, VikRentCar Car Rental Management System)
- [CVE-2024-22280](https://cve.now/CVE-2024-22280.md): VMSA-2024-0017: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280) (CVSS 8.5, VMware Aria Automation)
- [CVE-2024-0619](https://cve.now/CVE-2024-0619.md): Payflex Payment Gateway \<= 2.5.0 - Missing Authorization to Order Status Update (CVSS 5.3, tomlister Payflex Payment Gateway)
- [CVE-2024-6397](https://cve.now/CVE-2024-6397.md): InstaWP Connect – 1-click WP Staging & Migration \<= 0.1.0.44 - Authentication Bypass to Admin (CVSS 9.8, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2024-6554](https://cve.now/CVE-2024-6554.md): Branda – White Label WordPress, Custom Login Page Customizer \<= 3.4.18 - Unauthenticated Full Path Disclosure (CVSS 5.3, wpmudev Branda – White Label & Branding, Free Login Page Cu…)
- [CVE-2024-23317](https://cve.now/CVE-2024-23317.md): External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Contro (CVSS 6.3, Gallagher Controller 6000 and Controller)
- [CVE-2024-23194](https://cve.now/CVE-2024-23194.md): Improper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint could allow an attacker limited ability to (CVSS 3.3, Gallagher Command Centre)
- [CVE-2024-22387](https://cve.now/CVE-2024-22387.md): External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticate (CVSS 6.8, Gallagher Controller 6000 and Controller)
- [CVE-2024-23485](https://cve.now/CVE-2024-23485.md): Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation (CWE-1304) in the Controller 6000 and 7 (CVSS 4.6, Gallagher Controller 6000 and Controller)
- [CVE-2016-15039](https://cve.now/CVE-2016-15039.md): mhuertos phpLDAPadmin ajax\_functions.js makeHttpRequest request smuggling (CVSS 5.3, mhuertos phpLDAPadmin)
- [CVE-2024-6210](https://cve.now/CVE-2024-6210.md): Duplicator \<= 1.5.9 - Full Path Disclosure (CVSS 5.3, smub Duplicator – Backups & Migration Plugin – Cloud Backup…)
- [CVE-2024-6676](https://cve.now/CVE-2024-6676.md): witmy my-springsecurity-plus user sql injection (CVSS 5.3, witmy my-springsecurity-plus)
- [CVE-2024-40618](https://cve.now/CVE-2024-40618.md): Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in (CVSS 9.6, NAVER Whale browser)
- [CVE-2024-6653](https://cve.now/CVE-2024-6653.md): code-projects Simple Task List Login loginForm.php sql injection (CVSS 6.9, code-projects Simple Task List)
- [CVE-2022-29946](https://cve.now/CVE-2022-29946.md): NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by (CVSS 6.3, github.com/nats-io/nats-server · github.com/nats-io/nats… +1)
- [CVE-2024-36435](https://cve.now/CVE-2024-36435.md): An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.