CVEs published July 15, 2024
86 CVEs were published on July 15, 2024: 11 critical, 20 high.
- Published
- 86
- Critical
- 11
- High
- 20
- Medium
- 52
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Broadcom Symantec Privileged Access Management
- 10
- IBM Datacap Navigator
- 9
- wp-cart-for-digital-products
- 5
- Apache Software Foundation Apache Linkis DataSource · org.a…
- 3
- AguardNet Space Management System
- 2
- jasonraimondi url-to-png · @jmondi/url-to-png
- 2
- Mattermost
- 2
- Openfind Mail2000
- 2
- OTRS AG OTRS
- 2
- Zoom Communications Zoom Apps and SDKs
- 2
Critical 11
- CVE-2024-4143Certain HP PC products using AMI BIOS – Buffer OverflowCertain HP PC Products
- CVE-2024-39915Authenticated remote code execution in Thruksni Thruk
- CVE-2024-40624Deserialization of untrusted data in torrentpier/torrentpiertorrentpier · torrentpier/torrentpier
- CVE-2024-38492Symantec Privileged Access Manager Remote Command Execution vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-36456Symantec Privileged Access Manager Remote Command Execution vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-36455Symantec Privileged Access Manager Remote Command Execution vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-6744The SMTP Listener of Secure Email Gateway from Cellopoint does not properly validate user input, leading to a Buffer Overflow vulnerability.Cellopoint Secure Email Gateway
- CVE-2024-6743AguardNet Space Management System - SQL injectionAguardNet Space Management System
- CVE-2024-40414A vulnerability in /goform/SetNetControlList in the sub_656BC function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow
- CVE-2024-40415A vulnerability in /goform/SetStaticRouteCfg in the sub_519F4 function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow
- CVE-2024-40524Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py
High 20
- CVE-2024-40631Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate mediaudecode plate · @udecode/plate-media
- CVE-2024-27238Zoom Apps and SDKs - Race ConditionZoom Communications Zoom Apps and SDKs
- CVE-2024-27240Zoom Apps for Windows - Improper Input ValidationZoom Communications Zoom Apps for Windows
- CVE-2024-38494Symantec Privileged Access Manager Remote Command Execution vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-38491Symantec Privileged Access Manager SQL Injection vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-6689Local privilege escalation vulnerability in baramundi Management Agent via MSI Installerbaramundi Management Agent
- CVE-2024-41007tcp: avoid too many retransmit packetsLinux
- CVE-2023-49566Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerabilityApache Software Foundation Apache Linkis DataSource · org.a…
- CVE-2023-46801Apache Linkis DataSource: DataSource Remote code execution vulnerabilityApache Software Foundation Apache Linkis DataSource · org.a…
- CVE-2024-6075WP eStore < 8.5.5 - Coupon Deletion via CSRFwp-cart-for-digital-products
- CVE-2024-5630Insert or Embed Articulate Content into WordPress < 4.3000000024 - Author+ Arbitrary File UploadInsert or Embed Articulate Content into WordPress
- CVE-2024-21513Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving valulangchain-experimental
- CVE-2024-67372100 TECHNOLOGY Electronic Official Document Management System - Broken Access Control2100 TECHNOLOGY Electronic Official Document Management Sys…
- CVE-2024-6345Remote Code Execution in pypa/setuptoolspypa/setuptools · setuptools
- CVE-2024-36432An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS
- CVE-2024-36433An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware befor
- CVE-2024-36434An SMM callout vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4.
- CVE-2024-36438eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to c
- CVE-2024-40554An access control issue in Tmall_demo v2024.07.03 allows attackers to obtain sensitive information.
- CVE-2024-40560Tmall_demo before v2024.07.03 was discovered to contain a SQL injection vulnerability.
Medium, low and unrated 55
- CVE-2024-40632Linkerd potential access to the shutdown endpointlinkerd2 · github.com/linkerd/linkerd2
- CVE-2024-4224TP-Link TL-SG1016DE XSSTP-Link TL-SG1016DE
- CVE-2024-39919Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-pngjasonraimondi url-to-png · @jmondi/url-to-png
- CVE-2024-39918Path Traveral in @jmondi/url-to-pngjasonraimondi url-to-png · @jmondi/url-to-png
- CVE-2024-38360Denial of service via Watched Words in Discoursediscourse
- CVE-2024-39912Enumeration of valid usernames in web-auth/webauthn-libweb-auth webauthn-framework · web-auth/webauthn-lib +1
- CVE-2024-40627OpaMiddleware does not filter HTTP OPTIONS requestsbusykoala fastapi-opa · fastapi-opa
- CVE-2024-40630HEIF Heap OOB Read in OpenImageIOAcademySoftwareFoundation OpenImageIO
- CVE-2024-39821Zoom Workplace App for Windows and Zoom Rooms App for Windows - Race ConditionZoom Communications Zoom Workplace App for Windows and Zoom…
- CVE-2024-39820Zoom Workplace Desktop App for macOS - Uncontrolled Search Path ElementZoom Communications Zoom Workplace Desktop App for macOS
- CVE-2024-39819Zoom Workplace Apps and SDK for Windows - Improper Privilege ManagementZoom Communications Zoom Workplace Apps and SDK for Windows
- CVE-2024-39827Zoom Workplace Desktop App for Windows - Improper Input ValidationZoom Communications Zoom Workplace Desktop App for Windows
- CVE-2024-39826Zoom Workplace Apps and SDKs - Path traversalZoom Communications Zoom Workplace Apps and SDKs
- CVE-2024-27241Zoom Apps and SDKs - Improper Input ValidationZoom Communications Zoom Apps and SDKs
- CVE-2024-38496Symantec Privileged Access Manager Insecure Direct Object Reference vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-38495Symantec Privileged Access Manager User Enumeration vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-38493Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-36458Symantec Privileged Access Manager Privilege Escalation vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-36457Symantec Privileged Access Manager Authentication Bypass vulnerabilityBroadcom Symantec Privileged Access Management
- CVE-2024-6746NaiboWang EasySpider HTTP GET Request server.js path traversalNaiboWang EasySpider
- CVE-2024-5402Mint Workbench I Unquoted Service Path EnumerationABB Mint Workbench I
- CVE-2024-6745code-projects Simple Ticket Booking Login adminauthenticate.php sql injectioncode-projects Simple Ticket Booking
- CVE-2024-6398An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a cuSkyhigh Secure Web Gateway
- CVE-2024-39767Spoofed push notifications from malicious serverMattermost
- CVE-2024-32945LaTeX post content manipulation via renderer state leak across contextsMattermost
- CVE-2024-6741Openfind Mail2000 - HttpOnly flag bypassOpenfind Mail2000
- CVE-2024-6740Openfind Mail2000 - Stored XSSOpenfind Mail2000
- CVE-2023-41916Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file readingApache Software Foundation Apache Linkis DataSource · org.a…
- CVE-2024-23794Agents are able to lock the ticket without the "Owner" permissionOTRS AG OTRS
- CVE-2024-6540Information exlosure in external interfaceOTRS AG OTRS
- CVE-2024-6289WPS Hide Login < 1.9.16.4 - Hidden Login Page DisclosureWPS Hide Login
- CVE-2024-6076WP eStore < 8.5.5 - Reflected XSS in Category Editingwp-cart-for-digital-products
- CVE-2024-6074WP eStore < 8.5.5 - Reflected XSS in Customer Editingwp-cart-for-digital-products
- CVE-2024-6073WP eStore < 8.5.5 - Reflected XSS in Discount Editingwp-cart-for-digital-products
- CVE-2024-6072WP eStore < 8.5.5 - Reflected XSS via $_SERVER['REQUEST_URI']wp-cart-for-digital-products
- CVE-2024-6742AguardNet Space Management System - Reflected Cross-Site ScriptingAguardNet Space Management System
- CVE-2024-6739Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' FlagOpenfind MailGates · Openfind MailAudit
- CVE-2024-6738WisdomGarden Tronclass - Broken Access ControlWisdomGarden Tronclass
- CVE-2024-39740IBM Datacap Navigator information disclosureIBM Datacap Navigator
- CVE-2024-39741IBM Datacap Navigator directory traversalIBM Datacap Navigator
- CVE-2024-39729IBM Datacap Navigator information disclosureIBM Datacap Navigator
- CVE-2024-39735IBM Datacap Navigator cross-site scriptingIBM Datacap Navigator
- CVE-2024-39731IBM Datacap Navigator information disclosureIBM Datacap Navigator
- CVE-2024-39728IBM Datacap Navigator cross-site scriptingIBM Datacap Navigator
- CVE-2024-39736IBM Datacap Navigator HTTP HOST header injectionIBM Datacap Navigator
- CVE-2024-39737IBM Datacap Navigator information disclosureIBM Datacap Navigator
- CVE-2024-39739IBM Datacap Navigator server-side request forgeryIBM Datacap Navigator
- CVE-2024-6736SourceCodester Employee and Visitor Gate Pass Logging System view_employee.php sql injectionSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-6735itsourcecode Tailoring Management System setgeneral.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-31946An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 th
- CVE-2024-37016Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach.
- CVE-2024-37386An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0.
- CVE-2024-40416A vulnerability in /goform/SetVirtualServerCfg in the sub_6320C function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overfl
- CVE-2024-40553Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage.
- CVE-2024-40555Tmall_demo v2024.07.03 was discovered to contain an arbitrary file upload vulnerability.