# CVEs published 2024-07-15

86 CVEs were published on July 15, 2024: 11 critical, 20 high. Days are UTC.

- [CVE-2024-4143](https://cve.now/CVE-2024-4143.md): Certain HP PC products using AMI BIOS – Buffer Overflow (CVSS 9.8, Certain HP PC Products)
- [CVE-2024-40632](https://cve.now/CVE-2024-40632.md): Linkerd potential access to the shutdown endpoint (CVSS 3.7, linkerd2 · github.com/linkerd/linkerd2)
- [CVE-2024-4224](https://cve.now/CVE-2024-4224.md): TP-Link TL-SG1016DE XSS (CVSS 5.4, TP-Link TL-SG1016DE)
- [CVE-2024-39919](https://cve.now/CVE-2024-39919.md): Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png (CVSS 3.1, jasonraimondi url-to-png · @jmondi/url-to-png)
- [CVE-2024-39918](https://cve.now/CVE-2024-39918.md): Path Traveral in @jmondi/url-to-png (CVSS 4.3, jasonraimondi url-to-png · @jmondi/url-to-png)
- [CVE-2024-38360](https://cve.now/CVE-2024-38360.md): Denial of service via Watched Words in Discourse (CVSS 4.9, discourse)
- [CVE-2024-39912](https://cve.now/CVE-2024-39912.md): Enumeration of valid usernames in web-auth/webauthn-lib (CVSS 5.3, web-auth webauthn-framework · web-auth/webauthn-lib +1)
- [CVE-2024-39915](https://cve.now/CVE-2024-39915.md): Authenticated remote code execution in Thruk (CVSS 10.0, sni Thruk)
- [CVE-2024-40624](https://cve.now/CVE-2024-40624.md): Deserialization of untrusted data in torrentpier/torrentpier (CVSS 9.8, torrentpier · torrentpier/torrentpier)
- [CVE-2024-40627](https://cve.now/CVE-2024-40627.md): OpaMiddleware does not filter HTTP OPTIONS requests (CVSS 5.8, busykoala fastapi-opa · fastapi-opa)
- [CVE-2024-40630](https://cve.now/CVE-2024-40630.md): HEIF Heap OOB Read in OpenImageIO (CVSS 4.3, AcademySoftwareFoundation OpenImageIO)
- [CVE-2024-40631](https://cve.now/CVE-2024-40631.md): Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media (CVSS 8.1, udecode plate · @udecode/plate-media)
- [CVE-2024-39821](https://cve.now/CVE-2024-39821.md): Zoom Workplace App for Windows and Zoom Rooms App for Windows - Race Condition (CVSS 6.6, Zoom Communications Zoom Workplace App for Windows and Zoom…)
- [CVE-2024-39820](https://cve.now/CVE-2024-39820.md): Zoom Workplace Desktop App for macOS - Uncontrolled Search Path Element (CVSS 6.6, Zoom Communications Zoom Workplace Desktop App for macOS)
- [CVE-2024-39819](https://cve.now/CVE-2024-39819.md): Zoom Workplace Apps and SDK for Windows - Improper Privilege Management (CVSS 6.7, Zoom Communications Zoom Workplace Apps and SDK for Windows)
- [CVE-2024-39827](https://cve.now/CVE-2024-39827.md): Zoom Workplace Desktop App for Windows - Improper Input Validation (CVSS 5.5, Zoom Communications Zoom Workplace Desktop App for Windows)
- [CVE-2024-39826](https://cve.now/CVE-2024-39826.md): Zoom Workplace Apps and SDKs - Path traversal (CVSS 6.8, Zoom Communications Zoom Workplace Apps and SDKs)
- [CVE-2024-27238](https://cve.now/CVE-2024-27238.md): Zoom Apps and SDKs - Race Condition (CVSS 7.1, Zoom Communications Zoom Apps and SDKs)
- [CVE-2024-27241](https://cve.now/CVE-2024-27241.md): Zoom Apps and SDKs - Improper Input Validation (CVSS 5.3, Zoom Communications Zoom Apps and SDKs)
- [CVE-2024-27240](https://cve.now/CVE-2024-27240.md): Zoom Apps for Windows - Improper Input Validation (CVSS 7.1, Zoom Communications Zoom Apps for Windows)
- [CVE-2024-38496](https://cve.now/CVE-2024-38496.md): Symantec Privileged Access Manager Insecure Direct Object Reference vulnerability (CVSS 5.1, Broadcom Symantec Privileged Access Management)
- [CVE-2024-38495](https://cve.now/CVE-2024-38495.md): Symantec Privileged Access Manager User Enumeration vulnerability (CVSS 5.3, Broadcom Symantec Privileged Access Management)
- [CVE-2024-38494](https://cve.now/CVE-2024-38494.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 8.6, Broadcom Symantec Privileged Access Management)
- [CVE-2024-38493](https://cve.now/CVE-2024-38493.md): Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerability (CVSS 6.8, Broadcom Symantec Privileged Access Management)
- [CVE-2024-38492](https://cve.now/CVE-2024-38492.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 9.4, Broadcom Symantec Privileged Access Management)
- [CVE-2024-38491](https://cve.now/CVE-2024-38491.md): Symantec Privileged Access Manager SQL Injection vulnerability (CVSS 8.4, Broadcom Symantec Privileged Access Management)
- [CVE-2024-36458](https://cve.now/CVE-2024-36458.md): Symantec Privileged Access Manager Privilege Escalation vulnerability (CVSS 5.1, Broadcom Symantec Privileged Access Management)
- [CVE-2024-36457](https://cve.now/CVE-2024-36457.md): Symantec Privileged Access Manager Authentication Bypass vulnerability (CVSS 5.3, Broadcom Symantec Privileged Access Management)
- [CVE-2024-36456](https://cve.now/CVE-2024-36456.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 9.4, Broadcom Symantec Privileged Access Management)
- [CVE-2024-36455](https://cve.now/CVE-2024-36455.md): Symantec Privileged Access Manager Remote Command Execution vulnerability (CVSS 9.4, Broadcom Symantec Privileged Access Management)
- [CVE-2024-6689](https://cve.now/CVE-2024-6689.md): Local privilege escalation vulnerability in baramundi Management Agent via MSI Installer (CVSS 7.8, baramundi Management Agent)
- [CVE-2024-6746](https://cve.now/CVE-2024-6746.md): NaiboWang EasySpider HTTP GET Request server.js path traversal (CVSS 5.3, NaiboWang EasySpider)
- [CVE-2024-5402](https://cve.now/CVE-2024-5402.md): Mint Workbench I Unquoted Service Path Enumeration (CVSS 6.2, ABB Mint Workbench I)
- [CVE-2024-6745](https://cve.now/CVE-2024-6745.md): code-projects Simple Ticket Booking Login adminauthenticate.php sql injection (CVSS 6.9, code-projects Simple Ticket Booking)
- [CVE-2024-6398](https://cve.now/CVE-2024-6398.md): An information disclosure vulnerability in SWG in versions 12.x prior to 12.2.10 and 11.x prior to 11.2.24 allows information stored in a cu (CVSS 4.3, Skyhigh Secure Web Gateway)
- [CVE-2024-41007](https://cve.now/CVE-2024-41007.md): tcp: avoid too many retransmit packets (CVSS 7.5, Linux)
- [CVE-2024-39767](https://cve.now/CVE-2024-39767.md): Spoofed push notifications from malicious server (CVSS 4.2, Mattermost)
- [CVE-2024-32945](https://cve.now/CVE-2024-32945.md): LaTeX post content manipulation via renderer state leak across contexts (CVSS 2.6, Mattermost)
- [CVE-2024-6741](https://cve.now/CVE-2024-6741.md): Openfind Mail2000 - HttpOnly flag bypass (CVSS 5.8, Openfind Mail2000)
- [CVE-2024-6740](https://cve.now/CVE-2024-6740.md): Openfind Mail2000 - Stored XSS (CVSS 6.1, Openfind Mail2000)
- [CVE-2023-49566](https://cve.now/CVE-2023-49566.md): Apache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerability (CVSS 8.8, Apache Software Foundation Apache Linkis DataSource · org.a…)
- [CVE-2023-46801](https://cve.now/CVE-2023-46801.md): Apache Linkis DataSource: DataSource Remote code execution vulnerability (CVSS 8.8, Apache Software Foundation Apache Linkis DataSource · org.a…)
- [CVE-2023-41916](https://cve.now/CVE-2023-41916.md): Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading (CVSS 6.5, Apache Software Foundation Apache Linkis DataSource · org.a…)
- [CVE-2024-23794](https://cve.now/CVE-2024-23794.md): Agents are able to lock the ticket without the "Owner" permission (CVSS 5.2, OTRS AG OTRS)
- [CVE-2024-6540](https://cve.now/CVE-2024-6540.md): Information exlosure in external interface (CVSS 5.7, OTRS AG OTRS)
- [CVE-2024-6744](https://cve.now/CVE-2024-6744.md): The SMTP Listener of Secure Email Gateway from Cellopoint does not properly validate user input, leading to a Buffer Overflow vulnerability. (CVSS 9.8, Cellopoint Secure Email Gateway)
- [CVE-2024-6743](https://cve.now/CVE-2024-6743.md): AguardNet Space Management System - SQL injection (CVSS 9.8, AguardNet Space Management System)
- [CVE-2024-6289](https://cve.now/CVE-2024-6289.md): WPS Hide Login \< 1.9.16.4 - Hidden Login Page Disclosure (CVSS 6.1, WPS Hide Login)
- [CVE-2024-6076](https://cve.now/CVE-2024-6076.md): WP eStore \< 8.5.5 - Reflected XSS in Category Editing (CVSS 6.1, wp-cart-for-digital-products)
- [CVE-2024-6075](https://cve.now/CVE-2024-6075.md): WP eStore \< 8.5.5 - Coupon Deletion via CSRF (CVSS 8.8, wp-cart-for-digital-products)
- [CVE-2024-6074](https://cve.now/CVE-2024-6074.md): WP eStore \< 8.5.5 - Reflected XSS in Customer Editing (CVSS 5.4, wp-cart-for-digital-products)
- [CVE-2024-6073](https://cve.now/CVE-2024-6073.md): WP eStore \< 8.5.5 - Reflected XSS in Discount Editing (CVSS 4.7, wp-cart-for-digital-products)
- [CVE-2024-6072](https://cve.now/CVE-2024-6072.md): WP eStore \< 8.5.5 - Reflected XSS via $\_SERVER\['REQUEST\_URI'\] (CVSS 6.1, wp-cart-for-digital-products)
- [CVE-2024-5630](https://cve.now/CVE-2024-5630.md): Insert or Embed Articulate Content into WordPress \< 4.3000000024 - Author+ Arbitrary File Upload (CVSS 8.8, Insert or Embed Articulate Content into WordPress)
- [CVE-2024-6742](https://cve.now/CVE-2024-6742.md): AguardNet Space Management System - Reflected Cross-Site Scripting (CVSS 5.4, AguardNet Space Management System)
- [CVE-2024-21513](https://cve.now/CVE-2024-21513.md): Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving valu (CVSS 8.5, langchain-experimental)
- [CVE-2024-6739](https://cve.now/CVE-2024-6739.md): Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag (CVSS 5.3, Openfind MailGates · Openfind MailAudit)
- [CVE-2024-6738](https://cve.now/CVE-2024-6738.md): WisdomGarden Tronclass - Broken Access Control (CVSS 5.3, WisdomGarden Tronclass)
- [CVE-2024-6737](https://cve.now/CVE-2024-6737.md): 2100 TECHNOLOGY Electronic Official Document Management System - Broken Access Control (CVSS 8.8, 2100 TECHNOLOGY Electronic Official Document Management Sys…)
- [CVE-2024-39740](https://cve.now/CVE-2024-39740.md): IBM Datacap Navigator information disclosure (CVSS 4.3, IBM Datacap Navigator)
- [CVE-2024-39741](https://cve.now/CVE-2024-39741.md): IBM Datacap Navigator directory traversal (CVSS 4.3, IBM Datacap Navigator)
- [CVE-2024-39729](https://cve.now/CVE-2024-39729.md): IBM Datacap Navigator information disclosure (CVSS 4.3, IBM Datacap Navigator)
- [CVE-2024-39735](https://cve.now/CVE-2024-39735.md): IBM Datacap Navigator cross-site scripting (CVSS 5.4, IBM Datacap Navigator)
- [CVE-2024-39731](https://cve.now/CVE-2024-39731.md): IBM Datacap Navigator information disclosure (CVSS 5.9, IBM Datacap Navigator)
- [CVE-2024-39728](https://cve.now/CVE-2024-39728.md): IBM Datacap Navigator cross-site scripting (CVSS 6.4, IBM Datacap Navigator)
- [CVE-2024-39736](https://cve.now/CVE-2024-39736.md): IBM Datacap Navigator HTTP HOST header injection (CVSS 6.5, IBM Datacap Navigator)
- [CVE-2024-39737](https://cve.now/CVE-2024-39737.md): IBM Datacap Navigator information disclosure (CVSS 5.4, IBM Datacap Navigator)
- [CVE-2024-39739](https://cve.now/CVE-2024-39739.md): IBM Datacap Navigator server-side request forgery (CVSS 5.4, IBM Datacap Navigator)
- [CVE-2024-6736](https://cve.now/CVE-2024-6736.md): SourceCodester Employee and Visitor Gate Pass Logging System view\_employee.php sql injection (CVSS 5.3, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-6345](https://cve.now/CVE-2024-6345.md): Remote Code Execution in pypa/setuptools (CVSS 8.8, pypa/setuptools · setuptools)
- [CVE-2024-6735](https://cve.now/CVE-2024-6735.md): itsourcecode Tailoring Management System setgeneral.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-31946](https://cve.now/CVE-2024-31946.md): An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 th (CVSS 4.2)
- [CVE-2024-36432](https://cve.now/CVE-2024-36432.md): An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS (CVSS 7.5)
- [CVE-2024-36433](https://cve.now/CVE-2024-36433.md): An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware befor (CVSS 7.5)
- [CVE-2024-36434](https://cve.now/CVE-2024-36434.md): An SMM callout vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4. (CVSS 7.5)
- [CVE-2024-36438](https://cve.now/CVE-2024-36438.md): eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to c (CVSS 7.3)
- [CVE-2024-37016](https://cve.now/CVE-2024-37016.md): Mengshen Wireless Door Alarm M70 2024-05-24 allows Authentication Bypass via a Capture-Replay approach. (CVSS 6.8)
- [CVE-2024-37386](https://cve.now/CVE-2024-37386.md): An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. (CVSS 4.2)
- [CVE-2024-40414](https://cve.now/CVE-2024-40414.md): A vulnerability in /goform/SetNetControlList in the sub\_656BC function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow (CVSS 9.6)
- [CVE-2024-40415](https://cve.now/CVE-2024-40415.md): A vulnerability in /goform/SetStaticRouteCfg in the sub\_519F4 function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overflow (CVSS 9.8)
- [CVE-2024-40416](https://cve.now/CVE-2024-40416.md): A vulnerability in /goform/SetVirtualServerCfg in the sub\_6320C function in Tenda AX1806 1.0.0.1 firmware leads to stack-based buffer overfl (CVSS 6.5)
- [CVE-2024-40524](https://cve.now/CVE-2024-40524.md): Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\\application.py (CVSS 9.8)
- [CVE-2024-40553](https://cve.now/CVE-2024-40553.md): Tmall\_demo v2024.07.03 was discovered to contain an arbitrary file upload via the component uploadUserHeadImage. (CVSS 4.9)
- [CVE-2024-40554](https://cve.now/CVE-2024-40554.md): An access control issue in Tmall\_demo v2024.07.03 allows attackers to obtain sensitive information. (CVSS 7.5)
- [CVE-2024-40555](https://cve.now/CVE-2024-40555.md): Tmall\_demo v2024.07.03 was discovered to contain an arbitrary file upload vulnerability. (CVSS 5.3)
- [CVE-2024-40560](https://cve.now/CVE-2024-40560.md): Tmall\_demo before v2024.07.03 was discovered to contain a SQL injection vulnerability. (CVSS 7.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.