# CVEs published 2024-07-16

253 CVEs were published on July 16, 2024: 23 critical, 72 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-35640](https://cve.now/CVE-2022-35640.md): IBM Sterling Partner Engagement Manager information disclosure (CVSS 4.0, IBM Sterling Partner Engagement Manager)
- [CVE-2024-40637](https://cve.now/CVE-2024-40637.md): Implicit override for built-in materializations from installed packages in dbt-core (CVSS 4.2, dbt-labs dbt-core · dbt-core)
- [CVE-2024-21188](https://cve.now/CVE-2024-21188.md): Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: (CVSS 6.1, Oracle Financial Services Revenue Management and Billing)
- [CVE-2024-21185](https://cve.now/CVE-2024-21185.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21184](https://cve.now/CVE-2024-21184.md): Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. (CVSS 7.2, Oracle Database - Enterprise Edition)
- [CVE-2024-21183](https://cve.now/CVE-2024-21183.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21182](https://cve.now/CVE-2024-21182.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, KEV, Oracle WebLogic Server)
- [CVE-2024-21181](https://cve.now/CVE-2024-21181.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2024-21180](https://cve.now/CVE-2024-21180.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). (CVSS 4.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2024-21179](https://cve.now/CVE-2024-21179.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21178](https://cve.now/CVE-2024-21178.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). (CVSS 6.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2024-21177](https://cve.now/CVE-2024-21177.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL NDB Cluster · Oracle MySQL Server)
- [CVE-2024-21176](https://cve.now/CVE-2024-21176.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). (CVSS 5.3, Oracle MySQL Server)
- [CVE-2024-21175](https://cve.now/CVE-2024-21175.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-21174](https://cve.now/CVE-2024-21174.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 3.1, Oracle Database - Enterprise Edition)
- [CVE-2024-21173](https://cve.now/CVE-2024-21173.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21171](https://cve.now/CVE-2024-21171.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-21170](https://cve.now/CVE-2024-21170.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python). (CVSS 6.3, Oracle MySQL Connectors)
- [CVE-2024-21169](https://cve.now/CVE-2024-21169.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Partners). (CVSS 6.5, Oracle Marketing)
- [CVE-2024-21168](https://cve.now/CVE-2024-21168.md): Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). (CVSS 6.5, Oracle JD Edwards EnterpriseOne Orchestrator)
- [CVE-2024-21167](https://cve.now/CVE-2024-21167.md): Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI). (CVSS 8.1, Oracle Trading Community)
- [CVE-2024-21166](https://cve.now/CVE-2024-21166.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.9, Oracle MySQL Server)
- [CVE-2024-21165](https://cve.now/CVE-2024-21165.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21164](https://cve.now/CVE-2024-21164.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 2.5, Oracle VM VirtualBox)
- [CVE-2024-21163](https://cve.now/CVE-2024-21163.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2024-21162](https://cve.now/CVE-2024-21162.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21161](https://cve.now/CVE-2024-21161.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.5, Oracle VM VirtualBox)
- [CVE-2024-21160](https://cve.now/CVE-2024-21160.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21159](https://cve.now/CVE-2024-21159.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21158](https://cve.now/CVE-2024-21158.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). (CVSS 6.4, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2024-21157](https://cve.now/CVE-2024-21157.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21155](https://cve.now/CVE-2024-21155.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: User Interface). (CVSS 4.7, Oracle Sun ZFS Storage Appliance Kit (AK) Software)
- [CVE-2024-21154](https://cve.now/CVE-2024-21154.md): Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Human Resources). (CVSS 4.3, Oracle PeopleSoft Enterprise HCM Human Resources)
- [CVE-2024-21153](https://cve.now/CVE-2024-21153.md): Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Spec (CVSS 8.1, Oracle Process Manufacturing Product Development)
- [CVE-2024-21152](https://cve.now/CVE-2024-21152.md): Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite (component: Allocation Rules). (CVSS 8.1, Oracle Process Manufacturing Financials)
- [CVE-2024-21151](https://cve.now/CVE-2024-21151.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 3.3, Oracle Solaris Operating System)
- [CVE-2024-21150](https://cve.now/CVE-2024-21150.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 6.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2024-21149](https://cve.now/CVE-2024-21149.md): Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Work Definition Issues). (CVSS 8.1, Oracle Enterprise Asset Management)
- [CVE-2024-21148](https://cve.now/CVE-2024-21148.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 4.8, Oracle Applications Framework)
- [CVE-2024-21147](https://cve.now/CVE-2024-21147.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 7.4, Oracle Java SE JDK and JRE)
- [CVE-2024-21146](https://cve.now/CVE-2024-21146.md): Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: GL Accounts). (CVSS 8.1, Oracle Trade Management)
- [CVE-2024-21145](https://cve.now/CVE-2024-21145.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). (CVSS 4.8, Oracle Java SE JDK and JRE)
- [CVE-2024-21144](https://cve.now/CVE-2024-21144.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2024-21143](https://cve.now/CVE-2024-21143.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). (CVSS 5.3, Oracle iStore)
- [CVE-2024-21142](https://cve.now/CVE-2024-21142.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21141](https://cve.now/CVE-2024-21141.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2024-21140](https://cve.now/CVE-2024-21140.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 4.8, Oracle Java SE JDK and JRE)
- [CVE-2024-21139](https://cve.now/CVE-2024-21139.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2024-21138](https://cve.now/CVE-2024-21138.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2024-21137](https://cve.now/CVE-2024-21137.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21136](https://cve.now/CVE-2024-21136.md): Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security). (CVSS 8.6, Oracle Retail Xstore Office)
- [CVE-2024-21135](https://cve.now/CVE-2024-21135.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21134](https://cve.now/CVE-2024-21134.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). (CVSS 4.3, Oracle MySQL Server)
- [CVE-2024-21133](https://cve.now/CVE-2024-21133.md): Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Servlet). (CVSS 6.1, Oracle Reports Developer)
- [CVE-2024-21132](https://cve.now/CVE-2024-21132.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). (CVSS 5.4, Oracle Purchasing)
- [CVE-2024-21131](https://cve.now/CVE-2024-21131.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2024-21130](https://cve.now/CVE-2024-21130.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21129](https://cve.now/CVE-2024-21129.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21128](https://cve.now/CVE-2024-21128.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: APIs). (CVSS 5.4, Oracle Application Object Library)
- [CVE-2024-21127](https://cve.now/CVE-2024-21127.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-21126](https://cve.now/CVE-2024-21126.md): Vulnerability in the Oracle Database Portable Clusterware component of Oracle Database Server. (CVSS 5.8, Oracle Database - Enterprise Edition)
- [CVE-2024-21125](https://cve.now/CVE-2024-21125.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). (CVSS 4.9, Oracle MySQL NDB Cluster · Oracle MySQL Server)
- [CVE-2024-21123](https://cve.now/CVE-2024-21123.md): Vulnerability in the Oracle Database Core component of Oracle Database Server. (CVSS 2.3, Oracle Database - Enterprise Edition)
- [CVE-2024-21122](https://cve.now/CVE-2024-21122.md): Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft (component: Text Catalog). (CVSS 5.4, Oracle PeopleSoft Enterprise HCM Shared Components)
- [CVE-2024-20996](https://cve.now/CVE-2024-20996.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-3176](https://cve.now/CVE-2024-3176.md): Out of bounds write in SwiftShader in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to perform an out of bounds memory writ (CVSS 8.8, Google Chrome)
- [CVE-2023-7012](https://cve.now/CVE-2023-7012.md): Insufficient data validation in Permission Prompts in Google Chrome prior to 117.0.5938.62 allowed an attacker who convinced a user to insta (CVSS 7.5, Google Chrome)
- [CVE-2023-7010](https://cve.now/CVE-2023-7010.md): Use after free in WebRTC in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-4860](https://cve.now/CVE-2023-4860.md): Inappropriate implementation in Skia in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer proc (CVSS 9.6, Google Chrome)
- [CVE-2020-36765](https://cve.now/CVE-2020-36765.md): Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via (CVSS 6.5, Google Chrome)
- [CVE-2019-25154](https://cve.now/CVE-2019-25154.md): Inappropriate implementation in iframe in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to potentially perform a sandbox esc (CVSS 5.3, Google Chrome)
- [CVE-2024-5500](https://cve.now/CVE-2024-5500.md): Inappropriate implementation in Sign-In in Google Chrome prior to 1.3.36.351 allowed a remote attacker to bypass navigation restrictions via (CVSS 6.5, Google Chrome)
- [CVE-2024-3175](https://cve.now/CVE-2024-3175.md): Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform privilege escalation (CVSS 8.8, Google Chrome)
- [CVE-2024-3174](https://cve.now/CVE-2024-3174.md): Inappropriate implementation in V8 in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit object corrupti (CVSS 8.8, Google Chrome)
- [CVE-2024-3173](https://cve.now/CVE-2024-3173.md): Insufficient data validation in Updater in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to perform OS-level privilege esca (CVSS 7.8, Google Chrome)
- [CVE-2024-3172](https://cve.now/CVE-2024-3172.md): Insufficient data validation in DevTools in Google Chrome prior to 121.0.6167.85 allowed a remote attacker who convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2024-3171](https://cve.now/CVE-2024-3171.md): Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who convinced a user to engage in specific (CVSS 7.5, Google Chrome)
- [CVE-2024-3170](https://cve.now/CVE-2024-3170.md): Use after free in WebRTC in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-3169](https://cve.now/CVE-2024-3169.md): Use after free in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-3168](https://cve.now/CVE-2024-3168.md): Use after free in DevTools in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2024-2884](https://cve.now/CVE-2024-2884.md): Out of bounds read in V8 in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially perform out of bounds memory acce (CVSS 6.3, Google Chrome)
- [CVE-2023-7013](https://cve.now/CVE-2023-7013.md): Inappropriate implementation in Compositing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially spoof security (CVSS 5.4, Google Chrome)
- [CVE-2023-7011](https://cve.now/CVE-2023-7011.md): Inappropriate implementation in Picture in Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to spoof the contents (CVSS 6.5, Google Chrome)
- [CVE-2024-6779](https://cve.now/CVE-2024-6779.md): Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape (CVSS 8.8, Google Chrome)
- [CVE-2024-6778](https://cve.now/CVE-2024-6778.md): Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injec (CVSS 8.8, Google Chrome)
- [CVE-2024-6777](https://cve.now/CVE-2024-6777.md): Use after free in Navigation in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extens (CVSS 8.8, Google Chrome)
- [CVE-2024-6776](https://cve.now/CVE-2024-6776.md): Use after free in Audio in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-6775](https://cve.now/CVE-2024-6775.md): Use after free in Media Stream in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specific (CVSS 8.8, Google Chrome)
- [CVE-2024-6774](https://cve.now/CVE-2024-6774.md): Use after free in Screen Capture in Google Chrome prior to 126.0.6478.182 allowed a remote attacker who convinced a user to engage in specif (CVSS 8.8, Google Chrome)
- [CVE-2024-6773](https://cve.now/CVE-2024-6773.md): Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2024-6772](https://cve.now/CVE-2024-6772.md): Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to perform out of bounds memory access (CVSS 8.8, Google Chrome)
- [CVE-2024-6395](https://cve.now/CVE-2024-6395.md): GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys (CVSS 6.3, GitHub Enterprise Server)
- [CVE-2024-6336](https://cve.now/CVE-2024-6336.md): Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure (CVSS 6.9, GitHub Enterprise Server)
- [CVE-2024-5817](https://cve.now/CVE-2024-5817.md): Improper authorization allows read access to issue content in GitHub Enterprise Server (CVSS 5.9, GitHub Enterprise Server)
- [CVE-2024-5816](https://cve.now/CVE-2024-5816.md): Improper authorization allows persistent access in GitHub Enterprise Server (CVSS 6.9, GitHub Enterprise Server)
- [CVE-2024-5815](https://cve.now/CVE-2024-5815.md): Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository (CVSS 6.8, GitHub Enterprise Server)
- [CVE-2024-5795](https://cve.now/CVE-2024-5795.md): Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion (CVSS 7.7, GitHub Enterprise Server)
- [CVE-2024-5566](https://cve.now/CVE-2024-5566.md): Improper Privilege Management allows for access to unauthorized repository content during migration (CVSS 5.8, GitHub Enterprise Server)
- [CVE-2020-25836](https://cve.now/CVE-2020-25836.md): Potential information leakage resulting in unauthorized access (CVSS 6.3, OpenText NetIQ Directory and Resource Administrator)
- [CVE-2024-21687](https://cve.now/CVE-2024-21687.md): This High severity File Inclusion vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0 and 9.6.0 of Bamboo Data (CVSS 8.1, Atlassian Bamboo Data Center · Atlassian Bamboo Server)
- [CVE-2024-21686](https://cve.now/CVE-2024-21686.md): This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. (CVSS 7.3, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2024-6492](https://cve.now/CVE-2024-6492.md): Exposure of Sensitive Information in edge browser session proxy feature in Devolutions Remote Desktop Manager 2024.2.14.0 and earlier on Win (CVSS 7.4, Devolutions Remote Desktop Manager)
- [CVE-2024-39700](https://cve.now/CVE-2024-39700.md): Remote Code Execution (RCE) vulnerability in jupyterlab extension template \`update-integration-tests\` GitHub Action (CVSS 10.0, jupyterlab extension-template · jupyterlab)
- [CVE-2024-39908](https://cve.now/CVE-2024-39908.md): Denial of service in REXML (CVSS 4.3, ruby rexml · rexml)
- [CVE-2024-6089](https://cve.now/CVE-2024-6089.md): Rockwell Automation Major nonrecoverable fault in 5015 – AENFTXT (CVSS 8.7, Rockwell Automation 5015 - AENFTXT)
- [CVE-2024-40626](https://cve.now/CVE-2024-40626.md): Stored Cross-site Scripting (XSS) vulnerability in Outline editor (CVSS 7.3, outline)
- [CVE-2024-3232](https://cve.now/CVE-2024-3232.md): Formula Injection Vulnerability (CVSS 7.6, Tenable Identity Exposure)
- [CVE-2024-6326](https://cve.now/CVE-2024-6326.md): Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services (CVSS 1.8, Rockwell Automation FactoryTalk® System Services · Rockwell…)
- [CVE-2024-6325](https://cve.now/CVE-2024-6325.md): Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services (CVSS 6.0, Rockwell Automation FactoryTalk® System Services · Rockwell…)
- [CVE-2024-22442](https://cve.now/CVE-2024-22442.md): The vulnerability could be remotely exploited to bypass authentication. (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE 3PAR Service Processor)
- [CVE-2024-6655](https://cve.now/CVE-2024-6655.md): Gtk3: gtk2: library injection from cwd (CVSS 7.0, gtk · Red Hat Enterprise Linux)
- [CVE-2022-45449](https://cve.now/CVE-2022-45449.md): Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. (CVSS 7.7, Acronis Cyber Protect)
- [CVE-2024-32861](https://cve.now/CVE-2024-32861.md): Software House C•CURE - CouchDB executable protection (CVSS 7.8, Johnson Controls Software House C•CURE 9000 Installer)
- [CVE-2024-6435](https://cve.now/CVE-2024-6435.md): Rockwell Automation Privilege Escalation Vulnerability in Pavilion8® (CVSS 8.7, Rockwell Automation Pavilion8®)
- [CVE-2022-48866](https://cve.now/CVE-2022-48866.md): HID: hid-thrustmaster: fix OOB read in thrustmaster\_interrupts (no CVSS, Linux)
- [CVE-2022-48865](https://cve.now/CVE-2022-48865.md): tipc: fix kernel panic when enabling bearer (no CVSS, Linux)
- [CVE-2022-48864](https://cve.now/CVE-2022-48864.md): vdpa/mlx5: add validation for VIRTIO\_NET\_CTRL\_MQ\_VQ\_PAIRS\_SET command (CVSS 8.8, Linux)
- [CVE-2022-48863](https://cve.now/CVE-2022-48863.md): mISDN: Fix memory leak in dsp\_pipeline\_build() (no CVSS, Linux)
- [CVE-2022-48862](https://cve.now/CVE-2022-48862.md): vhost: fix hung thread due to erroneous iotlb entries (no CVSS, Linux)
- [CVE-2022-48861](https://cve.now/CVE-2022-48861.md): vdpa: fix use-after-free on vp\_vdpa\_remove (no CVSS, Linux)
- [CVE-2022-48860](https://cve.now/CVE-2022-48860.md): ethernet: Fix error handling in xemaclite\_of\_probe (no CVSS, Linux)
- [CVE-2022-48859](https://cve.now/CVE-2022-48859.md): net: marvell: prestera: Add missing of\_node\_put() in prestera\_switch\_set\_base\_mac\_addr (no CVSS, Linux)
- [CVE-2022-48858](https://cve.now/CVE-2022-48858.md): net/mlx5: Fix a race on command flush flow (CVSS 7.0, Linux)
- [CVE-2022-48857](https://cve.now/CVE-2022-48857.md): NFC: port100: fix use-after-free in port100\_send\_complete (no CVSS, Linux)
- [CVE-2022-48856](https://cve.now/CVE-2022-48856.md): gianfar: ethtool: Fix refcount leak in gfar\_get\_ts\_info (no CVSS, Linux)
- [CVE-2022-48855](https://cve.now/CVE-2022-48855.md): sctp: fix kernel-infoleak for SCTP sockets (no CVSS, Linux)
- [CVE-2022-48854](https://cve.now/CVE-2022-48854.md): net: arc\_emac: Fix use after free in arc\_mdio\_probe() (no CVSS, Linux)
- [CVE-2022-48853](https://cve.now/CVE-2022-48853.md): Reinstate some of "swiotlb: rework "fix info leak with DMA\_FROM\_DEVICE"" (no CVSS, Linux)
- [CVE-2022-48852](https://cve.now/CVE-2022-48852.md): drm/vc4: hdmi: Unregister codec device on unbind (no CVSS, Linux)
- [CVE-2022-48851](https://cve.now/CVE-2022-48851.md): staging: gdm724x: fix use after free in gdm\_lte\_rx() (CVSS 9.8, Linux)
- [CVE-2022-48850](https://cve.now/CVE-2022-48850.md): net-sysfs: add check for netdevice being present to speed\_show (no CVSS, Linux)
- [CVE-2022-48849](https://cve.now/CVE-2022-48849.md): drm/amdgpu: bypass tiling flag check in virtual display case (v2) (no CVSS, Linux)
- [CVE-2022-48848](https://cve.now/CVE-2022-48848.md): tracing/osnoise: Do not unregister events twice (no CVSS, Linux)
- [CVE-2022-48847](https://cve.now/CVE-2022-48847.md): watch\_queue: Fix filter limit check (CVSS 7.8, Linux)
- [CVE-2022-48846](https://cve.now/CVE-2022-48846.md): block: release rq qos structures for queue without disk (no CVSS, Linux)
- [CVE-2022-48845](https://cve.now/CVE-2022-48845.md): MIPS: smp: fill in sibling and core maps earlier (no CVSS, Linux)
- [CVE-2022-48844](https://cve.now/CVE-2022-48844.md): Bluetooth: hci\_core: Fix leaking sent\_cmd skb (no CVSS, Linux)
- [CVE-2022-48842](https://cve.now/CVE-2022-48842.md): ice: Fix race condition during interface enslave (no CVSS, Linux)
- [CVE-2022-48841](https://cve.now/CVE-2022-48841.md): ice: fix NULL pointer dereference in ice\_update\_vsi\_tx\_ring\_stats() (no CVSS, Linux)
- [CVE-2022-48840](https://cve.now/CVE-2022-48840.md): iavf: Fix hang during reboot/shutdown (no CVSS, Linux)
- [CVE-2022-48839](https://cve.now/CVE-2022-48839.md): net/packet: fix slab-out-of-bounds access in packet\_recvmsg() (CVSS 7.8, Linux)
- [CVE-2022-48838](https://cve.now/CVE-2022-48838.md): usb: gadget: Fix use-after-free bug by not setting udc-\>dev.driver (no CVSS, Linux)
- [CVE-2022-48837](https://cve.now/CVE-2022-48837.md): usb: gadget: rndis: prevent integer overflow in rndis\_set\_response() (no CVSS, Linux)
- [CVE-2022-48836](https://cve.now/CVE-2022-48836.md): Input: aiptek - properly check endpoint type (no CVSS, Linux)
- [CVE-2022-48835](https://cve.now/CVE-2022-48835.md): scsi: mpt3sas: Page fault in reply q processing (no CVSS, Linux)
- [CVE-2022-48834](https://cve.now/CVE-2022-48834.md): usb: usbtmc: Fix bug in pipe direction for control transfers (no CVSS, Linux)
- [CVE-2022-48833](https://cve.now/CVE-2022-48833.md): btrfs: skip reserved bytes warning on unmount after log cleanup failure (no CVSS, Linux)
- [CVE-2022-48832](https://cve.now/CVE-2022-48832.md): audit: don't deref the syscall args when checking the openat2 open\_how::flags (no CVSS, Linux)
- [CVE-2022-48831](https://cve.now/CVE-2022-48831.md): ima: fix reference leak in asymmetric\_verify() (no CVSS, Linux)
- [CVE-2022-48830](https://cve.now/CVE-2022-48830.md): can: isotp: fix potential CAN frame reception race in isotp\_rcv() (CVSS 8.8, Linux)
- [CVE-2022-48829](https://cve.now/CVE-2022-48829.md): NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes (CVSS 9.1, Linux)
- [CVE-2022-48828](https://cve.now/CVE-2022-48828.md): NFSD: Fix ia\_size underflow (CVSS 9.1, Linux)
- [CVE-2022-48827](https://cve.now/CVE-2022-48827.md): NFSD: Fix the behavior of READ near OFFSET\_MAX (CVSS 7.5, Linux)
- [CVE-2022-48826](https://cve.now/CVE-2022-48826.md): drm/vc4: Fix deadlock on DSI device attach error (no CVSS, Linux)
- [CVE-2022-48825](https://cve.now/CVE-2022-48825.md): scsi: qedf: Add stag\_work to all the vports (no CVSS, Linux)
- [CVE-2022-48824](https://cve.now/CVE-2022-48824.md): scsi: myrs: Fix crash in error case (no CVSS, Linux)
- [CVE-2022-48823](https://cve.now/CVE-2022-48823.md): scsi: qedf: Fix refcount issue when LOGO is received during TMF (no CVSS, Linux)
- [CVE-2022-48822](https://cve.now/CVE-2022-48822.md): usb: f\_fs: Fix use-after-free for epfile (CVSS 7.8, Linux)
- [CVE-2022-48821](https://cve.now/CVE-2022-48821.md): misc: fastrpc: avoid double fput() on failed usercopy (CVSS 7.8, Linux)
- [CVE-2022-48820](https://cve.now/CVE-2022-48820.md): phy: stm32: fix a refcount leak in stm32\_usbphyc\_pll\_enable() (no CVSS, Linux)
- [CVE-2022-48819](https://cve.now/CVE-2022-48819.md): tcp: take care of mixed splice()/sendmsg(MSG\_ZEROCOPY) case (no CVSS, Linux)
- [CVE-2022-48818](https://cve.now/CVE-2022-48818.md): net: dsa: mv88e6xxx: don't use devres for mdiobus (no CVSS, Linux)
- [CVE-2022-48817](https://cve.now/CVE-2022-48817.md): net: dsa: ar9331: register the mdiobus under devres (no CVSS, Linux)
- [CVE-2022-48816](https://cve.now/CVE-2022-48816.md): SUNRPC: lock against -\>sock changing during sysfs read (CVSS 7.8, Linux)
- [CVE-2022-48815](https://cve.now/CVE-2022-48815.md): net: dsa: bcm\_sf2: don't use devres for mdiobus (no CVSS, Linux)
- [CVE-2022-48814](https://cve.now/CVE-2022-48814.md): net: dsa: seville: register the mdiobus under devres (no CVSS, Linux)
- [CVE-2022-48813](https://cve.now/CVE-2022-48813.md): net: dsa: felix: don't use devres for mdiobus (no CVSS, Linux)
- [CVE-2022-48812](https://cve.now/CVE-2022-48812.md): net: dsa: lantiq\_gswip: don't use devres for mdiobus (no CVSS, Linux)
- [CVE-2022-48811](https://cve.now/CVE-2022-48811.md): ibmvnic: don't release napi in \_\_ibmvnic\_open() (no CVSS, Linux)
- [CVE-2022-48810](https://cve.now/CVE-2022-48810.md): ipmr,ip6mr: acquire RTNL before calling ip\[6\]mr\_free\_table() on failure path (no CVSS, Linux)
- [CVE-2022-48809](https://cve.now/CVE-2022-48809.md): net: fix a memleak when uncloning an skb dst and its metadata (no CVSS, Linux)
- [CVE-2022-48808](https://cve.now/CVE-2022-48808.md): net: dsa: fix panic when DSA master device unbinds on shutdown (no CVSS, Linux)
- [CVE-2022-48807](https://cve.now/CVE-2022-48807.md): ice: Fix KASAN error in LAG NETDEV\_UNREGISTER handler (no CVSS, Linux)
- [CVE-2022-48806](https://cve.now/CVE-2022-48806.md): eeprom: ee1004: limit i2c reads to I2C\_SMBUS\_BLOCK\_MAX (no CVSS, Linux)
- [CVE-2022-48805](https://cve.now/CVE-2022-48805.md): net: usb: ax88179\_178a: Fix out-of-bounds accesses in RX fixup (no CVSS, Linux)
- [CVE-2022-48804](https://cve.now/CVE-2022-48804.md): vt\_ioctl: fix array\_index\_nospec in vt\_setactivate (no CVSS, Linux)
- [CVE-2022-48803](https://cve.now/CVE-2022-48803.md): phy: ti: Fix missing sentinel for clk\_div\_table (CVSS 7.3, Linux)
- [CVE-2022-48802](https://cve.now/CVE-2022-48802.md): fs/proc: task\_mmu.c: don't read mapcount for migration entry (no CVSS, Linux)
- [CVE-2022-48801](https://cve.now/CVE-2022-48801.md): iio: buffer: Fix file related error handling in IIO\_BUFFER\_GET\_FD\_IOCTL (CVSS 7.8, Linux)
- [CVE-2022-48800](https://cve.now/CVE-2022-48800.md): mm: vmscan: remove deadlock due to throttling failing to make progress (no CVSS, Linux)
- [CVE-2022-48799](https://cve.now/CVE-2022-48799.md): perf: Fix list corruption in perf\_cgroup\_switch() (no CVSS, Linux)
- [CVE-2022-48798](https://cve.now/CVE-2022-48798.md): s390/cio: verify the driver availability for path\_event call (no CVSS, Linux)
- [CVE-2022-48797](https://cve.now/CVE-2022-48797.md): mm: don't try to NUMA-migrate COW pages that have other uses (CVSS 7.1, Linux)
- [CVE-2022-48796](https://cve.now/CVE-2022-48796.md): iommu: Fix potential use-after-free during probe (CVSS 7.8, Linux)
- [CVE-2022-48795](https://cve.now/CVE-2022-48795.md): parisc: Fix data TLB miss in sba\_unmap\_sg (no CVSS, Linux)
- [CVE-2022-48794](https://cve.now/CVE-2022-48794.md): net: ieee802154: at86rf230: Stop leaking skb's (no CVSS, Linux)
- [CVE-2022-48793](https://cve.now/CVE-2022-48793.md): KVM: x86: nSVM: fix potential NULL derefernce on nested migration (no CVSS, Linux)
- [CVE-2022-48792](https://cve.now/CVE-2022-48792.md): scsi: pm8001: Fix use-after-free for aborted SSP/STP sas\_task (CVSS 7.8, Linux)
- [CVE-2022-48791](https://cve.now/CVE-2022-48791.md): scsi: pm8001: Fix use-after-free for aborted TMF sas\_task (CVSS 7.8, Linux)
- [CVE-2022-48790](https://cve.now/CVE-2022-48790.md): nvme: fix a possible use-after-free in controller reset during load (CVSS 9.8, Linux)
- [CVE-2022-48789](https://cve.now/CVE-2022-48789.md): nvme-tcp: fix possible use-after-free in transport error\_recovery work (CVSS 9.8, Linux)
- [CVE-2022-48788](https://cve.now/CVE-2022-48788.md): nvme-rdma: fix possible use-after-free in transport error\_recovery work (CVSS 9.8, Linux)
- [CVE-2022-48787](https://cve.now/CVE-2022-48787.md): iwlwifi: fix use-after-free (CVSS 7.8, Linux)
- [CVE-2022-48786](https://cve.now/CVE-2022-48786.md): vsock: remove vsock from connected table when connect is interrupted by a signal (CVSS 7.8, Linux)
- [CVE-2021-47624](https://cve.now/CVE-2021-47624.md): net/sunrpc: fix reference count leaks in rpc\_sysfs\_xprt\_state\_change (no CVSS, Linux)
- [CVE-2021-47623](https://cve.now/CVE-2021-47623.md): powerpc/fixmap: Fix VM debug warning on unmap (no CVSS, Linux)
- [CVE-2021-47622](https://cve.now/CVE-2021-47622.md): scsi: ufs: Fix a deadlock in the error handler (no CVSS, Linux)
- [CVE-2022-48785](https://cve.now/CVE-2022-48785.md): ipv6: mcast: use rcu-safe version of ipv6\_get\_lladdr() (CVSS 8.8, Linux)
- [CVE-2022-48784](https://cve.now/CVE-2022-48784.md): cfg80211: fix race in netlink owner interface destruction (no CVSS, Linux)
- [CVE-2022-48783](https://cve.now/CVE-2022-48783.md): net: dsa: lantiq\_gswip: fix use after free in gswip\_remove() (no CVSS, Linux)
- [CVE-2022-48782](https://cve.now/CVE-2022-48782.md): mctp: fix use after free (CVSS 8.8, Linux)
- [CVE-2022-48781](https://cve.now/CVE-2022-48781.md): crypto: af\_alg - get rid of alg\_memory\_allocated (no CVSS, Linux)
- [CVE-2022-48780](https://cve.now/CVE-2022-48780.md): net/smc: Avoid overwriting the copies of clcsock callback functions (no CVSS, Linux)
- [CVE-2022-48779](https://cve.now/CVE-2022-48779.md): net: mscc: ocelot: fix use-after-free in ocelot\_vlan\_del() (CVSS 7.8, Linux)
- [CVE-2022-48778](https://cve.now/CVE-2022-48778.md): mtd: rawnand: gpmi: don't leak PM reference in error path (no CVSS, Linux)
- [CVE-2022-48777](https://cve.now/CVE-2022-48777.md): mtd: parsers: qcom: Fix kernel panic on skipped partition (no CVSS, Linux)
- [CVE-2022-48776](https://cve.now/CVE-2022-48776.md): mtd: parsers: qcom: Fix missing free for pparts in cleanup (no CVSS, Linux)
- [CVE-2022-48775](https://cve.now/CVE-2022-48775.md): Drivers: hv: vmbus: Fix memory leak in vmbus\_add\_channel\_kobj (no CVSS, Linux)
- [CVE-2022-48774](https://cve.now/CVE-2022-48774.md): dmaengine: ptdma: Fix the error handling path in pt\_core\_init() (no CVSS, Linux)
- [CVE-2022-48773](https://cve.now/CVE-2022-48773.md): xprtrdma: fix pointer derefs in error cases of rpcrdma\_ep\_create (no CVSS, Linux)
- [CVE-2024-6457](https://cve.now/CVE-2024-6457.md): HUSKY - Products Filter Professional for WooCommerce \<= 1.3.6 - Unauthenticated Time-Based SQL Injection (CVSS 9.8, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2024-6621](https://cve.now/CVE-2024-6621.md): WP RSS Aggregator \<= 4.23.11 - Missing Authorization to Authenticated (Subscriber+) Feed State Update (CVSS 4.3, rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…)
- [CVE-2023-52886](https://cve.now/CVE-2023-52886.md): USB: core: Fix race by not overwriting udev-\>descriptor in hub\_port\_init() (no CVSS, Linux)
- [CVE-2024-6579](https://cve.now/CVE-2024-6579.md): Web and WooCommerce Addons for WPBakery Builder \<= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification (CVSS 4.3, genetechproducts Web and WooCommerce Addons for WPBakery Bu…)
- [CVE-2024-39887](https://cve.now/CVE-2024-39887.md): Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-1937](https://cve.now/CVE-2024-1937.md): Brizy – Page Builder \<= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification (CVSS 7.1, themefusecom Brizy – Page Builder)
- [CVE-2024-3587](https://cve.now/CVE-2024-3587.md): Premium Portfolio Features for Phlox theme \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios' (CVSS 6.4, averta Premium Portfolio Features for Phlox theme)
- [CVE-2024-6565](https://cve.now/CVE-2024-6565.md): AForms \<= 2.2.6 - Unauthenticated Full Path Disclosure (CVSS 5.3, vividcolorsjp AForms — Form Builder for Price Calculator &…)
- [CVE-2024-6570](https://cve.now/CVE-2024-6570.md): Glossary \<= 2.2.26 - Unauthenticated Full Path Disclosure (CVSS 5.3, mte90 Glossary)
- [CVE-2024-5852](https://cve.now/CVE-2024-5852.md): WordPress File Upload \<= 4.24.7 - Authenticated (Contributor+) Directory Traversal (CVSS 4.3, nickboss Iptanus File Upload)
- [CVE-2024-2691](https://cve.now/CVE-2024-2691.md): WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce \<= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode (CVSS 6.4, wpeventmanager WP Event Manager – Events Calendar, Registra…)
- [CVE-2024-3779](https://cve.now/CVE-2024-3779.md): Denial of Service in ESET products for Windows (CVSS 6.1, ESET s.r.o ESET NOD32 Antivirus · ESET s.r.o ESET Intern… +8)
- [CVE-2024-41008](https://cve.now/CVE-2024-41008.md): drm/amdgpu: change vm-\>task\_info handling (CVSS 7.8, Linux)
- [CVE-2023-52290](https://cve.now/CVE-2023-52290.md): Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability (CVSS 8.1, Apache Software Foundation Apache StreamPark)
- [CVE-2024-4780](https://cve.now/CVE-2024-4780.md): Image Hover Effects – Elementor Addon \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe\_link Parameter (CVSS 6.4, blocksera Image Hover Effects – Elementor Addon)
- [CVE-2024-6559](https://cve.now/CVE-2024-6559.md): XCloner \<= 4.7.3 - Unauthenticated Full Path Disclosure (CVSS 5.3, watchful Backup, Restore and Migrate your sites with XCloner)
- [CVE-2024-6557](https://cve.now/CVE-2024-6557.md): SchedulePress \<= 5.1.3 - Unauthenticated Full Path Disclosure (CVSS 5.3, wpdevteam SchedulePress – Auto Post & Publish, Auto Social…)
- [CVE-2024-6780](https://cve.now/CVE-2024-6780.md): Improper permission control in com.android.server.telecom (CVSS 3.3, TECNO com.android.server.telecom)
- [CVE-2019-16638](https://cve.now/CVE-2019-16638.md): An issue was found on the Ruijie EG-2000 series gateway. (CVSS 7.5)
- [CVE-2019-16639](https://cve.now/CVE-2019-16639.md): An issue was found on the Ruijie EG-2000 series gateway. (CVSS 9.8)
- [CVE-2019-16640](https://cve.now/CVE-2019-16640.md): An issue was found in upload.php on the Ruijie EG-2000 series gateway. (CVSS 7.5)
- [CVE-2019-16641](https://cve.now/CVE-2019-16641.md): An issue was found on the Ruijie EG-2000 series gateway. (CVSS 8.4)
- [CVE-2023-31456](https://cve.now/CVE-2023-31456.md): There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbit (CVSS 5.4)
- [CVE-2024-33180](https://cve.now/CVE-2024-33180.md): Tenda AC18 V15.03.3.10\_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/save (CVSS 9.8)
- [CVE-2024-33181](https://cve.now/CVE-2024-33181.md): Tenda AC18 V15.03.3.10\_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceMac parameter at ip/goform/add (CVSS 8.8)
- [CVE-2024-33182](https://cve.now/CVE-2024-33182.md): Tenda AC18 V15.03.3.10\_EN was discovered to contain a stack-based buffer overflow vulnerability via the deviceId parameter at ip/goform/addW (CVSS 8.3)
- [CVE-2024-35338](https://cve.now/CVE-2024-35338.md): Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root. (CVSS 9.8)
- [CVE-2024-39036](https://cve.now/CVE-2024-39036.md): SeaCMS v12.9 is vulnerable to Arbitrary File Read via admin\_safe.php. (CVSS 6.5)
- [CVE-2024-40129](https://cve.now/CVE-2024-40129.md): Open5GS v2.6.4 is vulnerable to Buffer Overflow. (CVSS 8.6)
- [CVE-2024-40130](https://cve.now/CVE-2024-40130.md): open5gs v2.6.4 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2024-40322](https://cve.now/CVE-2024-40322.md): An issue was discovered in JFinalCMS v.5.0.0. (CVSS 6.3)
- [CVE-2024-40392](https://cve.now/CVE-2024-40392.md): SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to co (CVSS 9.8)
- [CVE-2024-40393](https://cve.now/CVE-2024-40393.md): Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user param (CVSS 9.8)
- [CVE-2024-40394](https://cve.now/CVE-2024-40394.md): Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the compo (CVSS 9.8)
- [CVE-2024-40425](https://cve.now/CVE-2024-40425.md): File Upload vulnerability in Nanjin Xingyuantu Technology Co Sparkshop (Spark Mall B2C Mall v.1.1.6 and before allows a remote attacker to e (CVSS 9.8)
- [CVE-2024-40455](https://cve.now/CVE-2024-40455.md): An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request. (CVSS 2.7)
- [CVE-2024-40456](https://cve.now/CVE-2024-40456.md): ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \\system\\action\\update.php. (CVSS 9.8)
- [CVE-2024-40503](https://cve.now/CVE-2024-40503.md): An issue in Tenda AX12 v.16.03.49.18\_cn+ allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet (CVSS 6.5)
- [CVE-2024-40505](https://cve.now/CVE-2024-40505.md): Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi compo (CVSS 9.3)
- [CVE-2024-40515](https://cve.now/CVE-2024-40515.md): An issue in SHENZHEN TENDA TECHNOLOGY CO.,LTD Tenda AX2pro V16.03.29.48\_cn allows a remote attacker to execute arbitrary code via the Routin (CVSS 9.8)
- [CVE-2024-40516](https://cve.now/CVE-2024-40516.md): An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing (CVSS 8.8)
- [CVE-2024-40535](https://cve.now/CVE-2024-40535.md): Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a stack overflow via the apn\_name\_3g parameter in the conf (CVSS 9.8)
- [CVE-2024-40536](https://cve.now/CVE-2024-40536.md): Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 were discovered to contain a stack overflow via the pin\_3g\_code parameter in the con (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.