CVEs published July 17, 2024
86 CVEs were published on July 17, 2024: 15 critical, 23 high.
- Published
- 86
- Critical
- 15
- High
- 23
- Medium
- 44
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- SolarWinds Access Rights Manager
- 13
- Brainstorm Force Ultimate Addons for WPBakery
- 5
- XjSv Cooked
- 5
- Apache Software Foundation Apache StreamPark · org.apache.s…
- 3
- Apache Software Foundation Apache StreamPipes · streampi… +1
- 3
- Century Systems Co. FutureNet NXR-1300 series · Century… +20
- 3
- roundup
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Cisco Secure Email
- 2
- Cisco Webex Teams
- 2
Critical 15
- CVE-2024-20419A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote atCisco Smart Software Manager On-Prem
- CVE-2024-20401A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote Cisco Secure Email
- CVE-2023-4976FlashBlade Authentication Mechanism VulnerabilityPureStorage FlashBlade
- CVE-2024-6834Imperative Local Command Injection allows Activity MaskingOpen Mainframe Project Zowe
- CVE-2024-23471SolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23470SolarWinds Access Rights Manager (ARM) UserScriptHumster Exposed Dangerous Method Remote Command Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-28074SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability SolarWinds Access Rights Manager
- CVE-2024-23467SolarWinds Access Rights Manager Directory Traversal Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23466SolarWinds Access Rights Manager Directory Traversal Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23469SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23475SolarWinds Access Rights Manager Directory Traversal and Information Disclosure VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23472SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-36491FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd.Century Systems Co. FutureNet NXR-1300 series · Century… +20
- CVE-2024-31070Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century SCentury Systems Co. FutureNet NXR-1300 series · Century… +20
- CVE-2024-6220简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Uploadzhengdon 简数采集器
High 23
- CVE-2024-40641Unsigned code template execution through workflows in projectdiscovery/nucleiprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2024-20323A vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection betwCisco Intelligent Node Manager · Cisco Intelligent Node Sof…
- CVE-2024-20435A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commaCisco Secure Web Appliance
- CVE-2023-7272Eclipse Parsson stack overflow with deeply nested objectsEclipse Foundation Parsson · org.eclipse.parsson:parsson
- CVE-2024-23465SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-28993SolarWinds Access Rights Manager Directory Traversal and Information Disclosure VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-28992SolarWinds Access Rights Manager Directory Traversal and Information Disclosure VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23468SolarWinds Access Rights Manager Directory Traversal and Information Disclosure VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23474SolarWinds Access Rights Manager (ARM) deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-5471Agent takeoverManageEngine DDI Central
- CVE-2024-31979Apache StreamPipes: Possibility of SSRF in pipeline element installation processApache Software Foundation Apache StreamPipes · streampi… +1
- CVE-2024-36475FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd.Century Systems Co. FutureNet NXR-1300 series · Century… +20
- CVE-2024-29737Apache StreamPark (incubating): maven build params could trigger remote command executionApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2023-52291Apache StreamPark (incubating): Unchecked maven build params could trigger remote command executionApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2024-39877Apache Airflow: DAG Author Code Execution possibility in airflow-schedulerApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-39863Apache Airflow: Potential XSS VulnerabilityApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-6467BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creationreputeinfosystems Appointment Booking Calendar Plugin and S…
- CVE-2024-6660BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Uploadreputeinfosystems Appointment Booking Calendar Plugin and S…
- CVE-2024-41010bpf: Fix too early release of tcx_entryLinux
- CVE-2024-41009bpf: Fix overrunning reservations in ringbufLinux
- CVE-2024-38447NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to
- CVE-2024-40119Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2024-40492Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function.
Medium, low and unrated 48
- CVE-2024-39682WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe ExcerptXjSv Cooked
- CVE-2024-39681WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All RecipesXjSv Cooked
- CVE-2024-39680WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template SaveXjSv Cooked
- CVE-2024-39679WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template ResetXjSv Cooked
- CVE-2024-39678WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDsXjSv Cooked
- CVE-2024-32981Cross-site Scripting vulnerability with encoded payload in silverstripe/frameworksilverstripe-framework · silverstripe/framework
- CVE-2024-29885Reports are still accessible even when `canView()` returns false in silverstripe/reportssilverstripe-reports · silverstripe/reports
- CVE-2024-28796IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting.IBM ClearQuest
- CVE-2024-40633Customer data leak via adjustments API endpoint in SyliusSylius · sylius/sylius
- CVE-2024-40636Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer AwarenessSteeltoeOSS security-advisories · Steeltoe.Discovery.Eur… +3
- CVE-2024-40640Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemacmatrix-org vodozemac · vodozemac
- CVE-2023-42010IBM Sterling B2B Integrator Standard Edition information disclosureIBM Sterling B2B Integrator Standard Edition
- CVE-2024-38870Stored XSSManageEngine OpManager, OpManager Plus, OpManager MSP, OpMa…
- CVE-2024-20396A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive infoCisco Webex Teams
- CVE-2024-20395A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to Cisco Webex Teams
- CVE-2024-20400A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirectCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2024-20429A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attackeCisco Secure Email
- CVE-2024-20416A vulnerability in the upload module of Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to Cisco Small Business RV Series Router Firmware
- CVE-2024-20296A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2024-6830SourceCodester Simple Inventory Management System Order action.php sql injectionSourceCodester Simple Inventory Management System
- CVE-2024-29120Apache StreamPark: Information leakage vulnerabilityApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2024-6833Zowe CLI Auto-Init Leaks Credentials LocallyOpen Mainframe Project Zowe · @zowe/cli
- CVE-2024-27311Arbitrary file writingManageEngine DDI Central
- CVE-2024-31411Apache StreamPipes: Potential remote code execution (RCE) via file uploadApache Software Foundation Apache StreamPipes · streampi… +1
- CVE-2024-30471Apache StreamPipes: Potential creation of multiple identical accountsApache Software Foundation Apache StreamPipes · streampi… +1
- CVE-2024-40617Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS).Fujitsu Limited FUJITSU Network Edgiot GW1500
- CVE-2024-5582Schema & Structured Data for WP & AMP <= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attributemagazine3 Schema & Structured Data for WP & AMP
- CVE-2024-5703Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorizationicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2024-5251Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeBrainstorm Force Ultimate Addons for WPBakery
- CVE-2024-6669AI ChatBot for WordPress – WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scriptingquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2024-5253Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeBrainstorm Force Ultimate Addons for WPBakery
- CVE-2024-5252Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeBrainstorm Force Ultimate Addons for WPBakery
- CVE-2024-5255Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeBrainstorm Force Ultimate Addons for WPBakery
- CVE-2024-5254Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeBrainstorm Force Ultimate Addons for WPBakery
- CVE-2024-6033Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Importarraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2024-6808itsourcecode Simple Task List signUp.php insertUserRecord sql injectionitsourcecode Simple Task List
- CVE-2024-6807SourceCodester Student Study Center Desk Management System HTTP POST Request Users.php cross site scriptingSourceCodester Student Study Center Desk Management System
- CVE-2024-6803itsourcecode Document Management System insert.php sql injectionitsourcecode Document Management System
- CVE-2024-6535Skupper: potential authentication bypass to skupper console via forged cookiesskupper · Red Hat Service Interconnect 1.4 for RHEL +3
- CVE-2024-6802SourceCodester Computer Laboratory Management System Master.php sql injectionSourceCodester Computer Laboratory Management System
- CVE-2024-6801SourceCodester Online Student Management System add-students.php unrestricted uploadSourceCodester Online Student Management System
- CVE-2024-6595Uncontrolled Search Path Element in GitLabGitLab
- CVE-2023-43971Cross Site Scripting vulnerability in ACG-faka v1.1.7 allows a remote attacker to execute arbitrary code via the encode parameter in Index.p
- CVE-2024-38446NATO NCI ANET 3.4.1 mishandles report ownership.
- CVE-2024-39124In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.roundup
- CVE-2024-39125Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.roundup
- CVE-2024-39126Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.roundup
- CVE-2024-40402A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0.