# CVEs published 2024-07-17

86 CVEs were published on July 17, 2024: 15 critical, 23 high. Days are UTC.

- [CVE-2024-39682](https://cve.now/CVE-2024-39682.md): WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt (CVSS 6.4, XjSv Cooked)
- [CVE-2024-39681](https://cve.now/CVE-2024-39681.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes (CVSS 5.4, XjSv Cooked)
- [CVE-2024-39680](https://cve.now/CVE-2024-39680.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save (CVSS 5.4, XjSv Cooked)
- [CVE-2024-39679](https://cve.now/CVE-2024-39679.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template Reset (CVSS 4.3, XjSv Cooked)
- [CVE-2024-39678](https://cve.now/CVE-2024-39678.md): WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs (CVSS 4.3, XjSv Cooked)
- [CVE-2024-32981](https://cve.now/CVE-2024-32981.md): Cross-site Scripting vulnerability with encoded payload in silverstripe/framework (CVSS 5.4, silverstripe-framework · silverstripe/framework)
- [CVE-2024-29885](https://cve.now/CVE-2024-29885.md): Reports are still accessible even when \`canView()\` returns false in silverstripe/reports (CVSS 4.3, silverstripe-reports · silverstripe/reports)
- [CVE-2024-28796](https://cve.now/CVE-2024-28796.md): IBM ClearQuest (CQ) 9.1 through 9.1.0.6 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM ClearQuest)
- [CVE-2024-40633](https://cve.now/CVE-2024-40633.md): Customer data leak via adjustments API endpoint in Sylius (CVSS 5.3, Sylius · sylius/sylius)
- [CVE-2024-40636](https://cve.now/CVE-2024-40636.md): Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness (CVSS 5.3, SteeltoeOSS security-advisories · Steeltoe.Discovery.Eur… +3)
- [CVE-2024-40641](https://cve.now/CVE-2024-40641.md): Unsigned code template execution through workflows in projectdiscovery/nuclei (CVSS 7.4, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2024-40640](https://cve.now/CVE-2024-40640.md): Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac (CVSS 2.9, matrix-org vodozemac · vodozemac)
- [CVE-2023-42010](https://cve.now/CVE-2023-42010.md): IBM Sterling B2B Integrator Standard Edition information disclosure (CVSS 3.1, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2024-38870](https://cve.now/CVE-2024-38870.md): Stored XSS (CVSS 3.5, ManageEngine OpManager, OpManager Plus, OpManager MSP, OpMa…)
- [CVE-2024-20396](https://cve.now/CVE-2024-20396.md): A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive info (CVSS 5.3, Cisco Webex Teams)
- [CVE-2024-20395](https://cve.now/CVE-2024-20395.md): A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to (CVSS 6.4, Cisco Webex Teams)
- [CVE-2024-20400](https://cve.now/CVE-2024-20400.md): A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect (CVSS 4.7, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2024-20429](https://cve.now/CVE-2024-20429.md): A vulnerability in the web-based management interface of Cisco AsyncOS for Secure Email Gateway could allow an authenticated, remote attacke (CVSS 6.5, Cisco Secure Email)
- [CVE-2024-20416](https://cve.now/CVE-2024-20416.md): A vulnerability in the upload module of Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20323](https://cve.now/CVE-2024-20323.md): A vulnerability in Cisco Intelligent Node (iNode) Software could allow an unauthenticated, remote attacker to hijack the TLS connection betw (CVSS 7.5, Cisco Intelligent Node Manager · Cisco Intelligent Node Sof…)
- [CVE-2024-20296](https://cve.now/CVE-2024-20296.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker (CVSS 4.7, Cisco Identity Services Engine Software)
- [CVE-2024-20435](https://cve.now/CVE-2024-20435.md): A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary comma (CVSS 8.8, Cisco Secure Web Appliance)
- [CVE-2024-20419](https://cve.now/CVE-2024-20419.md): A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote at (CVSS 10.0, Cisco Smart Software Manager On-Prem)
- [CVE-2024-20401](https://cve.now/CVE-2024-20401.md): A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote (CVSS 9.8, Cisco Secure Email)
- [CVE-2024-6830](https://cve.now/CVE-2024-6830.md): SourceCodester Simple Inventory Management System Order action.php sql injection (CVSS 5.3, SourceCodester Simple Inventory Management System)
- [CVE-2023-4976](https://cve.now/CVE-2023-4976.md): FlashBlade Authentication Mechanism Vulnerability (CVSS 9.3, PureStorage FlashBlade)
- [CVE-2023-7272](https://cve.now/CVE-2023-7272.md): Eclipse Parsson stack overflow with deeply nested objects (CVSS 8.6, Eclipse Foundation Parsson · org.eclipse.parsson:parsson)
- [CVE-2024-29120](https://cve.now/CVE-2024-29120.md): Apache StreamPark: Information leakage vulnerability (CVSS 5.9, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2024-6834](https://cve.now/CVE-2024-6834.md): Imperative Local Command Injection allows Activity Masking (CVSS 9.0, Open Mainframe Project Zowe)
- [CVE-2024-6833](https://cve.now/CVE-2024-6833.md): Zowe CLI Auto-Init Leaks Credentials Locally (CVSS 5.9, Open Mainframe Project Zowe · @zowe/cli)
- [CVE-2024-23471](https://cve.now/CVE-2024-23471.md): SolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23470](https://cve.now/CVE-2024-23470.md): SolarWinds Access Rights Manager (ARM) UserScriptHumster Exposed Dangerous Method Remote Command Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-28074](https://cve.now/CVE-2024-28074.md): SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23467](https://cve.now/CVE-2024-23467.md): SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23466](https://cve.now/CVE-2024-23466.md): SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23465](https://cve.now/CVE-2024-23465.md): SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability (CVSS 8.3, SolarWinds Access Rights Manager)
- [CVE-2024-23469](https://cve.now/CVE-2024-23469.md): SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23475](https://cve.now/CVE-2024-23475.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23472](https://cve.now/CVE-2024-23472.md): SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-28993](https://cve.now/CVE-2024-28993.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-28992](https://cve.now/CVE-2024-28992.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-23468](https://cve.now/CVE-2024-23468.md): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-23474](https://cve.now/CVE-2024-23474.md): SolarWinds Access Rights Manager (ARM) deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability (CVSS 7.6, SolarWinds Access Rights Manager)
- [CVE-2024-5471](https://cve.now/CVE-2024-5471.md): Agent takeover (CVSS 8.8, ManageEngine DDI Central)
- [CVE-2024-27311](https://cve.now/CVE-2024-27311.md): Arbitrary file writing (CVSS 5.5, ManageEngine DDI Central)
- [CVE-2024-31411](https://cve.now/CVE-2024-31411.md): Apache StreamPipes: Potential remote code execution (RCE) via file upload (CVSS 6.0, Apache Software Foundation Apache StreamPipes · streampi… +1)
- [CVE-2024-31979](https://cve.now/CVE-2024-31979.md): Apache StreamPipes: Possibility of SSRF in pipeline element installation process (CVSS 7.5, Apache Software Foundation Apache StreamPipes · streampi… +1)
- [CVE-2024-30471](https://cve.now/CVE-2024-30471.md): Apache StreamPipes: Potential creation of multiple identical accounts (CVSS 5.3, Apache Software Foundation Apache StreamPipes · streampi… +1)
- [CVE-2024-36491](https://cve.now/CVE-2024-36491.md): FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. (CVSS 9.8, Century Systems Co. FutureNet NXR-1300 series · Century… +20)
- [CVE-2024-36475](https://cve.now/CVE-2024-36475.md): FutureNet NXR series, VXR series and WXR series provided by Century Systems Co., Ltd. (CVSS 7.2, Century Systems Co. FutureNet NXR-1300 series · Century… +20)
- [CVE-2024-31070](https://cve.now/CVE-2024-31070.md): Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR series and WXR series provided by Century S (CVSS 9.1, Century Systems Co. FutureNet NXR-1300 series · Century… +20)
- [CVE-2024-40617](https://cve.now/CVE-2024-40617.md): Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). (CVSS 6.5, Fujitsu Limited FUJITSU Network Edgiot GW1500)
- [CVE-2024-29737](https://cve.now/CVE-2024-29737.md): Apache StreamPark (incubating): maven build params could trigger remote command execution (CVSS 8.8, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2023-52291](https://cve.now/CVE-2023-52291.md): Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution (CVSS 8.8, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2024-39877](https://cve.now/CVE-2024-39877.md): Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler (CVSS 8.8, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-39863](https://cve.now/CVE-2024-39863.md): Apache Airflow: Potential XSS Vulnerability (CVSS 8.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-5582](https://cve.now/CVE-2024-5582.md): Schema & Structured Data for WP & AMP \<= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute (CVSS 6.4, magazine3 Schema & Structured Data for WP & AMP)
- [CVE-2024-6220](https://cve.now/CVE-2024-6220.md): 简数采集器 (Keydatas) \<= 2.5.2 - Unauthenticated Arbitrary File Upload (CVSS 9.8, zhengdon 简数采集器)
- [CVE-2024-5703](https://cve.now/CVE-2024-5703.md): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \<= 5.7.26 - Missing Authorization (CVSS 4.3, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-5251](https://cve.now/CVE-2024-5251.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-6467](https://cve.now/CVE-2024-6467.md): BookingPress Appointment Booking \<= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation (CVSS 8.8, reputeinfosystems Appointment Booking Calendar Plugin and S…)
- [CVE-2024-6669](https://cve.now/CVE-2024-6669.md): AI ChatBot for WordPress – WPBot \<= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2024-5253](https://cve.now/CVE-2024-5253.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-6660](https://cve.now/CVE-2024-6660.md): BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin \<= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload (CVSS 8.8, reputeinfosystems Appointment Booking Calendar Plugin and S…)
- [CVE-2024-5252](https://cve.now/CVE-2024-5252.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-5255](https://cve.now/CVE-2024-5255.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-5254](https://cve.now/CVE-2024-5254.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Brainstorm Force Ultimate Addons for WPBakery)
- [CVE-2024-6033](https://cve.now/CVE-2024-6033.md): Event Manager, Events Calendar, Tickets, Registrations – Eventin \<= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import (CVSS 4.3, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2024-41010](https://cve.now/CVE-2024-41010.md): bpf: Fix too early release of tcx\_entry (CVSS 7.8, Linux)
- [CVE-2024-41009](https://cve.now/CVE-2024-41009.md): bpf: Fix overrunning reservations in ringbuf (CVSS 7.8, Linux)
- [CVE-2024-6808](https://cve.now/CVE-2024-6808.md): itsourcecode Simple Task List signUp.php insertUserRecord sql injection (CVSS 6.9, itsourcecode Simple Task List)
- [CVE-2024-6807](https://cve.now/CVE-2024-6807.md): SourceCodester Student Study Center Desk Management System HTTP POST Request Users.php cross site scripting (CVSS 4.8, SourceCodester Student Study Center Desk Management System)
- [CVE-2024-6803](https://cve.now/CVE-2024-6803.md): itsourcecode Document Management System insert.php sql injection (CVSS 5.3, itsourcecode Document Management System)
- [CVE-2024-6535](https://cve.now/CVE-2024-6535.md): Skupper: potential authentication bypass to skupper console via forged cookies (CVSS 5.3, skupper · Red Hat Service Interconnect 1.4 for RHEL +3)
- [CVE-2024-6802](https://cve.now/CVE-2024-6802.md): SourceCodester Computer Laboratory Management System Master.php sql injection (CVSS 5.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-6801](https://cve.now/CVE-2024-6801.md): SourceCodester Online Student Management System add-students.php unrestricted upload (CVSS 5.3, SourceCodester Online Student Management System)
- [CVE-2024-6595](https://cve.now/CVE-2024-6595.md): Uncontrolled Search Path Element in GitLab (CVSS 3.0, GitLab)
- [CVE-2023-43971](https://cve.now/CVE-2023-43971.md): Cross Site Scripting vulnerability in ACG-faka v1.1.7 allows a remote attacker to execute arbitrary code via the encode parameter in Index.p (CVSS 6.1)
- [CVE-2024-38446](https://cve.now/CVE-2024-38446.md): NATO NCI ANET 3.4.1 mishandles report ownership. (CVSS 6.5)
- [CVE-2024-38447](https://cve.now/CVE-2024-38447.md): NATO NCI ANET 3.4.1 allows Insecure Direct Object Reference via a modified ID field in a request for a private draft report (that belongs to (CVSS 8.1)
- [CVE-2024-39124](https://cve.now/CVE-2024-39124.md): In Roundup before 2.4.0, classhelpers (\_generic.help.html) allow XSS. (CVSS 6.1, roundup)
- [CVE-2024-39125](https://cve.now/CVE-2024-39125.md): Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header. (CVSS 5.4, roundup)
- [CVE-2024-39126](https://cve.now/CVE-2024-39126.md): Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents. (CVSS 5.4, roundup)
- [CVE-2024-40119](https://cve.now/CVE-2024-40119.md): Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- [CVE-2024-40402](https://cve.now/CVE-2024-40402.md): A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. (CVSS 6.3)
- [CVE-2024-40492](https://cve.now/CVE-2024-40492.md): Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function. (CVSS 7.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.