CVEs published July 18, 2024
49 CVEs were published on July 18, 2024: 12 critical, 12 high.
- Published
- 49
- Critical
- 12
- High
- 12
- Medium
- 24
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- PruvaSoft Informatics Apinizer Management Console
- 4
- 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- 2
- Apache Software Foundation Apache HTTP Server
- 2
- bdthemes Element Pack – Widgets, Templates & Addons for Ele…
- 2
- HCL Software BigFix Compliance
- 2
- jumpserver
- 2
- pytorch serve · torchserve
- 2
- Acronis True Image
- 1
- Apache Software Foundation Apache StreamPark · org.apache.s…
- 1
- benbodhi SVG Support
- 1
Critical 12
- CVE-2024-35198TorchServe bypass allowed_urls configurationpytorch serve · torchserve
- CVE-2024-0857SQLi in Universal Software's FlexWater Corporate Water ManagementUniversal Software FlexWater Corporate Water Management
- CVE-2024-40628Arbitrary File Read in Ansible Playbooks in Jumpserverjumpserver
- CVE-2024-40629Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserverjumpserver
- CVE-2024-5619IDOR in PruvaSoft Informatics' Apinizer Management ConsolePruvaSoft Informatics Apinizer Management Console
- CVE-2024-5618Broken Access Control in PruvaSoft Informatics' Apinizer Management ConsolePruvaSoft Informatics Apinizer Management Console
- CVE-2024-399111Panel SQL injection1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2024-39907a sqlinjection in 1Panel 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2024-40898Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on WindowsApache Software Foundation Apache HTTP Server
- CVE-2024-6164Filter & Grids < 2.8.33 - Unauthenticated LFIFilter & Grids
- CVE-2024-39173calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculato
- CVE-2024-41184In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur.
High 12
- CVE-2024-35199TorchServe gRPC Port Exposurepytorch serve · torchserve
- CVE-2024-40642Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…
- CVE-2024-41111BishopFox Sliver Authenticated Remote Code ExecutionBishopFox sliver · github.com/bishopfox/sliver
- CVE-2023-50304IBM Engineering Requirements Management DOORS XML external entity injectionIBM Engineering Requirements Management DOORS
- CVE-2024-34013Local privilege escalation due to OS command injection vulnerability.Acronis True Image
- CVE-2024-31143double unlock in x86 guest IRQ handlingXen
- CVE-2024-29178Apache StreamPark: FreeMarker SSTI RCE VulnerabilityApache Software Foundation Apache StreamPark · org.apache.s…
- CVE-2024-3242Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Uploadthemefusecom Brizy – Page Builder
- CVE-2024-40764Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS)SonicWall SonicOS
- CVE-2024-29014Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary cSonicWall NetExtender
- CVE-2024-41011drm/amdkfd: don't allow mapping the MMIO HDP page with large pagesLinux
- CVE-2024-5726Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injectionwpdiscover Timeline Event History
Medium, low and unrated 25
- CVE-2024-38156Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-5997Duplica <= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creationcodexpert Duplica – Duplicate Posts, Pages, Custom Posts or…
- CVE-2024-6455ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Functionroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2024-30126HCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerabilityHCL Software BigFix Compliance
- CVE-2024-38806UAA Failure to Remove Shadow User’s AccessUAA
- CVE-2024-5321Incorrect permissions on Windows containers logsKubernetes · k8s.io/kubernetes
- CVE-2024-30125HCL BigFix Compliance is affected by an internal server errorHCL Software BigFix Compliance
- CVE-2024-5625XML External Entity Injection in PruvaSoft Informatics' Apinizer Management ConsolePruvaSoft Informatics Apinizer Management Console
- CVE-2024-5620Authentication Bypass in PruvaSoft Informatics' Apinizer Management ConsolePruvaSoft Informatics Apinizer Management Console
- CVE-2024-40644gitoxide's gix-path can use a fake program files locationByron gitoxide · gix-path
- CVE-2024-40647Unintentional exposure of environment variables to subprocesses in sentry-sdkgetsentry sentry-python · sentry-sdk
- CVE-2024-40648`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdkmatrix-org matrix-rust-sdk · matrix-sdk-crypto
- CVE-2023-40704Philips Vue PACS Use of Default CredentialsPhilips Vue PACS
- CVE-2024-38302Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst).Dell Data Lakehouse
- CVE-2024-30473Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management.Dell ECS
- CVE-2024-40725Apache HTTP Server: source code disclosure with handlers configured via AddTypeApache Software Foundation Apache HTTP Server
- CVE-2024-6504Rapid7 InsightVM Protection Mechanism FailureRapid7 InsightVM
- CVE-2024-5555Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-5554Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scriptingbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2023-6708SVG Support <= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVGbenbodhi SVG Support
- CVE-2024-6599Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modificationmekshq Meks Video Importer
- CVE-2024-6705RegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingericmann RegLevel
- CVE-2024-5964Zenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodetislam100 Zenon Lite
- CVE-2024-6175Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updatesdeetronix Booking Ultra Pro Appointments Booking Calendar P…
- CVE-2024-39090The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to