# CVEs published 2024-07-18

49 CVEs were published on July 18, 2024: 12 critical, 12 high. Days are UTC.

- [CVE-2024-38156](https://cve.now/CVE-2024-38156.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2024-35198](https://cve.now/CVE-2024-35198.md): TorchServe bypass allowed\_urls configuration (CVSS 9.8, pytorch serve · torchserve)
- [CVE-2024-35199](https://cve.now/CVE-2024-35199.md): TorchServe gRPC Port Exposure (CVSS 8.2, pytorch serve · torchserve)
- [CVE-2024-40642](https://cve.now/CVE-2024-40642.md): Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp (CVSS 8.1, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2024-41111](https://cve.now/CVE-2024-41111.md): BishopFox Sliver Authenticated Remote Code Execution (CVSS 7.2, BishopFox sliver · github.com/bishopfox/sliver)
- [CVE-2024-5997](https://cve.now/CVE-2024-5997.md): Duplica \<= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation (CVSS 4.3, codexpert Duplica – Duplicate Posts, Pages, Custom Posts or…)
- [CVE-2024-6455](https://cve.now/CVE-2024-6455.md): ElementsKit Elementor addons \<= 3.2.0 - Unauthenticated Information Exposure via ekit\_widgetarea\_content Function (CVSS 5.3, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2024-30126](https://cve.now/CVE-2024-30126.md): HCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerability (CVSS 4.7, HCL Software BigFix Compliance)
- [CVE-2024-38806](https://cve.now/CVE-2024-38806.md): UAA Failure to Remove Shadow User’s Access (CVSS 3.9, UAA)
- [CVE-2024-5321](https://cve.now/CVE-2024-5321.md): Incorrect permissions on Windows containers logs (CVSS 6.1, Kubernetes · k8s.io/kubernetes)
- [CVE-2024-30125](https://cve.now/CVE-2024-30125.md): HCL BigFix Compliance is affected by an internal server error (CVSS 6.2, HCL Software BigFix Compliance)
- [CVE-2024-0857](https://cve.now/CVE-2024-0857.md): SQLi in Universal Software's FlexWater Corporate Water Management (CVSS 9.8, Universal Software FlexWater Corporate Water Management)
- [CVE-2024-5625](https://cve.now/CVE-2024-5625.md): XML External Entity Injection in PruvaSoft Informatics' Apinizer Management Console (CVSS 6.5, PruvaSoft Informatics Apinizer Management Console)
- [CVE-2024-40628](https://cve.now/CVE-2024-40628.md): Arbitrary File Read in Ansible Playbooks in Jumpserver (CVSS 10.0, jumpserver)
- [CVE-2024-40629](https://cve.now/CVE-2024-40629.md): Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver (CVSS 10.0, jumpserver)
- [CVE-2024-5620](https://cve.now/CVE-2024-5620.md): Authentication Bypass in PruvaSoft Informatics' Apinizer Management Console (CVSS 6.5, PruvaSoft Informatics Apinizer Management Console)
- [CVE-2024-40644](https://cve.now/CVE-2024-40644.md): gitoxide's gix-path can use a fake program files location (CVSS 6.8, Byron gitoxide · gix-path)
- [CVE-2024-40647](https://cve.now/CVE-2024-40647.md): Unintentional exposure of environment variables to subprocesses in sentry-sdk (CVSS 5.3, getsentry sentry-python · sentry-sdk)
- [CVE-2024-5619](https://cve.now/CVE-2024-5619.md): IDOR in PruvaSoft Informatics' Apinizer Management Console (CVSS 9.6, PruvaSoft Informatics Apinizer Management Console)
- [CVE-2024-40648](https://cve.now/CVE-2024-40648.md): \`UserIdentity::is\_verified\` not checking verification status of own user identity while performing the check in matrix-rust-sdk (CVSS 5.4, matrix-org matrix-rust-sdk · matrix-sdk-crypto)
- [CVE-2023-40704](https://cve.now/CVE-2023-40704.md): Philips Vue PACS Use of Default Credentials (CVSS 6.8, Philips Vue PACS)
- [CVE-2024-5618](https://cve.now/CVE-2024-5618.md): Broken Access Control in PruvaSoft Informatics' Apinizer Management Console (CVSS 9.9, PruvaSoft Informatics Apinizer Management Console)
- [CVE-2023-50304](https://cve.now/CVE-2023-50304.md): IBM Engineering Requirements Management DOORS XML external entity injection (CVSS 7.1, IBM Engineering Requirements Management DOORS)
- [CVE-2024-38302](https://cve.now/CVE-2024-38302.md): Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). (CVSS 6.8, Dell Data Lakehouse)
- [CVE-2024-30473](https://cve.now/CVE-2024-30473.md): Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. (CVSS 4.9, Dell ECS)
- [CVE-2024-39911](https://cve.now/CVE-2024-39911.md): 1Panel SQL injection (CVSS 10.0, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2024-39907](https://cve.now/CVE-2024-39907.md): a sqlinjection in 1Panel (CVSS 9.8, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2024-34013](https://cve.now/CVE-2024-34013.md): Local privilege escalation due to OS command injection vulnerability. (CVSS 7.8, Acronis True Image)
- [CVE-2024-31143](https://cve.now/CVE-2024-31143.md): double unlock in x86 guest IRQ handling (CVSS 7.5, Xen)
- [CVE-2024-29178](https://cve.now/CVE-2024-29178.md): Apache StreamPark: FreeMarker SSTI RCE Vulnerability (CVSS 8.8, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2024-40725](https://cve.now/CVE-2024-40725.md): Apache HTTP Server: source code disclosure with handlers configured via AddType (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-40898](https://cve.now/CVE-2024-40898.md): Apache HTTP Server: SSRF with mod\_rewrite in server/vhost context on Windows (CVSS 9.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-6504](https://cve.now/CVE-2024-6504.md): Rapid7 InsightVM Protection Mechanism Failure (CVSS 4.3, Rapid7 InsightVM)
- [CVE-2024-5555](https://cve.now/CVE-2024-5555.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-3242](https://cve.now/CVE-2024-3242.md): Brizy – Page Builder \<= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, themefusecom Brizy – Page Builder)
- [CVE-2024-5554](https://cve.now/CVE-2024-5554.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-40764](https://cve.now/CVE-2024-40764.md): Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS) (CVSS 7.5, SonicWall SonicOS)
- [CVE-2024-29014](https://cve.now/CVE-2024-29014.md): Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary c (CVSS 7.1, SonicWall NetExtender)
- [CVE-2024-41011](https://cve.now/CVE-2024-41011.md): drm/amdkfd: don't allow mapping the MMIO HDP page with large pages (CVSS 7.8, Linux)
- [CVE-2024-6164](https://cve.now/CVE-2024-6164.md): Filter & Grids \< 2.8.33 - Unauthenticated LFI (CVSS 9.8, Filter & Grids)
- [CVE-2023-6708](https://cve.now/CVE-2023-6708.md): SVG Support \<= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG (CVSS 5.4, benbodhi SVG Support)
- [CVE-2024-6599](https://cve.now/CVE-2024-6599.md): Meks Video Importer \<= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification (CVSS 4.3, mekshq Meks Video Importer)
- [CVE-2024-6705](https://cve.now/CVE-2024-6705.md): RegLevel \<= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, ericmann RegLevel)
- [CVE-2024-5964](https://cve.now/CVE-2024-5964.md): Zenon Lite \<= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (CVSS 6.4, tislam100 Zenon Lite)
- [CVE-2024-5726](https://cve.now/CVE-2024-5726.md): Timeline Event History \<= 3.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, wpdiscover Timeline Event History)
- [CVE-2024-6175](https://cve.now/CVE-2024-6175.md): Booking Ultra Pro \<= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates (CVSS 5.4, deetronix Booking Ultra Pro Appointments Booking Calendar P…)
- [CVE-2024-39090](https://cve.now/CVE-2024-39090.md): The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to (CVSS 6.1)
- [CVE-2024-39173](https://cve.now/CVE-2024-39173.md): calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculato (CVSS 9.8)
- [CVE-2024-41184](https://cve.now/CVE-2024-41184.md): In the vrrp\_ipsets\_handler handler (fglobal\_parser.c) of keepalived through 2.3.1, an integer overflow can occur. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.