CVEs published July 19, 2024
50 CVEs were published on July 19, 2024: 2 critical, 19 high.
- Published
- 50
- Critical
- 2
- High
- 19
- Medium
- 28
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- SourceCodester Record Management System
- 10
- Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- 3
- YugabyteDB Anywhere
- 3
- ArtPlacer Widget
- 2
- HP Display Control
- 2
- woodpecker-ci woodpecker · go.woodpecker-ci.org/woodpeck… +1
- 2
- Apache Software Foundation Apache CloudStack
- 1
- ARPSyndicate puncia · puncia
- 1
- automad/automad
- 1
- Bug Library
- 1
Critical 2
High 19
- CVE-2024-41122Custom environment variables allow to alter execution flow of plugins in Woodpeckerwoodpecker-ci woodpecker · go.woodpecker-ci.org/woodpeck… +1
- CVE-2024-41121Custom workspace allow to overwrite plugin entrypoint executable in Woodpeckerwoodpecker-ci woodpecker · go.woodpecker-ci.org/woodpeck… +1
- CVE-2024-39906Remote code execution in Haven IndieAuthClient (GHSL-2024-093)havenweb haven
- CVE-2024-41107Apache CloudStack: SAML Signature ExclusionApache Software Foundation Apache CloudStack
- CVE-2024-32007Apache CXF Denial of Service vulnerability in JOSEApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2024-29736Apache CXF: SSRF vulnerability via WADL stylesheet parameterApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2024-40724Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a Open Asset Import Library Assimp
- CVE-2024-6338FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameterfoliovision FV Flowplayer Video Player
- CVE-2024-6205PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLiPayPlus Payment Gateway
- CVE-2023-7269ArtPlacer Widget < 2.21.2 - Stored XSS via CSRFArtPlacer Widget
- CVE-2024-21527Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberggithub.com/gotenberg/gotenberg/v8/pkg/gotenberg · github… +3
- CVE-2024-27489An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request.
- CVE-2024-39963AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered
- CVE-2024-40400An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a craftautomad/automad
- CVE-2024-41281Linksys WRT54G v4.21.5 has a stack overflow vulnerability in get_merge_mac function.
- CVE-2024-41492A stack overflow in Tenda AX1806 v1.0.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.
- CVE-2024-41600Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the
- CVE-2024-41601Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login meth
- CVE-2024-41602Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL
Medium, low and unrated 29
- CVE-2024-41124Puncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`ARPSyndicate puncia · puncia
- CVE-2024-29080Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software DrivHP Display Control
- CVE-2024-24970Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software DrivHP Display Control
- CVE-2024-6908Admin Can Escalate Privileges to SuperAdmin Using Manual PUT RequestYugabyteDB Anywhere
- CVE-2024-6895Insecure Account Profile ManagementYugabyteDB Anywhere
- CVE-2024-0006DB User Password Leak in Application LogYugabyteDB Anywhere
- CVE-2024-37066A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary coWyze Cam V4 Pro
- CVE-2024-5977GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actionsstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-6916Zowe CLI --show-inputs-only displays securely stored propertiesOpen Mainframe Project Zowe CLI - Imperative
- CVE-2024-6907SourceCodester Record Management System sort.php cross site scriptingSourceCodester Record Management System
- CVE-2024-6906SourceCodester Record Management System add_leave_non_user.php sql injectionSourceCodester Record Management System
- CVE-2024-6905SourceCodester Record Management System view_info_user.php sql injectionSourceCodester Record Management System
- CVE-2024-41172Apache CXF: Unrestricted memory consumption in CXF HTTP clientsApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2024-39457Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview.Cybozu Garoon
- CVE-2024-6904SourceCodester Record Management System sort2_user.php sql injectionSourceCodester Record Management System
- CVE-2024-6903SourceCodester Record Management System sort1_user.php sql injectionSourceCodester Record Management System
- CVE-2024-6799YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivationyithemes YITH Essential Kit for WooCommerce #1
- CVE-2024-6902SourceCodester Record Management System sort_user.php sql injectionSourceCodester Record Management System
- CVE-2024-6901SourceCodester Record Management System entry.php sql injectionSourceCodester Record Management System
- CVE-2024-6900SourceCodester Record Management System edit_emp.php sql injectionSourceCodester Record Management System
- CVE-2024-5604Bug Library < 2.1.2 - Admin+ Stored XSSBug Library
- CVE-2023-7268ArtPlacer Widget < 2.21.2 - Subscriber+ Arbitrary Widget DeletionArtPlacer Widget
- CVE-2024-6899SourceCodester Record Management System view_info.php sql injectionSourceCodester Record Management System
- CVE-2024-21583Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/ggithub.com/gitpod-io/gitpod/components/server/go/pkg/lib… +8
- CVE-2024-6898SourceCodester Record Management System index.php sql injectionSourceCodester Record Management System
- CVE-2024-30130HCL Nomad server on Domino is affected by a use of web browser cache containing sensitive information vulnerabilityHCL Software Nomad server on Domino
- CVE-2024-39123In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizcalibreweb
- CVE-2024-41597Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment.processwire/processwire
- CVE-2024-41599Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method