# CVEs published 2024-07-19

50 CVEs were published on July 19, 2024: 2 critical, 19 high. Days are UTC.

- [CVE-2024-41122](https://cve.now/CVE-2024-41122.md): Custom environment variables allow to alter execution flow of plugins in Woodpecker (CVSS 7.5, woodpecker-ci woodpecker · go.woodpecker-ci.org/woodpeck… +1)
- [CVE-2024-41121](https://cve.now/CVE-2024-41121.md): Custom workspace allow to overwrite plugin entrypoint executable in Woodpecker (CVSS 8.8, woodpecker-ci woodpecker · go.woodpecker-ci.org/woodpeck… +1)
- [CVE-2024-39906](https://cve.now/CVE-2024-39906.md): Remote code execution in Haven IndieAuthClient (GHSL-2024-093) (CVSS 8.4, havenweb haven)
- [CVE-2024-41124](https://cve.now/CVE-2024-41124.md): Puncia Cleartext Transmission of Sensitive Information via HTTP urls in \`API\_URLS\` (CVSS 6.3, ARPSyndicate puncia · puncia)
- [CVE-2024-29080](https://cve.now/CVE-2024-29080.md): Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driv (CVSS 6.5, HP Display Control)
- [CVE-2024-24970](https://cve.now/CVE-2024-24970.md): Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driv (CVSS 6.5, HP Display Control)
- [CVE-2024-6908](https://cve.now/CVE-2024-6908.md): Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request (CVSS 6.0, YugabyteDB Anywhere)
- [CVE-2024-6895](https://cve.now/CVE-2024-6895.md): Insecure Account Profile Management (CVSS 6.1, YugabyteDB Anywhere)
- [CVE-2024-0006](https://cve.now/CVE-2024-0006.md): DB User Password Leak in Application Log (CVSS 5.4, YugabyteDB Anywhere)
- [CVE-2024-37066](https://cve.now/CVE-2024-37066.md): A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary co (CVSS 6.8, Wyze Cam V4 Pro)
- [CVE-2024-5977](https://cve.now/CVE-2024-5977.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions (CVSS 5.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-6916](https://cve.now/CVE-2024-6916.md): Zowe CLI --show-inputs-only displays securely stored properties (CVSS 5.9, Open Mainframe Project Zowe CLI - Imperative)
- [CVE-2024-41107](https://cve.now/CVE-2024-41107.md): Apache CloudStack: SAML Signature Exclusion (CVSS 8.1, Apache Software Foundation Apache CloudStack)
- [CVE-2024-6907](https://cve.now/CVE-2024-6907.md): SourceCodester Record Management System sort.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6906](https://cve.now/CVE-2024-6906.md): SourceCodester Record Management System add\_leave\_non\_user.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6905](https://cve.now/CVE-2024-6905.md): SourceCodester Record Management System view\_info\_user.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-41172](https://cve.now/CVE-2024-41172.md): Apache CXF: Unrestricted memory consumption in CXF HTTP clients (CVSS 5.3, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2024-32007](https://cve.now/CVE-2024-32007.md): Apache CXF Denial of Service vulnerability in JOSE (CVSS 7.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2024-29736](https://cve.now/CVE-2024-29736.md): Apache CXF: SSRF vulnerability via WADL stylesheet parameter (CVSS 7.5, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2024-39457](https://cve.now/CVE-2024-39457.md): Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. (CVSS 5.4, Cybozu Garoon)
- [CVE-2024-6904](https://cve.now/CVE-2024-6904.md): SourceCodester Record Management System sort2\_user.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6903](https://cve.now/CVE-2024-6903.md): SourceCodester Record Management System sort1\_user.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-40724](https://cve.now/CVE-2024-40724.md): Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a (CVSS 8.4, Open Asset Import Library Assimp)
- [CVE-2024-6338](https://cve.now/CVE-2024-6338.md): FV Player \<= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter (CVSS 8.8, foliovision FV Flowplayer Video Player)
- [CVE-2024-6799](https://cve.now/CVE-2024-6799.md): YITH Essential Kit for WooCommerce #1 \<= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation (CVSS 4.3, yithemes YITH Essential Kit for WooCommerce #1)
- [CVE-2024-6902](https://cve.now/CVE-2024-6902.md): SourceCodester Record Management System sort\_user.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6901](https://cve.now/CVE-2024-6901.md): SourceCodester Record Management System entry.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6900](https://cve.now/CVE-2024-6900.md): SourceCodester Record Management System edit\_emp.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-6205](https://cve.now/CVE-2024-6205.md): PayPlus Payment Gateway \< 6.6.9 - Unauthenticated SQLi (CVSS 7.6, PayPlus Payment Gateway)
- [CVE-2024-5604](https://cve.now/CVE-2024-5604.md): Bug Library \< 2.1.2 - Admin+ Stored XSS (CVSS 5.9, Bug Library)
- [CVE-2023-7269](https://cve.now/CVE-2023-7269.md): ArtPlacer Widget \< 2.21.2 - Stored XSS via CSRF (CVSS 7.5, ArtPlacer Widget)
- [CVE-2023-7268](https://cve.now/CVE-2023-7268.md): ArtPlacer Widget \< 2.21.2 - Subscriber+ Arbitrary Widget Deletion (CVSS 6.5, ArtPlacer Widget)
- [CVE-2024-6899](https://cve.now/CVE-2024-6899.md): SourceCodester Record Management System view\_info.php sql injection (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-21527](https://cve.now/CVE-2024-21527.md): Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg (CVSS 8.8, github.com/gotenberg/gotenberg/v8/pkg/gotenberg · github… +3)
- [CVE-2024-21583](https://cve.now/CVE-2024-21583.md): Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/g (CVSS 4.1, github.com/gitpod-io/gitpod/components/server/go/pkg/lib… +8)
- [CVE-2024-6898](https://cve.now/CVE-2024-6898.md): SourceCodester Record Management System index.php sql injection (CVSS 6.9, SourceCodester Record Management System)
- [CVE-2024-30130](https://cve.now/CVE-2024-30130.md): HCL Nomad server on Domino is affected by a use of web browser cache containing sensitive information vulnerability (CVSS 3.7, HCL Software Nomad server on Domino)
- [CVE-2024-27489](https://cve.now/CVE-2024-27489.md): An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request. (CVSS 7.5)
- [CVE-2024-39123](https://cve.now/CVE-2024-39123.md): In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit\_book\_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitiz (CVSS 5.4, calibreweb)
- [CVE-2024-39962](https://cve.now/CVE-2024-39962.md): D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21\_D240126 was discovered to contain a remote code execution (RCE) vulnerability i (CVSS 9.8)
- [CVE-2024-39963](https://cve.now/CVE-2024-39963.md): AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX9 V22.03.01.46 and AX3000 Dual-Band Gigabit Wi-Fi 6 Router AX12 V1.0 V22.03.01.46 were discovered (CVSS 8.0)
- [CVE-2024-40400](https://cve.now/CVE-2024-40400.md): An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a craft (CVSS 8.8, automad/automad)
- [CVE-2024-41281](https://cve.now/CVE-2024-41281.md): Linksys WRT54G v4.21.5 has a stack overflow vulnerability in get\_merge\_mac function. (CVSS 8.8)
- [CVE-2024-41492](https://cve.now/CVE-2024-41492.md): A stack overflow in Tenda AX1806 v1.0.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVSS 7.5)
- [CVE-2024-41597](https://cve.now/CVE-2024-41597.md): Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment. (CVSS 4.2, processwire/processwire)
- [CVE-2024-41599](https://cve.now/CVE-2024-41599.md): Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method (CVSS 6.1)
- [CVE-2024-41600](https://cve.now/CVE-2024-41600.md): Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the (CVSS 7.5)
- [CVE-2024-41601](https://cve.now/CVE-2024-41601.md): Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login meth (CVSS 7.5)
- [CVE-2024-41602](https://cve.now/CVE-2024-41602.md): Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL (CVSS 8.8)
- [CVE-2024-41603](https://cve.now/CVE-2024-41603.md): Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout. (CVSS 9.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.