CVEs published July 22, 2024
133 CVEs were published on July 22, 2024: 19 critical, 45 high.
- Published
- 133
- Critical
- 19
- High
- 45
- Medium
- 64
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- JetBrains TeamCity
- 6
- NI VeriStand
- 6
- Ankitects Anki · anki
- 3
- FishAudio Bert-VITS2
- 3
- PerkinElmer ProcessPlus
- 3
- Tenda O3
- 3
- NI SystemLink Server · NI FlexLogger
- 2
- Siemens CPCI85 Central Processing/Communication · Siemens S…
- 2
- SixLabors ImageSharp · SixLabors.ImageSharp
- 2
- SourceCodester Clinics Patient Management System
- 2
Critical 19
- CVE-2024-6806Missing Authorization Checks In NI VeriStand Gateway For Project ResourcesNI VeriStand
- CVE-2024-6913Execution with Unnecessary PrivilegesPerkinElmer ProcessPlus
- CVE-2024-6912Hardcoded MSSQL CredentialsPerkinElmer ProcessPlus
- CVE-2024-6794Deserialization of Untrusted Data in NI VeriStand Waveform Streaming ServerNI VeriStand
- CVE-2024-6793Deserialization of Untrusted Data in NI VeriStand DataLogging ServerNI VeriStand
- CVE-2024-39686fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py bert_gen functionFishAudio Bert-VITS2
- CVE-2024-39685fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py resample functionFishAudio Bert-VITS2
- CVE-2024-26020An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04.Ankitects Anki · anki
- CVE-2024-21552All versions of `SuperAGI` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function.SuperAGI
- CVE-2024-37998A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1Siemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2024-38773WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerabilityAdrian Tobey FormLift for Infusionsoft Web Forms
- CVE-2024-5973MasterStudy LMS < 3.3.24 - Privilege Escalation to InstructorMasterStudy LMS WordPress Plugin
- CVE-2024-28698Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted scripCsla
- CVE-2024-38944An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateFo
- CVE-2024-39250EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interf
- CVE-2024-40502SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the
- CVE-2024-41316TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_canc
- CVE-2024-41318TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_
- CVE-2024-41704LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.
High 45
- CVE-2024-6805Missing Authorization Checks in NI VeriStand Gateway for File Transfer ResourcesNI VeriStand
- CVE-2024-6911Unauthenticated Local File InclusionPerkinElmer ProcessPlus
- CVE-2024-6791Directory Path Traversal Vulnerability in NI VeriStand with vsmodel FilesNI VeriStand
- CVE-2024-6675Deserialization of Untrusted Data Vulnerability in NI VeriStand Project FileNI VeriStand
- CVE-2024-6121NI SystemLink Server Ships Out of Date Redis VersionNI SystemLink Server · NI FlexLogger
- CVE-2024-40634Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpointargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2024-41827In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expirationJetBrains TeamCity
- CVE-2024-41131Out-of-bounds Write in SixLabors ImageSharpSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2024-32484An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04.Ankitects Anki
- CVE-2024-25638DNSJava DNSSEC Bypassdnsjava · dnsjava:dnsjava
- CVE-2024-37942WordPress BerqWP plugin <= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerabilityBerqier BerqWP
- CVE-2024-38728WordPress Seraphinite Post .DOCX Source plugin <= 2.16.9 - Server Side Request Forgery (SSRF) vulnerabilitySeraphinite Solutions Seraphinite Post .DOCX Source
- CVE-2024-38692WordPress spiffy-calendar plugin <= 4.9.11 - SQL Injection vulnerabilitySpiffy Plugins Spiffy Calendar
- CVE-2024-38708WordPress Barcode Scanner and Inventory manager plugin <= 1.6.1 - SQL Injection vulnerabilityDmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…
- CVE-2024-38755WordPress DirectoryPress plugin <= 3.6.10 - SQL Injection vulnerabilityDesigninvento DirectoryPress
- CVE-2024-38788WordPress UiPress lite plugin <= 3.4.06 - SQL Injection vulnerabilityBởi Admin 2020 UiPress lite
- CVE-2024-35656WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerabilityElementor Pro
- CVE-2024-37097WordPress Shortcodes by United Themes plugin < 5.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityUnitedThemes Shortcodes by United Themes
- CVE-2024-37117WordPress Uncanny Automator Pro plugin <= 5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityUncanny Owl Uncanny Automator Pro
- CVE-2024-37199WordPress Enfold theme <= 5.6.9 - Reflected Cross Site Scripting (XSS) vulnerabilityKriesi.at Enfold
- CVE-2024-37206WordPress Demo Awesome plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityTheme4Press Demo Awesome
- CVE-2024-37211WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityAli2Woo Team Ali2Woo Lite
- CVE-2024-23321Apache RocketMQ: Unauthorized Exposure of Sensitive DataApache Software Foundation Apache RocketMQ · org.apache.roc…
- CVE-2024-37245WordPress All In One Redirection plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityVsourz Digital All In One Redirection
- CVE-2024-37257WordPress Permalink Manager Lite plugin <= 2.4.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMaciej Bis Permalink Manager Lite
- CVE-2024-37258WordPress Social Rocket plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySocial Rocket
- CVE-2024-37259WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityThe Ultimate WordPress Toolkit – WP Extended
- CVE-2024-37261WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Lab WP-Lister Lite for Amazon
- CVE-2024-37262WordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityvCita.com Online Booking & Scheduling Calendar for WordPres…
- CVE-2024-37264WordPress Groundhogg plugin <= 3.4.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityGroundhogg
- CVE-2024-37267WordPress Striking theme <= 2.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilitykaptinlin Striking
- CVE-2024-37275WordPress NextScripts plugin <= 4.4.7 - Cross Site Scripting (XSS) vulnerabilityNextScripts
- CVE-2024-37416WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerabilityJ.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
- CVE-2024-37433WordPress Mailster plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerabilityEverPress Mailster
- CVE-2024-37436WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityUncanny Owl Uncanny Toolkit Pro for LearnDash
- CVE-2024-6244pz-frontend-manager < 1.0.6 - CSRF change user profile picturePZ Frontend Manager
- CVE-2024-6965Tenda O3 fromVirtualSet stack-based overflowTenda O3
- CVE-2024-6964Tenda O3 fromDhcpSetSer stack-based overflowTenda O3
- CVE-2024-6963Tenda O3 formexeCommand stack-based overflowTenda O3
- CVE-2020-24102Directory Traversal vulnerability in Punkbuster pbsv.d64 2.351, allows remote attackers to execute arbitrary code.
- CVE-2024-34329Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated
- CVE-2024-37391ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\Proton\Drive')
- CVE-2024-40051IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter.
- CVE-2024-41317TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_e
- CVE-2024-41320TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get_apcli_
Medium, low and unrated 69
- CVE-2024-6638Integer Overflow Vulnerability Reading TDMS Files in LabVIEWNI LabVIEW
- CVE-2024-6122Incorrect Default Directory Permissions for NI SystemLink Redis ServiceNI SystemLink Server · NI FlexLogger
- CVE-2024-37380A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point.Ubiquiti UniFi U6+ Access Point
- CVE-2024-41130llama.cpp null pointer dereference in gguf_init_from_fileggerganov llama.cpp
- CVE-2024-39688fishaudio/Bert-VITS2 Limited File Write in webui_preprocess.py generate_config functionFishAudio Bert-VITS2
- CVE-2024-41829In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connectionJetBrains TeamCity
- CVE-2024-41828In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeJetBrains TeamCity
- CVE-2024-41826In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection pageJetBrains TeamCity
- CVE-2024-41825In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tabJetBrains TeamCity
- CVE-2024-41824In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific casesJetBrains TeamCity
- CVE-2024-41132SixLabors ImageSharp Allows Excessive Memory Allocation in Gif DecoderSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2024-29073An vulnerability in the handling of Latex exists in Ankitects Anki 24.04.Ankitects Anki · anki
- CVE-2024-32152A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04.Ankitects Anki · anki
- CVE-2024-41129The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI commandcanonical operator · ops
- CVE-2024-39902Tuleap's recursive permissions to document manager folder are not properly appliedEnalean tuleap
- CVE-2024-39601A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1Siemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2024-38759WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerabilityWP MEDIA SAS Search & Replace
- CVE-2024-38723WordPress Get Use APIs – JSON Content Importer plugin <= 1.5.6 - Server Side Request Forgery (SSRF) vulnerabilityBernhard Kux JSON Content Importer
- CVE-2024-38730WordPress Magical Addons For Elementor plugin <= 1.1.41 - Server Side Request Forgery (SSRF) vulnerabilityNoor alam Magical Addons For Elementor
- CVE-2024-38701WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerabilityAcademy LMS
- CVE-2024-33933WordPress Elementor Header & Footer Builder plugin <= 1.6.35 - Contributor+ DOM-Based Cross Site Scripting (XSS) vulnerabilityBrainstorm Force, Nikhil Chavan Elementor – Header, Footer…
- CVE-2024-37100WordPress Elegant Themes Icons plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityMayur Somani, threeroutes media Elegant Themes Icons
- CVE-2024-37101WordPress WP Post Author plugin <= 3.6.7 - Cross Site Scripting (XSS) vulnerabilityAF themes WP Post Author
- CVE-2024-6542Livestatus injection in mknotifydCheckmk
- CVE-2024-34457Apache StreamPark IDOR VulnerabilityApache Software Foundation Apache StreamPark
- CVE-2024-38503Apache Syncope: HTML tags can be injected into Console or Enduser text fieldsApache Software Foundation Apache Syncope · org.apache.s… +1
- CVE-2024-37114WordPress My Favorites plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityTakashi Matsuyama My Favorites
- CVE-2024-37116WordPress Sinatra theme <= 1.3 - Cross Site Scripting (XSS) vulnerabilitysinatrateam Sinatra
- CVE-2024-37120WordPress Tabs plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerabilityBiplob Adhikari Tabs
- CVE-2024-37121WordPress Shortcode Addons plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilitybiplob018 Shortcode Addons
- CVE-2024-37122WordPress Accordions plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerabilityBiplob Adhikari Accordions
- CVE-2024-37215WordPress Transition Slider – Responsive Image Slider and Gallery plugin <= 2.20.3 - Cross Site Scripting (XSS) vulnerabilitycreativeinteractivemedia Transition Slider – Responsive Ima…
- CVE-2024-37216WordPress Sketchfab Embed plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityRami Yushuvaev Sketchfab Embed
- CVE-2024-37217WordPress Empty Cart Button for WooCommerce plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerabilityProWCPlugins Empty Cart Button for WooCommerce
- CVE-2024-37219WordPress Page Builder Sandwich plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerabilityPBN Hosting SL Page Builder Sandwich – Front-End Page Build…
- CVE-2024-37221WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityMichael Bester Kimili Flash Embed
- CVE-2024-37223WordPress Restaurant Reservations plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityNicdark Restaurant Reservations
- CVE-2024-37229WordPress Blogmentor – Blog Layouts for Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityAuburnForest Blogmentor – Blog Layouts for Elementor
- CVE-2024-37239WordPress Branda plugin <= 3.4.17 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Branda
- CVE-2024-37244WordPress Ninja Beaver Add-ons for Beaver Builder plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerabilityNinja Team Ninja Beaver Add-ons for Beaver Builder
- CVE-2024-37246WordPress Gallery Slideshow plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityJethin Gallery Slideshow
- CVE-2024-37263WordPress Enter Addons – Ultimate Template Builder for Elementor plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityThemeLooks Enter Addons
- CVE-2024-37265WordPress IdeaPush plugin <= 8.60 - Cross Site Scripting (XSS) vulnerabilityMartin Gibson IdeaPush
- CVE-2024-37271WordPress Print My Blog plugin <= 3.27.0 - Cross Site Scripting (XSS) vulnerabilityMichael Nelson Print My Blog
- CVE-2024-37278WordPress Cards for Beaver Builder plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityPratik Chaskar Cards for Beaver Builder
- CVE-2024-37409WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.4 - Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations PowerPack Lite for Beaver Builder
- CVE-2024-37414WordPress Depicter Slider plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityAverta Depicter Slider
- CVE-2024-37422WordPress Progress Planner plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerabilityProgress Planner
- CVE-2024-37428WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityThemesgrove WidgetKit
- CVE-2024-37429WordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerabilityHamid Alinia Login with phone number
- CVE-2024-37432WordPress Esteem theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityThemeGrill Esteem
- CVE-2024-37434WordPress Atarim plugin <= 3.31 - Authenticated Cross Site Scripting (XSS) vulnerabilityVito Peleg Atarim
- CVE-2024-37445WordPress HTML5 Audio Player plugin <= 2.2.23 - Cross Site Scripting (XSS) vulnerabilitybPlugins Html5 Audio Player
- CVE-2024-6271Community Events < 1.5 - Event Deletion via CSRFCommunity Events
- CVE-2024-6243HTML Forms < 1.3.33 - Admin+ Stored XSSHTML Forms
- CVE-2024-5529WP QuickLaTeX < 3.8.8 - Admin+ Stored XSSWP QuickLaTeX
- CVE-2024-5004CM Popup Plugin for WordPress < 1.6.6 - Contributor+ Stored XSSCM Popup Plugin for WordPress
- CVE-2024-6970itsourcecode Tailoring Management System staffcatadd.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-6969SourceCodester Clinics Patient Management System get_patient_history.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2024-6968SourceCodester Clinics Patient Management System print_patients_visits.php sql injectionSourceCodester Clinics Patient Management System
- CVE-2024-6967SourceCodester Employee and Visitor Gate Pass Logging System sql injectionSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-6966itsourcecode Online Blood Bank Management System Login login.php sql injectionitsourcecode Online Blood Bank Management System
- CVE-2024-24507Cross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login.
- CVE-2024-40075Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
- CVE-2024-41314TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable
- CVE-2024-41315TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_e
- CVE-2024-41703LibreChat through 0.7.4-rc1 has incorrect access control for message updates.
- CVE-2024-41709Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places.backdrop/backdrop
- CVE-2024-41880In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and p