# CVEs published 2024-07-22

133 CVEs were published on July 22, 2024: 19 critical, 45 high. Days are UTC.

- [CVE-2024-6806](https://cve.now/CVE-2024-6806.md): Missing Authorization Checks In NI VeriStand Gateway For Project Resources (CVSS 9.8, NI VeriStand)
- [CVE-2024-6805](https://cve.now/CVE-2024-6805.md): Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources (CVSS 7.5, NI VeriStand)
- [CVE-2024-6913](https://cve.now/CVE-2024-6913.md): Execution with Unnecessary Privileges (CVSS 9.3, PerkinElmer ProcessPlus)
- [CVE-2024-6912](https://cve.now/CVE-2024-6912.md): Hardcoded MSSQL Credentials (CVSS 9.3, PerkinElmer ProcessPlus)
- [CVE-2024-6794](https://cve.now/CVE-2024-6794.md): Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server (CVSS 9.8, NI VeriStand)
- [CVE-2024-6793](https://cve.now/CVE-2024-6793.md): Deserialization of Untrusted Data in NI VeriStand DataLogging Server (CVSS 9.8, NI VeriStand)
- [CVE-2024-6911](https://cve.now/CVE-2024-6911.md): Unauthenticated Local File Inclusion (CVSS 8.7, PerkinElmer ProcessPlus)
- [CVE-2024-6791](https://cve.now/CVE-2024-6791.md): Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files (CVSS 7.8, NI VeriStand)
- [CVE-2024-6675](https://cve.now/CVE-2024-6675.md): Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File (CVSS 7.8, NI VeriStand)
- [CVE-2024-6638](https://cve.now/CVE-2024-6638.md): Integer Overflow Vulnerability Reading TDMS Files in LabVIEW (CVSS 5.5, NI LabVIEW)
- [CVE-2024-6121](https://cve.now/CVE-2024-6121.md): NI SystemLink Server Ships Out of Date Redis Version (CVSS 7.8, NI SystemLink Server · NI FlexLogger)
- [CVE-2024-6122](https://cve.now/CVE-2024-6122.md): Incorrect Default Directory Permissions for NI SystemLink Redis Service (CVSS 5.5, NI SystemLink Server · NI FlexLogger)
- [CVE-2024-37380](https://cve.now/CVE-2024-37380.md): A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point. (CVSS 5.3, Ubiquiti UniFi U6+ Access Point)
- [CVE-2024-41130](https://cve.now/CVE-2024-41130.md): llama.cpp null pointer dereference in gguf\_init\_from\_file (CVSS 5.4, ggerganov llama.cpp)
- [CVE-2024-40634](https://cve.now/CVE-2024-40634.md): Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint (CVSS 7.5, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-39688](https://cve.now/CVE-2024-39688.md): fishaudio/Bert-VITS2 Limited File Write in webui\_preprocess.py generate\_config function (CVSS 6.5, FishAudio Bert-VITS2)
- [CVE-2024-39686](https://cve.now/CVE-2024-39686.md): fishaudio/Bert-VITS2 Command Injection in webui\_preprocess.py bert\_gen function (CVSS 9.8, FishAudio Bert-VITS2)
- [CVE-2024-39685](https://cve.now/CVE-2024-39685.md): fishaudio/Bert-VITS2 Command Injection in webui\_preprocess.py resample function (CVSS 9.8, FishAudio Bert-VITS2)
- [CVE-2024-41829](https://cve.now/CVE-2024-41829.md): In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection (CVSS 3.5, JetBrains TeamCity)
- [CVE-2024-41828](https://cve.now/CVE-2024-41828.md): In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time (CVSS 2.6, JetBrains TeamCity)
- [CVE-2024-41827](https://cve.now/CVE-2024-41827.md): In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration (CVSS 7.4, JetBrains TeamCity)
- [CVE-2024-41826](https://cve.now/CVE-2024-41826.md): In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page (CVSS 3.5, JetBrains TeamCity)
- [CVE-2024-41825](https://cve.now/CVE-2024-41825.md): In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab (CVSS 4.6, JetBrains TeamCity)
- [CVE-2024-41824](https://cve.now/CVE-2024-41824.md): In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases (CVSS 6.4, JetBrains TeamCity)
- [CVE-2024-41132](https://cve.now/CVE-2024-41132.md): SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder (CVSS 5.3, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-41131](https://cve.now/CVE-2024-41131.md): Out-of-bounds Write in SixLabors ImageSharp (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-29073](https://cve.now/CVE-2024-29073.md): An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. (CVSS 5.3, Ankitects Anki · anki)
- [CVE-2024-26020](https://cve.now/CVE-2024-26020.md): An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. (CVSS 9.6, Ankitects Anki · anki)
- [CVE-2024-32152](https://cve.now/CVE-2024-32152.md): A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. (CVSS 3.1, Ankitects Anki · anki)
- [CVE-2024-32484](https://cve.now/CVE-2024-32484.md): An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. (CVSS 7.4, Ankitects Anki)
- [CVE-2024-41129](https://cve.now/CVE-2024-41129.md): The ops library leaks secrets if \`subprocess.CalledProcessError\` happens with a \`secret-\*\` CLI command (CVSS 4.4, canonical operator · ops)
- [CVE-2024-21552](https://cve.now/CVE-2024-21552.md): All versions of \`SuperAGI\` are vulnerable to Arbitrary Code Execution due to unsafe use of the ‘eval’ function. (CVSS 9.8, SuperAGI)
- [CVE-2024-39902](https://cve.now/CVE-2024-39902.md): Tuleap's recursive permissions to document manager folder are not properly applied (CVSS 4.8, Enalean tuleap)
- [CVE-2024-25638](https://cve.now/CVE-2024-25638.md): DNSJava DNSSEC Bypass (CVSS 8.9, dnsjava · dnsjava:dnsjava)
- [CVE-2024-39601](https://cve.now/CVE-2024-39601.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V5.40), SICORE Base system (All versions \< V1 (CVSS 6.5, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2024-37998](https://cve.now/CVE-2024-37998.md): A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \< V5.40), SICORE Base system (All versions \< V1 (CVSS 9.8, Siemens CPCI85 Central Processing/Communication · Siemens S…)
- [CVE-2024-38759](https://cve.now/CVE-2024-38759.md): WordPress Search & Replace plugin \<= 3.2.2 - Deserialization of untrusted data vulnerability (CVSS 5.4, WP MEDIA SAS Search & Replace)
- [CVE-2024-37942](https://cve.now/CVE-2024-37942.md): WordPress BerqWP plugin \<= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, Berqier BerqWP)
- [CVE-2024-38723](https://cve.now/CVE-2024-38723.md): WordPress Get Use APIs – JSON Content Importer plugin \<= 1.5.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Bernhard Kux JSON Content Importer)
- [CVE-2024-38728](https://cve.now/CVE-2024-38728.md): WordPress Seraphinite Post .DOCX Source plugin \<= 2.16.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.1, Seraphinite Solutions Seraphinite Post .DOCX Source)
- [CVE-2024-38730](https://cve.now/CVE-2024-38730.md): WordPress Magical Addons For Elementor plugin \<= 1.1.41 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Noor alam Magical Addons For Elementor)
- [CVE-2024-38701](https://cve.now/CVE-2024-38701.md): WordPress Academy LMS plugin \<= 2.0.4 - Broken Access Control vulnerability (CVSS 4.3, Academy LMS)
- [CVE-2024-38692](https://cve.now/CVE-2024-38692.md): WordPress spiffy-calendar plugin \<= 4.9.11 - SQL Injection vulnerability (CVSS 7.6, Spiffy Plugins Spiffy Calendar)
- [CVE-2024-38708](https://cve.now/CVE-2024-38708.md): WordPress Barcode Scanner and Inventory manager plugin \<= 1.6.1 - SQL Injection vulnerability (CVSS 8.5, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2024-38755](https://cve.now/CVE-2024-38755.md): WordPress DirectoryPress plugin \<= 3.6.10 - SQL Injection vulnerability (CVSS 8.5, Designinvento DirectoryPress)
- [CVE-2024-38773](https://cve.now/CVE-2024-38773.md): WordPress formlift plugin \<= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability (CVSS 9.3, Adrian Tobey FormLift for Infusionsoft Web Forms)
- [CVE-2024-38788](https://cve.now/CVE-2024-38788.md): WordPress UiPress lite plugin \<= 3.4.06 - SQL Injection vulnerability (CVSS 7.6, Bởi Admin 2020 UiPress lite)
- [CVE-2024-33933](https://cve.now/CVE-2024-33933.md): WordPress Elementor Header & Footer Builder plugin \<= 1.6.35 - Contributor+ DOM-Based Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force, Nikhil Chavan Elementor – Header, Footer…)
- [CVE-2024-35656](https://cve.now/CVE-2024-35656.md): WordPress Elementor Pro \<= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Elementor Pro)
- [CVE-2024-37097](https://cve.now/CVE-2024-37097.md): WordPress Shortcodes by United Themes plugin \< 5.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, UnitedThemes Shortcodes by United Themes)
- [CVE-2024-37100](https://cve.now/CVE-2024-37100.md): WordPress Elegant Themes Icons plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mayur Somani, threeroutes media Elegant Themes Icons)
- [CVE-2024-37101](https://cve.now/CVE-2024-37101.md): WordPress WP Post Author plugin \<= 3.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AF themes WP Post Author)
- [CVE-2024-6542](https://cve.now/CVE-2024-6542.md): Livestatus injection in mknotifyd (CVSS 6.5, Checkmk)
- [CVE-2024-34457](https://cve.now/CVE-2024-34457.md): Apache StreamPark IDOR Vulnerability (CVSS 6.5, Apache Software Foundation Apache StreamPark)
- [CVE-2024-38503](https://cve.now/CVE-2024-38503.md): Apache Syncope: HTML tags can be injected into Console or Enduser text fields (CVSS 3.9, Apache Software Foundation Apache Syncope · org.apache.s… +1)
- [CVE-2024-37114](https://cve.now/CVE-2024-37114.md): WordPress My Favorites plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Takashi Matsuyama My Favorites)
- [CVE-2024-37116](https://cve.now/CVE-2024-37116.md): WordPress Sinatra theme \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, sinatrateam Sinatra)
- [CVE-2024-37117](https://cve.now/CVE-2024-37117.md): WordPress Uncanny Automator Pro plugin \<= 5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Uncanny Owl Uncanny Automator Pro)
- [CVE-2024-37120](https://cve.now/CVE-2024-37120.md): WordPress Tabs plugin \<= 4.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Biplob Adhikari Tabs)
- [CVE-2024-37121](https://cve.now/CVE-2024-37121.md): WordPress Shortcode Addons plugin \<= 3.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, biplob018 Shortcode Addons)
- [CVE-2024-37122](https://cve.now/CVE-2024-37122.md): WordPress Accordions plugin \<= 2.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Biplob Adhikari Accordions)
- [CVE-2024-37199](https://cve.now/CVE-2024-37199.md): WordPress Enfold theme \<= 5.6.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kriesi.at Enfold)
- [CVE-2024-37206](https://cve.now/CVE-2024-37206.md): WordPress Demo Awesome plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Theme4Press Demo Awesome)
- [CVE-2024-37211](https://cve.now/CVE-2024-37211.md): WordPress AliExpress Dropshipping with AliNext Lite plugin \<= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Ali2Woo Team Ali2Woo Lite)
- [CVE-2024-37215](https://cve.now/CVE-2024-37215.md): WordPress Transition Slider – Responsive Image Slider and Gallery plugin \<= 2.20.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, creativeinteractivemedia Transition Slider – Responsive Ima…)
- [CVE-2024-37216](https://cve.now/CVE-2024-37216.md): WordPress Sketchfab Embed plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rami Yushuvaev Sketchfab Embed)
- [CVE-2024-37217](https://cve.now/CVE-2024-37217.md): WordPress Empty Cart Button for WooCommerce plugin \<= 1.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ProWCPlugins Empty Cart Button for WooCommerce)
- [CVE-2024-23321](https://cve.now/CVE-2024-23321.md): Apache RocketMQ: Unauthorized Exposure of Sensitive Data (CVSS 7.5, Apache Software Foundation Apache RocketMQ · org.apache.roc…)
- [CVE-2024-37219](https://cve.now/CVE-2024-37219.md): WordPress Page Builder Sandwich plugin \<= 5.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PBN Hosting SL Page Builder Sandwich – Front-End Page Build…)
- [CVE-2024-37221](https://cve.now/CVE-2024-37221.md): WordPress Kimili Flash Embed plugin \<= 2.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Michael Bester Kimili Flash Embed)
- [CVE-2024-37223](https://cve.now/CVE-2024-37223.md): WordPress Restaurant Reservations plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nicdark Restaurant Reservations)
- [CVE-2024-37229](https://cve.now/CVE-2024-37229.md): WordPress Blogmentor – Blog Layouts for Elementor plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, AuburnForest Blogmentor – Blog Layouts for Elementor)
- [CVE-2024-37239](https://cve.now/CVE-2024-37239.md): WordPress Branda plugin \<= 3.4.17 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPMU DEV - Your All-in-One WordPress Platform Branda)
- [CVE-2024-37244](https://cve.now/CVE-2024-37244.md): WordPress Ninja Beaver Add-ons for Beaver Builder plugin \<= 2.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ninja Team Ninja Beaver Add-ons for Beaver Builder)
- [CVE-2024-37245](https://cve.now/CVE-2024-37245.md): WordPress All In One Redirection plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vsourz Digital All In One Redirection)
- [CVE-2024-37246](https://cve.now/CVE-2024-37246.md): WordPress Gallery Slideshow plugin \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jethin Gallery Slideshow)
- [CVE-2024-37257](https://cve.now/CVE-2024-37257.md): WordPress Permalink Manager Lite plugin \<= 2.4.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Maciej Bis Permalink Manager Lite)
- [CVE-2024-37258](https://cve.now/CVE-2024-37258.md): WordPress Social Rocket plugin \<= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Social Rocket)
- [CVE-2024-37259](https://cve.now/CVE-2024-37259.md): WordPress WP Extended plugin \<= 2.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, The Ultimate WordPress Toolkit – WP Extended)
- [CVE-2024-37261](https://cve.now/CVE-2024-37261.md): WordPress WP-Lister Lite for Amazon plugin \<= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP Lab WP-Lister Lite for Amazon)
- [CVE-2024-37262](https://cve.now/CVE-2024-37262.md): WordPress Online Booking & Scheduling Calendar plugin \<= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, vCita.com Online Booking & Scheduling Calendar for WordPres…)
- [CVE-2024-37263](https://cve.now/CVE-2024-37263.md): WordPress Enter Addons – Ultimate Template Builder for Elementor plugin \<= 2.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThemeLooks Enter Addons)
- [CVE-2024-37264](https://cve.now/CVE-2024-37264.md): WordPress Groundhogg plugin \<= 3.4.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Groundhogg)
- [CVE-2024-37265](https://cve.now/CVE-2024-37265.md): WordPress IdeaPush plugin \<= 8.60 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Martin Gibson IdeaPush)
- [CVE-2024-37267](https://cve.now/CVE-2024-37267.md): WordPress Striking theme \<= 2.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kaptinlin Striking)
- [CVE-2024-37271](https://cve.now/CVE-2024-37271.md): WordPress Print My Blog plugin \<= 3.27.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Michael Nelson Print My Blog)
- [CVE-2024-37275](https://cve.now/CVE-2024-37275.md): WordPress NextScripts plugin \<= 4.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NextScripts)
- [CVE-2024-37278](https://cve.now/CVE-2024-37278.md): WordPress Cards for Beaver Builder plugin \<= 1.1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Pratik Chaskar Cards for Beaver Builder)
- [CVE-2024-37409](https://cve.now/CVE-2024-37409.md): WordPress PowerPack Lite for Beaver Builder plugin \<= 1.3.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, IdeaBox Creations PowerPack Lite for Beaver Builder)
- [CVE-2024-37414](https://cve.now/CVE-2024-37414.md): WordPress Depicter Slider plugin \<= 3.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Averta Depicter Slider)
- [CVE-2024-37416](https://cve.now/CVE-2024-37416.md): WordPress WP Photo Album Plus plugin \<= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus)
- [CVE-2024-37422](https://cve.now/CVE-2024-37422.md): WordPress Progress Planner plugin \<= 0.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Progress Planner)
- [CVE-2024-37428](https://cve.now/CVE-2024-37428.md): WordPress All-in-One Addons for Elementor – WidgetKit plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themesgrove WidgetKit)
- [CVE-2024-37429](https://cve.now/CVE-2024-37429.md): WordPress Login with phone number plugin \<= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Hamid Alinia Login with phone number)
- [CVE-2024-37432](https://cve.now/CVE-2024-37432.md): WordPress Esteem theme \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ThemeGrill Esteem)
- [CVE-2024-37433](https://cve.now/CVE-2024-37433.md): WordPress Mailster plugin \<= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, EverPress Mailster)
- [CVE-2024-37434](https://cve.now/CVE-2024-37434.md): WordPress Atarim plugin \<= 3.31 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Vito Peleg Atarim)
- [CVE-2024-37436](https://cve.now/CVE-2024-37436.md): WordPress Uncanny Toolkit Pro for LearnDash plugin \< 4.1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Uncanny Owl Uncanny Toolkit Pro for LearnDash)
- [CVE-2024-37445](https://cve.now/CVE-2024-37445.md): WordPress HTML5 Audio Player plugin \<= 2.2.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Html5 Audio Player)
- [CVE-2024-6271](https://cve.now/CVE-2024-6271.md): Community Events \< 1.5 - Event Deletion via CSRF (CVSS 5.4, Community Events)
- [CVE-2024-6244](https://cve.now/CVE-2024-6244.md): pz-frontend-manager \< 1.0.6 - CSRF change user profile picture (CVSS 8.8, PZ Frontend Manager)
- [CVE-2024-6243](https://cve.now/CVE-2024-6243.md): HTML Forms \< 1.3.33 - Admin+ Stored XSS (CVSS 5.9, HTML Forms)
- [CVE-2024-5973](https://cve.now/CVE-2024-5973.md): MasterStudy LMS \< 3.3.24 - Privilege Escalation to Instructor (CVSS 9.1, MasterStudy LMS WordPress Plugin)
- [CVE-2024-5529](https://cve.now/CVE-2024-5529.md): WP QuickLaTeX \< 3.8.8 - Admin+ Stored XSS (CVSS 4.8, WP QuickLaTeX)
- [CVE-2024-5004](https://cve.now/CVE-2024-5004.md): CM Popup Plugin for WordPress \< 1.6.6 - Contributor+ Stored XSS (CVSS 5.4, CM Popup Plugin for WordPress)
- [CVE-2024-6970](https://cve.now/CVE-2024-6970.md): itsourcecode Tailoring Management System staffcatadd.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-6969](https://cve.now/CVE-2024-6969.md): SourceCodester Clinics Patient Management System get\_patient\_history.php sql injection (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-6968](https://cve.now/CVE-2024-6968.md): SourceCodester Clinics Patient Management System print\_patients\_visits.php sql injection (CVSS 5.3, SourceCodester Clinics Patient Management System)
- [CVE-2024-6967](https://cve.now/CVE-2024-6967.md): SourceCodester Employee and Visitor Gate Pass Logging System sql injection (CVSS 5.3, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-6966](https://cve.now/CVE-2024-6966.md): itsourcecode Online Blood Bank Management System Login login.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2024-6965](https://cve.now/CVE-2024-6965.md): Tenda O3 fromVirtualSet stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2024-6964](https://cve.now/CVE-2024-6964.md): Tenda O3 fromDhcpSetSer stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2024-6963](https://cve.now/CVE-2024-6963.md): Tenda O3 formexeCommand stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2020-24102](https://cve.now/CVE-2020-24102.md): Directory Traversal vulnerability in Punkbuster pbsv.d64 2.351, allows remote attackers to execute arbitrary code. (CVSS 7.6)
- [CVE-2024-24507](https://cve.now/CVE-2024-24507.md): Cross Site Scripting vulnerability in Act-On 2023 allows a remote attacker to execute arbitrary code via the newUser parameter in the login. (CVSS 4.6)
- [CVE-2024-28698](https://cve.now/CVE-2024-28698.md): Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted scrip (CVSS 9.8, Csla)
- [CVE-2024-34329](https://cve.now/CVE-2024-34329.md): Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated (CVSS 8.4)
- [CVE-2024-37391](https://cve.now/CVE-2024-37391.md): ProtonVPN before 3.2.10 on Windows mishandles the drive installer path, which should use this: '"' + ExpandConstant('{autopf}\\Proton\\Drive') (CVSS 7.8)
- [CVE-2024-38944](https://cve.now/CVE-2024-38944.md): An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateFo (CVSS 9.8)
- [CVE-2024-39250](https://cve.now/CVE-2024-39250.md): EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interf (CVSS 9.8)
- [CVE-2024-40051](https://cve.now/CVE-2024-40051.md): IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter. (CVSS 7.5)
- [CVE-2024-40075](https://cve.now/CVE-2024-40075.md): Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability. (CVSS 4.3)
- [CVE-2024-40502](https://cve.now/CVE-2024-40502.md): SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the (CVSS 9.8)
- [CVE-2024-41314](https://cve.now/CVE-2024-41314.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif\_disable (CVSS 6.8)
- [CVE-2024-41315](https://cve.now/CVE-2024-41315.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_do\_e (CVSS 6.8)
- [CVE-2024-41316](https://cve.now/CVE-2024-41316.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_canc (CVSS 9.8)
- [CVE-2024-41317](https://cve.now/CVE-2024-41317.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_do\_e (CVSS 8.0)
- [CVE-2024-41318](https://cve.now/CVE-2024-41318.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli\_wps\_ (CVSS 9.8)
- [CVE-2024-41320](https://cve.now/CVE-2024-41320.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the get\_apcli\_ (CVSS 8.8)
- [CVE-2024-41703](https://cve.now/CVE-2024-41703.md): LibreChat through 0.7.4-rc1 has incorrect access control for message updates. (CVSS 5.4)
- [CVE-2024-41704](https://cve.now/CVE-2024-41704.md): LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. (CVSS 9.1)
- [CVE-2024-41709](https://cve.now/CVE-2024-41709.md): Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. (CVSS 6.1, backdrop/backdrop)
- [CVE-2024-41880](https://cve.now/CVE-2024-41880.md): In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and p (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.