CVEs published July 23, 2024
38 CVEs were published on July 23, 2024: 2 critical, 25 high.
- Published
- 38
- Critical
- 2
- High
- 25
- Medium
- 9
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- ISC BIND
- 4
- NI LabVIEW
- 3
- ABB Advant MOD 300 AdvaBuild
- 2
- Adobe Experience Manager
- 2
- Microsoft GroupMe
- 2
- thinkst canarytokens
- 2
- Adobe InDesign Desktop
- 1
- ampache
- 1
- Apache Software Foundation Apache Arrow Rust Object Store ·…
- 1
- Apache Software Foundation Apache StreamPark
- 1
Critical 2
High 25
- CVE-2024-41656Sentry vulnerable to stored Cross-Site Scripting (XSS)getsentry sentry · sentry
- CVE-2024-38176GroupMe Elevation of Privilege VulnerabilityMicrosoft GroupMe
- CVE-2024-0981Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting.Okta Browser Plugin
- CVE-2024-41668cBioPortal Proxy Endpoint Vulnerabliitycbioportal
- CVE-2020-11640Elevation of PrivilegeABB Advant MOD 300 AdvaBuild
- CVE-2020-11639Insufficient access control on Inter process communication,ABB Advant MOD 300 AdvaBuild
- CVE-2024-41178Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log filesApache Software Foundation Apache Arrow Rust Object Store ·…
- CVE-2024-6714An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege.Canonical Ubuntu Desktop Provision
- CVE-2024-41655TF2 Item Format Regular Expression Denial of Service vulnerabilitydanocmx node-tf2-item-format · tf2-item-format
- CVE-2024-4076Assertion failure when serving both stale cache data and authoritative zone contentISC BIND
- CVE-2024-1975SIG(0) can be used to exhaust CPU resourcesISC BIND
- CVE-2024-1737BIND's database will be slow if a very large number of RRs exist at the same nameISC BIND
- CVE-2024-0760A flood of DNS messages over TCP may make the server unstableISC BIND
- CVE-2024-4081Memory Corruption Due to Improper Length Check in NI LabVIEWNI LabVIEW
- CVE-2024-4080Memory Corruption Due to Improper Length Checks in LabVIEW tdcore.dllNI LabVIEW
- CVE-2024-4079Out of Bounds Read Due to Missing Bounds Check in LabVIEWNI LabVIEW
- CVE-2024-5602Stack-based Buffer Overflow Vulnerability in NI I/O Trace ToolNI IO Trace Tool
- CVE-2024-7014Improper multimedia file attachment validation in Telegram for Android appTelegram for Android
- CVE-2024-41012filelock: Remove locks reliably when fcntl/close race is detectedLinux
- CVE-2024-6420Hide My WP Ghost < 5.2.02 - Hidden Login Page DisclosureHide My WP Ghost
- CVE-2024-6885MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletionckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns…
- CVE-2024-6828Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scriptingdavidanderson Redux Framework
- CVE-2024-6717Nomad Vulnerable to Allocation Directory Path Escape Through Archive UnpackingHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2024-40060go-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function.
- CVE-2024-41319TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd functi
Medium, low and unrated 11
- CVE-2024-41665Ampache Stored Cross-site Scripting Vulnerabilityampache
- CVE-2024-41664Blind SSRF via Canarytoken Webhookthinkst canarytokens
- CVE-2024-41663Canarytoken "Cloned Website" Vulnerable to Stored Cross-Site Scriptingthinkst canarytokens
- CVE-2024-6783Vue client-side XSS via prototype pollutionvue · vue-template-compiler
- CVE-2024-41836InDesign Desktop | NULL Pointer Dereference (CWE-476)Adobe InDesign Desktop
- CVE-2024-41839Adobe Experience Manager | Improper Input Validation (CWE-20)Adobe Experience Manager
- CVE-2024-34128Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-6231Request a Quote < 2.4.1 - Admin+ Stored XSSRequest a Quote
- CVE-2024-4260CoBlocks < 3.1.12 - Contributor+ SSRFPage Builder Gutenberg Blocks
- CVE-2024-1575The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an autheZyxel WBE660S firmware
- CVE-2024-39702In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Den