# CVEs published 2024-07-23

38 CVEs were published on July 23, 2024: 2 critical, 25 high. Days are UTC.

- [CVE-2024-41656](https://cve.now/CVE-2024-41656.md): Sentry vulnerable to stored Cross-Site Scripting (XSS) (CVSS 7.1, getsentry sentry · sentry)
- [CVE-2024-38164](https://cve.now/CVE-2024-38164.md): GroupMe Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft GroupMe)
- [CVE-2024-38176](https://cve.now/CVE-2024-38176.md): GroupMe Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft GroupMe)
- [CVE-2024-0981](https://cve.now/CVE-2024-0981.md): Okta Browser Plugin versions 6.5.0 through 6.31.0 (Chrome/Edge/Firefox/Safari) are vulnerable to cross-site scripting. (CVSS 7.1, Okta Browser Plugin)
- [CVE-2024-41668](https://cve.now/CVE-2024-41668.md): cBioPortal Proxy Endpoint Vulnerabliity (CVSS 8.3, cbioportal)
- [CVE-2020-11640](https://cve.now/CVE-2020-11640.md): Elevation of Privilege (CVSS 8.8, ABB Advant MOD 300 AdvaBuild)
- [CVE-2020-11639](https://cve.now/CVE-2020-11639.md): Insufficient access control on Inter process communication, (CVSS 7.8, ABB Advant MOD 300 AdvaBuild)
- [CVE-2024-41665](https://cve.now/CVE-2024-41665.md): Ampache Stored Cross-site Scripting Vulnerability (CVSS 5.5, ampache)
- [CVE-2024-41664](https://cve.now/CVE-2024-41664.md): Blind SSRF via Canarytoken Webhook (CVSS 5.4, thinkst canarytokens)
- [CVE-2024-41178](https://cve.now/CVE-2024-41178.md): Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files (CVSS 7.5, Apache Software Foundation Apache Arrow Rust Object Store ·…)
- [CVE-2024-41663](https://cve.now/CVE-2024-41663.md): Canarytoken "Cloned Website" Vulnerable to Stored Cross-Site Scripting (CVSS 3.5, thinkst canarytokens)
- [CVE-2024-6714](https://cve.now/CVE-2024-6714.md): An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. (CVSS 8.8, Canonical Ubuntu Desktop Provision)
- [CVE-2024-6783](https://cve.now/CVE-2024-6783.md): Vue client-side XSS via prototype pollution (CVSS 4.8, vue · vue-template-compiler)
- [CVE-2024-41655](https://cve.now/CVE-2024-41655.md): TF2 Item Format Regular Expression Denial of Service vulnerability (CVSS 7.5, danocmx node-tf2-item-format · tf2-item-format)
- [CVE-2024-4076](https://cve.now/CVE-2024-4076.md): Assertion failure when serving both stale cache data and authoritative zone content (CVSS 7.5, ISC BIND)
- [CVE-2024-1975](https://cve.now/CVE-2024-1975.md): SIG(0) can be used to exhaust CPU resources (CVSS 7.5, ISC BIND)
- [CVE-2024-1737](https://cve.now/CVE-2024-1737.md): BIND's database will be slow if a very large number of RRs exist at the same name (CVSS 7.5, ISC BIND)
- [CVE-2024-0760](https://cve.now/CVE-2024-0760.md): A flood of DNS messages over TCP may make the server unstable (CVSS 7.5, ISC BIND)
- [CVE-2024-4081](https://cve.now/CVE-2024-4081.md): Memory Corruption Due to Improper Length Check in NI LabVIEW (CVSS 7.8, NI LabVIEW)
- [CVE-2024-4080](https://cve.now/CVE-2024-4080.md): Memory Corruption Due to Improper Length Checks in LabVIEW tdcore.dll (CVSS 7.8, NI LabVIEW)
- [CVE-2024-4079](https://cve.now/CVE-2024-4079.md): Out of Bounds Read Due to Missing Bounds Check in LabVIEW (CVSS 7.8, NI LabVIEW)
- [CVE-2024-5602](https://cve.now/CVE-2024-5602.md): Stack-based Buffer Overflow Vulnerability in NI I/O Trace Tool (CVSS 7.8, NI IO Trace Tool)
- [CVE-2024-41836](https://cve.now/CVE-2024-41836.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2024-41839](https://cve.now/CVE-2024-41839.md): Adobe Experience Manager | Improper Input Validation (CWE-20) (CVSS 3.5, Adobe Experience Manager)
- [CVE-2024-34128](https://cve.now/CVE-2024-34128.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-7014](https://cve.now/CVE-2024-7014.md): Improper multimedia file attachment validation in Telegram for Android app (CVSS 7.1, Telegram for Android)
- [CVE-2024-29070](https://cve.now/CVE-2024-29070.md): Apache StreamPark: session not invalidated after logout (CVSS 9.1, Apache Software Foundation Apache StreamPark)
- [CVE-2024-41012](https://cve.now/CVE-2024-41012.md): filelock: Remove locks reliably when fcntl/close race is detected (CVSS 7.8, Linux)
- [CVE-2024-6420](https://cve.now/CVE-2024-6420.md): Hide My WP Ghost \< 5.2.02 - Hidden Login Page Disclosure (CVSS 8.6, Hide My WP Ghost)
- [CVE-2024-6231](https://cve.now/CVE-2024-6231.md): Request a Quote \< 2.4.1 - Admin+ Stored XSS (CVSS 5.9, Request a Quote)
- [CVE-2024-4260](https://cve.now/CVE-2024-4260.md): CoBlocks \< 3.1.12 - Contributor+ SSRF (CVSS 6.5, Page Builder Gutenberg Blocks)
- [CVE-2024-6885](https://cve.now/CVE-2024-6885.md): MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles \<= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, ckp267 MaxiBlocks Builder | 17,000+ Design Assets, Patterns…)
- [CVE-2024-6828](https://cve.now/CVE-2024-6828.md): Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting (CVSS 7.2, davidanderson Redux Framework)
- [CVE-2024-1575](https://cve.now/CVE-2024-1575.md): The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authe (CVSS 6.5, Zyxel WBE660S firmware)
- [CVE-2024-6717](https://cve.now/CVE-2024-6717.md): Nomad Vulnerable to Allocation Directory Path Escape Through Archive Unpacking (CVSS 7.7, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2024-39702](https://cve.now/CVE-2024-39702.md): In lj\_str\_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Den (CVSS 5.9)
- [CVE-2024-40060](https://cve.now/CVE-2024-40060.md): go-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function. (CVSS 7.5)
- [CVE-2024-41319](https://cve.now/CVE-2024-41319.md): TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd functi (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.