CVEs published July 24, 2024
85 CVEs were published on July 24, 2024: 12 critical, 29 high. 1 is now in CISA KEV.
- Published
- 85
- Critical
- 12
- High
- 29
- Medium
- 38
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 20
Most affected products
- WPWeb Social Auto Poster
- 7
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- 5
- GitLab
- 4
- Hewlett Packard Enterprise HPE Aruba Networking EdgeConnect…
- 3
- curl
- 2
- Dell Edge Gateway
- 2
- SourceCodester Insurance Management System
- 2
- Acronis Cyber Infrastructure
- 1
- aguidrevitch WP Meteor Website Speed Optimization Addon
- 1
- amans2k FunnelKit – Funnel Builder for WooCommerce Checkout
- 1
Critical 12
- CVE-2024-41110Moby authz zero length regressionmoby · github.com/moby/moby +1
- CVE-2023-45249Remote command execution due to use of default passwords.Acronis Cyber Infrastructure
- CVE-2024-6327Progress Telerik Report Server DeserializationProgress Software Telerik Report Server
- CVE-2023-48362Apache Drill: XXE Vulnerability in XML Format ReaderApache Software Foundation Apache Drill · org.apache.drill.…
- CVE-2024-36533Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's volcano.sh/volcano · github.com/volcano-sh/volcano
- CVE-2024-36535Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's
- CVE-2024-36536Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's github.com/fabedge/fabedge
- CVE-2024-36539Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's
- CVE-2024-36540Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service
- CVE-2024-40422The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack.
- CVE-2024-41461Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/DhcpListCl
- CVE-2024-41464Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/Rou
High 29
- CVE-2024-41135Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2024-41134Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2024-41133Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2024-33519Authenticated Server-Side prototype pollution Leading to Information DisclosureHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2024-41672DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabledduckdb
- CVE-2024-41667OpenAM FreeMarker template injectionOpenIdentityPlatform OpenAM · org.openidentityplatform.open…
- CVE-2024-41662VNote vulnerable to Markdown XSS, which leads to RCEvnotex vnote
- CVE-2024-22443A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conHewlett Packard Enterprise HPE Aruba Networking EdgeConnect…
- CVE-2024-41914A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conHewlett Packard Enterprise HPE Aruba Networking EdgeConnect…
- CVE-2024-6096Unsafe Deserialization VulnerabilityProgress Software Telerik Reporting
- CVE-2024-39676Apache Pinot: Unauthorized endpoint exposed sensitive informationApache Software Foundation Apache Pinot · org.apache.pinot:…
- CVE-2024-6197freeing stack buffer in utf8asn1strcurl
- CVE-2024-7027WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher VendorWPWeb WooCommerce - PDF Vouchers
- CVE-2024-6753Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site ScriptingWPWeb Social Auto Poster
- CVE-2024-6750Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple FunctionsWPWeb Social Auto Poster
- CVE-2024-6756Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File UploadWPWeb Social Auto Poster
- CVE-2024-31970AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both ov
- CVE-2024-31977Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters
- CVE-2024-36534Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service accoun
- CVE-2024-36537Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service acco
- CVE-2024-36538Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account
- CVE-2024-36541Insecure permissions in logging-operator v4.6.0 allows attackers to access sensitive data and escalate privileges by obtaining the service a
- CVE-2024-39345AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable the SSH service by default and have a hidden, undocumented, hard-coded support
- CVE-2024-40495A vulnerability was discovered in Linksys Router E2500 with firmware 2.0.00, allows authenticated attackers to execute arbitrary code via th
- CVE-2024-41459Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the PPPOEPassword parameter at ip/goform/Qu
- CVE-2024-41465Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/setcfm
- CVE-2024-41466Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/NatStaticSe
- CVE-2024-41550CampCodes Supplier Management System v1.0 is vulnerable to SQL injection via Supply_Management_System/admin/view_invoice_items.php?id= .
- CVE-2024-41551CampCodes Supplier Management System v1.0 is vulnerable to SQL injection via Supply_Management_System/admin/view_order_items.php?id= .
Medium, low and unrated 44
- CVE-2024-0231Improper Control of Resource Identifiers ('Resource Injection') in GitLabGitLab
- CVE-2024-5067Exposure of Sensitive Information to an Unauthorized Actor in GitLabGitLab
- CVE-2024-7060Exposure of Sensitive Information to an Unauthorized Actor in GitLabGitLab
- CVE-2024-7091Exposure of Sensitive Information to an Unauthorized Actor in GitLabGitLab
- CVE-2024-7081itsourcecode Tailoring Management System expcatadd.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-41136Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line InterfaceHewlett Packard Enterprise (HPE) HPE Aruba Networking EdgeC…
- CVE-2024-7080SourceCodester Insurance Management System direct requestSourceCodester Insurance Management System
- CVE-2024-21684There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center.Atlassian Bitbucket Data Center
- CVE-2024-41666The Argo CD web terminal session does not handle the revocation of user permissions properly.argoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2024-37533IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-7079Openshift-console: unauthenticated installation of helm chartsopenshift-console · Red Hat OpenShift Container Platform
- CVE-2024-7069SourceCodester Employee and Visitor Gate Pass Logging System sql injectionSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-22444A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflHewlett Packard Enterprise HPE Aruba Networking EdgeConnect…
- CVE-2024-7068SourceCodester Insurance Management System update_sub_category cross site scriptingSourceCodester Insurance Management System
- CVE-2024-7067kirilkirkov Ecommerce-Laravel-Bootstrap Cart.php getCartProductsIds deserializationkirilkirkov Ecommerce-Laravel-Bootstrap
- CVE-2024-5818Royal Elementor Addons and Templates <= 1.3.980 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Magazine Grid/Slider Widgetwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-3896Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Titlerobosoft Robo Gallery – Photo & Image Slider
- CVE-2024-6896AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2024-7066F-logic DataCube3 HTTP POST Request config_time_sync.php os command injectionF-logic DataCube3
- CVE-2024-7065Spina CMS cross-site request forgerySpina CMS
- CVE-2024-3297Session establishment lock-up during replay of CASE Sigma1 messagesConnectivity Standards Alliance Matter
- CVE-2024-3454In-Fabric Matter Cluster Attribute DisclosureConnectivity Standards Alliance connectedhomeip
- CVE-2024-6874macidn punycode buffer overreadcurl
- CVE-2024-6930WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcodewpdevelop Booking Calendar
- CVE-2023-32471Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds read vulnerability.Dell Edge Gateway
- CVE-2023-32466Dell Edge Gateway BIOS, versions 3200 and 5200, contains an out-of-bounds write vulnerability.Dell Edge Gateway
- CVE-2024-6629All-in-One Video Gallery <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Shortcodeplugins360 All-in-One Video Gallery
- CVE-2024-6571Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosurearnoldasarny Image SEO – AI-Driven Image SEO Optimizer
- CVE-2024-6553WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosureaguidrevitch WP Meteor Website Speed Optimization Addon
- CVE-2024-6094WP ULike < 4.7.1 - Admin+ Stored XSSWP ULike
- CVE-2024-6836Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Updateamans2k FunnelKit – Funnel Builder for WooCommerce Checkout
- CVE-2024-3246LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptinglitespeedtech LiteSpeed Cache
- CVE-2024-5861WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnectionsaadiqbal WP Easy Pay – Payment and Donation form Builder f…
- CVE-2024-6755Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post DeletionWPWeb Social Auto Poster
- CVE-2024-6751Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple FunctionsWPWeb Social Auto Poster
- CVE-2024-6754Social Auto Poster <= 5.3.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update via wpw_auto_poster_update_tweet_templateWPWeb Social Auto Poster
- CVE-2024-6752Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site ScriptingWPWeb Social Auto Poster
- CVE-2024-31971Multiple stored cross-site scripting (XSS) vulnerabilities on AdTran NetVanta 3120 18.01.01.00.E devices allow remote attackers to inject ar
- CVE-2024-40137Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameterdolibarr/dolibarr
- CVE-2024-40575An issue in Huawei Technologies opengauss (openGauss 5.0.0 build) v.7.3.0 allows a local attacker to cause a denial of service via the modif
- CVE-2024-40767In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 imnova
- CVE-2024-41460Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/RouteStat
- CVE-2024-41462Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/DhcpListCli
- CVE-2024-41463Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the entrys parameter at ip/goform/addressNa