CVEs published July 25, 2024
46 CVEs were published on July 25, 2024: 7 critical, 15 high.
- Published
- 46
- Critical
- 7
- High
- 15
- Medium
- 23
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 6
- Softaculous Webuzo
- 3
- Absolute Security Secure Access
- 2
- Canonical snapd · github.com/snapcore/snapd
- 2
- ForIP Tecnologia Administração PABX
- 2
- GitLab
- 2
- IBM Security Directory Integrator · IBM Security Verify Dir…
- 2
- Octopus Deploy Octopus Server
- 2
- openobserve
- 2
- 1Panel-dev KubePi
- 1
Critical 7
- CVE-2024-24621Softaculous Webuzo Authentication BypassSoftaculous Webuzo
- CVE-2024-39671Access control vulnerability in the security verification module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-37084CVE-2024-37084: Remote code execution in Spring Cloud Data FlowSpring Cloud Data Flow · org.springframework.cloud:spring-c…
- CVE-2024-38287The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers
- CVE-2024-38289A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated
- CVE-2024-40324A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fiel
- CVE-2024-41468Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand
High 15
- CVE-2024-24622Softaculous Webuzo Password Reset Command InjectionSoftaculous Webuzo
- CVE-2024-24623Softaculous Webuzo FTP Management Command InjectionSoftaculous Webuzo
- CVE-2024-41809OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`openobserve
- CVE-2024-41808OpenObserve stored XSS vulnerability may lead to complete account takeoveropenobserve
- CVE-2024-40872Elevation of privilege in Absolute Secure Access clients and serversAbsolute Security Secure Access
- CVE-2024-7007Authentication Bypass Using an Alternate Path or Channel in Positron Broadcast Signal Processor TRA7005Positron S.R.L Broadcast Signal Processor TRA7005
- CVE-2024-39672Memory request logic vulnerability in the memory module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-6589LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusionthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-7047Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-36542Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's tok
- CVE-2024-38288A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated atta
- CVE-2024-40318An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2024-41473Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac
- CVE-2024-41705A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06.
- CVE-2024-41706A stored XSS issue was discovered in Archer Platform 6 before version 2024.06.
Medium, low and unrated 24
- CVE-2024-38103Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2024-3938The "reset password" login page accepted an HTML injection via URL parameters.dotCMS core
- CVE-2024-7106Spina CMS media_folders cross-site request forgerySpina CMS · spina
- CVE-2024-7105ForIP Tecnologia Administração PABX Lista Ura Page detalheIdUra sql injectionForIP Tecnologia Administração PABX
- CVE-2024-6558HMS Industrial Networks Anybus-CompactCom 30 Cross-site ScriptingHMS Industrial Networks Anybus-CompactCom
- CVE-2024-29069snapd will follow archived symlinks when unpacking a filesystemCanonical snapd · github.com/snapcore/snapd
- CVE-2024-29068snapd non-regular file indefinite blocking readCanonical snapd · github.com/snapcore/snapd
- CVE-2024-1724snapd allows $HOME/bin symlinkCanonical snap · github.com/snapcore/snapd
- CVE-2024-40873XSS in Secure Access administrative consoleAbsolute Security Secure Access
- CVE-2024-28772IBM Security Directory Integrator cross-site scriptingIBM Security Directory Integrator · IBM Security Verify Dir…
- CVE-2022-32759IBM Security Directory Server information disclosureIBM Security Directory Integrator · IBM Security Verify Dir…
- CVE-2024-41801OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configurationopf openproject
- CVE-2024-41800Craft CMS Allows TOTP Token To Stay Valid After Usecraftcms cms · craftcms/cms
- CVE-2024-7101ForIP Tecnologia Administração PABX Authentication Form login sql injectionForIP Tecnologia Administração PABX
- CVE-2024-41806Open edX Platform's instructor upload CSV for cohort creation not Private by Defaultopenedx edx-platform
- CVE-2024-36111KubePi's JWT token validation has a defect1Panel-dev KubePi
- CVE-2023-7271Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-39670Privilege escalation vulnerability in the account synchronisation module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-39674Plaintext vulnerability in the Gallery search module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-39673Vulnerability of serialisation/deserialisation mismatch in the iAware module.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-6972In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in cOctopus Deploy Octopus Server
- CVE-2024-4811In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifacOctopus Deploy Octopus Server
- CVE-2024-7057Improper Access Control in GitLabGitLab
- CVE-2024-41707An issue was discovered in Archer Platform 6 before 2024.06.