# CVEs published 2024-07-25

46 CVEs were published on July 25, 2024: 7 critical, 15 high. Days are UTC.

- [CVE-2024-24622](https://cve.now/CVE-2024-24622.md): Softaculous Webuzo Password Reset Command Injection (CVSS 8.8, Softaculous Webuzo)
- [CVE-2024-24623](https://cve.now/CVE-2024-24623.md): Softaculous Webuzo FTP Management Command Injection (CVSS 8.8, Softaculous Webuzo)
- [CVE-2024-24621](https://cve.now/CVE-2024-24621.md): Softaculous Webuzo Authentication Bypass (CVSS 9.8, Softaculous Webuzo)
- [CVE-2024-38103](https://cve.now/CVE-2024-38103.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 5.9, Microsoft Edge)
- [CVE-2024-3938](https://cve.now/CVE-2024-3938.md): The "reset password" login page accepted an HTML injection via URL parameters. (CVSS 5.4, dotCMS core)
- [CVE-2024-7106](https://cve.now/CVE-2024-7106.md): Spina CMS media\_folders cross-site request forgery (CVSS 6.9, Spina CMS · spina)
- [CVE-2024-7105](https://cve.now/CVE-2024-7105.md): ForIP Tecnologia Administração PABX Lista Ura Page detalheIdUra sql injection (CVSS 5.3, ForIP Tecnologia Administração PABX)
- [CVE-2024-41809](https://cve.now/CVE-2024-41809.md): OpenObserve Cross-site Scripting (XSS) vulnerability in \`openobserve/web/src/views/MemberSubscription.vue\` (CVSS 7.2, openobserve)
- [CVE-2024-41808](https://cve.now/CVE-2024-41808.md): OpenObserve stored XSS vulnerability may lead to complete account takeover (CVSS 8.8, openobserve)
- [CVE-2024-6558](https://cve.now/CVE-2024-6558.md): HMS Industrial Networks Anybus-CompactCom 30 Cross-site Scripting (CVSS 6.3, HMS Industrial Networks Anybus-CompactCom)
- [CVE-2024-29069](https://cve.now/CVE-2024-29069.md): snapd will follow archived symlinks when unpacking a filesystem (CVSS 4.8, Canonical snapd · github.com/snapcore/snapd)
- [CVE-2024-29068](https://cve.now/CVE-2024-29068.md): snapd non-regular file indefinite blocking read (CVSS 5.8, Canonical snapd · github.com/snapcore/snapd)
- [CVE-2024-1724](https://cve.now/CVE-2024-1724.md): snapd allows $HOME/bin symlink (CVSS 6.3, Canonical snap · github.com/snapcore/snapd)
- [CVE-2024-40873](https://cve.now/CVE-2024-40873.md): XSS in Secure Access administrative console (CVSS 4.5, Absolute Security Secure Access)
- [CVE-2024-28772](https://cve.now/CVE-2024-28772.md): IBM Security Directory Integrator cross-site scripting (CVSS 6.8, IBM Security Directory Integrator · IBM Security Verify Dir…)
- [CVE-2022-32759](https://cve.now/CVE-2022-32759.md): IBM Security Directory Server information disclosure (CVSS 5.3, IBM Security Directory Integrator · IBM Security Verify Dir…)
- [CVE-2024-40872](https://cve.now/CVE-2024-40872.md): Elevation of privilege in Absolute Secure Access clients and servers (CVSS 8.4, Absolute Security Secure Access)
- [CVE-2024-41801](https://cve.now/CVE-2024-41801.md): OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration (CVSS 4.7, opf openproject)
- [CVE-2024-7007](https://cve.now/CVE-2024-7007.md): Authentication Bypass Using an Alternate Path or Channel in Positron Broadcast Signal Processor TRA7005 (CVSS 8.7, Positron S.R.L Broadcast Signal Processor TRA7005)
- [CVE-2024-41800](https://cve.now/CVE-2024-41800.md): Craft CMS Allows TOTP Token To Stay Valid After Use (CVSS 4.8, craftcms cms · craftcms/cms)
- [CVE-2024-7101](https://cve.now/CVE-2024-7101.md): ForIP Tecnologia Administração PABX Authentication Form login sql injection (CVSS 6.9, ForIP Tecnologia Administração PABX)
- [CVE-2024-41806](https://cve.now/CVE-2024-41806.md): Open edX Platform's instructor upload CSV for cohort creation not Private by Default (CVSS 5.3, openedx edx-platform)
- [CVE-2024-36111](https://cve.now/CVE-2024-36111.md): KubePi's JWT token validation has a defect (CVSS 6.3, 1Panel-dev KubePi)
- [CVE-2024-39672](https://cve.now/CVE-2024-39672.md): Memory request logic vulnerability in the memory module. (CVSS 8.4, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-39671](https://cve.now/CVE-2024-39671.md): Access control vulnerability in the security verification module. (CVSS 9.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-7271](https://cve.now/CVE-2023-7271.md): Privilege escalation vulnerability in the NMS module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 5.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-39670](https://cve.now/CVE-2024-39670.md): Privilege escalation vulnerability in the account synchronisation module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-39674](https://cve.now/CVE-2024-39674.md): Plaintext vulnerability in the Gallery search module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-39673](https://cve.now/CVE-2024-39673.md): Vulnerability of serialisation/deserialisation mismatch in the iAware module. (CVSS 6.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-6589](https://cve.now/CVE-2024-6589.md): LearnPress \<= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-37084](https://cve.now/CVE-2024-37084.md): CVE-2024-37084: Remote code execution in Spring Cloud Data Flow (CVSS 9.8, Spring Cloud Data Flow · org.springframework.cloud:spring-c…)
- [CVE-2024-6972](https://cve.now/CVE-2024-6972.md): In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the task log in c (CVSS 6.5, Octopus Deploy Octopus Server)
- [CVE-2024-4811](https://cve.now/CVE-2024-4811.md): In affected versions of Octopus Server under certain conditions, a user with specific role assignments can access restricted project artifac (CVSS 2.2, Octopus Deploy Octopus Server)
- [CVE-2024-7057](https://cve.now/CVE-2024-7057.md): Improper Access Control in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-7047](https://cve.now/CVE-2024-7047.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.7, GitLab)
- [CVE-2024-36542](https://cve.now/CVE-2024-36542.md): Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's tok (CVSS 8.8)
- [CVE-2024-38287](https://cve.now/CVE-2024-38287.md): The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers (CVSS 9.1)
- [CVE-2024-38288](https://cve.now/CVE-2024-38288.md): A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated atta (CVSS 7.2)
- [CVE-2024-38289](https://cve.now/CVE-2024-38289.md): A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated (CVSS 9.8)
- [CVE-2024-40318](https://cve.now/CVE-2024-40318.md): An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file. (CVSS 7.2)
- [CVE-2024-40324](https://cve.now/CVE-2024-40324.md): A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fiel (CVSS 9.8)
- [CVE-2024-41468](https://cve.now/CVE-2024-41468.md): Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand (CVSS 9.8)
- [CVE-2024-41473](https://cve.now/CVE-2024-41473.md): Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac (CVSS 8.0)
- [CVE-2024-41705](https://cve.now/CVE-2024-41705.md): A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06. (CVSS 7.1)
- [CVE-2024-41706](https://cve.now/CVE-2024-41706.md): A stored XSS issue was discovered in Archer Platform 6 before version 2024.06. (CVSS 7.3)
- [CVE-2024-41707](https://cve.now/CVE-2024-41707.md): An issue was discovered in Archer Platform 6 before 2024.06. (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.