CVEs published July 26, 2024
71 CVEs were published on July 26, 2024: 12 critical, 32 high.
- Published
- 71
- Critical
- 12
- High
- 32
- Medium
- 25
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- opengeos streamlit-geospatial
- 9
- SyroTech SY-GPON-1110-WDONT router
- 9
- Lenovo XClarity Controller
- 5
- MD-MAFUJUL-HASAN Online-Payroll-Management-System
- 5
- Apache Software Foundation Apache Traffic Server
- 3
- icecoder/icecoder
- 3
- ManageEngine Exchange Reporter Plus
- 2
- txtdot
- 2
- 202ecommerce paypal
- 1
- Apache Software Foundation Apache Roller
- 1
Critical 12
- CVE-2024-41120streamlit-geospatial blind SSRF in pages/9_🔲_Vector_Data_Visualization.pyopengeos streamlit-geospatial
- CVE-2024-41119streamlit-geospatial remote code execution in pages/8_🏜️_Raster_Data_Visualization.pyopengeos streamlit-geospatial
- CVE-2024-41117Remote code execution in streamlit geospatial in pages/10_🌍_Earth_Engine_Datasets.pyopengeos streamlit-geospatial
- CVE-2024-41116Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option vis_paramsopengeos streamlit-geospatial
- CVE-2024-41115Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Ocean Color SMI option paletteopengeos streamlit-geospatial
- CVE-2024-41114Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py MODIS Gap filled Land Surface Temperature Daily optionopengeos streamlit-geospatial
- CVE-2024-41113Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option vis_paramsopengeos streamlit-geospatial
- CVE-2024-41112Remote code execution in streamlit geospatial in pages/1_📷_Timelapse.py Any Earth Engine ImageCollection option paletteopengeos streamlit-geospatial
- CVE-2024-35161Apache Traffic Server: Incomplete check for chunked trailer section allows request smugglingApache Software Foundation Apache Traffic Server
- CVE-2024-4447In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjadotCMS core
- CVE-2024-26520An issue in Hangzhou Xiongwei Technology Development Co., Ltd.
- CVE-2024-40117Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via c
High 32
- CVE-2024-41815Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commandsstarship
- CVE-2024-41118streamlit-geospatial blind SSRF in pages/7_📦_Web_Map_Service.pyopengeos streamlit-geospatial
- CVE-2024-38512A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform coLenovo XClarity Controller
- CVE-2024-38511A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user Lenovo XClarity Controller
- CVE-2024-38510A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wiLenovo XClarity Controller
- CVE-2024-38509A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arLenovo XClarity Controller
- CVE-2024-38508A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an aLenovo XClarity Controller
- CVE-2024-39304ChurchCRM SQL Injection VulnerabilityChurchCRM CRM
- CVE-2024-38872SQL InjectionManageEngine Exchange Reporter Plus
- CVE-2024-38871SQL InjectionManageEngine Exchange Reporter Plus
- CVE-2024-41813txtdot SSRF vulnerability in /proxytxtdot
- CVE-2024-41812txtdot SSRF vulnerability in /gettxtdot
- CVE-2024-7050Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular sceOpenText Directory Services
- CVE-2024-41670PayPal Official Module for PrestaShop has Improperly Implemented Security Check for Standard202ecommerce paypal
- CVE-2024-41692Incorrect Access Control VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-41691Insecure Storage of Sensitive Information VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-41690Default Credential Storage in Plaintext VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-41688Cleartext Storage of Sensitive Information VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-41687Cleartext Transmission of Sensitive Information VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-41686Password Policy Bypass VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-7062Local Privilege Escalation in Nimble Commander <= v1.6.0, Build 4087Nimble Commander
- CVE-2023-38522Apache Traffic Server: Incomplete field name check allows request smugglingApache Software Foundation Apache Traffic Server
- CVE-2024-35296Apache Traffic Server: Invalid Accept-Encoding can force forwarding requestsApache Software Foundation Apache Traffic Server
- CVE-2024-40897Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39.GStreamer ORC
- CVE-2023-50700Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged u
- CVE-2024-24257An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information v
- CVE-2024-40116An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html,
- CVE-2024-40433Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component.
- CVE-2024-41353phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\groups\edit-group.php
- CVE-2024-41354phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php
- CVE-2024-41357phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.
- CVE-2024-41628Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9
Medium, low and unrated 27
- CVE-2024-4786An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device Lenovo Tab K10
- CVE-2024-41805Tracks vulnerable to reflected cross-site scriptingTracksApp tracks
- CVE-2024-6922Server-Side Request Forgery in Automation 360Automationanywhere Automation
- CVE-2024-7128Openshift-console: unauthenticated data exposureopenshift-console · Red Hat OpenShift Container Platform
- CVE-2024-40689IBM InfoSphere Information Server SQL injectionIBM InfoSphere Information Server
- CVE-2024-41689Hard-coded Credentials VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-41685Cookie Without HTTPOnly Flag Set VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-41684Cookie Without Secure Flag Set VulnerabilitySyroTech SY-GPON-1110-WDONT router
- CVE-2024-25090Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users modeApache Software Foundation Apache Roller
- CVE-2024-6490Master Slider – Responsive Touch Slider <= 3.9.10 - CSRF to slider deletionMaster Slider
- CVE-2023-49921An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2024-7120Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injectionRaisecom MSG1200 · Raisecom MSG2100E +2
- CVE-2024-7119MD-MAFUJUL-HASAN Online-Payroll-Management-System employee_viewmore.php sql injectionMD-MAFUJUL-HASAN Online-Payroll-Management-System
- CVE-2024-7118MD-MAFUJUL-HASAN Online-Payroll-Management-System department_viewmore.php sql injectionMD-MAFUJUL-HASAN Online-Payroll-Management-System
- CVE-2024-7117MD-MAFUJUL-HASAN Online-Payroll-Management-System shift_viewmore.php sql injectionMD-MAFUJUL-HASAN Online-Payroll-Management-System
- CVE-2024-7116MD-MAFUJUL-HASAN Online-Payroll-Management-System branch_viewmore.php sql injectionMD-MAFUJUL-HASAN Online-Payroll-Management-System
- CVE-2024-7115MD-MAFUJUL-HASAN Online-Payroll-Management-System designation_viewmore.php sql injectionMD-MAFUJUL-HASAN Online-Payroll-Management-System
- CVE-2024-7114Tianchoy Blog so.php sql injectionTianchoy Blog
- CVE-2024-27357An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and
- CVE-2024-27358An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS.
- CVE-2024-37034An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1.
- CVE-2024-41355phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php.
- CVE-2024-41356phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\firewall-zones\zones-edit-network.php.
- CVE-2024-41373ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php.icecoder/icecoder
- CVE-2024-41374ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.phpicecoder/icecoder
- CVE-2024-41375ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.phpicecoder/icecoder
- CVE-2024-42007SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files.