# CVEs published 2024-07-26

71 CVEs were published on July 26, 2024: 12 critical, 32 high. Days are UTC.

- [CVE-2024-41815](https://cve.now/CVE-2024-41815.md): Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands (CVSS 7.4, starship)
- [CVE-2024-41120](https://cve.now/CVE-2024-41120.md): streamlit-geospatial blind SSRF in pages/9\_🔲\_Vector\_Data\_Visualization.py (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-41119](https://cve.now/CVE-2024-41119.md): streamlit-geospatial remote code execution in pages/8\_🏜️\_Raster\_Data\_Visualization.py (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-41118](https://cve.now/CVE-2024-41118.md): streamlit-geospatial blind SSRF in pages/7\_📦\_Web\_Map\_Service.py (CVSS 7.5, opengeos streamlit-geospatial)
- [CVE-2024-41117](https://cve.now/CVE-2024-41117.md): Remote code execution in streamlit geospatial in pages/10\_🌍\_Earth\_Engine\_Datasets.py (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-41116](https://cve.now/CVE-2024-41116.md): Remote code execution in streamlit geospatial in pages/1\_📷\_Timelapse.py MODIS Ocean Color SMI option vis\_params (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-41115](https://cve.now/CVE-2024-41115.md): Remote code execution in streamlit geospatial in pages/1\_📷\_Timelapse.py MODIS Ocean Color SMI option palette (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-41114](https://cve.now/CVE-2024-41114.md): Remote code execution in streamlit geospatial in pages/1\_📷\_Timelapse.py MODIS Gap filled Land Surface Temperature Daily option (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-41113](https://cve.now/CVE-2024-41113.md): Remote code execution in streamlit geospatial in pages/1\_📷\_Timelapse.py Any Earth Engine ImageCollection option vis\_params (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-41112](https://cve.now/CVE-2024-41112.md): Remote code execution in streamlit geospatial in pages/1\_📷\_Timelapse.py Any Earth Engine ImageCollection option palette (CVSS 9.8, opengeos streamlit-geospatial)
- [CVE-2024-4786](https://cve.now/CVE-2024-4786.md): An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device (CVSS 2.8, Lenovo Tab K10)
- [CVE-2024-38512](https://cve.now/CVE-2024-38512.md): A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform co (CVSS 7.2, Lenovo XClarity Controller)
- [CVE-2024-38511](https://cve.now/CVE-2024-38511.md): A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user (CVSS 7.2, Lenovo XClarity Controller)
- [CVE-2024-38510](https://cve.now/CVE-2024-38510.md): A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wi (CVSS 7.2, Lenovo XClarity Controller)
- [CVE-2024-38509](https://cve.now/CVE-2024-38509.md): A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute ar (CVSS 7.2, Lenovo XClarity Controller)
- [CVE-2024-38508](https://cve.now/CVE-2024-38508.md): A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an a (CVSS 7.2, Lenovo XClarity Controller)
- [CVE-2024-39304](https://cve.now/CVE-2024-39304.md): ChurchCRM SQL Injection Vulnerability (CVSS 8.8, ChurchCRM CRM)
- [CVE-2024-38872](https://cve.now/CVE-2024-38872.md): SQL Injection (CVSS 8.3, ManageEngine Exchange Reporter Plus)
- [CVE-2024-38871](https://cve.now/CVE-2024-38871.md): SQL Injection (CVSS 8.3, ManageEngine Exchange Reporter Plus)
- [CVE-2024-41813](https://cve.now/CVE-2024-41813.md): txtdot SSRF vulnerability in /proxy (CVSS 7.5, txtdot)
- [CVE-2024-41812](https://cve.now/CVE-2024-41812.md): txtdot SSRF vulnerability in /get (CVSS 7.5, txtdot)
- [CVE-2024-7050](https://cve.now/CVE-2024-7050.md): Improper Authentication vulnerability in OpenText OpenText Directory Services may allow Multi-factor Authentication Bypass in particular sce (CVSS 8.3, OpenText Directory Services)
- [CVE-2024-41805](https://cve.now/CVE-2024-41805.md): Tracks vulnerable to reflected cross-site scripting (CVSS 6.1, TracksApp tracks)
- [CVE-2024-41670](https://cve.now/CVE-2024-41670.md): PayPal Official Module for PrestaShop has Improperly Implemented Security Check for Standard (CVSS 7.5, 202ecommerce paypal)
- [CVE-2024-6922](https://cve.now/CVE-2024-6922.md): Server-Side Request Forgery in Automation 360 (CVSS 6.9, Automationanywhere Automation)
- [CVE-2024-7128](https://cve.now/CVE-2024-7128.md): Openshift-console: unauthenticated data exposure (CVSS 5.3, openshift-console · Red Hat OpenShift Container Platform)
- [CVE-2024-40689](https://cve.now/CVE-2024-40689.md): IBM InfoSphere Information Server SQL injection (CVSS 6.0, IBM InfoSphere Information Server)
- [CVE-2024-41692](https://cve.now/CVE-2024-41692.md): Incorrect Access Control Vulnerability (CVSS 8.6, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41691](https://cve.now/CVE-2024-41691.md): Insecure Storage of Sensitive Information Vulnerability (CVSS 7.0, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41690](https://cve.now/CVE-2024-41690.md): Default Credential Storage in Plaintext Vulnerability (CVSS 7.0, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41689](https://cve.now/CVE-2024-41689.md): Hard-coded Credentials Vulnerability (CVSS 5.2, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41688](https://cve.now/CVE-2024-41688.md): Cleartext Storage of Sensitive Information Vulnerability (CVSS 7.0, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41687](https://cve.now/CVE-2024-41687.md): Cleartext Transmission of Sensitive Information Vulnerability (CVSS 8.6, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41686](https://cve.now/CVE-2024-41686.md): Password Policy Bypass Vulnerability (CVSS 7.3, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41685](https://cve.now/CVE-2024-41685.md): Cookie Without HTTPOnly Flag Set Vulnerability (CVSS 6.9, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-41684](https://cve.now/CVE-2024-41684.md): Cookie Without Secure Flag Set Vulnerability (CVSS 6.9, SyroTech SY-GPON-1110-WDONT router)
- [CVE-2024-7062](https://cve.now/CVE-2024-7062.md): Local Privilege Escalation in Nimble Commander \<= v1.6.0, Build 4087 (CVSS 8.8, Nimble Commander)
- [CVE-2023-38522](https://cve.now/CVE-2023-38522.md): Apache Traffic Server: Incomplete field name check allows request smuggling (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-35296](https://cve.now/CVE-2024-35296.md): Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests (CVSS 8.2, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-35161](https://cve.now/CVE-2024-35161.md): Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling (CVSS 9.1, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-25090](https://cve.now/CVE-2024-25090.md): Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode (CVSS 5.4, Apache Software Foundation Apache Roller)
- [CVE-2024-40897](https://cve.now/CVE-2024-40897.md): Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. (CVSS 7.0, GStreamer ORC)
- [CVE-2024-6490](https://cve.now/CVE-2024-6490.md): Master Slider – Responsive Touch Slider \<= 3.9.10 - CSRF to slider deletion (CVSS 6.5, Master Slider)
- [CVE-2023-49921](https://cve.now/CVE-2023-49921.md): An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. (CVSS 5.2, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-7120](https://cve.now/CVE-2024-7120.md): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list\_base\_config.php os command injection (CVSS 5.3, Raisecom MSG1200 · Raisecom MSG2100E +2)
- [CVE-2024-7119](https://cve.now/CVE-2024-7119.md): MD-MAFUJUL-HASAN Online-Payroll-Management-System employee\_viewmore.php sql injection (CVSS 5.3, MD-MAFUJUL-HASAN Online-Payroll-Management-System)
- [CVE-2024-7118](https://cve.now/CVE-2024-7118.md): MD-MAFUJUL-HASAN Online-Payroll-Management-System department\_viewmore.php sql injection (CVSS 5.3, MD-MAFUJUL-HASAN Online-Payroll-Management-System)
- [CVE-2024-7117](https://cve.now/CVE-2024-7117.md): MD-MAFUJUL-HASAN Online-Payroll-Management-System shift\_viewmore.php sql injection (CVSS 5.3, MD-MAFUJUL-HASAN Online-Payroll-Management-System)
- [CVE-2024-7116](https://cve.now/CVE-2024-7116.md): MD-MAFUJUL-HASAN Online-Payroll-Management-System branch\_viewmore.php sql injection (CVSS 5.3, MD-MAFUJUL-HASAN Online-Payroll-Management-System)
- [CVE-2024-4447](https://cve.now/CVE-2024-4447.md): In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAja (CVSS 9.9, dotCMS core)
- [CVE-2024-7115](https://cve.now/CVE-2024-7115.md): MD-MAFUJUL-HASAN Online-Payroll-Management-System designation\_viewmore.php sql injection (CVSS 5.3, MD-MAFUJUL-HASAN Online-Payroll-Management-System)
- [CVE-2024-7114](https://cve.now/CVE-2024-7114.md): Tianchoy Blog so.php sql injection (CVSS 5.3, Tianchoy Blog)
- [CVE-2023-50700](https://cve.now/CVE-2023-50700.md): Insecure Permissions vulnerability in Deepin dde-file-manager 6.0.54 and earlier allows privileged operations to be called by unprivileged u (CVSS 7.8)
- [CVE-2024-24257](https://cve.now/CVE-2024-24257.md): An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information v (CVSS 7.5)
- [CVE-2024-26520](https://cve.now/CVE-2024-26520.md): An issue in Hangzhou Xiongwei Technology Development Co., Ltd. (CVSS 9.8)
- [CVE-2024-27357](https://cve.now/CVE-2024-27357.md): An issue was discovered in WithSecure Elements Agent through 23.x for macOS, WithSecure Elements Client Security through 23.x for macOS, and (CVSS 5.8)
- [CVE-2024-27358](https://cve.now/CVE-2024-27358.md): An issue was discovered in WithSecure Elements Agent through 23.x for macOS and WithSecure Elements Client Security through 23.x for macOS. (CVSS 3.3)
- [CVE-2024-37034](https://cve.now/CVE-2024-37034.md): An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. (CVSS 5.9)
- [CVE-2024-40116](https://cve.now/CVE-2024-40116.md): An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, (CVSS 8.1)
- [CVE-2024-40117](https://cve.now/CVE-2024-40117.md): Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via c (CVSS 9.8)
- [CVE-2024-40433](https://cve.now/CVE-2024-40433.md): Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component. (CVSS 8.8)
- [CVE-2024-41353](https://cve.now/CVE-2024-41353.md): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\\admin\\groups\\edit-group.php (CVSS 7.1)
- [CVE-2024-41354](https://cve.now/CVE-2024-41354.md): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/widgets/edit.php (CVSS 7.1)
- [CVE-2024-41355](https://cve.now/CVE-2024-41355.md): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/tools/request-ip/index.php. (CVSS 6.5)
- [CVE-2024-41356](https://cve.now/CVE-2024-41356.md): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\\admin\\firewall-zones\\zones-edit-network.php. (CVSS 4.7)
- [CVE-2024-41357](https://cve.now/CVE-2024-41357.md): phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php. (CVSS 7.1)
- [CVE-2024-41373](https://cve.now/CVE-2024-41373.md): ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. (CVSS 6.3, icecoder/icecoder)
- [CVE-2024-41374](https://cve.now/CVE-2024-41374.md): ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php (CVSS 6.1, icecoder/icecoder)
- [CVE-2024-41375](https://cve.now/CVE-2024-41375.md): ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php (CVSS 6.1, icecoder/icecoder)
- [CVE-2024-41628](https://cve.now/CVE-2024-41628.md): Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9 (CVSS 7.5)
- [CVE-2024-42007](https://cve.now/CVE-2024-42007.md): SPX (aka php-spx) through 0.4.15 allows SPX\_UI\_URI Directory Traversal to read arbitrary files. (CVSS 5.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.