CVEs published July 28, 2024
27 CVEs were published on July 28, 2024: 1 critical, 7 high.
- Published
- 27
- Critical
- 1
- High
- 7
- Medium
- 18
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- SourceCodester School Fees Payment System
- 6
- TOTOLINK A3600R
- 4
- SeaCMS
- 3
- TOTOLINK A3700R
- 3
- TOTOLINK A3100R
- 2
- TOTOLINK A3000RU
- 1
- TOTOLINK A3300R
- 1
Critical 1
High 7
- CVE-2024-7173TOTOLINK A3600R cstecgi.cgi loginauth buffer overflowTOTOLINK A3600R
- CVE-2024-7172TOTOLINK A3600R getSaveConfig buffer overflowTOTOLINK A3600R
- CVE-2024-7157TOTOLINK A3100R getSaveConfig buffer overflowTOTOLINK A3100R
- CVE-2024-42050The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation.
- CVE-2024-42051The MSI installer for Splashtop Streamer for Windows before 3.6.2.0 uses a temporary folder with weak permissions during installation.
- CVE-2024-42052The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation.
- CVE-2024-42053The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation.
Medium, low and unrated 19
- CVE-2024-7171TOTOLINK A3600R cstecgi.cgi NTPSyncWithHost os command injectionTOTOLINK A3600R
- CVE-2024-7170TOTOLINK A3000RU product.ini hard-coded passwordTOTOLINK A3000RU
- CVE-2024-7169SourceCodester School Fees Payment System ajax.php cross-site request forgerySourceCodester School Fees Payment System
- CVE-2024-7168SourceCodester School Fees Payment System manage_user.php sql injectionSourceCodester School Fees Payment System
- CVE-2024-7167SourceCodester School Fees Payment System manage_course.php sql injectionSourceCodester School Fees Payment System
- CVE-2024-7166SourceCodester School Fees Payment System receipt.php sql injectionSourceCodester School Fees Payment System
- CVE-2024-7165SourceCodester School Fees Payment System view_payment.php sql injectionSourceCodester School Fees Payment System
- CVE-2024-7164SourceCodester School Fees Payment System sql injectionSourceCodester School Fees Payment System
- CVE-2024-7163SeaCMS index.php cross site scriptingSeaCMS
- CVE-2024-7162SeaCMS cross site scriptingSeaCMS
- CVE-2024-7161SeaCMS Password Change cross-site request forgerySeaCMS
- CVE-2024-7160TOTOLINK A3700R cstecgi.cgi setWanCfg command injectionTOTOLINK A3700R
- CVE-2024-7159TOTOLINK A3600R Telnet Service product.ini hard-coded passwordTOTOLINK A3600R
- CVE-2024-7158TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injectionTOTOLINK A3100R
- CVE-2024-7156TOTOLINK A3700R apmib Configuration ExportSettings.sh information disclosureTOTOLINK A3700R
- CVE-2024-7155TOTOLINK A3300R shadow.sample hard-coded passwordTOTOLINK A3300R
- CVE-2024-7154TOTOLINK A3700R Password Reset wizard.html access controlTOTOLINK A3700R
- CVE-2024-42054Cervantes through 0.5-alpha accepts insecure file uploads.
- CVE-2024-42055Cervantes through 0.5-alpha allows stored XSS.