CVEs published July 30, 2024
170 CVEs were published on July 30, 2024: 16 critical, 34 high.
- Published
- 170
- Critical
- 16
- High
- 34
- Medium
- 66
- Low
- 4
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 56
Most affected products
- Linux
- 70
- itsourcecode Alton Management System
- 5
- Matrix Tafnit
- 4
- SourceCodester School Log Management System · Campcodes Sch…
- 4
- xibosignage xibo-cms
- 4
- Akana API Platform
- 3
- discourse
- 3
- Hewlett Packard Enterprise (HPE) ClearPass Policy Manager
- 3
- IBM Aspera Orchestrator
- 3
- SourceCodester Lot Reservation Management System
- 3
Critical 16
- CVE-2024-6699SQLi in Mikafon Electronic's Mikafon MA7Mikafon Electronic Mikafon MA7
- CVE-2024-41702SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')SiberianCMS
- CVE-2023-48396Apache SeaTunnel Web: Authentication bypassApache Software Foundation Apache SeaTunnel Web · org.apach…
- CVE-2024-42108net: rswitch: Avoid use-after-free in rswitch_poll()Linux
- CVE-2024-5975CZ Loan Management <= 1.1 - Unauthenticated SQLiCZ Loan Management
- CVE-2024-5765WpStickyBar <= 2.1.0 - Unauthenticated SQLiWpStickyBar
- CVE-2024-36572Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefault
- CVE-2024-38909Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control.studio-42/elfinder
- CVE-2024-38983Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and
- CVE-2024-38984Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the
- CVE-2024-38986Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other i@75lb/deep-merge
- CVE-2024-39010chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty.
- CVE-2024-39011Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause
- CVE-2024-39012ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects.
- CVE-2024-41610D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely
- CVE-2024-41611In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely t
High 34
- CVE-2023-33976TensorFlow segfault in array_ops.upper_boundtensorflow · tensorflow-gpu +1
- CVE-2024-41915Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management InterfaceHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2024-7297Langflow Privilege Escalationlangflow
- CVE-2024-41802Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Importxibosignage xibo-cms
- CVE-2024-4188Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation.OpenText™ Documentum™ Server
- CVE-2024-7127XSS in Stackposts - Social Marketing ToolStackposts Social Marketing Tool
- CVE-2024-41696Priority PRI WEB Portal Add-On for Priority ERP on prem – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorPRI WEB Portal Add-On for Priority ERP on prem
- CVE-2024-41695Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted DirectoryCybonet PineApp Mail Relay
- CVE-2024-41924Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series.EC-CUBE CO. EC-CUBE 4 series
- CVE-2024-38429Matrix - CWE-552: Files or Directories Accessible to External PartiesMatrix Tafnit
- CVE-2024-42225wifi: mt76: replace skb_put with skb_put_zeroLinux
- CVE-2024-42224net: dsa: mv88e6xxx: Correct check for empty listLinux
- CVE-2024-42162gve: Account for stopped queues when reading NIC statsLinux
- CVE-2024-42152nvmet: fix a possible leak when destroy a ctrl during qp establishmentLinux
- CVE-2024-42145IB/core: Implement a limit on UMAD receive ListLinux
- CVE-2024-42133Bluetooth: Ignore too large handle values in BIGLinux
- CVE-2024-42132bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAXLinux
- CVE-2024-42123drm/amdgpu: fix double free err_addr pointer warningsLinux
- CVE-2024-42120drm/amd/display: Check pipe offset before setting vblankLinux
- CVE-2024-42117drm/amd/display: ASSERT when failing to find index by plane/stream idLinux
- CVE-2024-42115jffs2: Fix potential illegal address access in jffs2_free_inodeLinux
- CVE-2024-42112net: txgbe: free isb resources at the right timeLinux
- CVE-2024-42111btrfs: always do the basic checks for btrfs_qgroup_inherit structureLinux
- CVE-2024-42110net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()Linux
- CVE-2024-42109netfilter: nf_tables: unconditionally flush pending work before notifierLinux
- CVE-2024-42105nilfs2: fix inode number range checksLinux
- CVE-2024-42104nilfs2: add missing check for inode numbers on directory entriesLinux
- CVE-2024-42103btrfs: fix adding block group to a reclaim list and the unused list during reclaimLinux
- CVE-2024-42099s390/dasd: Fix invalid dereferencing of indirect CCW data pointerLinux
- CVE-2024-5807Business Card <= 1.0.0 - Admin+ File UploadBusiness Card
- CVE-2024-7213TOTOLINK A7000R cstecgi.cgi setWizardCfg buffer overflowTOTOLINK A7000R
- CVE-2024-7212TOTOLINK A7000R cstecgi.cgi loginauth buffer overflowTOTOLINK A7000R
- CVE-2024-23091Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values.
- CVE-2024-41305A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary req
Medium, low and unrated 120
- CVE-2024-7277itsourcecode Alton Management System Add a Menu menu.php unrestricted uploaditsourcecode Alton Management System
- CVE-2024-7276itsourcecode Alton Management System member_save.php sql injectionitsourcecode Alton Management System
- CVE-2024-7275itsourcecode Alton Management System category_save.php sql injectionitsourcecode Alton Management System
- CVE-2024-37281Kibana Denial of Service issueElastic Kibana
- CVE-2024-7274itsourcecode Alton Management System reservation_status.php sql injectionitsourcecode Alton Management System
- CVE-2024-7273itsourcecode Alton Management System search.php sql injectionitsourcecode Alton Management System
- CVE-2024-5901SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widgetgpriday SiteOrigin Widgets Bundle
- CVE-2024-41945The fuels-ts typescript SDK has no awareness of to-be-spent transactionsFuelLabs fuels-ts · @fuel-ts/account
- CVE-2024-3930XML External Entity in AkanaAkana API Platform
- CVE-2024-5250Overly Verbose Errors in SAML IntegrationAkana API Platform
- CVE-2024-5249SAML Replay in AkanaAkana API Platform
- CVE-2024-41943I, Librarian Stored XSS vulnerability in Item Summarymkucej i-librarian-free
- CVE-2024-41916Authenticated Sensitive Information Disclosure in ClearPass Policy ManagerHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2022-33167IBM Security Directory Integrator information disclosureIBM Security Directory Integrator · IBM Security Verify Dir…
- CVE-2024-5486Authenticated Sensitive Information Disclosure in ClearPass Policy ManagerHewlett Packard Enterprise (HPE) ClearPass Policy Manager
- CVE-2024-7208CVE-2024-7208HostGator
- CVE-2024-7209CVE-2024-7209NetWin · Bird Fastmail
- CVE-2023-26288IBM Aspera Orchestrator session fixationIBM Aspera Orchestrator
- CVE-2023-38001IBM Aspera Orchestrator cross-site request forgeryIBM Aspera Orchestrator
- CVE-2023-26289IBM Aspera Orchestrator HTTP header injectionIBM Aspera Orchestrator
- CVE-2024-41944Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play reportxibosignage xibo-cms
- CVE-2024-41804Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formulaxibosignage xibo-cms
- CVE-2024-41803Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filterxibosignage xibo-cms
- CVE-2024-41109Pimcore vulnerable to disclosure of system and database information behind /admin firewallpimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2024-39320Discourse allows iframe injection though default site settingdiscourse
- CVE-2024-37299Discourse vulnerable to DoS via Tag Groupdiscourse
- CVE-2024-37165Discourse has an XSS via Onebox systemdiscourse
- CVE-2024-41701AccuPOS – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorAccuPOS
- CVE-2024-41694Cybonet – CWE-200: Exposure of Sensitive Information to an Unauthorized ActorCybonet PineApp Mail Relay
- CVE-2024-7226SourceCodester Medicine Tracker System Password Change cross-site request forgerySourceCodester Medicine Tracker System
- CVE-2024-38432Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied FileMatrix Tafnit
- CVE-2024-38431Matrix Tafnit v8 - CWE-204: Observable Response DiscrepancyMatrix Tafnit
- CVE-2024-38430Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Matrix Tafnit
- CVE-2024-41141Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin.EC-CUBE CO. EC-CUBE Web API Plugin
- CVE-2024-40895FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticatedFFRI Security FFRI AMC · NEC FFRI AMC for ActSecure χ +1
- CVE-2024-7225SourceCodester Insurance Management System Edit Insurance Policy Page update_policy cross site scriptingSourceCodester Insurance Management System
- CVE-2024-41693Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)Mashov
- CVE-2024-7224SourceCodester Lot Reservation Management System lot_details.php sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-42231btrfs: zoned: fix calc_available_free_space() for zoned modeLinux
- CVE-2024-42230powerpc/pseries: Fix scv instruction crash with kexecLinux
- CVE-2024-42229crypto: aead,cipher - zeroize key buffer after useLinux
- CVE-2024-42228drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_relocLinux
- CVE-2024-42227drm/amd/display: Fix overlapping copy within dml_core_mode_programmingLinux
- CVE-2024-42223media: dvb-frontends: tda10048: Fix integer overflowLinux
- CVE-2024-42161bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELDLinux
- CVE-2024-42160f2fs: check validation of fault attrs in f2fs_build_fault_attr()Linux
- CVE-2024-42159scsi: mpi3mr: Sanitise num_physLinux
- CVE-2024-42158s390/pkey: Use kfree_sensitive() to fix Coccinelle warningsLinux
- CVE-2024-42157s390/pkey: Wipe sensitive data on failureLinux
- CVE-2024-42156s390/pkey: Wipe copies of clear-key structures on failureLinux
- CVE-2024-42155s390/pkey: Wipe copies of protected- and secure-keysLinux
- CVE-2024-42154tcp_metrics: validate source addr lengthLinux
- CVE-2024-42153i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isrLinux
- CVE-2024-42151bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullableLinux
- CVE-2024-42150net: txgbe: remove separate irq request for MSI and INTxLinux
- CVE-2024-42149fs: don't misleadingly warn during thaw operationsLinux
- CVE-2024-42148bnx2x: Fix multiple UBSAN array-index-out-of-boundsLinux
- CVE-2024-42147crypto: hisilicon/debugfs - Fix debugfs uninit process issueLinux
- CVE-2024-42146drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_bufLinux
- CVE-2024-42144thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_dataLinux
- CVE-2024-42142net/mlx5: E-switch, Create ingress ACL when neededLinux
- CVE-2024-42141Bluetooth: ISO: Check socket flag instead of hconLinux
- CVE-2024-42140riscv: kexec: Avoid deadlock in kexec crash pathLinux
- CVE-2024-42139ice: Fix improper extts handlingLinux
- CVE-2024-42138mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI fileLinux
- CVE-2024-42137Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm rebootLinux
- CVE-2024-42136cdrom: rearrange last_media_change check to avoid unintentional overflowLinux
- CVE-2024-42135vhost_task: Handle SIGKILL by flushing work and exitingLinux
- CVE-2024-42134virtio-pci: Check if is_avq is NULLLinux
- CVE-2024-42131mm: avoid overflows in dirty throttling logicLinux
- CVE-2024-42129leds: mlxreg: Use devm_mutex_init() for mutex initializationLinux
- CVE-2024-42128leds: an30259a: Use devm_mutex_init() for mutex initializationLinux
- CVE-2024-42127drm/lima: fix shared irq handling on driver removeLinux
- CVE-2024-42126powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.Linux
- CVE-2024-42125wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sbandLinux
- CVE-2024-42124scsi: qedf: Make qedf_execute_tmf() non-preemptibleLinux
- CVE-2024-42122drm/amd/display: Add NULL pointer check for kzallocLinux
- CVE-2024-42121drm/amd/display: Check index msg_id before read or writeLinux
- CVE-2024-42119drm/amd/display: Skip finding free audio for unknown engine_idLinux
- CVE-2024-42118drm/amd/display: Do not return negative stream id for arrayLinux
- CVE-2024-42114wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM valuesLinux
- CVE-2024-42113net: txgbe: initialize num_q_vectors for MSI/INTx interruptsLinux
- CVE-2024-42107ice: Don't process extts if PTP is disabledLinux
- CVE-2024-42106inet_diag: Initialize pad field in struct inet_diag_req_v2Linux
- CVE-2024-42102Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"Linux
- CVE-2024-42101drm/nouveau: fix null pointer dereference in nouveau_connector_get_modesLinux
- CVE-2024-42100clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without commonLinux
- CVE-2023-52888media: mediatek: vcodec: Only free buffer VA that is not NULLLinux
- CVE-2024-7223SourceCodester Lot Reservation Management System view_model.php sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-7222SourceCodester Lot Reservation Management System home.php sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-7100Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcodeboldthemes Bold Page Builder
- CVE-2024-7221SourceCodester/Campcodes School Log Management System manage_user.php sql injectionSourceCodester School Log Management System · Campcodes Sch…
- CVE-2024-6536Zephyr Project Manager < 3.3.99 - Editor+ XSSZephyr Project Manager
- CVE-2024-6230Pardakht Delkhah <= 2.9.8 - Form Fields Reset via CSRFپلاگین پرداخت دلخواه
- CVE-2024-6226WpStickyBar <= 2.1.0 - Reflected XSSWpStickyBar
- CVE-2024-6224Send email only on Reply to My Comment <= 1.0.6 - Stored XSS via CSRFSend email only on Reply to My Comment
- CVE-2024-6223Send email only on Reply to My Comment <= 1.0.6 - Reflected XSSSend email only on Reply to My Comment
- CVE-2024-6021Donation Block for PayPal <= 2.1.0 - Unauthenticated Stored XSSDonation Block For PayPal
- CVE-2024-5809WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site ScriptingWP Ajax Contact Form
- CVE-2024-5808WP Ajax Contact Form <= 2.2.2 - Arbitrary Email Deletion via CSRFWP Ajax Contact Form
- CVE-2024-7220SourceCodester/Campcodes School Log Management System print_barcode.php sql injectionSourceCodester School Log Management System · Campcodes Sch…
- CVE-2024-4096Responsive Tabs <= 4.0.8 - Contributor+ Stored XSSResponsive Tabs
- CVE-2024-3986SportsPress < 2.7.22 - Admin+ Stored XSSSportsPress
- CVE-2024-3669Web Directory Free < 1.7.2 - Reflected XSSWeb Directory Free
- CVE-2024-3113FormFlow < 2.12.2 - Admin+ Stored XSSFormFlow: WhatsApp Social and Advanced Form Builder with Ea…
- CVE-2024-1287Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLipmpro-member-directory
- CVE-2024-1286Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosurepmpro-membership-maps
- CVE-2024-7219SourceCodester/Campcodes School Log Management System ajax.php sql injectionSourceCodester School Log Management System · Campcodes Sch…
- CVE-2024-7218SourceCodester/Campcodes School Log Management System ajax.php cross site scriptingSourceCodester School Log Management System · Campcodes Sch…
- CVE-2024-7217TOTOLINK CA300-PoE cstecgi.cgi loginauth buffer overflowTOTOLINK CA300-PoE
- CVE-2024-7216TOTOLINK LR1200 shadow.sample hard-coded passwordTOTOLINK LR1200
- CVE-2024-7215TOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injectionTOTOLINK LR1200
- CVE-2024-7214TOTOLINK LR350 cstecgi.cgi setWanCfg command injectionTOTOLINK LR350
- CVE-2024-40094GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of sercom.graphql-java:graphql-java
- CVE-2024-41304An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via
- CVE-2024-41437A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (D
- CVE-2024-41438A heap buffer overflow in the function cp_stored() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS
- CVE-2024-41439A heap buffer overflow in the function cp_block() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS)
- CVE-2024-41440A heap buffer overflow in the function png_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PN
- CVE-2024-41443A stack overflow in the function cp_dynamic() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via