# CVEs published 2024-07-30

170 CVEs were published on July 30, 2024: 16 critical, 34 high. Days are UTC.

- [CVE-2024-7277](https://cve.now/CVE-2024-7277.md): itsourcecode Alton Management System Add a Menu menu.php unrestricted upload (CVSS 5.1, itsourcecode Alton Management System)
- [CVE-2024-7276](https://cve.now/CVE-2024-7276.md): itsourcecode Alton Management System member\_save.php sql injection (CVSS 5.1, itsourcecode Alton Management System)
- [CVE-2024-7275](https://cve.now/CVE-2024-7275.md): itsourcecode Alton Management System category\_save.php sql injection (CVSS 5.1, itsourcecode Alton Management System)
- [CVE-2024-37281](https://cve.now/CVE-2024-37281.md): Kibana Denial of Service issue (CVSS 6.5, Elastic Kibana)
- [CVE-2024-7274](https://cve.now/CVE-2024-7274.md): itsourcecode Alton Management System reservation\_status.php sql injection (CVSS 5.1, itsourcecode Alton Management System)
- [CVE-2024-7273](https://cve.now/CVE-2024-7273.md): itsourcecode Alton Management System search.php sql injection (CVSS 5.3, itsourcecode Alton Management System)
- [CVE-2024-5901](https://cve.now/CVE-2024-5901.md): SiteOrigin Widgets Bundle \<= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget (CVSS 6.4, gpriday SiteOrigin Widgets Bundle)
- [CVE-2024-41945](https://cve.now/CVE-2024-41945.md): The fuels-ts typescript SDK has no awareness of to-be-spent transactions (CVSS 3.1, FuelLabs fuels-ts · @fuel-ts/account)
- [CVE-2023-33976](https://cve.now/CVE-2023-33976.md): TensorFlow segfault in array\_ops.upper\_bound (CVSS 7.5, tensorflow · tensorflow-gpu +1)
- [CVE-2024-3930](https://cve.now/CVE-2024-3930.md): XML External Entity in Akana (CVSS 6.3, Akana API Platform)
- [CVE-2024-5250](https://cve.now/CVE-2024-5250.md): Overly Verbose Errors in SAML Integration (CVSS 3.5, Akana API Platform)
- [CVE-2024-5249](https://cve.now/CVE-2024-5249.md): SAML Replay in Akana (CVSS 5.4, Akana API Platform)
- [CVE-2024-41943](https://cve.now/CVE-2024-41943.md): I, Librarian Stored XSS vulnerability in Item Summary (CVSS 4.6, mkucej i-librarian-free)
- [CVE-2024-41916](https://cve.now/CVE-2024-41916.md): Authenticated Sensitive Information Disclosure in ClearPass Policy Manager (CVSS 6.8, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2024-41915](https://cve.now/CVE-2024-41915.md): Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2022-33167](https://cve.now/CVE-2022-33167.md): IBM Security Directory Integrator information disclosure (CVSS 3.7, IBM Security Directory Integrator · IBM Security Verify Dir…)
- [CVE-2024-5486](https://cve.now/CVE-2024-5486.md): Authenticated Sensitive Information Disclosure in ClearPass Policy Manager (CVSS 5.8, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2024-7208](https://cve.now/CVE-2024-7208.md): CVE-2024-7208 (CVSS 6.5, HostGator)
- [CVE-2024-7209](https://cve.now/CVE-2024-7209.md): CVE-2024-7209 (CVSS 6.5, NetWin · Bird Fastmail)
- [CVE-2023-26288](https://cve.now/CVE-2023-26288.md): IBM Aspera Orchestrator session fixation (CVSS 5.5, IBM Aspera Orchestrator)
- [CVE-2023-38001](https://cve.now/CVE-2023-38001.md): IBM Aspera Orchestrator cross-site request forgery (CVSS 6.5, IBM Aspera Orchestrator)
- [CVE-2023-26289](https://cve.now/CVE-2023-26289.md): IBM Aspera Orchestrator HTTP header injection (CVSS 5.4, IBM Aspera Orchestrator)
- [CVE-2024-41944](https://cve.now/CVE-2024-41944.md): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report (CVSS 6.5, xibosignage xibo-cms)
- [CVE-2024-7297](https://cve.now/CVE-2024-7297.md): Langflow Privilege Escalation (CVSS 8.8, langflow)
- [CVE-2024-41804](https://cve.now/CVE-2024-41804.md): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula (CVSS 6.5, xibosignage xibo-cms)
- [CVE-2024-41802](https://cve.now/CVE-2024-41802.md): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import (CVSS 8.1, xibosignage xibo-cms)
- [CVE-2024-41803](https://cve.now/CVE-2024-41803.md): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter (CVSS 4.9, xibosignage xibo-cms)
- [CVE-2024-41109](https://cve.now/CVE-2024-41109.md): Pimcore vulnerable to disclosure of system and database information behind /admin firewall (CVSS 6.3, pimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…)
- [CVE-2024-4188](https://cve.now/CVE-2024-4188.md): Security vulnerability exists in Documentum server cloud releases that could allow access to sensitive information which can impact system Operation. (CVSS 7.1, OpenText™ Documentum™ Server)
- [CVE-2024-39320](https://cve.now/CVE-2024-39320.md): Discourse allows iframe injection though default site setting (CVSS 6.1, discourse)
- [CVE-2024-37299](https://cve.now/CVE-2024-37299.md): Discourse vulnerable to DoS via Tag Group (CVSS 4.9, discourse)
- [CVE-2024-37165](https://cve.now/CVE-2024-37165.md): Discourse has an XSS via Onebox system (CVSS 6.3, discourse)
- [CVE-2024-6699](https://cve.now/CVE-2024-6699.md): SQLi in Mikafon Electronic's Mikafon MA7 (CVSS 9.3, Mikafon Electronic Mikafon MA7)
- [CVE-2024-7127](https://cve.now/CVE-2024-7127.md): XSS in Stackposts - Social Marketing Tool (CVSS 7.2, Stackposts Social Marketing Tool)
- [CVE-2024-41702](https://cve.now/CVE-2024-41702.md): SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVSS 9.8, SiberianCMS)
- [CVE-2024-41701](https://cve.now/CVE-2024-41701.md): AccuPOS – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, AccuPOS)
- [CVE-2024-41696](https://cve.now/CVE-2024-41696.md): Priority PRI WEB Portal Add-On for Priority ERP on prem – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, PRI WEB Portal Add-On for Priority ERP on prem)
- [CVE-2024-41695](https://cve.now/CVE-2024-41695.md): Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory (CVSS 7.5, Cybonet PineApp Mail Relay)
- [CVE-2024-41694](https://cve.now/CVE-2024-41694.md): Cybonet – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, Cybonet PineApp Mail Relay)
- [CVE-2024-7226](https://cve.now/CVE-2024-7226.md): SourceCodester Medicine Tracker System Password Change cross-site request forgery (CVSS 6.9, SourceCodester Medicine Tracker System)
- [CVE-2024-38432](https://cve.now/CVE-2024-38432.md): Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File (CVSS 5.5, Matrix Tafnit)
- [CVE-2024-38431](https://cve.now/CVE-2024-38431.md): Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy (CVSS 5.3, Matrix Tafnit)
- [CVE-2024-38430](https://cve.now/CVE-2024-38430.md): Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 5.4, Matrix Tafnit)
- [CVE-2024-41924](https://cve.now/CVE-2024-41924.md): Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. (CVSS 7.2, EC-CUBE CO. EC-CUBE 4 series)
- [CVE-2024-41141](https://cve.now/CVE-2024-41141.md): Stored cross-site scripting vulnerability exists in EC-CUBE Web API Plugin. (CVSS 6.1, EC-CUBE CO. EC-CUBE Web API Plugin)
- [CVE-2024-38429](https://cve.now/CVE-2024-38429.md): Matrix - CWE-552: Files or Directories Accessible to External Parties (CVSS 7.5, Matrix Tafnit)
- [CVE-2024-40895](https://cve.now/CVE-2024-40895.md): FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated (CVSS 6.4, FFRI Security FFRI AMC · NEC FFRI AMC for ActSecure χ +1)
- [CVE-2024-7225](https://cve.now/CVE-2024-7225.md): SourceCodester Insurance Management System Edit Insurance Policy Page update\_policy cross site scripting (CVSS 5.3, SourceCodester Insurance Management System)
- [CVE-2024-41693](https://cve.now/CVE-2024-41693.md): Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVSS 6.1, Mashov)
- [CVE-2023-48396](https://cve.now/CVE-2023-48396.md): Apache SeaTunnel Web: Authentication bypass (CVSS 9.1, Apache Software Foundation Apache SeaTunnel Web · org.apach…)
- [CVE-2024-7224](https://cve.now/CVE-2024-7224.md): SourceCodester Lot Reservation Management System lot\_details.php sql injection (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-42231](https://cve.now/CVE-2024-42231.md): btrfs: zoned: fix calc\_available\_free\_space() for zoned mode (no CVSS, Linux)
- [CVE-2024-42230](https://cve.now/CVE-2024-42230.md): powerpc/pseries: Fix scv instruction crash with kexec (no CVSS, Linux)
- [CVE-2024-42229](https://cve.now/CVE-2024-42229.md): crypto: aead,cipher - zeroize key buffer after use (no CVSS, Linux)
- [CVE-2024-42228](https://cve.now/CVE-2024-42228.md): drm/amdgpu: Using uninitialized value \*size when calling amdgpu\_vce\_cs\_reloc (no CVSS, Linux)
- [CVE-2024-42227](https://cve.now/CVE-2024-42227.md): drm/amd/display: Fix overlapping copy within dml\_core\_mode\_programming (no CVSS, Linux)
- [CVE-2024-42225](https://cve.now/CVE-2024-42225.md): wifi: mt76: replace skb\_put with skb\_put\_zero (CVSS 8.3, Linux)
- [CVE-2024-42224](https://cve.now/CVE-2024-42224.md): net: dsa: mv88e6xxx: Correct check for empty list (CVSS 7.0, Linux)
- [CVE-2024-42223](https://cve.now/CVE-2024-42223.md): media: dvb-frontends: tda10048: Fix integer overflow (no CVSS, Linux)
- [CVE-2024-42162](https://cve.now/CVE-2024-42162.md): gve: Account for stopped queues when reading NIC stats (CVSS 7.8, Linux)
- [CVE-2024-42161](https://cve.now/CVE-2024-42161.md): bpf: Avoid uninitialized value in BPF\_CORE\_READ\_BITFIELD (no CVSS, Linux)
- [CVE-2024-42160](https://cve.now/CVE-2024-42160.md): f2fs: check validation of fault attrs in f2fs\_build\_fault\_attr() (no CVSS, Linux)
- [CVE-2024-42159](https://cve.now/CVE-2024-42159.md): scsi: mpi3mr: Sanitise num\_phys (no CVSS, Linux)
- [CVE-2024-42158](https://cve.now/CVE-2024-42158.md): s390/pkey: Use kfree\_sensitive() to fix Coccinelle warnings (no CVSS, Linux)
- [CVE-2024-42157](https://cve.now/CVE-2024-42157.md): s390/pkey: Wipe sensitive data on failure (no CVSS, Linux)
- [CVE-2024-42156](https://cve.now/CVE-2024-42156.md): s390/pkey: Wipe copies of clear-key structures on failure (no CVSS, Linux)
- [CVE-2024-42155](https://cve.now/CVE-2024-42155.md): s390/pkey: Wipe copies of protected- and secure-keys (no CVSS, Linux)
- [CVE-2024-42154](https://cve.now/CVE-2024-42154.md): tcp\_metrics: validate source addr length (no CVSS, Linux)
- [CVE-2024-42153](https://cve.now/CVE-2024-42153.md): i2c: pnx: Fix potential deadlock warning from del\_timer\_sync() call in isr (no CVSS, Linux)
- [CVE-2024-42152](https://cve.now/CVE-2024-42152.md): nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVSS 7.5, Linux)
- [CVE-2024-42151](https://cve.now/CVE-2024-42151.md): bpf: mark bpf\_dummy\_struct\_ops.test\_1 parameter as nullable (no CVSS, Linux)
- [CVE-2024-42150](https://cve.now/CVE-2024-42150.md): net: txgbe: remove separate irq request for MSI and INTx (no CVSS, Linux)
- [CVE-2024-42149](https://cve.now/CVE-2024-42149.md): fs: don't misleadingly warn during thaw operations (no CVSS, Linux)
- [CVE-2024-42148](https://cve.now/CVE-2024-42148.md): bnx2x: Fix multiple UBSAN array-index-out-of-bounds (no CVSS, Linux)
- [CVE-2024-42147](https://cve.now/CVE-2024-42147.md): crypto: hisilicon/debugfs - Fix debugfs uninit process issue (no CVSS, Linux)
- [CVE-2024-42146](https://cve.now/CVE-2024-42146.md): drm/xe: Add outer runtime\_pm protection to xe\_live\_ktest@xe\_dma\_buf (no CVSS, Linux)
- [CVE-2024-42145](https://cve.now/CVE-2024-42145.md): IB/core: Implement a limit on UMAD receive List (CVSS 7.5, Linux)
- [CVE-2024-42144](https://cve.now/CVE-2024-42144.md): thermal/drivers/mediatek/lvts\_thermal: Check NULL ptr on lvts\_data (no CVSS, Linux)
- [CVE-2024-42142](https://cve.now/CVE-2024-42142.md): net/mlx5: E-switch, Create ingress ACL when needed (no CVSS, Linux)
- [CVE-2024-42141](https://cve.now/CVE-2024-42141.md): Bluetooth: ISO: Check socket flag instead of hcon (no CVSS, Linux)
- [CVE-2024-42140](https://cve.now/CVE-2024-42140.md): riscv: kexec: Avoid deadlock in kexec crash path (no CVSS, Linux)
- [CVE-2024-42139](https://cve.now/CVE-2024-42139.md): ice: Fix improper extts handling (no CVSS, Linux)
- [CVE-2024-42138](https://cve.now/CVE-2024-42138.md): mlxsw: core\_linecards: Fix double memory deallocation in case of invalid INI file (no CVSS, Linux)
- [CVE-2024-42137](https://cve.now/CVE-2024-42137.md): Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot (no CVSS, Linux)
- [CVE-2024-42136](https://cve.now/CVE-2024-42136.md): cdrom: rearrange last\_media\_change check to avoid unintentional overflow (no CVSS, Linux)
- [CVE-2024-42135](https://cve.now/CVE-2024-42135.md): vhost\_task: Handle SIGKILL by flushing work and exiting (no CVSS, Linux)
- [CVE-2024-42134](https://cve.now/CVE-2024-42134.md): virtio-pci: Check if is\_avq is NULL (no CVSS, Linux)
- [CVE-2024-42133](https://cve.now/CVE-2024-42133.md): Bluetooth: Ignore too large handle values in BIG (CVSS 7.6, Linux)
- [CVE-2024-42132](https://cve.now/CVE-2024-42132.md): bluetooth/hci: disallow setting handle bigger than HCI\_CONN\_HANDLE\_MAX (CVSS 7.6, Linux)
- [CVE-2024-42131](https://cve.now/CVE-2024-42131.md): mm: avoid overflows in dirty throttling logic (no CVSS, Linux)
- [CVE-2024-42129](https://cve.now/CVE-2024-42129.md): leds: mlxreg: Use devm\_mutex\_init() for mutex initialization (no CVSS, Linux)
- [CVE-2024-42128](https://cve.now/CVE-2024-42128.md): leds: an30259a: Use devm\_mutex\_init() for mutex initialization (no CVSS, Linux)
- [CVE-2024-42127](https://cve.now/CVE-2024-42127.md): drm/lima: fix shared irq handling on driver remove (no CVSS, Linux)
- [CVE-2024-42126](https://cve.now/CVE-2024-42126.md): powerpc: Avoid nmi\_enter/nmi\_exit in real mode interrupt. (no CVSS, Linux)
- [CVE-2024-42125](https://cve.now/CVE-2024-42125.md): wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband (no CVSS, Linux)
- [CVE-2024-42124](https://cve.now/CVE-2024-42124.md): scsi: qedf: Make qedf\_execute\_tmf() non-preemptible (no CVSS, Linux)
- [CVE-2024-42123](https://cve.now/CVE-2024-42123.md): drm/amdgpu: fix double free err\_addr pointer warnings (CVSS 7.0, Linux)
- [CVE-2024-42122](https://cve.now/CVE-2024-42122.md): drm/amd/display: Add NULL pointer check for kzalloc (no CVSS, Linux)
- [CVE-2024-42121](https://cve.now/CVE-2024-42121.md): drm/amd/display: Check index msg\_id before read or write (no CVSS, Linux)
- [CVE-2024-42120](https://cve.now/CVE-2024-42120.md): drm/amd/display: Check pipe offset before setting vblank (CVSS 7.8, Linux)
- [CVE-2024-42119](https://cve.now/CVE-2024-42119.md): drm/amd/display: Skip finding free audio for unknown engine\_id (no CVSS, Linux)
- [CVE-2024-42118](https://cve.now/CVE-2024-42118.md): drm/amd/display: Do not return negative stream id for array (no CVSS, Linux)
- [CVE-2024-42117](https://cve.now/CVE-2024-42117.md): drm/amd/display: ASSERT when failing to find index by plane/stream id (CVSS 7.8, Linux)
- [CVE-2024-42115](https://cve.now/CVE-2024-42115.md): jffs2: Fix potential illegal address access in jffs2\_free\_inode (CVSS 7.8, Linux)
- [CVE-2024-42114](https://cve.now/CVE-2024-42114.md): wifi: cfg80211: restrict NL80211\_ATTR\_TXQ\_QUANTUM values (no CVSS, Linux)
- [CVE-2024-42113](https://cve.now/CVE-2024-42113.md): net: txgbe: initialize num\_q\_vectors for MSI/INTx interrupts (no CVSS, Linux)
- [CVE-2024-42112](https://cve.now/CVE-2024-42112.md): net: txgbe: free isb resources at the right time (CVSS 7.8, Linux)
- [CVE-2024-42111](https://cve.now/CVE-2024-42111.md): btrfs: always do the basic checks for btrfs\_qgroup\_inherit structure (CVSS 7.8, Linux)
- [CVE-2024-42110](https://cve.now/CVE-2024-42110.md): net: ntb\_netdev: Move ntb\_netdev\_rx\_handler() to call netif\_rx() from \_\_netif\_rx() (CVSS 7.5, Linux)
- [CVE-2024-42109](https://cve.now/CVE-2024-42109.md): netfilter: nf\_tables: unconditionally flush pending work before notifier (CVSS 7.8, Linux)
- [CVE-2024-42108](https://cve.now/CVE-2024-42108.md): net: rswitch: Avoid use-after-free in rswitch\_poll() (CVSS 9.8, Linux)
- [CVE-2024-42107](https://cve.now/CVE-2024-42107.md): ice: Don't process extts if PTP is disabled (no CVSS, Linux)
- [CVE-2024-42106](https://cve.now/CVE-2024-42106.md): inet\_diag: Initialize pad field in struct inet\_diag\_req\_v2 (no CVSS, Linux)
- [CVE-2024-42105](https://cve.now/CVE-2024-42105.md): nilfs2: fix inode number range checks (CVSS 7.8, Linux)
- [CVE-2024-42104](https://cve.now/CVE-2024-42104.md): nilfs2: add missing check for inode numbers on directory entries (CVSS 7.8, Linux)
- [CVE-2024-42103](https://cve.now/CVE-2024-42103.md): btrfs: fix adding block group to a reclaim list and the unused list during reclaim (CVSS 7.8, Linux)
- [CVE-2024-42102](https://cve.now/CVE-2024-42102.md): Revert "mm/writeback: fix possible divide-by-zero in wb\_dirty\_limits(), again" (no CVSS, Linux)
- [CVE-2024-42101](https://cve.now/CVE-2024-42101.md): drm/nouveau: fix null pointer dereference in nouveau\_connector\_get\_modes (no CVSS, Linux)
- [CVE-2024-42100](https://cve.now/CVE-2024-42100.md): clk: sunxi-ng: common: Don't call hw\_to\_ccu\_common on hw without common (no CVSS, Linux)
- [CVE-2024-42099](https://cve.now/CVE-2024-42099.md): s390/dasd: Fix invalid dereferencing of indirect CCW data pointer (CVSS 7.8, Linux)
- [CVE-2023-52888](https://cve.now/CVE-2023-52888.md): media: mediatek: vcodec: Only free buffer VA that is not NULL (no CVSS, Linux)
- [CVE-2024-7223](https://cve.now/CVE-2024-7223.md): SourceCodester Lot Reservation Management System view\_model.php sql injection (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-7222](https://cve.now/CVE-2024-7222.md): SourceCodester Lot Reservation Management System home.php sql injection (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-7100](https://cve.now/CVE-2024-7100.md): Bold Page Builder \<= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_button Shortcode (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2024-7221](https://cve.now/CVE-2024-7221.md): SourceCodester/Campcodes School Log Management System manage\_user.php sql injection (CVSS 5.3, SourceCodester School Log Management System · Campcodes Sch…)
- [CVE-2024-6536](https://cve.now/CVE-2024-6536.md): Zephyr Project Manager \< 3.3.99 - Editor+ XSS (CVSS 5.4, Zephyr Project Manager)
- [CVE-2024-6230](https://cve.now/CVE-2024-6230.md): Pardakht Delkhah \<= 2.9.8 - Form Fields Reset via CSRF (CVSS 6.5, پلاگین پرداخت دلخواه)
- [CVE-2024-6226](https://cve.now/CVE-2024-6226.md): WpStickyBar \<= 2.1.0 - Reflected XSS (CVSS 6.1, WpStickyBar)
- [CVE-2024-6224](https://cve.now/CVE-2024-6224.md): Send email only on Reply to My Comment \<= 1.0.6 - Stored XSS via CSRF (CVSS 5.9, Send email only on Reply to My Comment)
- [CVE-2024-6223](https://cve.now/CVE-2024-6223.md): Send email only on Reply to My Comment \<= 1.0.6 - Reflected XSS (CVSS 6.1, Send email only on Reply to My Comment)
- [CVE-2024-6021](https://cve.now/CVE-2024-6021.md): Donation Block for PayPal \<= 2.1.0 - Unauthenticated Stored XSS (CVSS 6.8, Donation Block For PayPal)
- [CVE-2024-5975](https://cve.now/CVE-2024-5975.md): CZ Loan Management \<= 1.1 - Unauthenticated SQLi (CVSS 9.1, CZ Loan Management)
- [CVE-2024-5809](https://cve.now/CVE-2024-5809.md): WP Ajax Contact Form \<= 2.2.2 - Reflected Cross-Site Scripting (CVSS 6.1, WP Ajax Contact Form)
- [CVE-2024-5808](https://cve.now/CVE-2024-5808.md): WP Ajax Contact Form \<= 2.2.2 - Arbitrary Email Deletion via CSRF (CVSS 4.3, WP Ajax Contact Form)
- [CVE-2024-5807](https://cve.now/CVE-2024-5807.md): Business Card \<= 1.0.0 - Admin+ File Upload (CVSS 7.2, Business Card)
- [CVE-2024-7220](https://cve.now/CVE-2024-7220.md): SourceCodester/Campcodes School Log Management System print\_barcode.php sql injection (CVSS 5.3, SourceCodester School Log Management System · Campcodes Sch…)
- [CVE-2024-5765](https://cve.now/CVE-2024-5765.md): WpStickyBar \<= 2.1.0 - Unauthenticated SQLi (CVSS 9.8, WpStickyBar)
- [CVE-2024-4096](https://cve.now/CVE-2024-4096.md): Responsive Tabs \<= 4.0.8 - Contributor+ Stored XSS (CVSS 5.9, Responsive Tabs)
- [CVE-2024-3986](https://cve.now/CVE-2024-3986.md): SportsPress \< 2.7.22 - Admin+ Stored XSS (CVSS 4.8, SportsPress)
- [CVE-2024-3669](https://cve.now/CVE-2024-3669.md): Web Directory Free \< 1.7.2 - Reflected XSS (CVSS 6.8, Web Directory Free)
- [CVE-2024-3113](https://cve.now/CVE-2024-3113.md): FormFlow \< 2.12.2 - Admin+ Stored XSS (CVSS 5.9, FormFlow: WhatsApp Social and Advanced Form Builder with Ea…)
- [CVE-2024-1287](https://cve.now/CVE-2024-1287.md): Paid Memberships Pro - Member Directory Add On \< 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi (CVSS 6.5, pmpro-member-directory)
- [CVE-2024-1286](https://cve.now/CVE-2024-1286.md): Paid Memberships Pro - Membership Maps Add On \< 0.7 - Contributor+ Sensitive Information Disclosure (CVSS 4.9, pmpro-membership-maps)
- [CVE-2024-7219](https://cve.now/CVE-2024-7219.md): SourceCodester/Campcodes School Log Management System ajax.php sql injection (CVSS 6.9, SourceCodester School Log Management System · Campcodes Sch…)
- [CVE-2024-7218](https://cve.now/CVE-2024-7218.md): SourceCodester/Campcodes School Log Management System ajax.php cross site scripting (CVSS 5.1, SourceCodester School Log Management System · Campcodes Sch…)
- [CVE-2024-7217](https://cve.now/CVE-2024-7217.md): TOTOLINK CA300-PoE cstecgi.cgi loginauth buffer overflow (CVSS 5.3, TOTOLINK CA300-PoE)
- [CVE-2024-7216](https://cve.now/CVE-2024-7216.md): TOTOLINK LR1200 shadow.sample hard-coded password (CVSS 2.1, TOTOLINK LR1200)
- [CVE-2024-7215](https://cve.now/CVE-2024-7215.md): TOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injection (CVSS 5.3, TOTOLINK LR1200)
- [CVE-2024-7214](https://cve.now/CVE-2024-7214.md): TOTOLINK LR350 cstecgi.cgi setWanCfg command injection (CVSS 5.3, TOTOLINK LR350)
- [CVE-2024-7213](https://cve.now/CVE-2024-7213.md): TOTOLINK A7000R cstecgi.cgi setWizardCfg buffer overflow (CVSS 8.7, TOTOLINK A7000R)
- [CVE-2024-7212](https://cve.now/CVE-2024-7212.md): TOTOLINK A7000R cstecgi.cgi loginauth buffer overflow (CVSS 8.7, TOTOLINK A7000R)
- [CVE-2024-23091](https://cve.now/CVE-2024-23091.md): Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values. (CVSS 7.5)
- [CVE-2024-36572](https://cve.now/CVE-2024-36572.md): Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefault (CVSS 9.8)
- [CVE-2024-38909](https://cve.now/CVE-2024-38909.md): Studio 42 elFinder 2.1.64 is vulnerable to Incorrect Access Control. (CVSS 9.8, studio-42/elfinder)
- [CVE-2024-38983](https://cve.now/CVE-2024-38983.md): Prototype Pollution in alykoshin mini-deep-assign v0.0.8 allows an attacker to execute arbitrary code or cause a Denial of Service (DoS) and (CVSS 9.8)
- [CVE-2024-38984](https://cve.now/CVE-2024-38984.md): Prototype Pollution in lukebond json-override 0.2.0 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via the (CVSS 9.8)
- [CVE-2024-38986](https://cve.now/CVE-2024-38986.md): Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other i (CVSS 9.8, @75lb/deep-merge)
- [CVE-2024-39010](https://cve.now/CVE-2024-39010.md): chase-moskal snapstate v0.0.9 was discovered to contain a prototype pollution via the function attemptNestedProperty. (CVSS 9.8)
- [CVE-2024-39011](https://cve.now/CVE-2024-39011.md): Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause (CVSS 9.8)
- [CVE-2024-39012](https://cve.now/CVE-2024-39012.md): ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. (CVSS 9.8)
- [CVE-2024-40094](https://cve.now/CVE-2024-40094.md): GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of ser (CVSS 5.3, com.graphql-java:graphql-java)
- [CVE-2024-41304](https://cve.now/CVE-2024-41304.md): An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via (CVSS 5.4)
- [CVE-2024-41305](https://cve.now/CVE-2024-41305.md): A Server-Side Request Forgery (SSRF) in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary req (CVSS 7.1)
- [CVE-2024-41437](https://cve.now/CVE-2024-41437.md): A heap buffer overflow in the function cp\_unfilter() (/vendor/cute\_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (D (CVSS 5.5)
- [CVE-2024-41438](https://cve.now/CVE-2024-41438.md): A heap buffer overflow in the function cp\_stored() (/vendor/cute\_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS (CVSS 6.2)
- [CVE-2024-41439](https://cve.now/CVE-2024-41439.md): A heap buffer overflow in the function cp\_block() (/vendor/cute\_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) (CVSS 5.5)
- [CVE-2024-41440](https://cve.now/CVE-2024-41440.md): A heap buffer overflow in the function png\_quantize() of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PN (CVSS 6.2)
- [CVE-2024-41443](https://cve.now/CVE-2024-41443.md): A stack overflow in the function cp\_dynamic() (/vendor/cute\_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via (CVSS 5.5)
- [CVE-2024-41610](https://cve.now/CVE-2024-41610.md): D-Link DIR-820LW REVB FIRMWARE PATCH 2.03.B01\_TC contains hardcoded credentials in the Telnet service, enabling attackers to log in remotely (CVSS 9.8)
- [CVE-2024-41611](https://cve.now/CVE-2024-41611.md): In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely t (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.