CVEs published July 31, 2024
108 CVEs were published on July 31, 2024: 7 critical, 34 high.
- Published
- 108
- Critical
- 7
- High
- 34
- Medium
- 63
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- SourceCodester Establishment Billing Management System
- 9
- SourceCodester Lot Reservation Management System
- 6
- Cato Networks SDP Client
- 5
- Dahua NVR4XXX
- 5
- Plug&Track Sensor Net Connect
- 4
- Dell Peripheral Manager
- 3
- fogproject
- 3
- itsourcecode Online Blood Bank Management System
- 3
- Lenovo PC Manager
- 3
- Motorola Q14 Mesh Router Firmware
- 3
Critical 7
- CVE-2024-38182Microsoft Dynamics 365 Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 Field Service (on-premises) v7 series
- CVE-2024-41660slpd-lite unauthenticated memory corruptionopenbmc slpd-lite
- CVE-2024-41947XWiki Platform XSS through conflict resolutionxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2024-37901XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheetxwiki-platform · org.xwiki.platform:xwiki-platform-search-ui
- CVE-2024-6980Verbose error handling issue in GravityZone Update Server proxy serviceBitdefender GravityZone Update Server
- CVE-2024-6695profile-builder <= 3.11.8 - Unauthenticated Privilege EscalationUser Profile Builder
- CVE-2024-7205sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary userCoolKit eWeLink Cloud Service
High 34
- CVE-2024-7326IObit DualSafe Password Manager BPL RTL120.BPL uncontrolled search pathIObit DualSafe Password Manager
- CVE-2019-6197A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.Lenovo PC Manager
- CVE-2019-6198A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges.Lenovo PC Manager
- CVE-2022-4001An authentication bypass vulnerability could allow an attacker to access API functions without authentication.Motorola Q14 Mesh Router Firmware
- CVE-2022-4002A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted APIMotorola Q14 Mesh Router Firmware
- CVE-2023-1577A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to executeLenovo Driver Manager
- CVE-2024-7325IObit Driver Booster BPL VCL120.BPL uncontrolled search pathIObit Driver Booster
- CVE-2024-41108FOG Sensitive Information Disclosurefogproject
- CVE-2024-40645FOG Authenticated File Upload RCEfogproject
- CVE-2024-7324IObit iTop Data Recovery Pro BPL madbasic_.bpl uncontrolled search pathIObit iTop Data Recovery Pro
- CVE-2024-6975Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration fileCato Networks SDP Client
- CVE-2024-6974Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeCato Networks SDP Client
- CVE-2024-6973Remote Code Execution in Cato Windows SDP client via crafted URLsCato Networks SDP Client
- CVE-2024-41950Insecure Jinja2 templates rendered in Haystack Components can lead to RCEdeepset-ai haystack · haystack-ai
- CVE-2024-7340W&B Weave server remote arbitrary file leak and privilege escalationweave
- CVE-2024-31202A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perforPlug&Track Thermoscan IP
- CVE-2024-31199A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently injecPlug&Track Sensor Net Connect
- CVE-2024-3083A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrativePlug&Track Sensor Net Connect
- CVE-2024-32857Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability.Dell Peripheral Manager
- CVE-2024-37127Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability.Dell Peripheral Manager
- CVE-2024-37142Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability.Dell Peripheral Manager
- CVE-2024-6770Lifetime free Drag & Drop Contact Form Builder for WordPress VForm <= 2.1.5 - Unauthenticated Stored Cross-Site Scriptingvikasratudi VPSUForm – Drag & Drop Contact Form Builder wit…
- CVE-2024-39950A vulnerability has been found in Dahua products.Dahua NVR4XXX and IPC-HX8XXX
- CVE-2024-39949A vulnerability has been found in Dahua products.Dahua NVR4XXX
- CVE-2024-39948A vulnerability has been found in Dahua products.Dahua NVR4XXX
- CVE-2024-39944A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, caDahua IPC-HX8XXX and NVR4XXX
- CVE-2024-6255Path Traversal in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-40464An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smgithub.com/beego/beego/v2
- CVE-2024-40465An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go filegithub.com/beego/beego/v2
- CVE-2024-41253goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the
- CVE-2024-41255filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a mangithub.com/mickael-kerjean/filestash
- CVE-2024-41262mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to i
- CVE-2024-41630Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary code via the ssid param
- CVE-2024-42381os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve
Medium, low and unrated 67
- CVE-2024-7330YouDianCMS ydLib.php curl_exec server-side request forgeryYouDianCMS
- CVE-2024-7329YouDianCMS image_upload.php unrestricted uploadYouDianCMS
- CVE-2024-7328YouDianCMS information disclosureYouDianCMS
- CVE-2024-7327Xinhu RockOA openmodhetongAction.php dataAction sql injectionXinhu RockOA
- CVE-2017-3772A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot.Lenovo PC Manager
- CVE-2022-4003A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API requeMotorola Q14 Mesh Router Firmware
- CVE-2024-4187Stored XSS vulnerability has been discovered in OpenText™ Filr. The vulnerability could cause users to not be warned when clicking links to external sites.OpenText™ Filr
- CVE-2024-41951PheonixAppAPI has visible Encoding MapsAkshuDev PheonixAppAPI · pheonixappapi
- CVE-2024-41954FOG Weak file permissionsfogproject
- CVE-2024-41955Mobile Security Framework (MobSF) has an Open Redirect in Login RedirectMobile-Security-Framework-MobSF · mobsf
- CVE-2024-23444Elasticsearch elasticsearch-certutil csr fails to encrypt private keyElasticsearch · org.elasticsearch:elasticsearch
- CVE-2024-6978Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged usersCato Networks SDP Client
- CVE-2024-6977Cato Networks Windows SDP Client Sensitive data in trace logs can lead to account takeoverCato Networks SDP Client
- CVE-2024-41953Zitadel improperly sanitizes HTML in emails and Console UIzitadel · github.com/zitadel/zitadel
- CVE-2024-41952Zitadel has an "Ignoring unknown usernames" vulnerabilityzitadel · github.com/zitadel/zitadel
- CVE-2024-39694Duende IdentityServer Open Redirect vulnerabilityDuendeSoftware IdentityServer · Duende.IdentityServer +1
- CVE-2024-39318Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widgetibexa admin-ui · ibexa/admin-ui
- CVE-2024-37900XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploaderxwiki-platform · org.xwiki.platform:xwiki-platform-web-war
- CVE-2024-37898XWiki Platform vulnerable to document deletion and overwrite from editxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2024-37135DM5500 5.16.0.0, contains an information disclosure vulnerability.Dell Data Manager Appliance Software
- CVE-2024-31203A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll dynamic library packaged with the ThermoscanIP installer allows a local attackePlug&Track Thermoscan IP
- CVE-2024-31201A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service.Plug&Track Thermoscan IP
- CVE-2024-31200A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access Plug&Track Sensor Net Connect
- CVE-2024-3082A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to Plug&Track Sensor Net Connect
- CVE-2024-39379Acrobat for Edge | Out-of-bounds Read (CWE-125)Adobe Acrobat for Edge
- CVE-2024-6208Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecodename065 Download Manager
- CVE-2024-7321itsourcecode Online Blood Bank Management System User Registration signup.php cross site scriptingitsourcecode Online Blood Bank Management System
- CVE-2024-7320itsourcecode Online Blood Bank Management System Admin Login index.php sql injectionitsourcecode Online Blood Bank Management System
- CVE-2024-7135Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File ReadTainacan
- CVE-2024-6725Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scriptingstrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2024-7311code-projects Online Bus Reservation Site register.php sql injectioncode-projects Online Bus Reservation Site
- CVE-2024-7310SourceCodester Record Management System sort_user.php cross site scriptingSourceCodester Record Management System
- CVE-2024-7309SourceCodester Record Management System entry.php cross site scriptingSourceCodester Record Management System
- CVE-2024-7308SourceCodester Establishment Billing Management System view_bill.php sql injectionSourceCodester Establishment Billing Management System
- CVE-2024-37129Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability.Dell Inventory Collector
- CVE-2024-7307SourceCodester Establishment Billing Management System manage_billing.php sql injectionSourceCodester Establishment Billing Management System
- CVE-2024-2508WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modificationtakanakui WP Mobile Menu – The Mobile-Friendly Responsive M…
- CVE-2024-7264ASN.1 date parser overreadcurl
- CVE-2024-7306SourceCodester Establishment Billing Management System manage_block.php sql injectionSourceCodester Establishment Billing Management System
- CVE-2023-28074Dell BSAFE Crypto-C Micro Edition, version 4.1.5, and Dell BSAFE Micro Edition Suite, versions 4.0 through 4.6.1 and version 5.0, contains aDell BSAFE Micro Edition Suite · Dell BSAFE Crypto-C Micro…
- CVE-2024-7303itsourcecode Online Blood Bank Management System Send Blood Request Page request.php cross site scriptingitsourcecode Online Blood Bank Management System
- CVE-2024-7300Bolt CMS Showcase Creation showcases cross site scriptingBolt CMS · bolt/bolt
- CVE-2024-7299Bolt CMS Entry Preview page cross site scriptingBolt CMS
- CVE-2024-7290SourceCodester Establishment Billing Management System manage_tenant.php sql injectionSourceCodester Establishment Billing Management System
- CVE-2024-6412HTML Forms – Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRFHTML Forms
- CVE-2024-6408Slider by 10Web < 1.2.57 - Editor+ Stored XSSSlider by 10Web
- CVE-2024-6272SpiderContacts <= 1.1.7 - Reflected XSSSpiderContacts
- CVE-2024-6165WANotifier < 2.6.1 - Admin+ Stored XSSWANotifier
- CVE-2024-7289SourceCodester Establishment Billing Management System manage_payment.php sql injectionSourceCodester Establishment Billing Management System
- CVE-2024-7288SourceCodester Establishment Billing Management System sql injectionSourceCodester Establishment Billing Management System
- CVE-2024-7287SourceCodester Establishment Billing Management System manage_user.php sql injectionSourceCodester Establishment Billing Management System
- CVE-2024-7286SourceCodester Establishment Billing Management System Login sql injectionSourceCodester Establishment Billing Management System
- CVE-2024-7285SourceCodester Establishment Billing Management System cross site scriptingSourceCodester Establishment Billing Management System
- CVE-2024-39947A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefullDahua NVR4XXX
- CVE-2024-39946A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefullDahua NVR4XXX
- CVE-2024-39945A vulnerability has been found in Dahua products.Dahua NVR4XXX
- CVE-2024-7284SourceCodester Lot Reservation Management System cross site scriptingSourceCodester Lot Reservation Management System
- CVE-2024-7283SourceCodester Lot Reservation Management System manage_user.php sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-7282SourceCodester Lot Reservation Management System manage_model.php sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-7281SourceCodester Lot Reservation Management System sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-7280SourceCodester Lot Reservation Management System view_reserved.php sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-7279SourceCodester Lot Reservation Management System sql injectionSourceCodester Lot Reservation Management System
- CVE-2024-7278itsourcecode Alton Management System team_save.php sql injectionitsourcecode Alton Management System
- CVE-2023-28149An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 0
- CVE-2024-41254An issue was discovered in litestream v0.3.13.
- CVE-2024-41256Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification github.com/mickael-kerjean/filestash
- CVE-2024-41258An issue was discovered in filestash v0.4.