# CVEs published 2024-07-31

108 CVEs were published on July 31, 2024: 7 critical, 34 high. Days are UTC.

- [CVE-2024-7330](https://cve.now/CVE-2024-7330.md): YouDianCMS ydLib.php curl\_exec server-side request forgery (CVSS 5.3, YouDianCMS)
- [CVE-2024-38182](https://cve.now/CVE-2024-38182.md): Microsoft Dynamics 365 Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Dynamics 365 Field Service (on-premises) v7 series)
- [CVE-2024-7329](https://cve.now/CVE-2024-7329.md): YouDianCMS image\_upload.php unrestricted upload (CVSS 5.3, YouDianCMS)
- [CVE-2024-7328](https://cve.now/CVE-2024-7328.md): YouDianCMS information disclosure (CVSS 6.9, YouDianCMS)
- [CVE-2024-7327](https://cve.now/CVE-2024-7327.md): Xinhu RockOA openmodhetongAction.php dataAction sql injection (CVSS 5.3, Xinhu RockOA)
- [CVE-2024-7326](https://cve.now/CVE-2024-7326.md): IObit DualSafe Password Manager BPL RTL120.BPL uncontrolled search path (CVSS 8.5, IObit DualSafe Password Manager)
- [CVE-2017-3772](https://cve.now/CVE-2017-3772.md): A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot. (CVSS 5.5, Lenovo PC Manager)
- [CVE-2019-6197](https://cve.now/CVE-2019-6197.md): A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. (CVSS 7.8, Lenovo PC Manager)
- [CVE-2019-6198](https://cve.now/CVE-2019-6198.md): A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. (CVSS 7.8, Lenovo PC Manager)
- [CVE-2022-4001](https://cve.now/CVE-2022-4001.md): An authentication bypass vulnerability could allow an attacker to access API functions without authentication. (CVSS 7.3, Motorola Q14 Mesh Router Firmware)
- [CVE-2022-4002](https://cve.now/CVE-2022-4002.md): A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API (CVSS 7.2, Motorola Q14 Mesh Router Firmware)
- [CVE-2022-4003](https://cve.now/CVE-2022-4003.md): A denial-of-service vulnerability could allow an authenticated user to trigger an internal service restart via a specially crafted API reque (CVSS 2.7, Motorola Q14 Mesh Router Firmware)
- [CVE-2023-1577](https://cve.now/CVE-2023-1577.md): A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute (CVSS 7.8, Lenovo Driver Manager)
- [CVE-2024-4187](https://cve.now/CVE-2024-4187.md): Stored XSS vulnerability has been discovered in OpenText™ Filr. The vulnerability could cause users to not be warned when clicking links to external sites. (CVSS 2.1, OpenText™ Filr)
- [CVE-2024-41660](https://cve.now/CVE-2024-41660.md): slpd-lite unauthenticated memory corruption (CVSS 9.8, openbmc slpd-lite)
- [CVE-2024-7325](https://cve.now/CVE-2024-7325.md): IObit Driver Booster BPL VCL120.BPL uncontrolled search path (CVSS 8.5, IObit Driver Booster)
- [CVE-2024-41951](https://cve.now/CVE-2024-41951.md): PheonixAppAPI has visible Encoding Maps (CVSS 4.4, AkshuDev PheonixAppAPI · pheonixappapi)
- [CVE-2024-41954](https://cve.now/CVE-2024-41954.md): FOG Weak file permissions (CVSS 5.3, fogproject)
- [CVE-2024-41955](https://cve.now/CVE-2024-41955.md): Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect (CVSS 5.2, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2024-41108](https://cve.now/CVE-2024-41108.md): FOG Sensitive Information Disclosure (CVSS 7.5, fogproject)
- [CVE-2024-40645](https://cve.now/CVE-2024-40645.md): FOG Authenticated File Upload RCE (CVSS 8.8, fogproject)
- [CVE-2024-7324](https://cve.now/CVE-2024-7324.md): IObit iTop Data Recovery Pro BPL madbasic\_.bpl uncontrolled search path (CVSS 8.5, IObit iTop Data Recovery Pro)
- [CVE-2024-23444](https://cve.now/CVE-2024-23444.md): Elasticsearch elasticsearch-certutil csr fails to encrypt private key (CVSS 4.9, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2024-6978](https://cve.now/CVE-2024-6978.md): Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users (CVSS 5.6, Cato Networks SDP Client)
- [CVE-2024-6977](https://cve.now/CVE-2024-6977.md): Cato Networks Windows SDP Client Sensitive data in trace logs can lead to account takeover (CVSS 6.5, Cato Networks SDP Client)
- [CVE-2024-6975](https://cve.now/CVE-2024-6975.md): Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file (CVSS 8.8, Cato Networks SDP Client)
- [CVE-2024-6974](https://cve.now/CVE-2024-6974.md): Cato Networks Windows SDP Client Local Privilege Escalation via self-upgrade (CVSS 8.8, Cato Networks SDP Client)
- [CVE-2024-6973](https://cve.now/CVE-2024-6973.md): Remote Code Execution in Cato Windows SDP client via crafted URLs (CVSS 7.5, Cato Networks SDP Client)
- [CVE-2024-41953](https://cve.now/CVE-2024-41953.md): Zitadel improperly sanitizes HTML in emails and Console UI (CVSS 4.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-41952](https://cve.now/CVE-2024-41952.md): Zitadel has an "Ignoring unknown usernames" vulnerability (CVSS 5.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-41950](https://cve.now/CVE-2024-41950.md): Insecure Jinja2 templates rendered in Haystack Components can lead to RCE (CVSS 7.5, deepset-ai haystack · haystack-ai)
- [CVE-2024-39694](https://cve.now/CVE-2024-39694.md): Duende IdentityServer Open Redirect vulnerability (CVSS 4.7, DuendeSoftware IdentityServer · Duende.IdentityServer +1)
- [CVE-2024-39318](https://cve.now/CVE-2024-39318.md): Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget (CVSS 5.4, ibexa admin-ui · ibexa/admin-ui)
- [CVE-2024-41947](https://cve.now/CVE-2024-41947.md): XWiki Platform XSS through conflict resolution (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2024-37901](https://cve.now/CVE-2024-37901.md): XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-search-ui)
- [CVE-2024-37900](https://cve.now/CVE-2024-37900.md): XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader (CVSS 6.4, xwiki-platform · org.xwiki.platform:xwiki-platform-web-war)
- [CVE-2024-37898](https://cve.now/CVE-2024-37898.md): XWiki Platform vulnerable to document deletion and overwrite from edit (CVSS 4.3, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2024-7340](https://cve.now/CVE-2024-7340.md): W&B Weave server remote arbitrary file leak and privilege escalation (CVSS 8.8, weave)
- [CVE-2024-37135](https://cve.now/CVE-2024-37135.md): DM5500 5.16.0.0, contains an information disclosure vulnerability. (CVSS 3.3, Dell Data Manager Appliance Software)
- [CVE-2024-31203](https://cve.now/CVE-2024-31203.md): A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll dynamic library packaged with the ThermoscanIP installer allows a local attacke (CVSS 3.3, Plug&Track Thermoscan IP)
- [CVE-2024-31202](https://cve.now/CVE-2024-31202.md): A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perfor (CVSS 7.8, Plug&Track Thermoscan IP)
- [CVE-2024-31201](https://cve.now/CVE-2024-31201.md): A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP\_Scrutation service. (CVSS 6.5, Plug&Track Thermoscan IP)
- [CVE-2024-31200](https://cve.now/CVE-2024-31200.md): A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access (CVSS 4.2, Plug&Track Sensor Net Connect)
- [CVE-2024-31199](https://cve.now/CVE-2024-31199.md): A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently injec (CVSS 8.8, Plug&Track Sensor Net Connect)
- [CVE-2024-3083](https://cve.now/CVE-2024-3083.md): A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative (CVSS 8.3, Plug&Track Sensor Net Connect)
- [CVE-2024-3082](https://cve.now/CVE-2024-3082.md): A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to (CVSS 4.2, Plug&Track Sensor Net Connect)
- [CVE-2024-39379](https://cve.now/CVE-2024-39379.md): Acrobat for Edge | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat for Edge)
- [CVE-2024-6208](https://cve.now/CVE-2024-6208.md): Download Manager \<= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, codename065 Download Manager)
- [CVE-2024-7321](https://cve.now/CVE-2024-7321.md): itsourcecode Online Blood Bank Management System User Registration signup.php cross site scripting (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2024-7320](https://cve.now/CVE-2024-7320.md): itsourcecode Online Blood Bank Management System Admin Login index.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2024-7135](https://cve.now/CVE-2024-7135.md): Tainacan \<= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, Tainacan)
- [CVE-2024-6725](https://cve.now/CVE-2024-6725.md): Formidable Forms \<= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 4.9, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2024-7311](https://cve.now/CVE-2024-7311.md): code-projects Online Bus Reservation Site register.php sql injection (CVSS 6.9, code-projects Online Bus Reservation Site)
- [CVE-2024-7310](https://cve.now/CVE-2024-7310.md): SourceCodester Record Management System sort\_user.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-7309](https://cve.now/CVE-2024-7309.md): SourceCodester Record Management System entry.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-7308](https://cve.now/CVE-2024-7308.md): SourceCodester Establishment Billing Management System view\_bill.php sql injection (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2024-37129](https://cve.now/CVE-2024-37129.md): Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. (CVSS 6.7, Dell Inventory Collector)
- [CVE-2024-32857](https://cve.now/CVE-2024-32857.md): Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. (CVSS 7.3, Dell Peripheral Manager)
- [CVE-2024-7307](https://cve.now/CVE-2024-7307.md): SourceCodester Establishment Billing Management System manage\_billing.php sql injection (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2024-2508](https://cve.now/CVE-2024-2508.md): WP Mobile Menu \<= 2.8.4.4 - Missing Authorization to \_mobmenu\_icon Post Meta Modification (CVSS 5.3, takanakui WP Mobile Menu – The Mobile-Friendly Responsive M…)
- [CVE-2024-37127](https://cve.now/CVE-2024-37127.md): Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. (CVSS 7.8, Dell Peripheral Manager)
- [CVE-2024-37142](https://cve.now/CVE-2024-37142.md): Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. (CVSS 7.3, Dell Peripheral Manager)
- [CVE-2024-7264](https://cve.now/CVE-2024-7264.md): ASN.1 date parser overread (CVSS 6.3, curl)
- [CVE-2024-7306](https://cve.now/CVE-2024-7306.md): SourceCodester Establishment Billing Management System manage\_block.php sql injection (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2023-28074](https://cve.now/CVE-2023-28074.md): Dell BSAFE Crypto-C Micro Edition, version 4.1.5, and Dell BSAFE Micro Edition Suite, versions 4.0 through 4.6.1 and version 5.0, contains a (CVSS 6.2, Dell BSAFE Micro Edition Suite · Dell BSAFE Crypto-C Micro…)
- [CVE-2024-7303](https://cve.now/CVE-2024-7303.md): itsourcecode Online Blood Bank Management System Send Blood Request Page request.php cross site scripting (CVSS 5.3, itsourcecode Online Blood Bank Management System)
- [CVE-2024-7300](https://cve.now/CVE-2024-7300.md): Bolt CMS Showcase Creation showcases cross site scripting (CVSS 5.3, Bolt CMS · bolt/bolt)
- [CVE-2024-6980](https://cve.now/CVE-2024-6980.md): Verbose error handling issue in GravityZone Update Server proxy service (CVSS 9.2, Bitdefender GravityZone Update Server)
- [CVE-2024-7299](https://cve.now/CVE-2024-7299.md): Bolt CMS Entry Preview page cross site scripting (CVSS 5.3, Bolt CMS)
- [CVE-2024-7290](https://cve.now/CVE-2024-7290.md): SourceCodester Establishment Billing Management System manage\_tenant.php sql injection (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2024-6695](https://cve.now/CVE-2024-6695.md): profile-builder \<= 3.11.8 - Unauthenticated Privilege Escalation (CVSS 9.8, User Profile Builder)
- [CVE-2024-6412](https://cve.now/CVE-2024-6412.md): HTML Forms – Simple WordPress Forms Plugin \< 1.3.34 - Bulk Delete via CSRF (CVSS 6.5, HTML Forms)
- [CVE-2024-6408](https://cve.now/CVE-2024-6408.md): Slider by 10Web \< 1.2.57 - Editor+ Stored XSS (CVSS 5.4, Slider by 10Web)
- [CVE-2024-6272](https://cve.now/CVE-2024-6272.md): SpiderContacts \<= 1.1.7 - Reflected XSS (CVSS 6.1, SpiderContacts)
- [CVE-2024-6165](https://cve.now/CVE-2024-6165.md): WANotifier \< 2.6.1 - Admin+ Stored XSS (CVSS 4.8, WANotifier)
- [CVE-2024-7205](https://cve.now/CVE-2024-7205.md): sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user (CVSS 9.4, CoolKit eWeLink Cloud Service)
- [CVE-2024-7289](https://cve.now/CVE-2024-7289.md): SourceCodester Establishment Billing Management System manage\_payment.php sql injection (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2024-6770](https://cve.now/CVE-2024-6770.md): Lifetime free Drag & Drop Contact Form Builder for WordPress VForm \<= 2.1.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, vikasratudi VPSUForm – Drag & Drop Contact Form Builder wit…)
- [CVE-2024-7288](https://cve.now/CVE-2024-7288.md): SourceCodester Establishment Billing Management System sql injection (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2024-7287](https://cve.now/CVE-2024-7287.md): SourceCodester Establishment Billing Management System manage\_user.php sql injection (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2024-7286](https://cve.now/CVE-2024-7286.md): SourceCodester Establishment Billing Management System Login sql injection (CVSS 6.9, SourceCodester Establishment Billing Management System)
- [CVE-2024-39950](https://cve.now/CVE-2024-39950.md): A vulnerability has been found in Dahua products. (CVSS 8.6, Dahua NVR4XXX and IPC-HX8XXX)
- [CVE-2024-39949](https://cve.now/CVE-2024-39949.md): A vulnerability has been found in Dahua products. (CVSS 7.5, Dahua NVR4XXX)
- [CVE-2024-39948](https://cve.now/CVE-2024-39948.md): A vulnerability has been found in Dahua products. (CVSS 7.5, Dahua NVR4XXX)
- [CVE-2024-7285](https://cve.now/CVE-2024-7285.md): SourceCodester Establishment Billing Management System cross site scripting (CVSS 5.3, SourceCodester Establishment Billing Management System)
- [CVE-2024-39947](https://cve.now/CVE-2024-39947.md): A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacker can send a carefull (CVSS 6.5, Dahua NVR4XXX)
- [CVE-2024-39946](https://cve.now/CVE-2024-39946.md): A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacker can send a carefull (CVSS 6.0, Dahua NVR4XXX)
- [CVE-2024-39945](https://cve.now/CVE-2024-39945.md): A vulnerability has been found in Dahua products. (CVSS 4.9, Dahua NVR4XXX)
- [CVE-2024-39944](https://cve.now/CVE-2024-39944.md): A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface with vulnerabilities, ca (CVSS 7.5, Dahua IPC-HX8XXX and NVR4XXX)
- [CVE-2024-7284](https://cve.now/CVE-2024-7284.md): SourceCodester Lot Reservation Management System cross site scripting (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-7283](https://cve.now/CVE-2024-7283.md): SourceCodester Lot Reservation Management System manage\_user.php sql injection (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-7282](https://cve.now/CVE-2024-7282.md): SourceCodester Lot Reservation Management System manage\_model.php sql injection (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-7281](https://cve.now/CVE-2024-7281.md): SourceCodester Lot Reservation Management System sql injection (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-7280](https://cve.now/CVE-2024-7280.md): SourceCodester Lot Reservation Management System view\_reserved.php sql injection (CVSS 5.3, SourceCodester Lot Reservation Management System)
- [CVE-2024-7279](https://cve.now/CVE-2024-7279.md): SourceCodester Lot Reservation Management System sql injection (CVSS 6.9, SourceCodester Lot Reservation Management System)
- [CVE-2024-6255](https://cve.now/CVE-2024-6255.md): Path Traversal in gaizhenbiao/chuanhuchatgpt (CVSS 8.2, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-7278](https://cve.now/CVE-2024-7278.md): itsourcecode Alton Management System team\_save.php sql injection (CVSS 5.1, itsourcecode Alton Management System)
- [CVE-2023-28149](https://cve.now/CVE-2023-28149.md): An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 0 (CVSS 6.1)
- [CVE-2024-40464](https://cve.now/CVE-2024-40464.md): An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/sm (CVSS 8.8, github.com/beego/beego/v2)
- [CVE-2024-40465](https://cve.now/CVE-2024-40465.md): An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file (CVSS 8.8, github.com/beego/beego/v2)
- [CVE-2024-41253](https://cve.now/CVE-2024-41253.md): goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the (CVSS 7.1)
- [CVE-2024-41254](https://cve.now/CVE-2024-41254.md): An issue was discovered in litestream v0.3.13. (CVSS 5.3)
- [CVE-2024-41255](https://cve.now/CVE-2024-41255.md): filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man (CVSS 7.5, github.com/mickael-kerjean/filestash)
- [CVE-2024-41256](https://cve.now/CVE-2024-41256.md): Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification (CVSS 5.9, github.com/mickael-kerjean/filestash)
- [CVE-2024-41258](https://cve.now/CVE-2024-41258.md): An issue was discovered in filestash v0.4. (CVSS 5.3)
- [CVE-2024-41262](https://cve.now/CVE-2024-41262.md): mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to i (CVSS 7.4)
- [CVE-2024-41630](https://cve.now/CVE-2024-41630.md): Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10\_EN allows a remote attacker to execute arbitrary code via the ssid param (CVSS 7.6)
- [CVE-2024-42381](https://cve.now/CVE-2024-42381.md): os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve (CVSS 8.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.