CVEs published in July 2024
3,166 vulnerabilities, 289 critical, 12 exploited.
- kylephillips nested pagesNested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion8.8 High
- johnson controls kantech kt1 door controller, rev01, kantech kt2 door controller, rev01, kantech kt400 door controller, rev01 +2 moreJohnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information3.1 Low
- mitsubishi electric corporation melipc series mi5122-vw, mitsubishi melipc mi5122-vw firmware +1 moreIncorrect Default Permissions vulnerability in Smart Device Communication Gateway preinstalled on...8.8 High
- iconics genesis64, mitsubishi electric corporation analytix, bizviz +5 more +7 moreUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability...6.7 Medium
- iconics genesis64, mitsubishi electric corporation analytix, hyper historian +4 more +6 moreImproper Authentication vulnerability in the mobile monitoring feature of ICONICS GENESIS64...5.9 Medium
- iconics genesis64, mitsubishi electric corporation genesis32, hyper historian +2 more +4 moreUncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi...7.0 High
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service3.1 Low
- wbolt imgspider, imgspider – 图片采集抓取插件 +1 moreIMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload'8.8 High
- wbolt imgspider, imgspider – 图片采集抓取插件 +1 moreIMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file'8.8 High
- cedcommerce one click order re-orderOne Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- livemesh addons by elementor, livemeshelementor addons for elementor +1 moreElementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid6.4 Medium
- livemesh addons by elementor, livemeshelementor addons for elementor +1 moreElementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets6.4 Medium
- livemesh addons by elementor, livemeshelementor addons for elementor +1 moreElementor Addons by Livemesh <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets6.4 Medium
- livemesh elementor addons, addons by elementor, livemeshelementor addons for elementor +2 moreElementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets8.8 High
- tp-link archer air r5, archer ax3000, archer ax5400 +7 more +9 moreMultiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to...6.8 Medium
- sola plugins testimonials, solaplugins sola testimonials +1 moreA cross-site request forgery vulnerability exists in Sola Testimonials versions prior to 3.0.0....8.1 High
- sola plugins wp tweet wallsA cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If...5.4 Medium
- rejetto http file serverrejetto HFS vulnerable to OS Command Execution by remote authenticated users9.9 Critical
- bluetron supossupOS 5.0 allows api/image/download?fileName=../ directory traversal for reading files.8.6 High
- qtAn issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x...8.6 High
- jc21 nginx proxy managerjc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command...8.8 High
- robotmkRobotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated...7.8 High
- gogsDuplicate Advisory: Gogs allows argument injection during the tagging of a new release7.7 High
- gogsGogs allows argument injection during the previewing of changes9.9 Critical
- gogsDuplicate Advisory: Gogs allows deletion of internal files9.9 Critical
- gogsDuplicate Advisory: github.com/gogs/gogs affected by CVE-2024-399309.9 Critical
- eximExim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can...5.4 Medium
- apache http server, netapp ontap tools +1 moreApache HTTP Server: source code disclosure with handlers configured via AddType6.2 Medium
- kaitenKaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request,...5.3 Medium
- No product listedQR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers...9.8 Critical
- google https://github.com/google/nftables, nftables +1 moreImproper IPv4 and IPv6 byte order storage in github.com/google/nftables6.3 Medium
- mongodb inc libbsonMongoDB C Driver bson_string_append may be vulnerable to a buffer overflow5.3 Medium
php7.0Ubuntu,php7.2Ubuntu +1 morephp7.0 and php7.2 regressionNo score- apache tomcat, netapp ontap tools +1 moreApache Tomcat: HTTP/2 excess header handling DoS7.5 High
- zitadelZITADEL Vulnerable to Session Information Leakage5.7 Medium
- discourseDiscourse vulnerable to Server-Side Request Forgery via FastImage6.4 Medium
- discourseDiscourse doesn't limit reviewable user serializer payload2.4 Low
- discourseDiscourse missing authorization checks for suspending admins/moderators4.9 Medium
- discourseDiscourse vulnerable to stored-dom XSS via Facebook Oneboxes4.2 Medium
- stitionai devika, stitionai/devika +1 moreLocal File Inclusion (LFI) in stitionai/devika6.2 Medium
- discourseDiscourse vulnerable to DoS through Onebox7.5 High
- ethyca fidesFides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL5.3 Medium
- zephyrproject zephyrbt: host/smp: DoS caused by null pointer dereference6.5 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreCockpit: authenticated user can kill any process when enabling pam_env's user_readenv option3.2 Low
- checkmkXSS in SQL check parameters6.5 Medium
- grandstream gxp2135, gxp2135 firmware +1 moreAn os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of...8.1 High
- sourcecodester online tours & travels management, mayurik online tours \& travels management system, sourcecodester online tours and travels management +2 moreSourceCodester Online Tours & Travels Management sms_setting.php sql injection5.3 Medium
- playsmsplaySMS Template injection5.1 Medium
- mb connect line mbnet.mini, helmholz rex 100, rex 100 firmware +1 more +3 moreRed Lion Europe: mbNET.mini vulnerable to OS command injection7.2 High
openslidecrates.io`openslide` is unmaintainedNo score- Show moreLoading…