CVEs published in July 2024
3,166 vulnerabilities, 289 critical, 12 exploited.
- wedevs wp erp, erp: complete hr, accounting & crm suite with woocommerce crm support +1 moreWP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection via vendor_id8.8 High
- parorrey json api userJSON API User <= 3.9.3 - Unauthenticated Privilege Escalation9.8 Critical
- smashballoon feeds for youtube, smub feeds for youtube (youtube video, channel, and gallery plugin) +1 moreFeeds for YouTube (YouTube video, channel, and gallery plugin) <= 2.2.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting6.4 Medium
- ays-pro secure copy content protection and content lockingSecure Copy Content Protection < 4.0.9 - Admin+ Stored XSS4.8 Medium
- 10web slider, unknown slider by 10web +1 moreSlider by 10Web < 1.2.56 - Editor+ Stored XSS5.4 Medium
- expresstech quiz and survey master, unknown quiz and survey master (qsm) +1 moreQuiz and Survey Master < 9.0.5 - Contributor+ Stored XSS5.4 Medium
- mark8barnes bible text, markbarnes bible-text +1 moreBible Text <= 0.2 - Contributor+ Stored XSS5.4 Medium
- dotcamp ultimate blocks, ultimate blocks blocks +1 moreUltimate Blocks < 3.1.9 - Contributor+ Stored XSS5.4 Medium
- e4j vikrentcar car rental management system, e4jconnect vikrentcar +1 moreVikRentCar Car Rental Management System < 1.3.2 - Cross Site Request Forgery8.8 High
- vmware aria automation, cloud foundation +1 moreVMSA-2024-0017: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280)8.5 High
- payflex payment gateway, tomlister payflex payment gateway +1 morePayflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update5.3 Medium
- instawp connect – 1-click wp staging & migration, connect +1 moreInstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin9.8 Critical
- wpmudev branda, branda – white label & branding, free login page customizer, branda white label wordpress custom login page customizer +2 moreBranda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure5.3 Medium
- gallagher controller 6000 and controller 7000, controller 6000 firmware, controller 7000 firmware +2 moreExternal Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows...6.3 Medium
- gallagher command centreImproper output Neutralization for Logs (CWE-117) in the Command Centre API Diagnostics Endpoint...3.3 Low
- gallagher controller 6000 and controller 7000External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000...6.8 Medium
- gallagher controller 6000 and controller 7000Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore...4.6 Medium
- mhuertos phpldapadminmhuertos phpLDAPadmin ajax_functions.js makeHttpRequest request smuggling5.3 Medium
- snapcreek duplicator, smub duplicator – backups & migration plugin – cloud backups, scheduled backups, & more +1 moreDuplicator <= 1.5.9 - Full Path Disclosure5.3 Medium
- witmy my-springsecurity-pluswitmy my-springsecurity-plus user sql injection5.3 Medium
- naver whale browserWhale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to...9.6 Critical
- code-projects simple task listcode-projects Simple Task List Login loginForm.php sql injection6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreGtk3: gtk2: library injection from cwd7.0 High
- supermicro x13swa-tf firmwareAn issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and...9.8 Critical
github.com/nats-io/nats-serverGo,github.com/nats-io/nats-server/v2Go,github.com/nats-io/nats-streaming-serverGo +1 more +3 moreNATS Server and Streaming Server fails to enforce negative user permissions, may allow denied subjects6.3 Medium- fullservices full – clienteFULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter7.2 High
- juniper junos, junos os +1 moreJunos OS: MX240, MX480, MX960 platforms using MPC10E: Memory leak will be observed when subscribed to a specific subscription on Junos Telemetry Interface8.7 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configured7.1 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Receiving specific traffic on devices with EVPN-VPWS with IGMP-snooping enabled will cause the rpd to crash7.1 High
- juniper junos os evolvedJunos OS Evolved: Execution of a specific CLI command will cause a crash in the AFT manager6.8 Medium
- juniper junos os evolved, junos evolved +1 moreJunos OS Evolved: User is not logged out when the console cable is disconnected7.0 High
- admerc gym management system, gym management system project management system +1 moreitsourcecode Gym Management System manage_member.php sql injection5.3 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: The 802.1X Authentication Daemon crashes on running a specific command6.8 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreDenial of Service in gaizhenbiao/chuanhuchatgpt7.5 High
- juniper j-web, junos, junos os +2 moreJunos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.7.7 High
- juniper junos os evolvedJunos OS Evolved: A high rate of SSH connections causes a Denial of Service8.7 High
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX4600, SRX5000 Series: TCP packets with SYN/FIN or SYN/RST are transferred after enabling no-syn-check with Express Path6.9 Medium
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crash7.1 High
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreArbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt7.5 High
- juniper junos os evolvedJunos OS Evolved: Receipt of a specific TCP packet may result in a system crash (vmcore) on dual RE systems with NSR enabled8.2 High
- juniper junos, junos os, junos os evolved +2 moreJunos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRR7.1 High
- juniper junos os evolvedJunos OS Evolved: MAC table changes cause a memory leak7.1 High
- juniper junos, junos os, junos os evolved +2 moreJunos OS and Junos OS Evolved: Loading a malicious certificate from the CLI may result in a stack-based overflow7.1 High
- juniper junos, junos os, junos os evolved +2 moreJunos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to reset8.7 High
- juniper junos, junos os evolved, juniper networks junos os +2 moreJunos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash8.2 High
- oretnom23 employee and visitor gate pass logging system, sourcecodester employee visitor gatepass logging system +1 moreSourceCodester Employee and Visitor Gate Pass Logging System Master.php save_designation cross site scripting5.1 Medium
- citrix workspace app for html5, workspace +1 moreRedirection of users to a vulnerable URL in Citrix Workspace app for HTML54.8 Medium
- citrix workspace app for html5, workspace +1 moreBypass of GACS Policy Configuration settings in Citrix Workspace app for HTML55.3 Medium
- citrix provisioningA non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning4.8 Medium
- citrix workspace app for windows, workspace +1 moreLocal Privilege escalation allows a low-privileged user to gain SYSTEM privileges8.5 High
- Show moreLoading…