CVEs published in July 2024
3,166 vulnerabilities, 289 critical, 12 exploited.
- hcl software bigfix complianceHCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerability4.7 Medium
- cloudfoundry foundation uaaUAA Failure to Remove Shadow User’s Access3.9 Low
- kubernetesIncorrect permissions on Windows containers logs6.1 Medium
- hcl software bigfix complianceHCL BigFix Compliance is affected by an internal server error6.2 Medium
- uni-yaz flexwater corporate water managementSQLi in Universal Software's FlexWater Corporate Water Management9.8 Critical
- pruvasoft informatics apinizer management consoleXML External Entity Injection in PruvaSoft Informatics' Apinizer Management Console6.5 Medium
- fit2cloud jumpserverArbitrary File Read in Ansible Playbooks in Jumpserver10.0 Critical
- fit2cloud jumpserverArbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver10.0 Critical
- apinizer, pruvasoft informatics apinizer management console +1 moreAuthentication Bypass in PruvaSoft Informatics' Apinizer Management Console6.5 Medium
- getsentry sentry-pythonUnintentional exposure of environment variables to subprocesses in sentry-sdk5.3 Medium
- apinizer, pruvasoft informatics apinizer management console +1 moreIDOR in PruvaSoft Informatics' Apinizer Management Console9.6 Critical
- philips vue pacsPhilips Vue PACS Use of Default Credentials5.7 Medium
- apinizer, pruvasoft informatics apinizer management console +1 moreBroken Access Control in PruvaSoft Informatics' Apinizer Management Console9.9 Critical
- ibm engineering requirements management doors, engineering requirements management doors web access +1 moreIBM Engineering Requirements Management DOORS XML external entity injection7.1 High
- dell data lakehouseDell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data...6.8 Medium
- dell ecs, elastic cloud storage +1 moreDell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management...4.9 Medium
- 1panel-dev 1panel1Panel SQL injection10.0 Critical
- 1panel-dev 1panela sqlinjection in 1Panel9.8 Critical
- acronis true image, true image oem +1 moreLocal privilege escalation due to OS command injection vulnerability. The following products are...7.8 High
cggmp21crates.iocggmp21 vulnerable to ambiguous challenge derivation2.7 Lowrustyscriptcrates.ioop_panic in the base runtime can force a panic in the runtime's containing threadNo scorepaillier-zkcrates.iopaillier-zk has ambiguous challenge derivation2.7 Lowcggmp21-keygencrates.iocggmp21-keygen has ambiguous challenge derivation2.7 Lowjs-sandboxcrates.ioop_panic in the base runtime can force a panic in the runtime's containing threadNo score- matrix-org matrix-rust-sdk`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk5.4 Medium
- byron gitoxidegitoxide's gix-path can use a fake program files location6.8 Medium
- apache streamparkApache StreamPark: FreeMarker SSTI RCE Vulnerability8.8 High
- apache http serverApache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows7.5 High
- rapid7 insightvmRapid7 InsightVM Protection Mechanism Failure4.3 Medium
- bdthemes element pack, element pack – widgets, templates & addons for elementor +1 moreElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bdthemes element pack, element pack – widgets, templates & addons for elementor +1 moreElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- brizy, themefusecom brizy – page builder, brizy brizy-page builder +2 moreBrizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload8.8 High
- sonicwall sonicosHeap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated...7.5 High
- sonicwall netextenderVulnerability in SonicWall NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier...8.8 High
- linux, linux kernel +1 moredrm/amdkfd: don't allow mapping the MMIO HDP page with large pages7.8 High
- unknown filter & grids, ymc-22 filter \& grids +1 moreFilter & Grids < 2.8.33 - Unauthenticated LFI9.8 Critical
- benbodhi svg supportSVG Support <= 2.5.7 - Authenticated (Author+) Cross-Site Scripting via SVG5.4 Medium
- ericmann reglevelRegLevel <= 1.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- mekshq meks video importerMeks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification4.3 Medium
- tislam100 zenon liteZenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode6.4 Medium
- wpdiscover timeline event historyTimeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection8.8 High
- deetronix booking ultra pro appointments booking calendar pluginBooking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates5.4 Medium
gpacOSS-FuzzHeap-buffer-overflow in gf_dash_group_get_templateNo scorejavaparserOSS-FuzzSecurity exception in com.github.javaparser.CommentsInserter.insertCommentsNo scoreapache-poiOSS-FuzzSecurity exception in java.base/java.util.ArrayList.<init>No scoregpacOSS-FuzzIndex-out-of-bounds in gf_vvc_parse_nalu_bsNo score- google chromeInappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a...7.5 High
- acassen keepalivedIn the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer...9.8 Critical
- 253153 calculator-boilerplatecalculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability...9.8 Critical
- phpgurukul online shopping portalThe PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows...6.1 Medium
- Show moreLoading…