Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2024

186 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2024-6746
    22Monitor

    NaiboWang EasySpider HTTP GET Request server.js path traversal

    MediumCVSS 5.3Proof of conceptEPSS 3%

    easyspider · easyspiderJul 15, 2024

  • CVE-2024-39887
    40Plan

    Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    apache · supersetJul 16, 2024

  • CVE-2024-6457
    36Monitor

    HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection

    HighCVSS 7.5No exploitEPSS 19%

    pluginus · husky - products filter professional for woocommerceJul 16, 2024

  • CVE-2024-39700
    39Monitor

    Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jupyter · jupyterlabJul 16, 2024

  • CVE-2024-39908
    17Monitor

    Denial of service in REXML

    MediumCVSS 4.3Proof of conceptEPSS 1%

    ruby-lang · rexmlJul 16, 2024

  • CVE-2024-6778
    30Monitor

    Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injec

    HighCVSS 7.5Proof of conceptEPSS 0%

    google · chromeJul 16, 2024

  • CVE-2024-21136
    35Monitor

    Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security).

    HighCVSS 8.6Proof of conceptEPSS 1%

    oracle · retail xstore officeJul 16, 2024

  • CVE-2024-21182
    82Now

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    HighCVSS 7.5KEVWeaponizedEPSS 74%

    oracle · weblogic serverJul 16, 2024

  • CVE-2024-6220
    50Plan

    简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    keydatas · keydatasJul 17, 2024

  • CVE-2024-40617
    26Monitor

    Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS).

    MediumCVSS 6.5Proof of conceptEPSS 1%

    fujitsu · network edgiot gw1500 firmwareJul 17, 2024

  • CVE-2024-23469
    40Plan

    SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 17%

    solarwinds · access rights managerJul 17, 2024

  • CVE-2024-23472
    38Monitor

    SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability

    HighCVSS 8.0No exploitEPSS 18%

    solarwinds · access rights managerJul 17, 2024

  • CVE-2024-28074
    38Monitor

    SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 10%

    solarwinds · access rights managerJul 17, 2024

  • CVE-2024-20419
    64This week

    A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote at

    CriticalCVSS 10.0WeaponizedEPSS 80%

    cisco · smart software manager on-premJul 17, 2024

  • CVE-2024-40119
    35Monitor

    Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    Jul 17, 2024

  • CVE-2024-40492
    28Monitor

    Cross Site Scripting vulnerability in Heartbeat Chat v.15.2.1 allows a remote attacker to execute arbitrary code via the setname function.

    HighCVSS 7.1Proof of conceptEPSS 0%

    heartbeat · heartbeatJul 17, 2024

  • CVE-2024-40725
    22Monitor

    Apache HTTP Server: source code disclosure with handlers configured via AddType

    MediumCVSS 5.3Proof of conceptEPSS 4%

    apache · http serverJul 18, 2024

  • CVE-2024-40898
    30Monitor

    Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

    HighCVSS 7.5Proof of conceptEPSS 1%

    apache · http serverJul 18, 2024

  • CVE-2024-39907
    48Plan

    a sqlinjection in 1Panel

    CriticalCVSS 9.8Proof of conceptEPSS 29%

    fit2cloud · 1panelJul 18, 2024

  • CVE-2024-39090
    24Monitor

    The PHPGurukul Online Shopping Portal Project version 2.0 contains a vulnerability that allows Cross-Site Request Forgery (CSRF) to lead to

    MediumCVSS 6.1Proof of conceptEPSS 0%

    phpgurukul · online shopping portalJul 18, 2024

  • CVE-2024-6205
    40Plan

    PayPlus Payment Gateway < 6.6.9 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    payplus · payplus payment gatewayJul 19, 2024

  • CVE-2024-41107
    37Monitor

    Apache CloudStack: SAML Signature Exclusion

    HighCVSS 8.1Proof of conceptEPSS 17%

    apache · cloudstackJul 19, 2024

  • CVE-2024-39123
    28Monitor

    In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitiz

    MediumCVSS 5.4Proof of conceptEPSS 23%

    janeczku · calibre-webJul 19, 2024

  • CVE-2024-40348
    34Monitor

    An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.

    HighCVSS 8.2Proof of conceptEPSS 8%

    bazarr · bazarrJul 20, 2024

  • CVE-2024-6497
    27Monitor

    SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter

    MediumCVSS 6.1No exploitEPSS 10%

    squirrly · seo plugin by squirrly seoJul 20, 2024

  • CVE-2024-6244
    36Monitor

    pz-frontend-manager < 1.0.6 - CSRF change user profile picture

    HighCVSS 8.8Proof of conceptEPSS 3%

    projectzealous · pz frontend managerJul 22, 2024

  • CVE-2024-37259
    24Monitor

    WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 0%

    wpextended · wp extendedJul 22, 2024

  • CVE-2024-37261
    24Monitor

    WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 0%

    wplab · wp-lister lite for amazonJul 22, 2024

  • CVE-2024-37211
    24Monitor

    WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    ali2woo · aliexpress dropshipping with alinextJul 22, 2024

  • CVE-2024-38773
    40Plan

    WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    formlift · formlift for infusionsoft web formsJul 22, 2024

  • CVE-2024-26020
    40Plan

    An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04.

    HighCVSS 8.8No exploitEPSS 15%

    ankiweb · ankiJul 22, 2024

  • CVE-2024-29073
    30Monitor

    An vulnerability in the handling of Latex exists in Ankitects Anki 24.04.

    MediumCVSS 6.5No exploitEPSS 11%

    ankiweb · ankiJul 22, 2024

  • CVE-2024-32152
    21Monitor

    A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04.

    MediumCVSS 4.3No exploitEPSS 12%

    ankitects · ankiJul 22, 2024

  • CVE-2024-32484
    38Monitor

    An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04.

    HighCVSS 8.2No exploitEPSS 21%

    ankitects · ankiJul 22, 2024

  • CVE-2024-41131
    30Monitor

    Out-of-bounds Write in SixLabors ImageSharp

    HighCVSS 7.5No exploitEPSS 0%

    sixlabors · imagesharpJul 22, 2024

  • CVE-2024-38944
    40Plan

    An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateFo

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    Jul 22, 2024

  • CVE-2024-34329
    33Monitor

    Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated

    HighCVSS 8.4Proof of conceptEPSS 0%

    Jul 22, 2024

  • CVE-2024-39250
    40Plan

    EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interf

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    efrotech · timetraxJul 22, 2024

  • CVE-2024-6911
    35Monitor

    Unauthenticated Local File Inclusion

    HighCVSS 8.7Proof of conceptEPSS 4%

    perkinelmer · processplusJul 22, 2024

  • CVE-2024-6828
    28Monitor

    Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting

    HighCVSS 7.2No exploitEPSS 1%

    davidanderson · redux frameworkJul 22, 2024

  • CVE-2024-6420
    35Monitor

    Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

    HighCVSS 8.6Proof of conceptEPSS 1%

    wpplugins · hide my wp ghostJul 23, 2024

  • CVE-2024-7014
    28Monitor

    Improper multimedia file attachment validation in Telegram for Android app

    HighCVSS 7.1Proof of conceptEPSS 1%

    telegram · telegramJul 23, 2024

  • CVE-2024-0760
    31Monitor

    A flood of DNS messages over TCP may make the server unstable

    HighCVSS 7.5Proof of conceptEPSS 4%

    isc · bind 9Jul 23, 2024

  • CVE-2024-41319
    41Plan

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd functi

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    totolink · a6000r firmwareJul 23, 2024

  • CVE-2024-6783
    19Monitor

    Vue client-side XSS via prototype pollution

    MediumCVSS 4.8Proof of conceptEPSS 0%

    vue · vueJul 23, 2024

  • CVE-2024-6753
    24Monitor

    Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 0%

    wpwebinfotech · social auto posterJul 23, 2024

  • CVE-2023-45249
    85Now

    Remote command execution due to use of default passwords.

    CriticalCVSS 9.8KEVWeaponizedEPSS 53%

    acronis · cyber infrastructureJul 24, 2024

  • CVE-2024-40422
    39Monitor

    The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack.

    CriticalCVSS 9.1Proof of conceptEPSS 11%

    stitionai · devikaJul 24, 2024

  • CVE-2024-36539
    39Monitor

    Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    projectcontour · contourJul 24, 2024

  • CVE-2024-41110
    44Plan

    Moby authz zero length regression

    CriticalCVSS 9.9Proof of conceptEPSS 16%

    moby · mobyJul 24, 2024

  • CVE-2024-41662
    38Monitor

    VNote vulnerable to Markdown XSS, which leads to RCE

    CriticalCVSS 9.6Proof of conceptEPSS 1%

    vnote project · vnoteJul 24, 2024

  • CVE-2024-41667
    36Monitor

    OpenAM FreeMarker template injection

    HighCVSS 8.8Proof of conceptEPSS 3%

    openidentityplatform · openamJul 24, 2024

  • CVE-2024-37084
    46Plan

    CVE-2024-37084: Remote code execution in Spring Cloud Data Flow

    HighCVSS 8.8Proof of conceptEPSS 35%

    vmware · spring cloud data flowJul 25, 2024

  • CVE-2024-40318
    28Monitor

    An arbitrary file upload vulnerability in Webkul Qloapps v1.6.0.0 allows attackers to execute arbitrary code via uploading a crafted file.

    HighCVSS 7.2Proof of conceptEPSS 1%

    webkul · qloappsJul 25, 2024

  • CVE-2024-38288
    29Monitor

    A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated atta

    HighCVSS 7.2Proof of conceptEPSS 3%

    rhubcom · turbomeetingJul 25, 2024

  • CVE-2024-38289
    51Plan

    A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    rhubcom · turbomeetingJul 25, 2024

  • CVE-2024-40324
    21Monitor

    A CRLF injection vulnerability in E-Staff v5.1 allows attackers to insert Carriage Return (CR) and Line Feed (LF) characters into input fiel

    MediumCVSS 5.4Proof of conceptEPSS 0%

    datex-soft · e-staffJul 25, 2024

  • CVE-2024-7120
    49Plan

    Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection

    MediumCVSS 5.3Proof of conceptEPSS 93%

    raisecom · msg2300 firmwareJul 26, 2024

  • CVE-2024-6922
    36Monitor

    Server-Side Request Forgery in Automation 360

    MediumCVSS 6.9Proof of conceptEPSS 30%

    automationanywhere · automation 360Jul 26, 2024

  • CVE-2024-41357
    28Monitor

    phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php.

    HighCVSS 7.1Proof of conceptEPSS 1%

    phpipam · phpipamJul 26, 2024

  • CVE-2024-39304
    36Monitor

    ChurchCRM SQL Injection Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 2%

    churchcrm · churchcrmJul 26, 2024

  • CVE-2024-42007
    23Monitor

    SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files.

    MediumCVSS 5.8Proof of conceptEPSS 0%

    Jul 26, 2024

  • CVE-2024-41628
    32Monitor

    Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9

    HighCVSS 7.5Proof of conceptEPSS 6%

    Jul 26, 2024

  • CVE-2024-6569
    21Monitor

    Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    vibhorchhabra · campaign monitor for wordpressJul 27, 2024

  • CVE-2024-42049
    37Monitor

    TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    Jul 27, 2024

  • CVE-2024-7156
    31Monitor

    TOTOLINK A3700R apmib Configuration ExportSettings.sh information disclosure

    MediumCVSS 6.9No exploitEPSS 13%

    totolink · a3700r firmwareJul 28, 2024

  • CVE-2024-6366
    45Plan

    User Profile Builder < 3.11.8 - Unauthenticated Media Upload

    CriticalCVSS 9.1Proof of conceptEPSS 28%

    cozmoslabs · profile builderJul 29, 2024

  • CVE-2024-7188
    29Monitor

    Bylancer Quicklancer GET Parameter listing sql injection

    MediumCVSS 6.9Proof of conceptEPSS 7%

    bylancer · quicklancerJul 29, 2024

  • CVE-2024-41640
    24Monitor

    Cross Site Scripting (XSS) vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Jul 29, 2024

  • CVE-2024-41810
    24Monitor

    HTML injection in HTTP redirect body

    MediumCVSS 6.1Proof of conceptEPSS 1%

    twisted · twistedJul 29, 2024

  • CVE-2024-41817
    31Monitor

    Arbitrary Code Execution in `AppImage` version `ImageMagick`

    HighCVSS 7.8Proof of conceptEPSS 0%

    imagemagick · imagemagickJul 29, 2024

  • CVE-2024-6748
    40Plan

    Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and RMM versions 128317 and below are vulnerable to authenticated SQL injecti

    HighCVSS 8.3No exploitEPSS 23%

    manageengine · opmanagerJul 29, 2024

  • CVE-2024-40815
    30Monitor

    A race condition was addressed with additional validation.

    HighCVSS 7.5Proof of conceptEPSS 1%

    apple · ipadosJul 29, 2024

  • CVE-2024-5765
    47Plan

    WpStickyBar <= 2.1.0 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    a17lab · wpstickybarJul 30, 2024

  • CVE-2024-5975
    37Monitor

    CZ Loan Management <= 1.1 - Unauthenticated SQLi

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    contrive · cz loan managementJul 30, 2024

  • CVE-2024-6536
    21Monitor

    Zephyr Project Manager < 3.3.99 - Editor+ XSS

    MediumCVSS 5.4Proof of conceptEPSS 0%

    dylanjkotze · zephyr project managerJul 30, 2024

  • CVE-2024-40094
    21Monitor

    GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of ser

    MediumCVSS 5.3Proof of conceptEPSS 0%

    Jul 30, 2024

  • CVE-2024-7297
    41Plan

    Langflow Privilege Escalation

    HighCVSS 8.8No exploitEPSS 21%

    langflow · langflowJul 30, 2024

  • CVE-2024-6255
    40Plan

    Path Traversal in gaizhenbiao/chuanhuchatgpt

    CriticalCVSS 9.1No exploitEPSS 13%

    gaizhenbiao · chuanhuchatgptJul 30, 2024

  • CVE-2024-7135
    27Monitor

    Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

    MediumCVSS 6.5Proof of conceptEPSS 2%

    tainacan · tainacanJul 31, 2024

  • CVE-2024-7264
    32Monitor

    ASN.1 date parser overread

    MediumCVSS 6.5No exploitEPSS 20%

    haxx · libcurlJul 31, 2024

  • CVE-2024-7340
    37Monitor

    W&B Weave server remote arbitrary file leak and privilege escalation

    HighCVSS 8.8Proof of conceptEPSS 5%

    Jul 31, 2024

  • CVE-2024-37900
    23Monitor

    XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader

    MediumCVSS 4.6No exploitEPSS 15%

    xwiki · xwikiJul 31, 2024

  • CVE-2024-41947
    22Monitor

    XWiki Platform XSS through conflict resolution

    MediumCVSS 5.4Proof of conceptEPSS 1%

    xwiki · xwikiJul 31, 2024

  • CVE-2024-41955
    21Monitor

    Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect

    MediumCVSS 5.4Proof of conceptEPSS 1%

    opensecurity · mobile security frameworkJul 31, 2024

  • CVE-2024-7332
    43Plan

    TOTOLINK CP450 Telnet Service product.ini hard-coded password

    CriticalCVSS 9.3Proof of conceptEPSS 20%

    totolink · cp450 firmwareJul 31, 2024