July 2024
3,248 CVEs published, −3% on June 2024 and +36% on July 2023. CISA added 14 to KEV.
2024 month by month
- Critical
- 2759% of the 3,133 with a CVSS score
- Added to CISA KEV
- 1412 of this month's CVEs are in KEV, listed a median 19 days after publication
- Vendors
- 1,3125,448 products
- Top weakness
- XSSCWE-79 · 528 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Openvpn53719nonenew
- 2LinuxLinux Kernel, Linux4400nonenew
- 3Ооо «ред Софт»Ред Ос41011nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»37081new
- 5Ао "нппкт"Осон Основа Оnyx33471new
- 6Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 82200nonenew
- 7CanonicalUbuntu, Snapd, Snap1791nonenew
- 8MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows Server 2022 (Server Core Installation), Windows Server 202215993new
- 9UnknownWp-affiliate-platform, Wp-emember, Himer1318nonenew
- 10Ао «ивк»Альт Сп 10, Альт 8 Сп12851new
- 11Novell Inc.Opensuse Leap, Suse Linux Enterprise Desktop, Suse Linux Enterprise Server For Sap Applications1273nonenew
- 12Ао «нтц Ит Роса»Rosa Virtualization 3.0, Rosa Virtualization, Роса Кобальт9841new
- 13ApplemacOS, iOS and iPadOS, iPadOS800nonenew
- 14GoogleAndroid, Chrome, Google Chrome756nonenew
- 15SourcecodesterRecord Management System, Lot Reservation Management System, Establishment Billing Management System690nonenew
- 16OracleMySQL Server, MySQL, E-business Suite6311new
- 17PyPIDjango, Anki, Roundup593nonenew
- 18Oretnom23Establishment Billing Management System, Lot Reservation Management System, School Fees Payment System512nonenew
- 19GoGithub.com/gogs/gogs, Gogs.io/gogs, Github.com/snapcore/snapd499nonenew
- 20MavenOrg.apache.streampark:streampark, Org.geoserver.web:gs-web-app, Org.apache.linkis:linkis-datasource4881new
- 21npmFlowise, Bootstrap, Directus477nonenew
- 22SamsungAndroid, Exynos 1380 Firmware, Exynos 2200 Firmware471nonenew
- 23ApacheHTTP Server, Streampark, Streampipes4691new
- 24Apache Software FoundationApache HTTP Server, HTTP Server, Apache Streampark4691new
- 25JuniperJunos OS Evolved, Junos, J-web460nonenew
Severity
How this month's CVEs score on CVSS; 115 have no score yet. Severity is not exploitation.
- Critical275
- High1,082
- Medium1,650
- Low126
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS528
- CWE-89SQL Injection179
- CWE-787Out-of-bounds Write115
- CWE-352CSRF95
- CWE-416Use After Free95
- CWE-200Information Exposure94
- CWE-22Path Traversal83
- CWE-476NULL Pointer Dereference77
- CWE-125Out-of-bounds Read61
- CWE-20Improper Input Validation60
- CWE-12159
- CWE-94Code Injection59
- CWE-434Unrestricted File Upload58
- CWE-122Heap Buffer Overflow57
- CWE-400Resource Consumption54
- CWE-862Missing Authorization53
- CWE-78OS Command Injection52
- CWE-269Improper Privilege Mgmt51
- CWE-120Buffer Overflow49
- CWE-284Improper Access Control48
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems90322% of sector-tagged CVEs
- Web & CMS Plugins84421% of sector-tagged CVEs
- Enterprise Software43411% of sector-tagged CVEs
- OSS Libraries39410% of sector-tagged CVEs
- Networking Infrastructure2867% of sector-tagged CVEs
- Mobile Apps2145% of sector-tagged CVEs
- 9 smaller sectors792
- Not yet classified167
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 352CSRF | 416Use After Free | 200Information Exposure | 22Path Traversal | 476NULL Pointer Dereference | 125Out-of-bounds Read | 20Improper Input Validation |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 6 | 3 | 16 | 70 | 4 | 1 | 67 | 22 | 2 | |
| Linux | 11 | 63 | 65 | 16 | ||||||
| Ооо «ред Софт» | 4 | 1 | 17 | 1 | 54 | 3 | 2 | 38 | 15 | 7 |
| Ооо «русбитех-астра» | 1 | 17 | 45 | 1 | 3 | 49 | 18 | 2 | ||
| Ао «нппкт» | 1 | 13 | 40 | 3 | 2 | 43 | 14 | 1 | ||
| Red Hat Inc. | 6 | 28 | 1 | 2 | 33 | 7 | 2 | |||
| Canonical Ltd. | 9 | 22 | 1 | 27 | 5 | 2 | ||||
| Microsoft | 3 | 6 | 10 | 5 | 1 | 8 | 8 | |||
| Microsoft Corp | 3 | 9 | 12 | 5 | 1 | 1 | 11 | 8 | ||
| Ао «ивк» | 7 | 10 | 2 | 10 | 5 | 1 | ||||
| Novell Inc. | 5 | 14 | 1 | 12 | 8 | 1 | ||||
| Ао «нтц Ит Роса» | 9 | 8 | 2 | 10 | 8 | 1 |
CVEs published in July 2024
47 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2023-45249Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before bu...KEV9.8
- CVE-2024-36401Remote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverKEV9.8
- CVE-2024-4879Jelly Template Injection Vulnerability in ServiceNow UI MacrosKEV9.8
- CVE-2024-5217Incomplete Input Validation in GlideExpression ScriptKEV9.8
- CVE-2024-5910Expedition: Missing Authentication Leads to Admin Account TakeoverKEV9.8
- CVE-2024-38475Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.KEV9.1
- CVE-2024-38080Windows Hyper-V Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-21182Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerabi...KEV7.5
- CVE-2024-38112Windows MSHTML Platform Spoofing VulnerabilityKEV7.5
- CVE-2024-38094Microsoft SharePoint Remote Code Execution VulnerabilityKEV7.2
- CVE-2024-20399Cisco NX-OS Software CLI Command Injection VulnerabilityKEV6.0
- CVE-2024-39891In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in J...KEV5.3
- CVE-2024-37906Admidio has Blind SQL Injection in ecard_send.php9.9
- CVE-2024-40539my-springsecurity-plus before v2024.07.03 was discovered to contain a SQL injection vulnerability via the dataScope parameter at /api/user.9.8
- CVE-2024-5488SEOPress < 7.9 - Unauthenticated Object Injection9.8
- CVE-2024-28200N-central Authentication Bypass9.1
- CVE-2024-30213StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, leading to remote code execution.8.8
- CVE-2024-6069Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation8.8
- CVE-2024-38708WordPress Barcode Scanner and Inventory manager plugin <= 1.6.1 - SQL Injection vulnerability8.5
- CVE-2024-32229FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf_tiltandshift.c:189:5 in copy_column.8.4
- CVE-2024-35199TorchServe gRPC Port Exposure8.2
- CVE-2024-7014Improper multimedia file attachment validation in Telegram for Android app8.1
- CVE-2024-37560WordPress WP User Switch plugin <= 1.1.0 - Privilege Escalation vulnerability8.0
- CVE-2024-39684Tencent RapidJSON include/rapidjson/reader.h GenericReader::ParseNumber() Function Template Exponent Parsing Integer Overflow7.8
- CVE-2024-4467Qemu-kvm: 'qemu-img info' leads to host file read/write7.8
- CVE-2024-35227Discourse vulnerable to DoS through Onebox7.5
- CVE-2024-41655TF2 Item Format Regular Expression Denial of Service vulnerability7.5
- CVE-2024-38024Microsoft SharePoint Server Remote Code Execution Vulnerability7.2
- CVE-2024-6753Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting7.2
- CVE-2024-6828Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting7.2
- CVE-2024-38687WordPress Sky Addons for Elementor plugin <= 2.5.5 - Cross Site Scripting (XSS) vulnerability6.5
- CVE-2024-39537Junos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the network6.5
- CVE-2024-39558Junos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRR6.5
- CVE-2024-6580/n software IPWorks SSH insufficient file access verification6.5
- CVE-2024-41109Pimcore vulnerable to disclosure of system and database information behind /admin firewall6.3
- CVE-2024-40689IBM InfoSphere Information Server SQL injection6.0
- CVE-2024-37434WordPress Atarim plugin <= 3.31 - Authenticated Cross Site Scripting (XSS) vulnerability5.9
- CVE-2024-6833Zowe CLI Auto-Init Leaks Credentials Locally5.9
- CVE-2024-6375Missing authorization check may lead to shard key refinement5.4
- CVE-2024-37498WordPress Tablesome plugin <= 1.0.33 - Sensitive Data Exposure via API vulnerability5.3
- CVE-2024-7328YouDianCMS information disclosure5.3
- CVE-2024-39897Cache driver GetBlob() allows read access to any blob without access control check4.3
- CVE-2024-6410ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3
- CVE-2024-40637Implicit override for built-in materializations from installed packages in dbt-core4.2
- CVE-2024-30471Apache StreamPipes: Potential creation of multiple identical accounts3.7
- CVE-2024-40632Linkerd potential access to the shutdown endpoint3.7
- CVE-2024-40640Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac2.9