---
title: "Security digest: July 29, 2024"
url: https://erroneo.us/security/2024-07-29/
description: "July 29, 2024 vulnerability digest: 3 CISA KEV additions (Acronis, ServiceNow); 2 critical advisories (Composer (PHP)). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-07-29
date_modified: 2024-07-29
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: July 29, 2024

3 known exploited (cisa kev) additions and 2 critical advisories.

## Take stock

- Do you run any of these? ServiceNow Utah, Vancouver, and Washington DC Now Platform, Acronis Cyber Infrastructure (ACI). They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-08-19.
- Composer (PHP): 2 critical advisories ( admidio/admidio ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2024-5217](https://erroneo.us/security/cve/CVE-2024-5217/index.md) ServiceNow Utah, Vancouver, and Washington DC Now Platform: ServiceNow Incomplete List of Disallowed Inputs Vulnerability (CISA due 2024-08-19)
- [CVE-2024-4879](https://erroneo.us/security/cve/CVE-2024-4879/index.md) ServiceNow Utah, Vancouver, and Washington DC Now Platform: ServiceNow Improper Input Validation Vulnerability (CISA due 2024-08-19)
- [CVE-2023-45249](https://erroneo.us/security/cve/CVE-2023-45249/index.md) Acronis Cyber Infrastructure (ACI): Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability (CISA due 2024-08-19)

## Critical advisories

- [CVE-2024-38529](https://erroneo.us/security/cve/CVE-2024-38529/index.md) Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment — Composer (PHP) admidio/admidio < 4.3.10 → 4.3.10
- [CVE-2024-37906](https://erroneo.us/security/cve/CVE-2024-37906/index.md) Admidio has Blind SQL Injection in ecard_send.php — Composer (PHP) admidio/admidio < 4.3.9 → 4.3.9

---
Source page: https://erroneo.us/security/2024-07-29/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt