CVEs published June 3, 2024
109 CVEs were published on June 3, 2024: 17 critical, 25 high.
- Published
- 109
- Critical
- 17
- High
- 25
- Medium
- 64
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Qualcomm Snapdragon
- 12
- Linux
- 5
- Brainstorm Force Spectra
- 3
- Fortinet FortiWebManager
- 3
- Canonical Apport
- 2
- Fortinet FortiWeb
- 2
- Japan System Techniques Co. UNIVERSAL PASSPORT RX
- 2
- MediaTek MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT…
- 2
- MediaTek MT6890, MT6990, MT7622
- 2
- Netentsec NS-ASG Application Security Gateway
- 2
Critical 17
- CVE-2024-36782TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers t
- CVE-2024-36783TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost funct
- CVE-2024-31682Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass finge
- CVE-2024-37019Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication.
- CVE-2024-4332Improper Authentication in Tripwire Enterprise 9.1.0 APIsFortra Tripwire Enterprise
- CVE-2024-0336Improper Access Control in EMTA Grups PDKSEMTA Grup PDKS
- CVE-2024-36568Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=.
- CVE-2024-3829Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrantqdrant/qdrant · qdrant-client
- CVE-2023-43556Buffer Copy Without Checking Size of Input in HypervisorQualcomm Snapdragon
- CVE-2023-43551Improper Authentication in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-43538Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OSQualcomm Snapdragon
- CVE-2024-5404ifm: moneo prone to weak password recovery mechanism ifm moneo appliance QVA200 · ifm moneo appliance QHA210 +2
- CVE-2024-5311DigiWin EasyFlow .NET - SQL InjectionDigiWin EasyFlow .NET
- CVE-2024-36042Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthenticorg.silverpeas.core:silverpeas-core
- CVE-2024-20067In modem, there is a possible out of bounds write due to improper input invalidation.MediaTek MT6813, MT6815, MT6835, MT6878, MT6897, MT6899, MT…
- CVE-2023-51219A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within
- CVE-2024-34987A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2.
High 25
- CVE-2022-1242Apport can be tricked into connecting to arbitrary sockets as the root userCanonical Apport
- CVE-2021-3899There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arCanonical Apport
- CVE-2022-0555Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all PermissionsCanonical subiquity
- CVE-2024-4540Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookiekeycloak · Red Hat Build of Keycloak +3
- CVE-2024-32983Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activitiesmisskey-dev misskey
- CVE-2024-36128Directus is soft-locked by providing a string value to random string utildirectus
- CVE-2024-36127apko Exposure of HTTP basic auth credentials in log outputchainguard-dev apko · chainguard.dev/apko
- CVE-2024-36728TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2024-36569Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php.
- CVE-2024-34794WordPress Tainacan plugin <= 0.21.3 - Cross Site Scripting (XSS) vulnerabilityTainacan
- CVE-2024-35631WordPress FV Flowplayer Video Player plugin <= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerabilityFoliovision FV Flowplayer Video Player
- CVE-2024-35630WordPress WP TripAdvisor Review Slider plugin <= 12.6 - SQL Injection vulnerabilityLJ Apps WP TripAdvisor Review Slider
- CVE-2024-23363Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2024-23360Improper Access Control in Graphics WindowsQualcomm Snapdragon
- CVE-2023-43555Buffer Over-read in VideoQualcomm Snapdragon
- CVE-2023-43542Buffer Copy Without Checking Size of Input in Trusted Execution EnvironmentQualcomm Snapdragon
- CVE-2024-23667An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2Fortinet FortiWebManager
- CVE-2024-23668An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2Fortinet FortiWebManager
- CVE-2024-23670An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2Fortinet FortiWebManager
- CVE-2024-36964fs/9p: only translate RWX permissions for plain 9P2000Linux
- CVE-2024-36963tracefs: Reset permissions on remount if permissions are optionsLinux
- CVE-2024-36962net: ks8851: Queue RX packets in IRQ handler instead of disabling BHsLinux
- CVE-2024-36961thermal/debugfs: Fix two locking issues with thermal zone debugLinux
- CVE-2024-36960drm/vmwgfx: Fix invalid reads in fence signaled eventsLinux
- CVE-2024-20066In modem, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT…
Medium, low and unrated 67
- CVE-2023-28492WordPress Calendar Event Multi View plugin <= 1.4.10 - Missing Authorization Leading To Feedback Submission vulnerabilityCodePeople CP Multi View Event Calendar
- CVE-2023-27460WordPress CP Contact Form with PayPal plugin <= 1.3.34 - Missing Authorization Leading To Feedback Submission vulnerabilityCodePeople, paypaldev CP Contact Form with Paypal
- CVE-2023-27437WordPress Event Espresso 4 Decaf plugin <= 4.10.44.decaf - Bypass vulnerabilityEvent Espresso 4 Decaf
- CVE-2023-26523WordPress Calculated Fields Form plugin <= 1.1.120 - Missing Authorization Leading To Feedback Submission VulnerabilityCodePeople Calculated Fields Form
- CVE-2023-26521WordPress Search in Place plugin <= 1.0.104 - Missing Authorization Leading To Feedback Submission vulnerabilityCodePeople Search in Place
- CVE-2023-24373WordPress Booking calendar, Appointment Booking System plugin <= 3.2.3 - Bypass vulnerabilityWpDevArt Booking calendar, Appointment Booking System
- CVE-2023-23738WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email Spoofing VulnerabilityBrainstorm Force Spectra
- CVE-2023-23735WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email HTML Injection VulnerabilityBrainstorm Force Spectra
- CVE-2023-23730WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass VulnerabilityBrainstorm Force Spectra
- CVE-2023-52162Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is vulnerable to a stack-based buffer overflow, which could allow an atta
- CVE-2024-34051A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attadolibarr/dolibarr
- CVE-2024-31684Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass f
- CVE-2024-36674LyLme_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php.
- CVE-2024-36124iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crashdain snappy · org.iq80.snappy:snappy
- CVE-2024-36123Citizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:TaglineStarCitizenTools mediawiki-skins-Citizen
- CVE-2024-36729TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary.
- CVE-2024-5197Integer overflow in libvpxChromium libvpx
- CVE-2024-35632WordPress Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerabilityCRM Perks. Integration for Contact Form 7 and Constant Cont…
- CVE-2024-34385WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Wishlist
- CVE-2024-34766WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerabilityAutomattic ChaosTheory
- CVE-2024-34767WordPress ShopLentor plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerabilityHasThemes ShopLentor
- CVE-2024-34769WordPress Elegant Blocks – Amazing Gutenberg Blocks plugin <= 1.7 - Cross Site Scripting (XSS) vulnerabilitycyclonetheme Elegant Blocks
- CVE-2024-34770WordPress Popup Maker WP plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityPopup Maker WP
- CVE-2024-34789WordPress Post Grid Elementor Addon plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerabilityWP Hait Post Grid Elementor Addon
- CVE-2024-34790WordPress Download ImageMagick Sharpen Resized Images plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityHans van Eijsden,niwreg ImageMagick Sharpen Resized Images
- CVE-2024-34791WordPress WPB Elementor Addons plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilitywpbean WPB Elementor Addons
- CVE-2024-34793WordPress WP Next Post Navi plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilityKharim Tomlinson WP Next Post Navi
- CVE-2024-34795WordPress Tainacan plugin <= 0.21.3 - Cross Site Scripting (XSS) vulnerabilityTainacan
- CVE-2024-34796WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityAccessAlly PopupAlly
- CVE-2024-34797WordPress Simple Popup Manager plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityBenoit Mercusot Simple Popup Manager
- CVE-2024-34801WordPress Praison SEO WordPress plugin <= 4.0.15 - Cross Site Scripting (XSS) vulnerabilityMervin Praison Praison SEO WordPress
- CVE-2024-34754WordPress Contact Form Widget plugin <= 1.3.9 - Sensitive Data Exposure vulnerabilityA WP Life Contact Form Widget
- CVE-2024-34798WordPress Debug Log – Manger Tool plugin <= 1.4.5 - Sensitive Data Exposure vulnerabilityLukman Nakib Debug Log – Manger Tool
- CVE-2024-34803WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerabilityFastly
- CVE-2024-21478NULL Pointer Dereference in GraphicsQualcomm Snapdragon
- CVE-2023-43545Integer Overflow or Wraparound in WLAN HOSTQualcomm Snapdragon
- CVE-2023-43544Use After Free in AudioQualcomm Snapdragon
- CVE-2023-43543Use After Free in AudioQualcomm Snapdragon
- CVE-2023-43537Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2024-35633WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerabilityCreative Themes Blocksy Companion
- CVE-2024-35635WordPress Ninja Tables plugin <= 5.0.9 - Server Side Request Forgery (SSRF) vulnerabilityWPManageNinja Ninja Tables
- CVE-2024-23665Multiple improper authorization vulnerabilities [CWE-285] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and bFortinet FortiWeb
- CVE-2024-23664A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 aFortinet FortiAuthenticator
- CVE-2024-35637WordPress Church Admin plugin <= 4.3.6 - Server Side Request Forgery (SSRF) vulnerabilityandy_moyle Church Admin
- CVE-2024-35638WordPress ActiveDEMAND plugin <= 0.2.43 - Cross Site Request Forgery (CSRF) vulnerabilityJumpDEMAND ActiveDEMAND
- CVE-2024-35639WordPress Simple Spoiler plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityWebliberty Simple Spoiler
- CVE-2023-48789A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access coFortinet FortiPortal
- CVE-2024-31493An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 anFortinet FortiSOAR
- CVE-2024-23107An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, veFortinet FortiWeb
- CVE-2024-35640WordPress Safety Exit plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityTomas Cordero Safety Exit
- CVE-2024-35641WordPress Just Writing Statistics plugin <= 4.5 - Cross Site Scripting (XSS) vulnerabilityGregRoss Just Writing Statistics
- CVE-2024-35642WordPress Site Favicon plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilityBryan Hadaway Site Favicon
- CVE-2024-35643WordPress WP Back Button plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityXabier Miranda WP Back Button
- CVE-2024-37031The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create eactiveadmin
- CVE-2023-51436Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker Japan System Techniques Co. UNIVERSAL PASSPORT RX
- CVE-2023-42427Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker Japan System Techniques Co. UNIVERSAL PASSPORT RX
- CVE-2024-20075In eemgpu, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT…
- CVE-2024-20074In dmc, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-20073In wlan service, there is a possible out of bounds write due to improper input validation.MediaTek MT6890, MT7622
- CVE-2024-20072In wlan driver, there is a possible out of bounds write due to improper input validation.MediaTek MT6890, MT6990, MT7622
- CVE-2024-20071In wlan driver, there is a possible out of bounds read due to improper input validation.MediaTek MT6890, MT6990, MT7622
- CVE-2024-20070In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation.MediaTek MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT…
- CVE-2024-20069In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check.MediaTek MT6833, MT6853, MT6855, MT6873, MT6875, MT6875T, M…
- CVE-2024-20068In modem, there is a possible system crash due to improper input validation.MediaTek MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT…
- CVE-2024-20065In telephony, there is a possible information disclosure due to a missing permission check.MediaTek MT6768, MT6781, MT6835, MT6853, MT6855, MT6877, MT…
- CVE-2024-5590Netentsec NS-ASG Application Security Gateway JSON Content uploadiscuser.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-5589Netentsec NS-ASG Application Security Gateway sql injectionNetentsec NS-ASG Application Security Gateway