# CVEs published 2024-06-03

109 CVEs were published on June 3, 2024: 17 critical, 25 high. Days are UTC.

- [CVE-2023-28492](https://cve.now/CVE-2023-28492.md): WordPress Calendar Event Multi View plugin \<= 1.4.10 - Missing Authorization Leading To Feedback Submission vulnerability (CVSS 4.3, CodePeople CP Multi View Event Calendar)
- [CVE-2023-27460](https://cve.now/CVE-2023-27460.md): WordPress CP Contact Form with PayPal plugin \<= 1.3.34 - Missing Authorization Leading To Feedback Submission vulnerability (CVSS 4.3, CodePeople, paypaldev CP Contact Form with Paypal)
- [CVE-2023-27437](https://cve.now/CVE-2023-27437.md): WordPress Event Espresso 4 Decaf plugin \<= 4.10.44.decaf - Bypass vulnerability (CVSS 3.7, Event Espresso 4 Decaf)
- [CVE-2023-26523](https://cve.now/CVE-2023-26523.md): WordPress Calculated Fields Form plugin \<= 1.1.120 - Missing Authorization Leading To Feedback Submission Vulnerability (CVSS 4.3, CodePeople Calculated Fields Form)
- [CVE-2023-26521](https://cve.now/CVE-2023-26521.md): WordPress Search in Place plugin \<= 1.0.104 - Missing Authorization Leading To Feedback Submission vulnerability (CVSS 4.3, CodePeople Search in Place)
- [CVE-2023-24373](https://cve.now/CVE-2023-24373.md): WordPress Booking calendar, Appointment Booking System plugin \<= 3.2.3 - Bypass vulnerability (CVSS 3.7, WpDevArt Booking calendar, Appointment Booking System)
- [CVE-2023-23738](https://cve.now/CVE-2023-23738.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Unauthenticated Email Spoofing Vulnerability (CVSS 5.3, Brainstorm Force Spectra)
- [CVE-2023-23735](https://cve.now/CVE-2023-23735.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Unauthenticated Email HTML Injection Vulnerability (CVSS 5.3, Brainstorm Force Spectra)
- [CVE-2023-23730](https://cve.now/CVE-2023-23730.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Captcha Bypass Vulnerability (CVSS 5.3, Brainstorm Force Spectra)
- [CVE-2024-36782](https://cve.now/CVE-2024-36782.md): TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers t (CVSS 9.8)
- [CVE-2024-36783](https://cve.now/CVE-2024-36783.md): TOTOLINK LR350 V9.3.5u.6369\_B20220309 was discovered to contain a command injection via the host\_time parameter in the NTPSyncWithHost funct (CVSS 9.8)
- [CVE-2023-52162](https://cve.now/CVE-2023-52162.md): Mercusys MW325R EU V3 (Firmware MW325R(EU)\_V3\_1.11.0 Build 221019) is vulnerable to a stack-based buffer overflow, which could allow an atta (CVSS 6.7)
- [CVE-2024-34051](https://cve.now/CVE-2024-34051.md): A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote atta (CVSS 4.6, dolibarr/dolibarr)
- [CVE-2024-31682](https://cve.now/CVE-2024-31682.md): Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass finge (CVSS 9.8)
- [CVE-2024-31684](https://cve.now/CVE-2024-31684.md): Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass f (CVSS 3.5)
- [CVE-2022-1242](https://cve.now/CVE-2022-1242.md): Apport can be tricked into connecting to arbitrary sockets as the root user (CVSS 7.8, Canonical Apport)
- [CVE-2021-3899](https://cve.now/CVE-2021-3899.md): There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute ar (CVSS 7.8, Canonical Apport)
- [CVE-2022-0555](https://cve.now/CVE-2022-0555.md): Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions (CVSS 8.4, Canonical subiquity)
- [CVE-2024-37019](https://cve.now/CVE-2024-37019.md): Northern.tech Mender Enterprise before 3.6.4 and 3.7.x before 3.7.4 has Weak Authentication. (CVSS 9.8)
- [CVE-2024-4332](https://cve.now/CVE-2024-4332.md): Improper Authentication in Tripwire Enterprise 9.1.0 APIs (CVSS 9.3, Fortra Tripwire Enterprise)
- [CVE-2024-36674](https://cve.now/CVE-2024-36674.md): LyLme\_spage v1.9.5 is vulnerable to Cross Site Scripting (XSS) via admin/link.php. (CVSS 6.1)
- [CVE-2024-4540](https://cve.now/CVE-2024-4540.md): Keycloak: exposure of sensitive information in pushed authorization requests (par) kc\_restart cookie (CVSS 7.5, keycloak · Red Hat Build of Keycloak +3)
- [CVE-2024-32983](https://cve.now/CVE-2024-32983.md): Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities (CVSS 8.2, misskey-dev misskey)
- [CVE-2024-36128](https://cve.now/CVE-2024-36128.md): Directus is soft-locked by providing a string value to random string util (CVSS 7.5, directus)
- [CVE-2024-36127](https://cve.now/CVE-2024-36127.md): apko Exposure of HTTP basic auth credentials in log output (CVSS 7.5, chainguard-dev apko · chainguard.dev/apko)
- [CVE-2024-36124](https://cve.now/CVE-2024-36124.md): iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash (CVSS 5.3, dain snappy · org.iq80.snappy:snappy)
- [CVE-2024-36123](https://cve.now/CVE-2024-36123.md): Citizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:Tagline (CVSS 6.5, StarCitizenTools mediawiki-skins-Citizen)
- [CVE-2024-0336](https://cve.now/CVE-2024-0336.md): Improper Access Control in EMTA Grups PDKS (CVSS 9.4, EMTA Grup PDKS)
- [CVE-2024-36728](https://cve.now/CVE-2024-36728.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (CVSS 8.1)
- [CVE-2024-36729](https://cve.now/CVE-2024-36729.md): TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. (CVSS 6.3)
- [CVE-2024-5197](https://cve.now/CVE-2024-5197.md): Integer overflow in libvpx (CVSS 5.9, Chromium libvpx)
- [CVE-2024-36569](https://cve.now/CVE-2024-36569.md): Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php. (CVSS 8.1)
- [CVE-2024-36568](https://cve.now/CVE-2024-36568.md): Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. (CVSS 9.8)
- [CVE-2024-35632](https://cve.now/CVE-2024-35632.md): WordPress Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms plugin \<= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CRM Perks. Integration for Contact Form 7 and Constant Cont…)
- [CVE-2024-34385](https://cve.now/CVE-2024-34385.md): WordPress YITH WooCommerce Wishlist plugin \<= 3.32.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, YITHEMES YITH WooCommerce Wishlist)
- [CVE-2024-34766](https://cve.now/CVE-2024-34766.md): WordPress ChaosTheory theme \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic ChaosTheory)
- [CVE-2024-34767](https://cve.now/CVE-2024-34767.md): WordPress ShopLentor plugin \<= 2.8.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, HasThemes ShopLentor)
- [CVE-2024-34769](https://cve.now/CVE-2024-34769.md): WordPress Elegant Blocks – Amazing Gutenberg Blocks plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, cyclonetheme Elegant Blocks)
- [CVE-2024-34770](https://cve.now/CVE-2024-34770.md): WordPress Popup Maker WP plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Popup Maker WP)
- [CVE-2024-34789](https://cve.now/CVE-2024-34789.md): WordPress Post Grid Elementor Addon plugin \<= 2.0.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Hait Post Grid Elementor Addon)
- [CVE-2024-34790](https://cve.now/CVE-2024-34790.md): WordPress Download ImageMagick Sharpen Resized Images plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Hans van Eijsden,niwreg ImageMagick Sharpen Resized Images)
- [CVE-2024-34791](https://cve.now/CVE-2024-34791.md): WordPress WPB Elementor Addons plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpbean WPB Elementor Addons)
- [CVE-2024-34793](https://cve.now/CVE-2024-34793.md): WordPress WP Next Post Navi plugin \<= 1.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Kharim Tomlinson WP Next Post Navi)
- [CVE-2024-34794](https://cve.now/CVE-2024-34794.md): WordPress Tainacan plugin \<= 0.21.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tainacan)
- [CVE-2024-34795](https://cve.now/CVE-2024-34795.md): WordPress Tainacan plugin \<= 0.21.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Tainacan)
- [CVE-2024-34796](https://cve.now/CVE-2024-34796.md): WordPress PopupAlly plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AccessAlly PopupAlly)
- [CVE-2024-34797](https://cve.now/CVE-2024-34797.md): WordPress Simple Popup Manager plugin \<= 1.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Benoit Mercusot Simple Popup Manager)
- [CVE-2024-34801](https://cve.now/CVE-2024-34801.md): WordPress Praison SEO WordPress plugin \<= 4.0.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Mervin Praison Praison SEO WordPress)
- [CVE-2024-35631](https://cve.now/CVE-2024-35631.md): WordPress FV Flowplayer Video Player plugin \<= 7.5.45.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Foliovision FV Flowplayer Video Player)
- [CVE-2024-35630](https://cve.now/CVE-2024-35630.md): WordPress WP TripAdvisor Review Slider plugin \<= 12.6 - SQL Injection vulnerability (CVSS 7.6, LJ Apps WP TripAdvisor Review Slider)
- [CVE-2024-34754](https://cve.now/CVE-2024-34754.md): WordPress Contact Form Widget plugin \<= 1.3.9 - Sensitive Data Exposure vulnerability (CVSS 5.3, A WP Life Contact Form Widget)
- [CVE-2024-34798](https://cve.now/CVE-2024-34798.md): WordPress Debug Log – Manger Tool plugin \<= 1.4.5 - Sensitive Data Exposure vulnerability (CVSS 5.3, Lukman Nakib Debug Log – Manger Tool)
- [CVE-2024-34803](https://cve.now/CVE-2024-34803.md): WordPress Fastly plugin \<= 1.2.25 - Broken Access Control vulnerability (CVSS 4.3, Fastly)
- [CVE-2024-3829](https://cve.now/CVE-2024-3829.md): Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant (CVSS 9.8, qdrant/qdrant · qdrant-client)
- [CVE-2024-23363](https://cve.now/CVE-2024-23363.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2024-23360](https://cve.now/CVE-2024-23360.md): Improper Access Control in Graphics Windows (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-21478](https://cve.now/CVE-2024-21478.md): NULL Pointer Dereference in Graphics (CVSS 6.2, Qualcomm Snapdragon)
- [CVE-2023-43556](https://cve.now/CVE-2023-43556.md): Buffer Copy Without Checking Size of Input in Hypervisor (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2023-43555](https://cve.now/CVE-2023-43555.md): Buffer Over-read in Video (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2023-43551](https://cve.now/CVE-2023-43551.md): Improper Authentication in Multi-Mode Call Processor (CVSS 9.1, Qualcomm Snapdragon)
- [CVE-2023-43545](https://cve.now/CVE-2023-43545.md): Integer Overflow or Wraparound in WLAN HOST (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-43544](https://cve.now/CVE-2023-43544.md): Use After Free in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-43543](https://cve.now/CVE-2023-43543.md): Use After Free in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-43542](https://cve.now/CVE-2023-43542.md): Buffer Copy Without Checking Size of Input in Trusted Execution Environment (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-43538](https://cve.now/CVE-2023-43538.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in TZ Secure OS (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2023-43537](https://cve.now/CVE-2023-43537.md): Buffer Over-read in WLAN Host (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-35633](https://cve.now/CVE-2024-35633.md): WordPress Blocksy Companion plugin \<= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Creative Themes Blocksy Companion)
- [CVE-2024-35635](https://cve.now/CVE-2024-35635.md): WordPress Ninja Tables plugin \<= 5.0.9 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, WPManageNinja Ninja Tables)
- [CVE-2024-23665](https://cve.now/CVE-2024-23665.md): Multiple improper authorization vulnerabilities \[CWE-285\] in FortiWeb version 7.4.2 and below, version 7.2.7 and below, version 7.0.10 and b (CVSS 5.6, Fortinet FortiWeb)
- [CVE-2024-23664](https://cve.now/CVE-2024-23664.md): A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 a (CVSS 5.8, Fortinet FortiAuthenticator)
- [CVE-2024-23667](https://cve.now/CVE-2024-23667.md): An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2 (CVSS 7.6, Fortinet FortiWebManager)
- [CVE-2024-23668](https://cve.now/CVE-2024-23668.md): An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2 (CVSS 8.6, Fortinet FortiWebManager)
- [CVE-2024-23670](https://cve.now/CVE-2024-23670.md): An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2 (CVSS 7.6, Fortinet FortiWebManager)
- [CVE-2024-5404](https://cve.now/CVE-2024-5404.md): ifm: moneo prone to weak password recovery mechanism (CVSS 9.8, ifm moneo appliance QVA200 · ifm moneo appliance QHA210 +2)
- [CVE-2024-35637](https://cve.now/CVE-2024-35637.md): WordPress Church Admin plugin \<= 4.3.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, andy\_moyle Church Admin)
- [CVE-2024-35638](https://cve.now/CVE-2024-35638.md): WordPress ActiveDEMAND plugin \<= 0.2.43 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, JumpDEMAND ActiveDEMAND)
- [CVE-2024-35639](https://cve.now/CVE-2024-35639.md): WordPress Simple Spoiler plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Webliberty Simple Spoiler)
- [CVE-2023-48789](https://cve.now/CVE-2023-48789.md): A client-side enforcement of server-side security in Fortinet FortiPortal version 6.0.0 through 6.0.14 allows attacker to improper access co (CVSS 4.1, Fortinet FortiPortal)
- [CVE-2024-31493](https://cve.now/CVE-2024-31493.md): An improper removal of sensitive information before storage or transfer vulnerability \[CWE-212\] in FortiSOAR version 7.3.0, version 7.2.2 an (CVSS 6.0, Fortinet FortiSOAR)
- [CVE-2024-23107](https://cve.now/CVE-2024-23107.md): An exposure of sensitive information to an unauthorized actor vulnerability \[CWE-200\] in FortiWeb version 7.4.0, version 7.2.4 and below, ve (CVSS 5.2, Fortinet FortiWeb)
- [CVE-2024-36964](https://cve.now/CVE-2024-36964.md): fs/9p: only translate RWX permissions for plain 9P2000 (CVSS 8.8, Linux)
- [CVE-2024-36963](https://cve.now/CVE-2024-36963.md): tracefs: Reset permissions on remount if permissions are options (CVSS 7.8, Linux)
- [CVE-2024-36962](https://cve.now/CVE-2024-36962.md): net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs (CVSS 7.5, Linux)
- [CVE-2024-36961](https://cve.now/CVE-2024-36961.md): thermal/debugfs: Fix two locking issues with thermal zone debug (CVSS 7.8, Linux)
- [CVE-2024-36960](https://cve.now/CVE-2024-36960.md): drm/vmwgfx: Fix invalid reads in fence signaled events (CVSS 7.1, Linux)
- [CVE-2024-35640](https://cve.now/CVE-2024-35640.md): WordPress Safety Exit plugin \<= 1.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Tomas Cordero Safety Exit)
- [CVE-2024-35641](https://cve.now/CVE-2024-35641.md): WordPress Just Writing Statistics plugin \<= 4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, GregRoss Just Writing Statistics)
- [CVE-2024-35642](https://cve.now/CVE-2024-35642.md): WordPress Site Favicon plugin \<= 0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Bryan Hadaway Site Favicon)
- [CVE-2024-35643](https://cve.now/CVE-2024-35643.md): WordPress WP Back Button plugin \<= 1.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Xabier Miranda WP Back Button)
- [CVE-2024-5311](https://cve.now/CVE-2024-5311.md): DigiWin EasyFlow .NET - SQL Injection (CVSS 9.8, DigiWin EasyFlow .NET)
- [CVE-2024-37031](https://cve.now/CVE-2024-37031.md): The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create e (CVSS 6.1, activeadmin)
- [CVE-2024-36042](https://cve.now/CVE-2024-36042.md): Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthentic (CVSS 9.8, org.silverpeas.core:silverpeas-core)
- [CVE-2023-51436](https://cve.now/CVE-2023-51436.md): Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.8, which may allow a remote authenticated attacker (CVSS 5.9, Japan System Techniques Co. UNIVERSAL PASSPORT RX)
- [CVE-2023-42427](https://cve.now/CVE-2023-42427.md): Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker (CVSS 6.5, Japan System Techniques Co. UNIVERSAL PASSPORT RX)
- [CVE-2024-20075](https://cve.now/CVE-2024-20075.md): In eemgpu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6833, MT6853, MT6873, MT6877, MT6885, MT6893, MT…)
- [CVE-2024-20074](https://cve.now/CVE-2024-20074.md): In dmc, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20073](https://cve.now/CVE-2024-20073.md): In wlan service, there is a possible out of bounds write due to improper input validation. (CVSS 6.6, MediaTek MT6890, MT7622)
- [CVE-2024-20072](https://cve.now/CVE-2024-20072.md): In wlan driver, there is a possible out of bounds write due to improper input validation. (CVSS 6.6, MediaTek MT6890, MT6990, MT7622)
- [CVE-2024-20071](https://cve.now/CVE-2024-20071.md): In wlan driver, there is a possible out of bounds read due to improper input validation. (CVSS 4.4, MediaTek MT6890, MT6990, MT7622)
- [CVE-2024-20070](https://cve.now/CVE-2024-20070.md): In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. (CVSS 5.1, MediaTek MT6298, MT6813, MT6815, MT6833, MT6835, MT6853, MT…)
- [CVE-2024-20069](https://cve.now/CVE-2024-20069.md): In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check. (CVSS 6.5, MediaTek MT6833, MT6853, MT6855, MT6873, MT6875, MT6875T, M…)
- [CVE-2024-20068](https://cve.now/CVE-2024-20068.md): In modem, there is a possible system crash due to improper input validation. (CVSS 5.9, MediaTek MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT…)
- [CVE-2024-20067](https://cve.now/CVE-2024-20067.md): In modem, there is a possible out of bounds write due to improper input invalidation. (CVSS 9.8, MediaTek MT6813, MT6815, MT6835, MT6878, MT6897, MT6899, MT…)
- [CVE-2024-20066](https://cve.now/CVE-2024-20066.md): In modem, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.5, MediaTek MT6298, MT6813, MT6815, MT6835, MT6878, MT6879, MT…)
- [CVE-2024-20065](https://cve.now/CVE-2024-20065.md): In telephony, there is a possible information disclosure due to a missing permission check. (CVSS 4.0, MediaTek MT6768, MT6781, MT6835, MT6853, MT6855, MT6877, MT…)
- [CVE-2024-5590](https://cve.now/CVE-2024-5590.md): Netentsec NS-ASG Application Security Gateway JSON Content uploadiscuser.php sql injection (CVSS 5.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-5589](https://cve.now/CVE-2024-5589.md): Netentsec NS-ASG Application Security Gateway sql injection (CVSS 5.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2023-51219](https://cve.now/CVE-2023-51219.md): A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within (CVSS 9.6)
- [CVE-2024-34987](https://cve.now/CVE-2024-34987.md): A SQL Injection vulnerability exists in the \`ofrs/admin/index.php\` script of PHPGurukul Online Fire Reporting System 1.2. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.