CVEs published June 4, 2024
182 CVEs were published on June 4, 2024: 18 critical, 53 high.
- Published
- 182
- Critical
- 18
- High
- 53
- Medium
- 103
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Samsung Mobile Devices
- 13
- MLflow
- 10
- envoyproxy envoy
- 7
- Canonical Apport
- 6
- Zyxel NAS326 firmware · Zyxel NAS542 firmware
- 5
- @janhq/core
- 3
- SEH Computertechnik utnserver Pro · SEH Computertechnik… +1
- 3
- SolarWinds Platform
- 3
- YdataAI ydata-profiling · ydata-profiling
- 3
- BeyondTrust BeyondInsight
- 2
Critical 18
- CVE-2024-36675LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.
- CVE-2024-37273An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via@janhq/core
- CVE-2024-36858An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via @janhq/core
- CVE-2024-36604Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function.
- CVE-2024-36400nano-id is unable to generate the correct character setviz-rs nano-id · nano-id
- CVE-2024-35700WordPress UserPro plugin <= 5.1.8 - Unauthenticated Account Takeover vulnerabilityDeluxeThemes Userpro
- CVE-2024-35629WordPress Easy Digital Downloads – Recent Purchases plugin <= 1.0.2 - Remote File Inclusion vulnerabilityWow-Company Easy Digital Downloads – Recent Purchases
- CVE-2024-34792WordPress Dextaz Ping plugin <= 0.65 - Remote Code Execution (RCE) vulnerabilityDextaz Ping
- CVE-2024-34551WordPress Stockholm theme <= 9.6 - Unauthenticated Local File Inclusion vulnerabilitySelect-Themes Stockholm
- CVE-2024-33560WordPress XStore theme <= 9.3.8 - Unauthenticated Local File Inclusion vulnerability8theme XStore
- CVE-2024-25600WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerabilityCodeer Limited Bricks Builder
- CVE-2024-36104Apache OFBiz: Path traversal leading to a RCEApache Software Foundation Apache OFBiz
- CVE-2023-33930WordPress Unlimited Elements For Elementor plugin <= 1.5.66 - Unrestricted Zip Extraction vulnerabilityUnlimited Elements For Elementor
- CVE-2024-4180The Events Calendar < 6.4.0.1 - Reflected XSSThe Events Calendar
- CVE-2024-4552Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypassphoeniixx Social Login Lite For WooCommerce
- CVE-2024-29974** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versioZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2024-29973** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5Zyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2024-29972** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions bZyxel NAS326 firmware · Zyxel NAS542 firmware
High 53
- CVE-2022-28657Apport does not disable python crash handler before entering chrootCanonical Apport
- CVE-2022-28655is_closing_session() allows users to create arbitrary tcp dbus connectionsCanonical Apport
- CVE-2024-32976Envoy can enter an endless loop while decompressing Brotli data with extra inputenvoyproxy envoy
- CVE-2024-34363Envoy can crash due to uncaught nlohmann JSON exceptionenvoyproxy envoy
- CVE-2024-4520Improper Access Control in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt
- CVE-2024-35672WordPress Netgsm plugin <= 2.9.19 - Broken Access Control vulnerabilityNetgsm
- CVE-2024-25095WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerabilityCode Parrots Easy Forms for Mailchimp
- CVE-2024-36857Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.@janhq/core
- CVE-2024-29004SolarWinds Platform Stored XSS VulnerabilitySolarWinds Platform
- CVE-2024-28996SolarWinds Platform SWQL Injection VulnerabilitySolarWinds Platform
- CVE-2024-36549idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close
- CVE-2024-32871Pimcore Vulnerable to Flooding Server with Thumbnail filespimcore · pimcore/pimcore
- CVE-2024-35652WordPress Event Tickets with Ticket Scanner plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilitySaso Nikolov Event Tickets with Ticket Scanner
- CVE-2024-35664WordPress WPvivid Backup for MainWP plugin <= 0.9.32 - Reflected Cross Site Scripting (XSS) vulnerabilitywpvividplugins WPvivid Backup for MainWP
- CVE-2024-35668WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Brevo plugin <= 3.1.77 - Reflected Cross Site Scripting (XSS) vulnerabilityBrevo Newsletter, SMTP, Email marketing and Subscribe forms…
- CVE-2024-34554WordPress Stockholm Core plugin <= 2.4.1 - Local File Inclusion vulnerabilitySelect-Themes Stockholm Core
- CVE-2024-34552WordPress Stockholm theme <= 9.6 - Local File Inclusion vulnerabilitySelect-Themes Stockholm
- CVE-2024-33628WordPress XforWooCommerce plugin <= 2.0.2 - Authenticated Local File Inclusion vulnerabilityXforWooCommerce
- CVE-2024-33568WordPress Element Pack Pro plugin < 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerabilityBdThemes Element Pack Pro
- CVE-2024-33557WordPress XStore Core plugin <= 5.3.8 - Local File Inclusion vulnerability8theme XStore Core
- CVE-2024-36800A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php
- CVE-2024-29170Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability.Dell PowerScale OneFS
- CVE-2024-37065Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to ruSkops-dev Skops · skops
- CVE-2024-37064Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciouslYdataAI ydata-profiling · ydata-profiling
- CVE-2024-37063A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to YdataAI ydata-profiling · ydata-profiling
- CVE-2024-37062Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicouslyYdataAI ydata-profiling · ydata-profiling
- CVE-2024-37061Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLprojectMLflow
- CVE-2024-37060Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously craftMLflow
- CVE-2024-37059Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploadMLflow
- CVE-2024-37058Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploadMLflow
- CVE-2024-4254Secrets Exfiltration in gradio-app/gradiogradio-app/gradio
- CVE-2024-37057Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uplMLflow
- CVE-2024-37056Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaMLflow
- CVE-2024-37055Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaMLflow
- CVE-2024-37054Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploadMLflow
- CVE-2024-37053Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadMLflow
- CVE-2024-37052Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadMLflow
- CVE-2023-47837WordPress ARMember plugin <= 4.0.10 - Membership Plan Bypass vulnerabilityRepute Infosystems ARMember
- CVE-2023-46630WordPress Admin and Site Enhancements (ASE) plugin <= 5.7.1 - Password Protected View Bypass Vulnerability vulnerabilitywpase Admin and Site Enhancements
- CVE-2023-5751CODESYS: Development system prone to DoS through exposure of resource to wrong sphereCODESYS Control Win · CODESYS Development System +3
- CVE-2024-5000CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA productsCODESYS Control for BeagleBone SL · CODESYS Control for… +13
- CVE-2024-5422Denial of ServiceSEH Computertechnik utnserver Pro · SEH Computertechnik… +1
- CVE-2024-5421Authenticated Command InjectionSEH Computertechnik utnserver Pro · SEH Computertechnik… +1
- CVE-2024-5420Stored Cross-Site Scripting in SEH Computertechnik utnserver ProSEH Computertechnik utnserver Pro · SEH Computertechnik… +1
- CVE-2024-4253Command Injection in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-20878Heap out-of-bound write vulnerability in parsing grid image in libsavscmn.so prior to SMR June-2024 Release 1 allows local attackers to execSamsung Mobile Devices
- CVE-2024-20877Heap out-of-bound write vulnerability in parsing grid image header in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers tSamsung Mobile Devices
- CVE-2024-20874Improper access control vulnerability in SmartManagerCN prior to SMR Jun-2024 Release 1 allows local attackers to launch privileged activitiSamsung Mobile Devices
- CVE-2024-4856FS Product Inquiry <= 1.1.1 - Reflected XSSFS Product Inquiry
- CVE-2024-4749WP eMember < 10.3.9 - Reflected XSSwp-eMember
- CVE-2024-2019WP-DB-Table-Editor <= 1.8.4 - Missing Authorization to Authenticated(Contributor+) Database Accessbobbysmith007 WP-DB-Table-Editor
- CVE-2024-3555Social Link Pages: link-in-bio landing pages for your social media profiles <= 1.6.9 - Missing Authorization to Arbitrary Page Creation and Cross-Site Scriptinggelform Social Link Pages: link-in-bio landing pages for yo…
- CVE-2024-4870Frontend Registration – Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalationpokornydavid Frontend Registration – Contact Form
Medium, low and unrated 111
- CVE-2022-28658Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofingCanonical Apport
- CVE-2024-5635itsourcecode Bakery Online Ordering System index.php sql injectionitsourcecode Bakery Online Ordering System
- CVE-2022-28656is_closing_session() allows users to consume RAM in the Apport processCanonical Apport
- CVE-2022-28654is_closing_session() allows users to fill up apport.logCanonical Apport
- CVE-2024-30889Cross Site Scripting vulnerability in audimex audimexEE v.15.1.2 and fixed in 15.1.3.9 allows a remote attacker to execute arbitrary code vi
- CVE-2022-28652~/.config/apport/settings parsing is vulnerable to "billion laughs" attackCanonical Apport
- CVE-2024-36121 netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Noncesnetty-incubator-codec-ohttp · io.netty.incubator:netty-incu…
- CVE-2024-32974Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()envoyproxy envoy
- CVE-2024-32975Envoy crashes in QuicheDataReader::PeekVarInt62Length()envoyproxy envoy
- CVE-2024-34362Envoy affected by a crash (use-after-free) in EnvoyQuicServerStreamenvoyproxy envoy
- CVE-2024-34364Envoy OOM vector from HTTP async client with unbounded response buffer for mirror responseenvoyproxy envoy
- CVE-2024-4220Information Disclosure in BeyondInsightBeyondTrust BeyondInsight
- CVE-2024-4219SSRF In BeyondInsightBeyondTrust BeyondInsight
- CVE-2024-23326Envoy incorrectly accepts HTTP 200 response for entering upgrade modeenvoyproxy envoy
- CVE-2024-32464ActionText ContentAttachment can Contain Unsanitized HTMLrails · actiontext
- CVE-2024-28103Action Pack is missing security headers on non-HTML responsesrails · actionpack
- CVE-2024-30525WordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerabilitymoveaddons Move Addons for Elementor
- CVE-2024-30528WordPress Spiffy Calendar plugin <= 4.9.10 - Broken Access Control vulnerabilitySpiffy Plugins Spiffy Calendar
- CVE-2024-30484WordPress RT Easy Builder plugin <= 2.0 - Broken Access Control vulnerabilityRT Easy Builder – Advanced addons for Elementor
- CVE-2024-35670WordPress Integrate Google Drive plugin <= 1.3.93 - Broken Access Control vulnerabilitySoftLab Integrate Google Drive
- CVE-2024-34759WordPress Picture Gallery plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerabilityVideoWhisper Picture Gallery
- CVE-2024-28999SolarWinds Platform Race Condition VulnerabilitySolarWinds Platform
- CVE-2024-36550idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close
- CVE-2024-36548idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany_deal.php?mudi=del
- CVE-2024-36547idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=add
- CVE-2024-0756Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Iframe InjectionInsert or Embed Articulate Content into WordPress
- CVE-2024-35649WordPress Save as PDF Plugin by Pdfcrowd plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilitySave as PDF plugin by Pdfcrowd
- CVE-2024-35651WordPress WP Flow Plus plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerabilitySpiffy Plugins WP Flow Plus
- CVE-2024-35653WordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin <= 45.8.0 - Cross Site Scripting (XSS) vulnerabilityVisual Composer Website Builder
- CVE-2024-35654WordPress Responsive theme <= 5.0.3 - Cross Site Scripting (XSS) vulnerabilityCyberChimps Responsive
- CVE-2024-35655WordPress Brave – Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) vulnerabilityBrave
- CVE-2024-35666WordPress Themesflat Addons For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityThemesflat Addons For Elementor
- CVE-2024-35782WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityCodeless Cowidgets – Elementor Addons
- CVE-2024-35634Woocommerce – Recent Purchases plugin <= 1.0.1 - File Inclusion vulnerabilityWow-Company Woocommerce – Recent Purchases
- CVE-2024-34384WordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerabilitySinaExtra Sina Extension for Elementor
- CVE-2024-33541WordPress Better Elementor Addons plugin <= 1.4.1 - Local File Inclusion vulnerabilityBetterAddons Better Elementor Addons
- CVE-2024-36801A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.p
- CVE-2023-52176WordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerabilityminiorange Malware Scanner
- CVE-2023-52147WordPress All-In-One Security (AIOS) plugin <= 5.2.4 - Secret Login Page Location Disclosure on Multisites vulnerabilityAll In One WP Security & Firewall Team All In One WP Securi…
- CVE-2023-51667WordPress Rate my Post – WP Rating System plugin <= 3.4.2 - Broken Access Control vulnerabilityFeedbackWP Rate my Post – WP Rating System
- CVE-2023-51544WordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerabilityMetagauss RegistrationMagic
- CVE-2023-51543WordPress RegistrationMagic plugin <= 5.2.5.0 - IP Limit Bypass vulnerabilityMetagauss RegistrationMagic
- CVE-2023-51542WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerabilityWPMU DEV Branda
- CVE-2023-51511WordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification VulnerabilityPluggabl Booster Elite for WooCommerce
- CVE-2023-49852WordPress Responsive Slick Slider WordPress plugin <= 1.4 - Content Injection vulnerabilityVsourz Digital Responsive Slick Slider WordPress
- CVE-2023-49822WordPress Ultimate Dashboard plugin <= 3.7.10 - Secret Login Page Location Disclosure on Multisites vulnerabilityDavid Vongries Ultimate Dashboard
- CVE-2023-49774WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerabilityJ.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
- CVE-2023-49748WordPress WPS Hide Login plugin <= 1.9.11 - Secret Login Page Location Disclosure on Multisites vulnerabilityWPServeur, NicolasKulka, wpformation WPS Hide Login
- CVE-2023-49741WordPress Coming soon and Maintenance mode plugin <= 3.7.3 - IP Filtering Bypass vulnerabilitywpdevart Coming soon and Maintenance mode
- CVE-2023-48753WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability10up Restricted Site Access
- CVE-2023-48747WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification VulnerabilityPluggabl Booster for WooCommerce
- CVE-2023-48745WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerabilityWebFactory Captcha Code
- CVE-2023-48335WordPress Hide login page plugin <= 1.1.9 - Secret Login Page Location Disclosure on Multisites vulnerabilityWebcraftic Hide login page
- CVE-2023-48318WordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerabilityCodePeople Contact Form Email
- CVE-2023-48290WordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerability10Web Form Builder Team Form Maker by 10Web
- CVE-2023-48285WordPress Accept Stripe Payments plugin <= 2.0.79 - Content Injection vulnerabilityTips and Tricks HQ Stripe Payments
- CVE-2023-48276WordPress WP Forms Puzzle Captcha plugin <= 4.1 - Captcha Bypass vulnerabilityNitin Rathod WP Forms Puzzle Captcha
- CVE-2023-48271WordPress Maspik – Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass vulnerabilityyonifre Maspik – Spam blacklist
- CVE-2023-47818WordPress LWS Hide Login plugin <= 2.1.8 - Secret Login Page Location Disclosure on Multisites vulnerabilityLWS Hide Login
- CVE-2023-47769WordPress WP Maintenance plugin <= 6.1.3 - IP Filtering Bypass vulnerabilityFlorent Maillefaud WP Maintenance
- CVE-2023-47513WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection vulnerabilityARI Soft ARI Stream Quiz
- CVE-2024-5463A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component.Synology Camera Firmware
- CVE-2024-4637Slider Revolution <= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindexRevolution Slider Slider Revolution
- CVE-2023-47189WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerabilityWPMU DEV Defender Security
- CVE-2023-46310WordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerabilitygVectors Team wpDiscuz
- CVE-2023-45635WordPress Responsive Tabs plugin < 4.0.6 - HTML Content Injection vulnerabilityWP Darko Responsive Tabs
- CVE-2023-45053WordPress WP Content Pilot plugin <= 1.3.3 - HTML Injection vulnerabilitypluginever WP Content Pilot – Autoblogging & Affiliate Mark…
- CVE-2023-45009WordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerabilityForge12 Interactive Captcha/Honeypot for Contact Form
- CVE-2024-4581Slider Revolution <= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title AttributesRevolution Slider Slider Revolution
- CVE-2023-44235WordPress WP Captcha plugin <= 2.0.0 - Captcha Bypass vulnerabilityDevnath verma WP Captcha
- CVE-2023-41134WordPress Antispam Bee plugin <= 2.11.3 - Country IP Restriction Bypass vulnerabilitypluginkollektiv Antispam Bee
- CVE-2023-40673WordPress Cartpauj Register Captcha plugin <= 1.0.02 - Captcha Bypass vulnerabilityCartpauj Register Captcha
- CVE-2023-40557WordPress Tabs & Accordion plugin <= 1.3.10 - Content Injection vulnerabilityPickPlugins Tabs & Accordion
- CVE-2023-40332WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerabilityLester ‘GaMerZ’ Chan WP-PostRatings
- CVE-2023-39161WordPress Discussion Board plugin <= 2.4.8 - Content Injection vulnerabilityWP Discussion Board Discussion Board
- CVE-2023-38520WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter TamperingPINPOINT.WORLD Pinpoint Booking System
- CVE-2023-37865WordPress IP2Location Country Blocker plugin <= 2.29.1 - IP Bypass Vulnerability vulnerabilityDownload IP2Location Country Blocker
- CVE-2023-34001WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerabilityWPPlugins – WordPress Security Plugins Hide My WP Ghost
- CVE-2023-28494WordPress Contact Form Email plugin <= 1.3.31 - Missing Authorization Leading To Feedback Submission VulnerabilityCodePeople Contact Form Email
- CVE-2024-20887Arbitrary directory creation in GalaxyBudsManager PC prior to version 2.1.240315.51 allows attacker to create arbitrary directory.Samsung Mobile GalaxyBudsManager PC
- CVE-2024-20886Arbitrary directory creation in Samsung Live Wallpaper PC prior to version 3.3.8.0 allows attacker to create arbitrary directory.Samsung Mobile Samsung Live Wallpaper PC
- CVE-2024-20885Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without Samsung Mobile Devices
- CVE-2024-20884Incorrect use of privileged API vulnerability in getSemBatteryUsageStats in BatteryStatsService prior to SMR Jun-2024 Release 1 allows localSamsung Mobile Devices
- CVE-2024-20883Incorrect use of privileged API vulnerability in registerBatteryStatsCallback in BatteryStatsService prior to SMR Jun-2024 Release 1 allows Samsung Mobile Devices
- CVE-2024-20882Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary data access.Samsung Mobile Devices
- CVE-2024-20881Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential aSamsung Mobile Devices
- CVE-2024-20880Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physical attackers to overwrite memory.Samsung Mobile Devices
- CVE-2024-20879Improper input validation vulnerability in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to write out-of-bounds memorSamsung Mobile Devices
- CVE-2024-20876Improper input validation in libsheifdecadapter.so prior to SMR Jun-2024 Release 1 allows local attackers to lead to memory corruption.Samsung Mobile Devices
- CVE-2024-20875Improper caller verification vulnerability in SemClipboard prior to SMR June-2024 Release 1 allows local attackers to access arbitrary filesSamsung Mobile Devices
- CVE-2024-20873Improper input validation vulnerability in caminfo driver prior to SMR Jun-2024 Release 1 allows local privileged attackers to write out-of-Samsung Mobile Devices
- CVE-2024-5485SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcodebrainstormforce OttoKit: All-in-One Automation Platform
- CVE-2024-4857FS Product Inquiry <= 1.1.1 - Unauthenticated Stored XSSFS Product Inquiry
- CVE-2024-4750BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Commentbuddyboss-platform
- CVE-2024-4057Gutenberg Blocks by Kadence Blocks < 3.2.37 - Contributor+ Stored XSSGutenberg Blocks with AI by Kadence WP
- CVE-2024-2470Simple Ajax Chat < 20240412 - Admin+ Stored XSSSimple Ajax Chat
- CVE-2024-0757Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCEInsert or Embed Articulate Content into WordPress
- CVE-2024-4462Nafeza Prayer Time <= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scriptingfreephp-1 Nafeza Prayer Time
- CVE-2024-4997WPUpper Share Buttons <= 3.43 - Missing Authorizationvictorfreitas WPUpper Share Buttons
- CVE-2024-4273Essential Real Estate <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeg5theme Essential Real Estate
- CVE-2024-4697Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading_tag Parametercodelessthemes Cowidgets – Elementor Addons
- CVE-2024-4274Essential Real Estate <= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletiong5theme Essential Real Estate
- CVE-2024-3230Download Attachments <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingdfactory Download Attachments
- CVE-2024-2382Authorize.net Payment Gateway For WooCommerce <= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypassishanverma Authorize.net Payment Gateway For WooCommerce
- CVE-2024-3031Fluid Notification Bar <= 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scriptingshrinitech Fluid Notification Bar
- CVE-2024-1718Claudio Sanches – Checkout Cielo for WooCommerce <= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Updateclaudiosanches Claudio Sanches – Checkout Cielo for WooComm…
- CVE-2024-1717Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrievalmelapress Admin Notices Manager
- CVE-2024-3888tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button ShortcodetagDiv Composer
- CVE-2024-29976** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the command “show_allsessions” in Zyxel NAS326 firmware vZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2024-29975** UNSUPPORTED WHEN ASSIGNED ** The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versiZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2024-29152An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos