# CVEs published 2024-06-04

182 CVEs were published on June 4, 2024: 18 critical, 53 high. Days are UTC.

- [CVE-2022-28658](https://cve.now/CVE-2022-28658.md): Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing (CVSS 5.5, Canonical Apport)
- [CVE-2022-28657](https://cve.now/CVE-2022-28657.md): Apport does not disable python crash handler before entering chroot (CVSS 7.8, Canonical Apport)
- [CVE-2024-5635](https://cve.now/CVE-2024-5635.md): itsourcecode Bakery Online Ordering System index.php sql injection (CVSS 5.3, itsourcecode Bakery Online Ordering System)
- [CVE-2022-28656](https://cve.now/CVE-2022-28656.md): is\_closing\_session() allows users to consume RAM in the Apport process (CVSS 5.5, Canonical Apport)
- [CVE-2022-28655](https://cve.now/CVE-2022-28655.md): is\_closing\_session() allows users to create arbitrary tcp dbus connections (CVSS 7.1, Canonical Apport)
- [CVE-2022-28654](https://cve.now/CVE-2022-28654.md): is\_closing\_session() allows users to fill up apport.log (CVSS 5.5, Canonical Apport)
- [CVE-2024-30889](https://cve.now/CVE-2024-30889.md): Cross Site Scripting vulnerability in audimex audimexEE v.15.1.2 and fixed in 15.1.3.9 allows a remote attacker to execute arbitrary code vi (CVSS 5.4)
- [CVE-2022-28652](https://cve.now/CVE-2022-28652.md): ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack (CVSS 5.5, Canonical Apport)
- [CVE-2024-36675](https://cve.now/CVE-2024-36675.md): LyLme\_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get\_head function. (CVSS 9.1)
- [CVE-2024-36121](https://cve.now/CVE-2024-36121.md): netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces (CVSS 5.9, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2024-32974](https://cve.now/CVE-2024-32974.md): Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete() (CVSS 5.9, envoyproxy envoy)
- [CVE-2024-32975](https://cve.now/CVE-2024-32975.md): Envoy crashes in QuicheDataReader::PeekVarInt62Length() (CVSS 5.9, envoyproxy envoy)
- [CVE-2024-32976](https://cve.now/CVE-2024-32976.md): Envoy can enter an endless loop while decompressing Brotli data with extra input (CVSS 7.5, envoyproxy envoy)
- [CVE-2024-34362](https://cve.now/CVE-2024-34362.md): Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream (CVSS 5.9, envoyproxy envoy)
- [CVE-2024-34363](https://cve.now/CVE-2024-34363.md): Envoy can crash due to uncaught nlohmann JSON exception (CVSS 7.5, envoyproxy envoy)
- [CVE-2024-34364](https://cve.now/CVE-2024-34364.md): Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response (CVSS 5.7, envoyproxy envoy)
- [CVE-2024-4220](https://cve.now/CVE-2024-4220.md): Information Disclosure in BeyondInsight (CVSS 4.3, BeyondTrust BeyondInsight)
- [CVE-2024-4219](https://cve.now/CVE-2024-4219.md): SSRF In BeyondInsight (CVSS 4.8, BeyondTrust BeyondInsight)
- [CVE-2024-23326](https://cve.now/CVE-2024-23326.md): Envoy incorrectly accepts HTTP 200 response for entering upgrade mode (CVSS 5.9, envoyproxy envoy)
- [CVE-2024-32464](https://cve.now/CVE-2024-32464.md): ActionText ContentAttachment can Contain Unsanitized HTML (CVSS 6.1, rails · actiontext)
- [CVE-2024-28103](https://cve.now/CVE-2024-28103.md): Action Pack is missing security headers on non-HTML responses (CVSS 5.4, rails · actionpack)
- [CVE-2024-4520](https://cve.now/CVE-2024-4520.md): Improper Access Control in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-30525](https://cve.now/CVE-2024-30525.md): WordPress Move Addons for Elementor plugin \<= 1.2.9 - Broken Access Control vulnerability (CVSS 5.3, moveaddons Move Addons for Elementor)
- [CVE-2024-30528](https://cve.now/CVE-2024-30528.md): WordPress Spiffy Calendar plugin \<= 4.9.10 - Broken Access Control vulnerability (CVSS 5.4, Spiffy Plugins Spiffy Calendar)
- [CVE-2024-30484](https://cve.now/CVE-2024-30484.md): WordPress RT Easy Builder plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 4.3, RT Easy Builder – Advanced addons for Elementor)
- [CVE-2024-35670](https://cve.now/CVE-2024-35670.md): WordPress Integrate Google Drive plugin \<= 1.3.93 - Broken Access Control vulnerability (CVSS 5.3, SoftLab Integrate Google Drive)
- [CVE-2024-34759](https://cve.now/CVE-2024-34759.md): WordPress Picture Gallery plugin \<= 1.5.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, VideoWhisper Picture Gallery)
- [CVE-2024-35672](https://cve.now/CVE-2024-35672.md): WordPress Netgsm plugin \<= 2.9.19 - Broken Access Control vulnerability (CVSS 7.5, Netgsm)
- [CVE-2024-25095](https://cve.now/CVE-2024-25095.md): WordPress Easy Forms for Mailchimp plugin \<= 6.9.0 - Sensitive Data Exposure via Log File vulnerability (CVSS 7.5, Code Parrots Easy Forms for Mailchimp)
- [CVE-2024-37273](https://cve.now/CVE-2024-37273.md): An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via (CVSS 9.8, @janhq/core)
- [CVE-2024-36858](https://cve.now/CVE-2024-36858.md): An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via (CVSS 9.8, @janhq/core)
- [CVE-2024-36857](https://cve.now/CVE-2024-36857.md): Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface. (CVSS 7.5, @janhq/core)
- [CVE-2024-36604](https://cve.now/CVE-2024-36604.md): Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. (CVSS 9.8)
- [CVE-2024-29004](https://cve.now/CVE-2024-29004.md): SolarWinds Platform Stored XSS Vulnerability (CVSS 7.1, SolarWinds Platform)
- [CVE-2024-28999](https://cve.now/CVE-2024-28999.md): SolarWinds Platform Race Condition Vulnerability (CVSS 6.4, SolarWinds Platform)
- [CVE-2024-28996](https://cve.now/CVE-2024-28996.md): SolarWinds Platform SWQL Injection Vulnerability (CVSS 7.5, SolarWinds Platform)
- [CVE-2024-36550](https://cve.now/CVE-2024-36550.md): idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany\_deal.php?mudi=add&nohrefStr=close (CVSS 5.4)
- [CVE-2024-36549](https://cve.now/CVE-2024-36549.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/vpsCompany\_deal.php?mudi=rev&nohrefStr=close (CVSS 8.8)
- [CVE-2024-36548](https://cve.now/CVE-2024-36548.md): idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/vpsCompany\_deal.php?mudi=del (CVSS 5.4)
- [CVE-2024-36547](https://cve.now/CVE-2024-36547.md): idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass\_deal.php?mudi=add (CVSS 5.4)
- [CVE-2024-32871](https://cve.now/CVE-2024-32871.md): Pimcore Vulnerable to Flooding Server with Thumbnail files (CVSS 7.5, pimcore · pimcore/pimcore)
- [CVE-2024-0756](https://cve.now/CVE-2024-0756.md): Insert or Embed Articulate Content into WordPress \<= 4.3000000023 - Iframe Injection (CVSS 3.5, Insert or Embed Articulate Content into WordPress)
- [CVE-2024-35649](https://cve.now/CVE-2024-35649.md): WordPress Save as PDF Plugin by Pdfcrowd plugin \<= 3.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Save as PDF plugin by Pdfcrowd)
- [CVE-2024-35651](https://cve.now/CVE-2024-35651.md): WordPress WP Flow Plus plugin \<= 5.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Spiffy Plugins WP Flow Plus)
- [CVE-2024-35652](https://cve.now/CVE-2024-35652.md): WordPress Event Tickets with Ticket Scanner plugin \<= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Saso Nikolov Event Tickets with Ticket Scanner)
- [CVE-2024-36400](https://cve.now/CVE-2024-36400.md): nano-id is unable to generate the correct character set (CVSS 9.4, viz-rs nano-id · nano-id)
- [CVE-2024-35653](https://cve.now/CVE-2024-35653.md): WordPress Visual Composer Website Builder, Landing Page Builder, Custom Theme Builder, Maintenance Mode & Coming Soon Pages plugin \<= 45.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Visual Composer Website Builder)
- [CVE-2024-35654](https://cve.now/CVE-2024-35654.md): WordPress Responsive theme \<= 5.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CyberChimps Responsive)
- [CVE-2024-35655](https://cve.now/CVE-2024-35655.md): WordPress Brave – Interactive Content plugin \<= 0.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Brave)
- [CVE-2024-35664](https://cve.now/CVE-2024-35664.md): WordPress WPvivid Backup for MainWP plugin \<= 0.9.32 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, wpvividplugins WPvivid Backup for MainWP)
- [CVE-2024-35666](https://cve.now/CVE-2024-35666.md): WordPress Themesflat Addons For Elementor plugin \<= 2.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themesflat Addons For Elementor)
- [CVE-2024-35668](https://cve.now/CVE-2024-35668.md): WordPress Newsletter, SMTP, Email marketing and Subscribe forms by Brevo plugin \<= 3.1.77 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Brevo Newsletter, SMTP, Email marketing and Subscribe forms…)
- [CVE-2024-35782](https://cve.now/CVE-2024-35782.md): WordPress Cowidgets – Elementor Addons plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Codeless Cowidgets – Elementor Addons)
- [CVE-2024-35700](https://cve.now/CVE-2024-35700.md): WordPress UserPro plugin \<= 5.1.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, DeluxeThemes Userpro)
- [CVE-2024-35634](https://cve.now/CVE-2024-35634.md): Woocommerce – Recent Purchases plugin \<= 1.0.1 - File Inclusion vulnerability (CVSS 4.9, Wow-Company Woocommerce – Recent Purchases)
- [CVE-2024-35629](https://cve.now/CVE-2024-35629.md): WordPress Easy Digital Downloads – Recent Purchases plugin \<= 1.0.2 - Remote File Inclusion vulnerability (CVSS 9.6, Wow-Company Easy Digital Downloads – Recent Purchases)
- [CVE-2024-34792](https://cve.now/CVE-2024-34792.md): WordPress Dextaz Ping plugin \<= 0.65 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, Dextaz Ping)
- [CVE-2024-34554](https://cve.now/CVE-2024-34554.md): WordPress Stockholm Core plugin \<= 2.4.1 - Local File Inclusion vulnerability (CVSS 8.5, Select-Themes Stockholm Core)
- [CVE-2024-34552](https://cve.now/CVE-2024-34552.md): WordPress Stockholm theme \<= 9.6 - Local File Inclusion vulnerability (CVSS 8.5, Select-Themes Stockholm)
- [CVE-2024-34551](https://cve.now/CVE-2024-34551.md): WordPress Stockholm theme \<= 9.6 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, Select-Themes Stockholm)
- [CVE-2024-34384](https://cve.now/CVE-2024-34384.md): WordPress Sina Extension for Elementor plugin \<= 3.5.1 - Local File Inclusion vulnerability (CVSS 6.5, SinaExtra Sina Extension for Elementor)
- [CVE-2024-33628](https://cve.now/CVE-2024-33628.md): WordPress XforWooCommerce plugin \<= 2.0.2 - Authenticated Local File Inclusion vulnerability (CVSS 8.8, XforWooCommerce)
- [CVE-2024-33568](https://cve.now/CVE-2024-33568.md): WordPress Element Pack Pro plugin \< 7.19.3 - Arbitrary File Read and Phar Deserialization vulnerability (CVSS 8.5, BdThemes Element Pack Pro)
- [CVE-2024-33560](https://cve.now/CVE-2024-33560.md): WordPress XStore theme \<= 9.3.8 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, 8theme XStore)
- [CVE-2024-33557](https://cve.now/CVE-2024-33557.md): WordPress XStore Core plugin \<= 5.3.8 - Local File Inclusion vulnerability (CVSS 8.5, 8theme XStore Core)
- [CVE-2024-33541](https://cve.now/CVE-2024-33541.md): WordPress Better Elementor Addons plugin \<= 1.4.1 - Local File Inclusion vulnerability (CVSS 6.5, BetterAddons Better Elementor Addons)
- [CVE-2024-25600](https://cve.now/CVE-2024-25600.md): WordPress Bricks Theme \<= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability (CVSS 10.0, Codeer Limited Bricks Builder)
- [CVE-2024-36800](https://cve.now/CVE-2024-36800.md): A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Download.php (CVSS 7.5)
- [CVE-2024-36801](https://cve.now/CVE-2024-36801.md): A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.p (CVSS 5.9)
- [CVE-2023-52176](https://cve.now/CVE-2023-52176.md): WordPress Malware Scanner plugin \<= 4.7.1 - IP Restriction Bypass vulnerability (CVSS 5.3, miniorange Malware Scanner)
- [CVE-2023-52147](https://cve.now/CVE-2023-52147.md): WordPress All-In-One Security (AIOS) plugin \<= 5.2.4 - Secret Login Page Location Disclosure on Multisites vulnerability (CVSS 3.7, All In One WP Security & Firewall Team All In One WP Securi…)
- [CVE-2023-51667](https://cve.now/CVE-2023-51667.md): WordPress Rate my Post – WP Rating System plugin \<= 3.4.2 - Broken Access Control vulnerability (CVSS 5.3, FeedbackWP Rate my Post – WP Rating System)
- [CVE-2023-51544](https://cve.now/CVE-2023-51544.md): WordPress RegistrationMagic plugin \<= 5.2.5.0 - Form Submission Limit Bypass vulnerability (CVSS 5.3, Metagauss RegistrationMagic)
- [CVE-2023-51543](https://cve.now/CVE-2023-51543.md): WordPress RegistrationMagic plugin \<= 5.2.5.0 - IP Limit Bypass vulnerability (CVSS 5.3, Metagauss RegistrationMagic)
- [CVE-2023-51542](https://cve.now/CVE-2023-51542.md): WordPress Branda plugin \<= 3.4.14 - IP Restriction Bypass vulnerability (CVSS 5.3, WPMU DEV Branda)
- [CVE-2023-51511](https://cve.now/CVE-2023-51511.md): WordPress Booster Elite for WooCommerce plugin \< 7.1.3 - Authenticated Production Creation/Modification Vulnerability (CVSS 6.5, Pluggabl Booster Elite for WooCommerce)
- [CVE-2024-29170](https://cve.now/CVE-2024-29170.md): Dell PowerScale OneFS versions 8.2.x through 9.8.0.x contain a use of hard coded credentials vulnerability. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2024-37065](https://cve.now/CVE-2024-37065.md): Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to ru (CVSS 7.8, Skops-dev Skops · skops)
- [CVE-2024-37064](https://cve.now/CVE-2024-37064.md): Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciousl (CVSS 7.8, YdataAI ydata-profiling · ydata-profiling)
- [CVE-2024-37063](https://cve.now/CVE-2024-37063.md): A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to (CVSS 7.8, YdataAI ydata-profiling · ydata-profiling)
- [CVE-2024-37062](https://cve.now/CVE-2024-37062.md): Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously (CVSS 7.8, YdataAI ydata-profiling · ydata-profiling)
- [CVE-2024-37061](https://cve.now/CVE-2024-37061.md): Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject (CVSS 8.8, MLflow)
- [CVE-2024-37060](https://cve.now/CVE-2024-37060.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously craft (CVSS 8.8, MLflow)
- [CVE-2024-37059](https://cve.now/CVE-2024-37059.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously upload (CVSS 8.8, MLflow)
- [CVE-2024-37058](https://cve.now/CVE-2024-37058.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously upload (CVSS 8.8, MLflow)
- [CVE-2024-4254](https://cve.now/CVE-2024-4254.md): Secrets Exfiltration in gradio-app/gradio (CVSS 7.1, gradio-app/gradio)
- [CVE-2024-37057](https://cve.now/CVE-2024-37057.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously upl (CVSS 8.8, MLflow)
- [CVE-2024-37056](https://cve.now/CVE-2024-37056.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploa (CVSS 8.8, MLflow)
- [CVE-2024-37055](https://cve.now/CVE-2024-37055.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploa (CVSS 8.8, MLflow)
- [CVE-2024-37054](https://cve.now/CVE-2024-37054.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously upload (CVSS 8.8, MLflow)
- [CVE-2024-37053](https://cve.now/CVE-2024-37053.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously upload (CVSS 8.8, MLflow)
- [CVE-2024-37052](https://cve.now/CVE-2024-37052.md): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously upload (CVSS 8.8, MLflow)
- [CVE-2023-49852](https://cve.now/CVE-2023-49852.md): WordPress Responsive Slick Slider WordPress plugin \<= 1.4 - Content Injection vulnerability (CVSS 6.5, Vsourz Digital Responsive Slick Slider WordPress)
- [CVE-2023-49822](https://cve.now/CVE-2023-49822.md): WordPress Ultimate Dashboard plugin \<= 3.7.10 - Secret Login Page Location Disclosure on Multisites vulnerability (CVSS 3.7, David Vongries Ultimate Dashboard)
- [CVE-2023-49774](https://cve.now/CVE-2023-49774.md): WordPress WP Photo Album Plus plugin \<= 8.5.02.005 - IP Bypass vulnerability (CVSS 5.3, J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus)
- [CVE-2023-49748](https://cve.now/CVE-2023-49748.md): WordPress WPS Hide Login plugin \<= 1.9.11 - Secret Login Page Location Disclosure on Multisites vulnerability (CVSS 3.7, WPServeur, NicolasKulka, wpformation WPS Hide Login)
- [CVE-2023-49741](https://cve.now/CVE-2023-49741.md): WordPress Coming soon and Maintenance mode plugin \<= 3.7.3 - IP Filtering Bypass vulnerability (CVSS 3.7, wpdevart Coming soon and Maintenance mode)
- [CVE-2023-48753](https://cve.now/CVE-2023-48753.md): WordPress Restricted Site Access plugin \<= 7.4.1 - IP Restriction Bypass vulnerability (CVSS 5.3, 10up Restricted Site Access)
- [CVE-2023-48747](https://cve.now/CVE-2023-48747.md): WordPress Booster for WooCommerce plugin \<= 7.1.2 - Authenticated Production Creation/Modification Vulnerability (CVSS 6.5, Pluggabl Booster for WooCommerce)
- [CVE-2023-48745](https://cve.now/CVE-2023-48745.md): WordPress Captcha Code plugin \<= 2.9 - Captcha Bypass vulnerability (CVSS 5.3, WebFactory Captcha Code)
- [CVE-2023-48335](https://cve.now/CVE-2023-48335.md): WordPress Hide login page plugin \<= 1.1.9 - Secret Login Page Location Disclosure on Multisites vulnerability (CVSS 3.7, Webcraftic Hide login page)
- [CVE-2023-48318](https://cve.now/CVE-2023-48318.md): WordPress Contact Form Email plugin \<= 1.3.41 - Captcha Bypass vulnerability (CVSS 5.3, CodePeople Contact Form Email)
- [CVE-2023-48290](https://cve.now/CVE-2023-48290.md): WordPress Form Maker by 10Web plugin \<= 1.15.20 - Captcha Bypass Vulnerability vulnerability (CVSS 5.3, 10Web Form Builder Team Form Maker by 10Web)
- [CVE-2023-48285](https://cve.now/CVE-2023-48285.md): WordPress Accept Stripe Payments plugin \<= 2.0.79 - Content Injection vulnerability (CVSS 5.3, Tips and Tricks HQ Stripe Payments)
- [CVE-2023-48276](https://cve.now/CVE-2023-48276.md): WordPress WP Forms Puzzle Captcha plugin \<= 4.1 - Captcha Bypass vulnerability (CVSS 5.3, Nitin Rathod WP Forms Puzzle Captcha)
- [CVE-2023-48271](https://cve.now/CVE-2023-48271.md): WordPress Maspik – Spam Blacklist plugin \<= 0.10.3 - IP Filtering Bypass vulnerability (CVSS 5.3, yonifre Maspik – Spam blacklist)
- [CVE-2023-47837](https://cve.now/CVE-2023-47837.md): WordPress ARMember plugin \<= 4.0.10 - Membership Plan Bypass vulnerability (CVSS 8.3, Repute Infosystems ARMember)
- [CVE-2023-47818](https://cve.now/CVE-2023-47818.md): WordPress LWS Hide Login plugin \<= 2.1.8 - Secret Login Page Location Disclosure on Multisites vulnerability (CVSS 3.7, LWS Hide Login)
- [CVE-2023-47769](https://cve.now/CVE-2023-47769.md): WordPress WP Maintenance plugin \<= 6.1.3 - IP Filtering Bypass vulnerability (CVSS 3.7, Florent Maillefaud WP Maintenance)
- [CVE-2023-47513](https://cve.now/CVE-2023-47513.md): WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin \<= 1.3.2 - Content Injection vulnerability (CVSS 5.4, ARI Soft ARI Stream Quiz)
- [CVE-2024-5463](https://cve.now/CVE-2024-5463.md): A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in the login component. (CVSS 6.5, Synology Camera Firmware)
- [CVE-2024-4637](https://cve.now/CVE-2024-4637.md): Slider Revolution \<= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex (CVSS 6.4, Revolution Slider Slider Revolution)
- [CVE-2023-47189](https://cve.now/CVE-2023-47189.md): WordPress Defender Security plugin \<= 4.2.0 - Masked Login Area View Bypass vulnerability (CVSS 5.3, WPMU DEV Defender Security)
- [CVE-2023-46630](https://cve.now/CVE-2023-46630.md): WordPress Admin and Site Enhancements (ASE) plugin \<= 5.7.1 - Password Protected View Bypass Vulnerability vulnerability (CVSS 7.5, wpase Admin and Site Enhancements)
- [CVE-2023-46310](https://cve.now/CVE-2023-46310.md): WordPress wpDiscuz plugin \<= 7.6.10 - Content Injection vulnerability (CVSS 5.3, gVectors Team wpDiscuz)
- [CVE-2023-45635](https://cve.now/CVE-2023-45635.md): WordPress Responsive Tabs plugin \< 4.0.6 - HTML Content Injection vulnerability (CVSS 5.4, WP Darko Responsive Tabs)
- [CVE-2023-45053](https://cve.now/CVE-2023-45053.md): WordPress WP Content Pilot plugin \<= 1.3.3 - HTML Injection vulnerability (CVSS 4.3, pluginever WP Content Pilot – Autoblogging & Affiliate Mark…)
- [CVE-2023-45009](https://cve.now/CVE-2023-45009.md): WordPress Captcha for Contact Form 7 plugin \<= 1.11.3 - Capcha Bypass vulnerability (CVSS 5.3, Forge12 Interactive Captcha/Honeypot for Contact Form)
- [CVE-2023-5751](https://cve.now/CVE-2023-5751.md): CODESYS: Development system prone to DoS through exposure of resource to wrong sphere (CVSS 7.8, CODESYS Control Win · CODESYS Development System +3)
- [CVE-2024-5000](https://cve.now/CVE-2024-5000.md): CODESYS: Incorrect calculation of buffer size can cause DoS on CODESYS OPC UA products (CVSS 7.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +13)
- [CVE-2024-4581](https://cve.now/CVE-2024-4581.md): Slider Revolution \<= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes (CVSS 6.4, Revolution Slider Slider Revolution)
- [CVE-2024-5422](https://cve.now/CVE-2024-5422.md): Denial of Service (CVSS 7.1, SEH Computertechnik utnserver Pro · SEH Computertechnik… +1)
- [CVE-2024-5421](https://cve.now/CVE-2024-5421.md): Authenticated Command Injection (CVSS 8.7, SEH Computertechnik utnserver Pro · SEH Computertechnik… +1)
- [CVE-2024-5420](https://cve.now/CVE-2024-5420.md): Stored Cross-Site Scripting in SEH Computertechnik utnserver Pro (CVSS 8.3, SEH Computertechnik utnserver Pro · SEH Computertechnik… +1)
- [CVE-2023-44235](https://cve.now/CVE-2023-44235.md): WordPress WP Captcha plugin \<= 2.0.0 - Captcha Bypass vulnerability (CVSS 5.3, Devnath verma WP Captcha)
- [CVE-2024-4253](https://cve.now/CVE-2024-4253.md): Command Injection in gradio-app/gradio (CVSS 7.5, gradio-app/gradio · gradio)
- [CVE-2024-36104](https://cve.now/CVE-2024-36104.md): Apache OFBiz: Path traversal leading to a RCE (CVSS 9.1, Apache Software Foundation Apache OFBiz)
- [CVE-2023-41134](https://cve.now/CVE-2023-41134.md): WordPress Antispam Bee plugin \<= 2.11.3 - Country IP Restriction Bypass vulnerability (CVSS 5.3, pluginkollektiv Antispam Bee)
- [CVE-2023-40673](https://cve.now/CVE-2023-40673.md): WordPress Cartpauj Register Captcha plugin \<= 1.0.02 - Captcha Bypass vulnerability (CVSS 6.5, Cartpauj Register Captcha)
- [CVE-2023-40557](https://cve.now/CVE-2023-40557.md): WordPress Tabs & Accordion plugin \<= 1.3.10 - Content Injection vulnerability (CVSS 5.4, PickPlugins Tabs & Accordion)
- [CVE-2023-40332](https://cve.now/CVE-2023-40332.md): WordPress WP-PostRatings plugin \<= 1.91 - Rating limit Bypass vulnerability (CVSS 5.3, Lester ‘GaMerZ’ Chan WP-PostRatings)
- [CVE-2023-39161](https://cve.now/CVE-2023-39161.md): WordPress Discussion Board plugin \<= 2.4.8 - Content Injection vulnerability (CVSS 5.4, WP Discussion Board Discussion Board)
- [CVE-2023-38520](https://cve.now/CVE-2023-38520.md): WordPress Pinpoint Booking System plugin \<= 2.9.9.3.4 - Parameter Tampering (CVSS 6.5, PINPOINT.WORLD Pinpoint Booking System)
- [CVE-2023-37865](https://cve.now/CVE-2023-37865.md): WordPress IP2Location Country Blocker plugin \<= 2.29.1 - IP Bypass Vulnerability vulnerability (CVSS 5.3, Download IP2Location Country Blocker)
- [CVE-2023-34001](https://cve.now/CVE-2023-34001.md): WordPress Hide My WP Ghost – Security Plugin plugin \<= 5.0.25 - Captcha Bypass vulnerability (CVSS 5.3, WPPlugins – WordPress Security Plugins Hide My WP Ghost)
- [CVE-2023-33930](https://cve.now/CVE-2023-33930.md): WordPress Unlimited Elements For Elementor plugin \<= 1.5.66 - Unrestricted Zip Extraction vulnerability (CVSS 9.1, Unlimited Elements For Elementor)
- [CVE-2023-28494](https://cve.now/CVE-2023-28494.md): WordPress Contact Form Email plugin \<= 1.3.31 - Missing Authorization Leading To Feedback Submission Vulnerability (CVSS 4.3, CodePeople Contact Form Email)
- [CVE-2024-20887](https://cve.now/CVE-2024-20887.md): Arbitrary directory creation in GalaxyBudsManager PC prior to version 2.1.240315.51 allows attacker to create arbitrary directory. (CVSS 6.2, Samsung Mobile GalaxyBudsManager PC)
- [CVE-2024-20886](https://cve.now/CVE-2024-20886.md): Arbitrary directory creation in Samsung Live Wallpaper PC prior to version 3.3.8.0 allows attacker to create arbitrary directory. (CVSS 6.2, Samsung Mobile Samsung Live Wallpaper PC)
- [CVE-2024-20885](https://cve.now/CVE-2024-20885.md): Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to make a call without (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2024-20884](https://cve.now/CVE-2024-20884.md): Incorrect use of privileged API vulnerability in getSemBatteryUsageStats in BatteryStatsService prior to SMR Jun-2024 Release 1 allows local (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-20883](https://cve.now/CVE-2024-20883.md): Incorrect use of privileged API vulnerability in registerBatteryStatsCallback in BatteryStatsService prior to SMR Jun-2024 Release 1 allows (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-20882](https://cve.now/CVE-2024-20882.md): Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary data access. (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2024-20881](https://cve.now/CVE-2024-20881.md): Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential a (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2024-20880](https://cve.now/CVE-2024-20880.md): Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physical attackers to overwrite memory. (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2024-20879](https://cve.now/CVE-2024-20879.md): Improper input validation vulnerability in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers to write out-of-bounds memor (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20878](https://cve.now/CVE-2024-20878.md): Heap out-of-bound write vulnerability in parsing grid image in libsavscmn.so prior to SMR June-2024 Release 1 allows local attackers to exec (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2024-20877](https://cve.now/CVE-2024-20877.md): Heap out-of-bound write vulnerability in parsing grid image header in libsavscmn.so prior to SMR Jun-2024 Release 1 allows local attackers t (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2024-20876](https://cve.now/CVE-2024-20876.md): Improper input validation in libsheifdecadapter.so prior to SMR Jun-2024 Release 1 allows local attackers to lead to memory corruption. (CVSS 6.1, Samsung Mobile Devices)
- [CVE-2024-20875](https://cve.now/CVE-2024-20875.md): Improper caller verification vulnerability in SemClipboard prior to SMR June-2024 Release 1 allows local attackers to access arbitrary files (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20874](https://cve.now/CVE-2024-20874.md): Improper access control vulnerability in SmartManagerCN prior to SMR Jun-2024 Release 1 allows local attackers to launch privileged activiti (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2024-20873](https://cve.now/CVE-2024-20873.md): Improper input validation vulnerability in caminfo driver prior to SMR Jun-2024 Release 1 allows local privileged attackers to write out-of- (CVSS 4.2, Samsung Mobile Devices)
- [CVE-2024-5485](https://cve.now/CVE-2024-5485.md): SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! \<= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode (CVSS 6.4, brainstormforce OttoKit: All-in-One Automation Platform)
- [CVE-2024-4857](https://cve.now/CVE-2024-4857.md): FS Product Inquiry \<= 1.1.1 - Unauthenticated Stored XSS (CVSS 6.1, FS Product Inquiry)
- [CVE-2024-4856](https://cve.now/CVE-2024-4856.md): FS Product Inquiry \<= 1.1.1 - Reflected XSS (CVSS 8.2, FS Product Inquiry)
- [CVE-2024-4750](https://cve.now/CVE-2024-4750.md): BuddyBoss Platform \< 2.6.0 - Insecure Direct Object Reference on Like Comment (CVSS 5.3, buddyboss-platform)
- [CVE-2024-4749](https://cve.now/CVE-2024-4749.md): WP eMember \< 10.3.9 - Reflected XSS (CVSS 8.3, wp-eMember)
- [CVE-2024-4180](https://cve.now/CVE-2024-4180.md): The Events Calendar \< 6.4.0.1 - Reflected XSS (CVSS 9.1, The Events Calendar)
- [CVE-2024-4057](https://cve.now/CVE-2024-4057.md): Gutenberg Blocks by Kadence Blocks \< 3.2.37 - Contributor+ Stored XSS (CVSS 6.1, Gutenberg Blocks with AI by Kadence WP)
- [CVE-2024-2470](https://cve.now/CVE-2024-2470.md): Simple Ajax Chat \< 20240412 - Admin+ Stored XSS (CVSS 5.4, Simple Ajax Chat)
- [CVE-2024-0757](https://cve.now/CVE-2024-0757.md): Insert or Embed Articulate Content into WordPress \<= 4.3000000023 - Author+ Upload to RCE (CVSS 5.4, Insert or Embed Articulate Content into WordPress)
- [CVE-2024-4462](https://cve.now/CVE-2024-4462.md): Nafeza Prayer Time \<= 1.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, freephp-1 Nafeza Prayer Time)
- [CVE-2024-4997](https://cve.now/CVE-2024-4997.md): WPUpper Share Buttons \<= 3.43 - Missing Authorization (CVSS 5.3, victorfreitas WPUpper Share Buttons)
- [CVE-2024-4273](https://cve.now/CVE-2024-4273.md): Essential Real Estate \<= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, g5theme Essential Real Estate)
- [CVE-2024-4697](https://cve.now/CVE-2024-4697.md): Cowidgets – Elementor Addons \<= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via heading\_tag Parameter (CVSS 6.4, codelessthemes Cowidgets – Elementor Addons)
- [CVE-2024-4274](https://cve.now/CVE-2024-4274.md): Essential Real Estate \<= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion (CVSS 4.3, g5theme Essential Real Estate)
- [CVE-2024-3230](https://cve.now/CVE-2024-3230.md): Download Attachments \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dfactory Download Attachments)
- [CVE-2024-2382](https://cve.now/CVE-2024-2382.md): Authorize.net Payment Gateway For WooCommerce \<= 8.0 - Insufficient Verification of Data Authenticity to Unauthenticated Payment Bypass (CVSS 5.3, ishanverma Authorize.net Payment Gateway For WooCommerce)
- [CVE-2024-3031](https://cve.now/CVE-2024-3031.md): Fluid Notification Bar \<= 3.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, shrinitech Fluid Notification Bar)
- [CVE-2024-1718](https://cve.now/CVE-2024-1718.md): Claudio Sanches – Checkout Cielo for WooCommerce \<= 1.1.0 - Insufficient Verification of Data Authenticity to Order Payment Status Update (CVSS 5.3, claudiosanches Claudio Sanches – Checkout Cielo for WooComm…)
- [CVE-2024-2019](https://cve.now/CVE-2024-2019.md): WP-DB-Table-Editor \<= 1.8.4 - Missing Authorization to Authenticated(Contributor+) Database Access (CVSS 7.5, bobbysmith007 WP-DB-Table-Editor)
- [CVE-2024-3555](https://cve.now/CVE-2024-3555.md): Social Link Pages: link-in-bio landing pages for your social media profiles \<= 1.6.9 - Missing Authorization to Arbitrary Page Creation and Cross-Site Scripting (CVSS 7.2, gelform Social Link Pages: link-in-bio landing pages for yo…)
- [CVE-2024-1717](https://cve.now/CVE-2024-1717.md): Admin Notices Manager \<= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval (CVSS 4.3, melapress Admin Notices Manager)
- [CVE-2024-3888](https://cve.now/CVE-2024-3888.md): tagDiv Composer \<= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode (CVSS 6.4, tagDiv Composer)
- [CVE-2024-4552](https://cve.now/CVE-2024-4552.md): Social Login Lite For WooCommerce \<= 1.6.0 - Authentication Bypass (CVSS 9.8, phoeniixx Social Login Lite For WooCommerce)
- [CVE-2024-4870](https://cve.now/CVE-2024-4870.md): Frontend Registration – Contact Form 7 \<= 5.1 - Authenticated (Editor+) Privilege Escalation (CVSS 7.2, pokornydavid Frontend Registration – Contact Form)
- [CVE-2024-29976](https://cve.now/CVE-2024-29976.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The improper privilege management vulnerability in the command “show\_allsessions” in Zyxel NAS326 firmware v (CVSS 6.5, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2024-29975](https://cve.now/CVE-2024-29975.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versi (CVSS 6.7, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2024-29974](https://cve.now/CVE-2024-29974.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The remote code execution vulnerability in the CGI program “file\_upload-cgi” in Zyxel NAS326 firmware versio (CVSS 9.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2024-29973](https://cve.now/CVE-2024-29973.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5 (CVSS 9.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2024-29972](https://cve.now/CVE-2024-29972.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\* The command injection vulnerability in the CGI program "remote\_help-cgi" in Zyxel NAS326 firmware versions b (CVSS 9.8, Zyxel NAS326 firmware · Zyxel NAS542 firmware)
- [CVE-2024-29152](https://cve.now/CVE-2024-29152.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.