CVEs published June 5, 2024
72 CVEs were published on June 5, 2024: 6 critical, 15 high.
- Published
- 72
- Critical
- 6
- High
- 15
- Medium
- 49
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- themefusecom Brizy – Page Builder
- 5
- ABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825 · A… +10
- 2
- Cisco Unified Contact Center Enterprise · Cisco Unified… +2
- 2
- buddyboss-platform
- 1
- Chanjet Smooth T+system
- 1
- chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- 1
- codename065 Download Manager
- 1
- creativethemeshq Blocksy
- 1
- cyberchimps Responsive Plus – Elementor Templates & Starter…
- 1
- duongancol Boostify Header Footer Builder for Elementor
- 1
Critical 6
- CVE-2024-5171heap buffer overflow in libaomlibaom
- CVE-2024-4009Replay Attack in KNX Secure DevicesABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825 · A… +10
- CVE-2024-4008FDSK Leak in KNX Secure DevicesABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825 · A… +10
- CVE-2024-24790Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipGo standard library net/netip · stdlib
- CVE-2024-4295Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hashicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2024-5262ProjectDiscovery Interactsh - Files or Directories Accessible to External PartiesProjectDiscovery Interactsh · github.com/projectdiscovery/i…
High 15
- CVE-2024-0912CCURE passwords exposed to administratorsJohnson Controls Software House C•CURE
- CVE-2024-36670idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass_deal.php?mudi=del
- CVE-2024-5037Openshift/telemeter: iss check during jwt authentication can be bypassedtelemeter · Red Hat OpenShift Container Platform +3
- CVE-2024-5184Prompt Injection in EmailGPTEmailGPT
- CVE-2024-36129OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPCopen-telemetry opentelemetry-collector · go.opentelemetr… +1
- CVE-2024-20404A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF atCisco Unified Contact Center Enterprise · Cisco Unified… +2
- CVE-2024-1662Information Disclosure in Porty's PowerBankPORTY Smart Tech Technology Joint Stock Company PowerBank A…
- CVE-2024-5526Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and inteGrafana OnCall
- CVE-2024-4743LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcodechrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- CVE-2024-1272Information Disclosure to Source Code in TNB Mobile Solutions' Cockpit SoftwareTNB Mobile Solutions Cockpit Software
- CVE-2024-3667Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URLthemefusecom Brizy – Page Builder
- CVE-2024-1940Brizy – Page Builder <= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scriptingthemefusecom Brizy – Page Builder
- CVE-2024-2087Brizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Formthemefusecom Brizy – Page Builder
- CVE-2024-4084SSRF vulnerability in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2023-49928An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2
Medium, low and unrated 51
- CVE-2024-5653Chanjet Smooth T+system keyEdit.aspx sql injectionChanjet Smooth T+system
- CVE-2024-36667idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType_deal.php?mudi=add&nohrefStr=c
- CVE-2024-36668idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=del
- CVE-2024-36669idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add.
- CVE-2024-27371An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27373An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27374An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27375An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27372An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27377An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27370An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27381An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27382An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27378An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27376An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27380An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-27379An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.
- CVE-2024-35674WordPress Unlimited Elements For Elementor plugin <= 1.5.109 - Broken Access Control vulnerabilityUnlimited Elements For Elementor
- CVE-2024-20405A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XCisco Unified Contact Center Enterprise · Cisco Unified… +2
- CVE-2024-24789Mishandling of corrupt central directory record in archive/zipGo standard library archive/zip · stdlib
- CVE-2024-4812Katello: potential cross-site scripting exploit in uikatello · Red Hat Satellite
- CVE-2024-3716Foreman-installer: candlepin database password being leaked to local users via the process listforeman-installer · Red Hat Satellite
- CVE-2024-5629Out-of-bounds read in bson module of PyMongoMongoDB PyMongo · pymongo
- CVE-2024-35673WordPress Pure Chat plugin <= 2.22 - Cross Site Request Forgery (CSRF) vulnerabilityPure Chat by Ruby Pure Chat
- CVE-2024-3469GP Premium <= 2.4.0 - Reflected Cross-Site ScriptingGeneratePress GP Premium
- CVE-2024-5459Restaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu Creationrustaurius Five Star Restaurant Menu and Food Ordering
- CVE-2024-4001Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcodecodename065 Download Manager
- CVE-2024-5536GamiPress – Link <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingrubengc GamiPress – Link
- CVE-2024-4821WP Shortcodes Plugin — Shortcodes Ultimate <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcodegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-5571EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widgetwpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-23669An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2Fortinet FortiWebManager
- CVE-2024-5439Blocksy <= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
- CVE-2024-4939Weaver Xtreme Theme Support <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcodewpweaver Weaver Xtreme Theme Support
- CVE-2024-5453ProfileGrid <= 5.8.6 - Missing Authorizationmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-5006Boostify Header Footer Builder for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameterduongancol Boostify Header Footer Builder for Elementor
- CVE-2024-4088Gutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 - Missing Authorizationshafayat-alam Gutenberg Blocks and Page Layouts – Attire Bl…
- CVE-2024-5222Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scriptingcyberchimps Responsive Plus – Elementor Templates & Starter…
- CVE-2024-1164Brizy – Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionalitythemefusecom Brizy – Page Builder
- CVE-2024-2368Mollie Forms <= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplicationndijkstra Mollie Forms
- CVE-2024-4886BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDORbuddyboss-platform
- CVE-2024-1161Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributesthemefusecom Brizy – Page Builder
- CVE-2024-5149BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomnessthemekraft Post Form – Registration Form – Profile Form for…
- CVE-2024-5483LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON APIthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-5317Newsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1satollo Newsletter – Send awesome emails from WordPress
- CVE-2024-5636itsourcecode Bakery Online Ordering System index.php sql injectionitsourcecode Bakery Online Ordering System
- CVE-2023-49927An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2
- CVE-2023-50803An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Ex
- CVE-2023-50804An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Ex
- CVE-2024-28818An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos
- CVE-2024-34055Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LIT
- CVE-2024-36837SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the