# CVEs published 2024-06-05

72 CVEs were published on June 5, 2024: 6 critical, 15 high. Days are UTC.

- [CVE-2024-0912](https://cve.now/CVE-2024-0912.md): CCURE passwords exposed to administrators (CVSS 8.5, Johnson Controls Software House C•CURE)
- [CVE-2024-5653](https://cve.now/CVE-2024-5653.md): Chanjet Smooth T+system keyEdit.aspx sql injection (CVSS 6.9, Chanjet Smooth T+system)
- [CVE-2024-5171](https://cve.now/CVE-2024-5171.md): heap buffer overflow in libaom (CVSS 10.0, libaom)
- [CVE-2024-36667](https://cve.now/CVE-2024-36667.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/idcProType\_deal.php?mudi=add&nohrefStr=c (CVSS 5.4)
- [CVE-2024-36668](https://cve.now/CVE-2024-36668.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type\_deal.php?mudi=del (CVSS 5.4)
- [CVE-2024-36670](https://cve.now/CVE-2024-36670.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/vpsClass\_deal.php?mudi=del (CVSS 8.8)
- [CVE-2024-36669](https://cve.now/CVE-2024-36669.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type\_deal.php?mudi=add. (CVSS 5.4)
- [CVE-2024-27371](https://cve.now/CVE-2024-27371.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27373](https://cve.now/CVE-2024-27373.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27374](https://cve.now/CVE-2024-27374.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27375](https://cve.now/CVE-2024-27375.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27372](https://cve.now/CVE-2024-27372.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27377](https://cve.now/CVE-2024-27377.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27370](https://cve.now/CVE-2024-27370.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27381](https://cve.now/CVE-2024-27381.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.0)
- [CVE-2024-27382](https://cve.now/CVE-2024-27382.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.0)
- [CVE-2024-27378](https://cve.now/CVE-2024-27378.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.0)
- [CVE-2024-27376](https://cve.now/CVE-2024-27376.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-27380](https://cve.now/CVE-2024-27380.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.0)
- [CVE-2024-27379](https://cve.now/CVE-2024-27379.md): An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330. (CVSS 6.7)
- [CVE-2024-5037](https://cve.now/CVE-2024-5037.md): Openshift/telemeter: iss check during jwt authentication can be bypassed (CVSS 7.5, telemeter · Red Hat OpenShift Container Platform +3)
- [CVE-2024-5184](https://cve.now/CVE-2024-5184.md): Prompt Injection in EmailGPT (CVSS 8.5, EmailGPT)
- [CVE-2024-36129](https://cve.now/CVE-2024-36129.md): OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC (CVSS 8.2, open-telemetry opentelemetry-collector · go.opentelemetr… +1)
- [CVE-2024-4009](https://cve.now/CVE-2024-4009.md): Replay Attack in KNX Secure Devices (CVSS 9.2, ABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825 · A… +10)
- [CVE-2024-4008](https://cve.now/CVE-2024-4008.md): FDSK Leak in KNX Secure Devices (CVSS 9.6, ABB, Busch-Jaeger 2.4! Display 55, SD/U12.55.11-825 · A… +10)
- [CVE-2024-35674](https://cve.now/CVE-2024-35674.md): WordPress Unlimited Elements For Elementor plugin \<= 1.5.109 - Broken Access Control vulnerability (CVSS 4.3, Unlimited Elements For Elementor)
- [CVE-2024-20405](https://cve.now/CVE-2024-20405.md): A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored X (CVSS 4.8, Cisco Unified Contact Center Enterprise · Cisco Unified… +2)
- [CVE-2024-20404](https://cve.now/CVE-2024-20404.md): A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF at (CVSS 7.2, Cisco Unified Contact Center Enterprise · Cisco Unified… +2)
- [CVE-2024-24789](https://cve.now/CVE-2024-24789.md): Mishandling of corrupt central directory record in archive/zip (CVSS 5.3, Go standard library archive/zip · stdlib)
- [CVE-2024-24790](https://cve.now/CVE-2024-24790.md): Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (CVSS 9.8, Go standard library net/netip · stdlib)
- [CVE-2024-4812](https://cve.now/CVE-2024-4812.md): Katello: potential cross-site scripting exploit in ui (CVSS 4.8, katello · Red Hat Satellite)
- [CVE-2024-3716](https://cve.now/CVE-2024-3716.md): Foreman-installer: candlepin database password being leaked to local users via the process list (CVSS 6.2, foreman-installer · Red Hat Satellite)
- [CVE-2024-5629](https://cve.now/CVE-2024-5629.md): Out-of-bounds read in bson module of PyMongo (CVSS 4.7, MongoDB PyMongo · pymongo)
- [CVE-2024-35673](https://cve.now/CVE-2024-35673.md): WordPress Pure Chat plugin \<= 2.22 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pure Chat by Ruby Pure Chat)
- [CVE-2024-3469](https://cve.now/CVE-2024-3469.md): GP Premium \<= 2.4.0 - Reflected Cross-Site Scripting (CVSS 6.1, GeneratePress GP Premium)
- [CVE-2024-5459](https://cve.now/CVE-2024-5459.md): Restaurant Menu and Food Ordering \<= 2.4.16 - Missing Authorization to Menu Creation (CVSS 4.3, rustaurius Five Star Restaurant Menu and Food Ordering)
- [CVE-2024-1662](https://cve.now/CVE-2024-1662.md): Information Disclosure in Porty's PowerBank (CVSS 7.5, PORTY Smart Tech Technology Joint Stock Company PowerBank A…)
- [CVE-2024-5526](https://cve.now/CVE-2024-5526.md): Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and inte (CVSS 7.7, Grafana OnCall)
- [CVE-2024-4001](https://cve.now/CVE-2024-4001.md): Download Manager \<= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm\_modal\_login\_form Shortcode (CVSS 6.4, codename065 Download Manager)
- [CVE-2024-5536](https://cve.now/CVE-2024-5536.md): GamiPress – Link \<= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rubengc GamiPress – Link)
- [CVE-2024-4821](https://cve.now/CVE-2024-4821.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via su\_lightbox Shortcode (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-4743](https://cve.now/CVE-2024-4743.md): LifterLMS – WordPress LMS Plugin for eLearning \<= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…)
- [CVE-2024-5571](https://cve.now/CVE-2024-5571.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-1272](https://cve.now/CVE-2024-1272.md): Information Disclosure to Source Code in TNB Mobile Solutions' Cockpit Software (CVSS 7.5, TNB Mobile Solutions Cockpit Software)
- [CVE-2024-23669](https://cve.now/CVE-2024-23669.md): An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2 (CVSS 6.4, Fortinet FortiWebManager)
- [CVE-2024-5439](https://cve.now/CVE-2024-5439.md): Blocksy \<= 2.0.50 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, creativethemeshq Blocksy)
- [CVE-2024-4939](https://cve.now/CVE-2024-4939.md): Weaver Xtreme Theme Support \<= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode (CVSS 6.4, wpweaver Weaver Xtreme Theme Support)
- [CVE-2024-5453](https://cve.now/CVE-2024-5453.md): ProfileGrid \<= 5.8.6 - Missing Authorization (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-5006](https://cve.now/CVE-2024-5006.md): Boostify Header Footer Builder for Elementor \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter (CVSS 6.4, duongancol Boostify Header Footer Builder for Elementor)
- [CVE-2024-4088](https://cve.now/CVE-2024-4088.md): Gutenberg Blocks and Page Layouts – Attire Blocks \<= 1.9.2 - Missing Authorization (CVSS 4.3, shafayat-alam Gutenberg Blocks and Page Layouts – Attire Bl…)
- [CVE-2024-5222](https://cve.now/CVE-2024-5222.md): Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. \<= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, cyberchimps Responsive Plus – Elementor Templates & Starter…)
- [CVE-2024-1164](https://cve.now/CVE-2024-1164.md): Brizy – Page Builder \<= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2024-2368](https://cve.now/CVE-2024-2368.md): Mollie Forms \<= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplication (CVSS 4.3, ndijkstra Mollie Forms)
- [CVE-2024-4886](https://cve.now/CVE-2024-4886.md): BuddyBoss Platform \< 2.6.0 - Subscriber+ Comment on Private Post via IDOR (CVSS 4.3, buddyboss-platform)
- [CVE-2024-3667](https://cve.now/CVE-2024-3667.md): Brizy – Page Builder \<= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL (CVSS 7.4, themefusecom Brizy – Page Builder)
- [CVE-2024-1940](https://cve.now/CVE-2024-1940.md): Brizy – Page Builder \<= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting (CVSS 7.1, themefusecom Brizy – Page Builder)
- [CVE-2024-2087](https://cve.now/CVE-2024-2087.md): Brizy – Page Builder \<= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form (CVSS 7.2, themefusecom Brizy – Page Builder)
- [CVE-2024-4295](https://cve.now/CVE-2024-4295.md): Email Subscribers by Icegram Express \<= 5.7.20 - Unauthenticated SQL Injection via hash (CVSS 9.8, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2024-1161](https://cve.now/CVE-2024-1161.md): Brizy – Page Builder \<= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2024-5149](https://cve.now/CVE-2024-5149.md): BuddyForms \<= 2.8.9 - Email Verification Bypass due to Insufficient Randomness (CVSS 6.5, themekraft Post Form – Registration Form – Profile Form for…)
- [CVE-2024-5262](https://cve.now/CVE-2024-5262.md): ProjectDiscovery Interactsh - Files or Directories Accessible to External Parties (CVSS 9.3, ProjectDiscovery Interactsh · github.com/projectdiscovery/i…)
- [CVE-2024-5483](https://cve.now/CVE-2024-5483.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.8 - Basic Information Disclosure via JSON API (CVSS 5.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-5317](https://cve.now/CVE-2024-5317.md): Newsletter \<= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np1 (CVSS 6.4, satollo Newsletter – Send awesome emails from WordPress)
- [CVE-2024-5636](https://cve.now/CVE-2024-5636.md): itsourcecode Bakery Online Ordering System index.php sql injection (CVSS 5.3, itsourcecode Bakery Online Ordering System)
- [CVE-2024-4084](https://cve.now/CVE-2024-4084.md): SSRF vulnerability in mintplex-labs/anything-llm (CVSS 7.7, mintplex-labs/anything-llm)
- [CVE-2023-49927](https://cve.now/CVE-2023-49927.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2 (CVSS 5.3)
- [CVE-2023-49928](https://cve.now/CVE-2023-49928.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2 (CVSS 7.5)
- [CVE-2023-50803](https://cve.now/CVE-2023-50803.md): An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Ex (CVSS 3.7)
- [CVE-2023-50804](https://cve.now/CVE-2023-50804.md): An issue was discovered in Samsung Mobile Processor, and Modem Exynos 9820, Exynos 9825, Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Ex (CVSS 3.7)
- [CVE-2024-28818](https://cve.now/CVE-2024-28818.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 1080, Exynos 2100, Exynos (CVSS 5.9)
- [CVE-2024-34055](https://cve.now/CVE-2024-34055.md): Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LIT (CVSS 6.5)
- [CVE-2024-36837](https://cve.now/CVE-2024-36837.md): SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.