# CVEs published 2024-06-06

178 CVEs were published on June 6, 2024: 23 critical, 78 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-37539](https://cve.now/CVE-2023-37539.md): HCL Domino Catalog template is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability (CVSS 8.4, HCL Software Domino Server)
- [CVE-2024-36775](https://cve.now/CVE-2024-36775.md): A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pay (CVSS 4.7)
- [CVE-2024-36774](https://cve.now/CVE-2024-36774.md): An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. (CVSS 8.0)
- [CVE-2024-4013](https://cve.now/CVE-2024-4013.md): Failure to update BT Mesh Replay Protection List (CVSS 5.6, silabs.com Gecko SDK)
- [CVE-2023-51847](https://cve.now/CVE-2023-51847.md): An issue in obgm and Libcoap v.a3ed466 allows a remote attacker to cause a denial of service via thecoap\_context\_t function in the src/coap\_ (CVSS 7.5)
- [CVE-2024-22525](https://cve.now/CVE-2024-22525.md): dnspod-sr 0dfbd37 contains a SEGV. (CVSS 5.5)
- [CVE-2024-22524](https://cve.now/CVE-2024-22524.md): dnspod-sr 0dfbd37 is vulnerable to buffer overflow. (CVSS 5.5)
- [CVE-2024-24199](https://cve.now/CVE-2024-24199.md): smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c. (CVSS 7.5)
- [CVE-2024-24198](https://cve.now/CVE-2024-24198.md): smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c. (CVSS 7.5)
- [CVE-2024-24195](https://cve.now/CVE-2024-24195.md): robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c. (CVSS 7.5)
- [CVE-2024-24194](https://cve.now/CVE-2024-24194.md): robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item-\>tokens component at /src/conf-parse.c. (CVSS 7.5)
- [CVE-2024-24192](https://cve.now/CVE-2024-24192.md): robdns commit d76d2e6 was discovered to contain a heap overflow via the component block-\>filename at /src/zonefile-insertion.c. (CVSS 2.7)
- [CVE-2023-49441](https://cve.now/CVE-2023-49441.md): dnsmasq 2.9 is vulnerable to Integer Overflow via forward\_query. (CVSS 7.5)
- [CVE-2024-36823](https://cve.now/CVE-2024-36823.md): The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive (CVSS 7.5, org.ninjaframework:ninja-core)
- [CVE-2024-32752](https://cve.now/CVE-2024-32752.md): Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool (CVSS 8.8, Johnson Controls iSTAR Configuration Utility · Johnson C… +1)
- [CVE-2024-36795](https://cve.now/CVE-2024-36795.md): Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54\_1.0.1 allows attackers to access URLs and directories embedded within the fi (CVSS 4.0)
- [CVE-2024-22074](https://cve.now/CVE-2024-22074.md): Dynamsoft Service 1.8.1025 through 1.8.2013, 1.7.0330 through 1.7.2531, 1.6.0428 through 1.6.1112, 1.5.0625 through 1.5.3116, 1.4.0618 throu (CVSS 9.8)
- [CVE-2024-36730](https://cve.now/CVE-2024-36730.md): Improper input validation in OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-37154](https://cve.now/CVE-2024-37154.md): Evmos allows unvested token delegations (CVSS 5.3, evmos · github.com/evmos/evmos +17)
- [CVE-2024-2359](https://cve.now/CVE-2024-2359.md): Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui (CVSS 9.8, parisneo/lollms-webui)
- [CVE-2024-2360](https://cve.now/CVE-2024-2360.md): Path Traversal leading to Remote Code Execution in parisneo/lollms-webui (CVSS 9.8, parisneo/lollms-webui)
- [CVE-2024-3408](https://cve.now/CVE-2024-3408.md): Authentication Bypass and RCE in man-group/dtale (CVSS 9.8, man-group/dtale · dtale)
- [CVE-2024-5124](https://cve.now/CVE-2024-5124.md): Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-5328](https://cve.now/CVE-2024-5328.md): SSRF Vulnerability in lunary-ai/lunary (CVSS 8.6, lunary-ai/lunary)
- [CVE-2024-3150](https://cve.now/CVE-2024-3150.md): Privilege Escalation in mintplex-labs/anything-llm (CVSS 8.1, mintplex-labs/anything-llm)
- [CVE-2024-2965](https://cve.now/CVE-2024-2965.md): Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain (CVSS 4.2, langchain-ai/langchain · langchain-community +1)
- [CVE-2024-36732](https://cve.now/CVE-2024-36732.md): An issue in OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-37153](https://cve.now/CVE-2024-37153.md): Evmos's contract balance not updating correctly after interchain transaction (CVSS 7.5, evmos · github.com/evmos/evmos +17)
- [CVE-2024-5248](https://cve.now/CVE-2024-5248.md): Improper Access Control in lunary-ai/lunary (CVSS 6.5, lunary-ai/lunary)
- [CVE-2024-2032](https://cve.now/CVE-2024-2032.md): Race Condition Vulnerability in zenml-io/zenml (CVSS 3.1, zenml-io/zenml · zenml)
- [CVE-2023-45192](https://cve.now/CVE-2023-45192.md): IBM Engineering Requirements Management DOORS Next XML external entity injection (CVSS 8.2, IBM Engineering Requirements Management DOORS Next)
- [CVE-2024-5187](https://cve.now/CVE-2024-5187.md): Arbitrary File Overwrite in download\_model\_with\_test\_data in onnx/onnx (CVSS 8.8, onnx/onnx · onnx)
- [CVE-2024-3404](https://cve.now/CVE-2024-3404.md): Improper Access Control in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-3429](https://cve.now/CVE-2024-3429.md): Path Traversal in parisneo/lollms (CVSS 9.8, parisneo/lollms · lollms)
- [CVE-2024-5278](https://cve.now/CVE-2024-5278.md): Unrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgpt (CVSS 6.5, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-36734](https://cve.now/CVE-2024-36734.md): Improper input validation in OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-3149](https://cve.now/CVE-2024-3149.md): SSRF in mintplex-labs/anything-llm (CVSS 9.6, mintplex-labs/anything-llm)
- [CVE-2024-5130](https://cve.now/CVE-2024-5130.md): Incorrect Authorization in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-36735](https://cve.now/CVE-2024-36735.md): OneFlow-Inc. (CVSS 5.3)
- [CVE-2024-3153](https://cve.now/CVE-2024-3153.md): Uncontrolled Resource Consumption in mintplex-labs/anything-llm (CVSS 6.5, mintplex-labs/anything-llm)
- [CVE-2024-3322](https://cve.now/CVE-2024-3322.md): Path Traversal in parisneo/lollms-webui (CVSS 8.4, parisneo/lollms-webui)
- [CVE-2024-36740](https://cve.now/CVE-2024-36740.md): An issue in OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-1873](https://cve.now/CVE-2024-1873.md): Path Traversal and Denial of Service in parisneo/lollms-webui (CVSS 8.2, parisneo/lollms-webui)
- [CVE-2024-4851](https://cve.now/CVE-2024-4851.md): SSRF Vulnerability in stangirard/quivr (CVSS 7.7, stangirard/quivr)
- [CVE-2024-1880](https://cve.now/CVE-2024-1880.md): OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt (CVSS 7.8, significant-gravitas/autogpt)
- [CVE-2024-5131](https://cve.now/CVE-2024-5131.md): Improper Access Control in lunary-ai/lunary (CVSS 7.5, lunary-ai/lunary)
- [CVE-2024-4888](https://cve.now/CVE-2024-4888.md): Arbitrary File Deletion in BerriAI/litellm (CVSS 6.5, berriai/litellm · litellm)
- [CVE-2024-2928](https://cve.now/CVE-2024-2928.md): Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow (CVSS 7.5, mlflow/mlflow · mlflow)
- [CVE-2024-3095](https://cve.now/CVE-2024-3095.md): SSRF in Langchain Web Research Retriever in langchain-ai/langchain (CVSS 4.8, langchain-ai/langchain · langchain-community)
- [CVE-2024-5129](https://cve.now/CVE-2024-5129.md): Privilege Escalation Vulnerability in lunary-ai/lunary (CVSS 8.2, lunary-ai/lunary)
- [CVE-2024-5206](https://cve.now/CVE-2024-5206.md): Sensitive Data Leakage in sklearn.feature\_extraction.text.TfidfVectorizer in scikit-learn/scikit-learn (CVSS 4.7, scikit-learn/scikit-learn · scikit-learn)
- [CVE-2024-2035](https://cve.now/CVE-2024-2035.md): Improper Authorization in zenml-io/zenml (CVSS 6.5, zenml-io/zenml · zenml)
- [CVE-2024-2288](https://cve.now/CVE-2024-2288.md): CSRF File Upload Vulnerability in parisneo/lollms-webui (CVSS 8.3, parisneo/lollms-webui)
- [CVE-2024-3402](https://cve.now/CVE-2024-3402.md): Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt (CVSS 6.8, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-4890](https://cve.now/CVE-2024-4890.md): Blind SQL Injection in berriai/litellm (CVSS 4.9, berriai/litellm · litellm)
- [CVE-2024-3166](https://cve.now/CVE-2024-3166.md): Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm (CVSS 3.4, mintplex-labs/anything-llm)
- [CVE-2024-4320](https://cve.now/CVE-2024-4320.md): Remote Code Execution due to LFI in '/install\_extension' in parisneo/lollms-webui (CVSS 9.8, parisneo/lollms-webui)
- [CVE-2024-2171](https://cve.now/CVE-2024-2171.md): Stored XSS in zenml-io/zenml (CVSS 3.4, zenml-io/zenml · zenml)
- [CVE-2024-5133](https://cve.now/CVE-2024-5133.md): Account Takeover via Exposed Recovery Token in lunary-ai/lunary (CVSS 9.1, lunary-ai/lunary)
- [CVE-2024-30373](https://cve.now/CVE-2024-30373.md): Kofax Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-3234](https://cve.now/CVE-2024-3234.md): Path Traversal in gaizhenbiao/chuanhuchatgpt (CVSS 9.8, gaizhenbiao/chuanhuchatgpt)
- [CVE-2024-5478](https://cve.now/CVE-2024-5478.md): Cross-site Scripting (XSS) in SAML metadata endpoint in lunary-ai/lunary (CVSS 7.4, lunary-ai/lunary)
- [CVE-2024-5186](https://cve.now/CVE-2024-5186.md): Server Side Request Forgery (SSRF) in imartinez/privategpt (CVSS 8.3, imartinez/privategpt)
- [CVE-2024-5225](https://cve.now/CVE-2024-5225.md): SQL Injection in berriai/litellm (CVSS 6.4, berriai/litellm · litellm)
- [CVE-2024-0520](https://cve.now/CVE-2024-0520.md): Remote Code Execution due to Full Controlled File Write in mlflow/mlflow (CVSS 10.0, mlflow/mlflow · mlflow)
- [CVE-2024-2213](https://cve.now/CVE-2024-2213.md): Improper Authentication in zenml-io/zenml (CVSS 3.3, zenml-io/zenml · zenml)
- [CVE-2024-3102](https://cve.now/CVE-2024-3102.md): JSON Injection in mintplex-labs/anything-llm (CVSS 5.3, mintplex-labs/anything-llm)
- [CVE-2024-5307](https://cve.now/CVE-2024-5307.md): Kofax Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-22326](https://cve.now/CVE-2024-22326.md): IBM System Storage improper authentication (CVSS 5.0, IBM System Storage DS8900F)
- [CVE-2024-1881](https://cve.now/CVE-2024-1881.md): Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt (CVSS 8.8, significant-gravitas/autogpt)
- [CVE-2024-5306](https://cve.now/CVE-2024-5306.md): Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-5550](https://cve.now/CVE-2024-5550.md): Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3 (CVSS 5.3, h2oai/h2o-3 · h2o)
- [CVE-2024-2383](https://cve.now/CVE-2024-2383.md): Clickjacking Vulnerability in zenml-io/zenml (CVSS 4.3, zenml-io/zenml · zenml)
- [CVE-2024-4881](https://cve.now/CVE-2024-4881.md): Path Traversal in parisneo/lollms (CVSS 7.5, parisneo/lollms · lollms)
- [CVE-2024-37364](https://cve.now/CVE-2024-37364.md): Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensi (CVSS 6.8)
- [CVE-2024-32873](https://cve.now/CVE-2024-32873.md): evmos allows transferring unvested tokens after delegations (CVSS 3.5, evmos · github.com/evmos/evmos +17)
- [CVE-2024-2624](https://cve.now/CVE-2024-2624.md): Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui (CVSS 9.4, parisneo/lollms-webui)
- [CVE-2024-3110](https://cve.now/CVE-2024-3110.md): Stored XSS leading to admin account takeover in mintplex-labs/anything-llm (CVSS 7.3, mintplex-labs/anything-llm)
- [CVE-2024-5126](https://cve.now/CVE-2024-5126.md): Improper Access Control in lunary-ai/lunary (CVSS 7.6, lunary-ai/lunary)
- [CVE-2024-5552](https://cve.now/CVE-2024-5552.md): ReDoS in kubeflow/kubeflow (CVSS 7.5, kubeflow/kubeflow)
- [CVE-2024-5128](https://cve.now/CVE-2024-5128.md): IDOR Vulnerability in lunary-ai/lunary (CVSS 9.4, lunary-ai/lunary)
- [CVE-2024-3099](https://cve.now/CVE-2024-3099.md): Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow (CVSS 5.4, mlflow/mlflow · mlflow)
- [CVE-2024-2548](https://cve.now/CVE-2024-2548.md): Path Traversal in parisneo/lollms-webui (CVSS 7.5, parisneo/lollms-webui)
- [CVE-2024-2362](https://cve.now/CVE-2024-2362.md): Path Traversal in parisneo/lollms-webui (CVSS 9.1, parisneo/lollms-webui)
- [CVE-2024-23793](https://cve.now/CVE-2024-23793.md): Upload of files outside application directory (CVSS 6.3, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2024-5305](https://cve.now/CVE-2024-5305.md): Kofax Power PDF PDF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-5304](https://cve.now/CVE-2024-5304.md): Kofax Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-5303](https://cve.now/CVE-2024-5303.md): Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-5482](https://cve.now/CVE-2024-5482.md): SSRF in add\_webpage endpoint in parisneo/lollms-webui (CVSS 7.4, parisneo/lollms-webui)
- [CVE-2024-2914](https://cve.now/CVE-2024-2914.md): TarSlip Vulnerability in deepjavalibrary/djl (CVSS 7.8, deepjavalibrary/djl)
- [CVE-2024-4325](https://cve.now/CVE-2024-4325.md): Server-Side Request Forgery (SSRF) in gradio-app/gradio (CVSS 8.6, gradio-app/gradio · gradio)
- [CVE-2024-4941](https://cve.now/CVE-2024-4941.md): Local File Inclusion in JSON component in gradio-app/gradio (CVSS 7.5, gradio-app/gradio · gradio)
- [CVE-2024-5452](https://cve.now/CVE-2024-5452.md): RCE via Property/Class Pollution in lightning-ai/pytorch-lightning (CVSS 9.8, lightning-ai/pytorch-lightning · pytorch-lightning +1)
- [CVE-2024-5302](https://cve.now/CVE-2024-5302.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-5301](https://cve.now/CVE-2024-5301.md): Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-3504](https://cve.now/CVE-2024-3504.md): Improper Access Control in lunary-ai/lunary (CVSS 8.1, lunary-ai/lunary)
- [CVE-2024-4889](https://cve.now/CVE-2024-4889.md): Code Injection in berriai/litellm (CVSS 7.2, berriai/litellm)
- [CVE-2024-1879](https://cve.now/CVE-2024-1879.md): CSRF to RCE in significant-gravitas/autogpt (CVSS 8.8, significant-gravitas/autogpt)
- [CVE-2024-30369](https://cve.now/CVE-2024-30369.md): A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability (CVSS 7.8, A10 Thunder ADC)
- [CVE-2024-30368](https://cve.now/CVE-2024-30368.md): A10 Thunder ADC CsrRequestView Command Injection Remote Code Execution Vulnerability (CVSS 7.2, A10 Thunder ADC)
- [CVE-2024-5506](https://cve.now/CVE-2024-5506.md): Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot Viewer)
- [CVE-2024-5508](https://cve.now/CVE-2024-5508.md): Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot Viewer)
- [CVE-2024-5509](https://cve.now/CVE-2024-5509.md): Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot)
- [CVE-2024-5507](https://cve.now/CVE-2024-5507.md): Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot Viewer)
- [CVE-2024-3104](https://cve.now/CVE-2024-3104.md): Remote Code Execution in mintplex-labs/anything-llm (CVSS 9.6, mintplex-labs/anything-llm)
- [CVE-2024-5269](https://cve.now/CVE-2024-5269.md): Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution Vulnerability (CVSS 8.8, Sonos Era)
- [CVE-2024-5268](https://cve.now/CVE-2024-5268.md): Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 4.3, Sonos Era)
- [CVE-2024-5267](https://cve.now/CVE-2024-5267.md): Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 8.8, Sonos Era)
- [CVE-2024-5256](https://cve.now/CVE-2024-5256.md): Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disclosure Vulnerability (CVSS 4.3, Sonos Era)
- [CVE-2024-5505](https://cve.now/CVE-2024-5505.md): NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability (CVSS 8.8, NETGEAR ProSAFE Network Management System)
- [CVE-2024-30375](https://cve.now/CVE-2024-30375.md): Luxion KeyShot Viewer KSP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot Viewer)
- [CVE-2024-30374](https://cve.now/CVE-2024-30374.md): Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Luxion KeyShot Viewer)
- [CVE-2024-36736](https://cve.now/CVE-2024-36736.md): An issue in the oneflow.permute component of OneFlow-Inc. (CVSS 9.8)
- [CVE-2024-5277](https://cve.now/CVE-2024-5277.md): Weak Password Recovery Mechanism in lunary-ai/lunary (CVSS 6.4, lunary-ai/lunary)
- [CVE-2024-36737](https://cve.now/CVE-2024-36737.md): Improper input validation in OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-3033](https://cve.now/CVE-2024-3033.md): Improper Authorization in mintplex-labs/anything-llm (CVSS 9.1, mintplex-labs/anything-llm)
- [CVE-2024-5127](https://cve.now/CVE-2024-5127.md): Improper Access Control in lunary-ai/lunary (CVSS 5.4, lunary-ai/lunary)
- [CVE-2024-3152](https://cve.now/CVE-2024-3152.md): Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm (CVSS 8.8, mintplex-labs/anything-llm)
- [CVE-2024-36745](https://cve.now/CVE-2024-36745.md): An issue in OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-36743](https://cve.now/CVE-2024-36743.md): An issue in OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-36742](https://cve.now/CVE-2024-36742.md): An issue in the oneflow.scatter\_nd parameter OneFlow-Inc. (CVSS 7.5)
- [CVE-2024-37156](https://cve.now/CVE-2024-37156.md): TokenController formName not sanitized in hidden input (CVSS 6.1, SuluFormBundle · sulu/form-bundle)
- [CVE-2024-35178](https://cve.now/CVE-2024-35178.md): Jupyter server on Windows discloses Windows user password hash (CVSS 7.5, jupyter-server jupyter\_server · jupyter-server)
- [CVE-2024-37152](https://cve.now/CVE-2024-37152.md): Unauthenticated Access to sensitive settings in Argo CD (CVSS 5.3, argoproj argo-cd · github.com/argoproj/argo-cd/v2/server +2)
- [CVE-2024-37150](https://cve.now/CVE-2024-37150.md): Private npm registry support used scope auth token for downloading tarballs (CVSS 7.6, denoland deno)
- [CVE-2024-36399](https://cve.now/CVE-2024-36399.md): Kanboard affected by Project Takeover via IDOR in ProjectPermissionController (CVSS 8.2, kanboard)
- [CVE-2024-36106](https://cve.now/CVE-2024-36106.md): Argo CD allows authenticated users to enumerate clusters by name (CVSS 4.3, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-34832](https://cve.now/CVE-2024-34832.md): Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to (CVSS 9.8)
- [CVE-2024-5684](https://cve.now/CVE-2024-5684.md): ID Charger Connect & Pro - JWT-Null-Algorithm (CVSS 6.3, Volkswagen Group Charging GmbH - Elli, EVBox ID Charger Con…)
- [CVE-2024-36779](https://cve.now/CVE-2024-36779.md): Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php. (CVSS 9.8)
- [CVE-2024-5675](https://cve.now/CVE-2024-5675.md): Unreliable data deserialization vulnerability in Mentor (CVSS 10.0, Summar Software Mentor – Employee Portal)
- [CVE-2024-5489](https://cve.now/CVE-2024-5489.md): Wbcom Designs - Custom Font Uploader \<= 2.3.4 - Missing Authorization to Font Deletion (CVSS 4.3, wbcomdesigns Wbcom Designs – Custom Font Uploader)
- [CVE-2024-5188](https://cve.now/CVE-2024-5188.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-5038](https://cve.now/CVE-2024-5038.md): Colibri Page Builder \<= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, extendthemes Colibri Page Builder)
- [CVE-2024-5658](https://cve.now/CVE-2024-5658.md): CraftCMS Plugin - Two-Factor Authentication - TOTP Token Stays Valid After Use (CVSS 4.8, Born05 CraftCMS Plugin - Two-Factor Authentication · born05…)
- [CVE-2024-5657](https://cve.now/CVE-2024-5657.md): CraftCMS Plugin - Two-Factor Authentication - Password Hash Disclosure (CVSS 3.7, Born05 CraftCMS Plugin - Two-Factor Authentication · born05…)
- [CVE-2024-5673](https://cve.now/CVE-2024-5673.md): Cross-Site Scripting in PHP File Manager by Dulldusk (CVSS 6.1, Dulldusk PHP File Manager)
- [CVE-2024-5329](https://cve.now/CVE-2024-5329.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.109 - Authenticated (Contributor+) Blind SQL Injection via data\[addonID\] Parameter (CVSS 8.8, unitecms Unlimited Elements For Elementor)
- [CVE-2024-5259](https://cve.now/CVE-2024-5259.md): MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution \<= 4.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via hover\_animation Parameter (CVSS 6.4, wcmp MultiVendorX – WooCommerce Multivendor Marketplace Sol…)
- [CVE-2024-28995](https://cve.now/CVE-2024-28995.md): SolarWinds Serv-U L Directory Transversal Vulnerability (CVSS 8.6, KEV, SolarWinds Serv-U)
- [CVE-2024-5221](https://cve.now/CVE-2024-5221.md): Qi Blocks \<= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, qodeinteractive Qi Blocks)
- [CVE-2024-36394](https://cve.now/CVE-2024-36394.md): SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVSS 9.1, SysAid)
- [CVE-2024-36393](https://cve.now/CVE-2024-36393.md): SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CVSS 9.9, SysAid)
- [CVE-2024-4177](https://cve.now/CVE-2024-4177.md): Host whitelist parser issue in GravityZone Console On-Premise (VA-11554) (CVSS 8.1, Bitdefender GravityZone Console On-Premise)
- [CVE-2024-5665](https://cve.now/CVE-2024-5665.md): Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Exposure (CVSS 4.3, xootix Login/Signup Popup)
- [CVE-2024-3049](https://cve.now/CVE-2024-3049.md): Booth: specially crafted hash can lead to invalid hmac being accepted by booth server (CVSS 5.9, booth · Red Hat Enterprise Linux)
- [CVE-2024-0972](https://cve.now/CVE-2024-0972.md): BuddyPress Members Only \<= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API (CVSS 5.3, zhuyi BuddyPress Members Only)
- [CVE-2024-5152](https://cve.now/CVE-2024-5152.md): ElementsReady Addons for Elementor \<= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, quomodosoft ElementsReady Addons for Elementor)
- [CVE-2024-5161](https://cve.now/CVE-2024-5161.md): Magical Addons For Elementor \<= 1.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nalam-1 Magical Addons For Elementor)
- [CVE-2024-5162](https://cve.now/CVE-2024-5162.md): WordPress prettyPhoto \<= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter (CVSS 6.4, ibabar PrettyPhoto – Simple Lightbox Plugin)
- [CVE-2024-5153](https://cve.now/CVE-2024-5153.md): Startklar Elementor Addons \<= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion (CVSS 9.1, wshberlin Startklar Elementor Addons)
- [CVE-2024-1175](https://cve.now/CVE-2024-1175.md): WP-Recall – Registration, Profile, Commerce & More \<= 16.26.6 - Unauthenticated Payment Deletion via delete\_payment (CVSS 5.3, wppost WP-Recall – Registration, Profile, Commerce & More)
- [CVE-2024-5141](https://cve.now/CVE-2024-5141.md): Rotating Tweets (Twitter widget and shortcode) \<= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, mpntod Rotating Tweets)
- [CVE-2024-5615](https://cve.now/CVE-2024-5615.md): Open Graph \<= 1.11.2 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, willnorris Open Graph)
- [CVE-2024-4458](https://cve.now/CVE-2024-4458.md): Themesflat Addons For Elementor \<= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via URLs (CVSS 6.4, Themesflat Addons For Elementor)
- [CVE-2024-4212](https://cve.now/CVE-2024-4212.md): Themesflat Addons For Elementor \<= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets (CVSS 6.4, Themesflat Addons For Elementor)
- [CVE-2024-5449](https://cve.now/CVE-2024-5449.md): WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing \<= 5.0.4 - Missing Authorization (CVSS 4.3, wppool WP Dark Mode – Improve Accessibility with AI Powered…)
- [CVE-2024-4459](https://cve.now/CVE-2024-4459.md): Themesflat Addons For Elementor \<= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles (CVSS 6.4, Themesflat Addons For Elementor)
- [CVE-2024-4608](https://cve.now/CVE-2024-4608.md): SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster \<= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, artbees SellKit – Funnel builder and checkout optimizer for…)
- [CVE-2024-4707](https://cve.now/CVE-2024-4707.md): Materialis Companion \<= 1.3.41 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis\_contact\_form Shortcode (CVSS 6.4, horearadu Materialis Companion)
- [CVE-2024-2922](https://cve.now/CVE-2024-2922.md): Themesflat Addons For Elementor \<= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags (CVSS 6.4, Themesflat Addons For Elementor)
- [CVE-2024-4364](https://cve.now/CVE-2024-4364.md): Qi Addons For Elementor \<= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4, qodeinteractive Qi Addons For Elementor)
- [CVE-2024-2017](https://cve.now/CVE-2024-2017.md): Countdown, Coming Soon, Maintenance – Countdown & Clock \<= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection (CVSS 5.4, adamskaat Countdown, Coming Soon, Maintenance – Countdown &…)
- [CVE-2024-4705](https://cve.now/CVE-2024-4705.md): Testimonials Widget \<= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode (CVSS 6.4, j0hnsmith Testimonials Widget)
- [CVE-2024-5179](https://cve.now/CVE-2024-5179.md): Cowidgets – Elementor Addons \<= 1.1.2 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8, codelessthemes Cowidgets – Elementor Addons)
- [CVE-2024-2350](https://cve.now/CVE-2024-2350.md): Clever Addons for Elementor \<= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets (CVSS 6.4, zootemplate Clever Addons for Elementor)
- [CVE-2024-5224](https://cve.now/CVE-2024-5224.md): Easy Social Like Box – Popup – Sidebar Widget \<= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, johnnash1975 Easy Social Like Box – Popup – Sidebar Widget)
- [CVE-2023-6966](https://cve.now/CVE-2023-6966.md): The Moneytizer \<= 9.6.3 - Missing Authorization via multiple AJAX actions (CVSS 8.1, lvaudore The Moneytizer)
- [CVE-2024-5001](https://cve.now/CVE-2024-5001.md): Image Hover Effects for Elementor with Lightbox and Flipbox \<= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via \_id, oxi\_addons\_f\_title\_tag, and content\_description\_tag Parameters (CVSS 6.4, biplob018 Image Hover Effects for Elementor with Lightbox a…)
- [CVE-2024-4194](https://cve.now/CVE-2024-4194.md): Album and Image Gallery plus Lightbox \<= 2.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, essentialplugin Album and Image Gallery Plus Lightbox)
- [CVE-2023-6956](https://cve.now/CVE-2023-6956.md): EasyAzon – Amazon Associates Affiliate Plugin \<= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale (CVSS 6.1, flowdee EasyAzon – Amazon Associates Affiliate Plugin)
- [CVE-2024-0910](https://cve.now/CVE-2024-0910.md): Restrict for Elementor \<= 1.0.7 - Protection Mechanism Bypass (CVSS 5.3, Restrict for Elementor)
- [CVE-2023-6968](https://cve.now/CVE-2023-6968.md): The Moneytizer \<= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions (CVSS 8.1, lvaudore The Moneytizer)
- [CVE-2024-4942](https://cve.now/CVE-2024-4942.md): Custom Dash \<= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, dextorlobo Custom Dash)
- [CVE-2024-5342](https://cve.now/CVE-2024-5342.md): Simple Image Popup Shortcode \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, purvabathe Simple Image Popup Shortcode)
- [CVE-2024-4788](https://cve.now/CVE-2024-4788.md): Boostify Header Footer Builder for Elementor \<= 1.3.5 - Missing Authorization to Page/Post Creation (CVSS 4.3, duongancol Boostify Header Footer Builder for Elementor)
- [CVE-2024-5324](https://cve.now/CVE-2024-5324.md): XootiX Framework \<= Various Plugin Versions - Missing Authorization to Arbitrary Options Update (CVSS 8.8, xootix Waitlist Woocommerce · xootix OTP Login & Registe… +2)
- [CVE-2024-33655](https://cve.now/CVE-2024-33655.md): The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS qu (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.