CVEs published June 7, 2024
70 CVEs were published on June 7, 2024: 6 critical, 23 high. 2 are now in CISA KEV.
- Published
- 70
- Critical
- 6
- High
- 23
- Medium
- 41
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 11
Most affected products
- ARForms - Premium WordPress Form Builder Plugin
- 2
- ebookmeta
- 2
- Google Omaha
- 2
- itsourcecode Online Discussion Forum
- 2
- litonice13 Master Addons For Elementor – Widgets, Extension…
- 2
- nayrathemes Clever Fox
- 2
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- 2
- pickplugins Post Grid
- 2
- themeum Tutor LMS – eLearning and online course solution
- 2
- wproyal Royal Addons for Elementor – Addons and Templates K…
- 2
Critical 6
- CVE-2024-36673Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php.
- CVE-2024-4620ArForms < 6.6 - Unauthenticated RCEARForms - Premium WordPress Form Builder Plugin
- CVE-2024-3592Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injectionexpresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…
- CVE-2024-37385Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path.
- CVE-2024-30163Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\
- CVE-2024-37388An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitiveebookmeta
High 23
- CVE-2024-0444GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2023-7261Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalationGoogle Omaha
- CVE-2024-1694Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access Google Omaha
- CVE-2024-32503An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, E
- CVE-2024-36790Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 was discovered to store credentials in plaintext.
- CVE-2024-36789An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to create passwords that do not conform to defined security stand
- CVE-2024-36787An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 allows attackers to bypass authentication and access the administrative interface
- CVE-2024-36792An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to gain access to the router's p
- CVE-2024-5599FileOrganizer <= 1.0.7 - Sensitive Information Exposure via Directory Listingsoftaculous FileOrganizer – WordPress File Manager
- CVE-2024-5542Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widgetlitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2024-4610Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel Driv…
- CVE-2024-5637Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletionvanyukov Market Exporter
- CVE-2024-4902Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injectionthemeum Tutor LMS – eLearning and online course solution
- CVE-2024-4887Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusionqodeinteractive Qi Addons For Elementor
- CVE-2023-32475Dell BIOS contains a missing support for integrity check vulnerability.Dell CPG BIOS
- CVE-2023-49221Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and a
- CVE-2023-49222Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key.
- CVE-2023-49223Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stor
- CVE-2023-49224Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized_keys file.
- CVE-2024-30162Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\a
- CVE-2024-31959An issue was discovered in Samsung Mobile Processor Exynos 2200, Exynos 1480, Exynos 2400.
- CVE-2024-32502An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, E
- CVE-2024-36827An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensebookmeta
Medium, low and unrated 41
- CVE-2024-5745itsourcecode Bakery Online Ordering System unrestricted uploaditsourcecode Bakery Online Ordering System
- CVE-2024-37163SkyScrape Secure API Requestsoslabs-beta SkyScraper
- CVE-2024-36773A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pay
- CVE-2024-36788Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies.
- CVE-2024-37162zsa Generates Error Messages Containing Sensitive InformationIdoPesok zsa · zsa
- CVE-2024-37160Formwork has a Cross-site scripting (XSS) vulnerability in Description metadatagetformwork formwork · getformwork/formwork
- CVE-2024-31878IBM i information disclosureIBM i
- CVE-2024-5382Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modificationlitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2024-5438Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletionthemeum Tutor LMS – eLearning and online course solution
- CVE-2024-5734itsourcecode Online Discussion Forum poster.php unrestricted uploaditsourcecode Online Discussion Forum
- CVE-2024-5733itsourcecode Online Discussion Forum register_me.php sql injectionitsourcecode Online Discussion Forum
- CVE-2024-5732Clash Proxy Port improper authenticationClash
- CVE-2024-5645Envo Extra <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widgetenvothemes Envo Extra
- CVE-2024-5481Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir FunctionPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2023-5424WS Form LITE <= 1.9.217 - Unauthenticated CSV Injectionwestguard WS Form LITE – Drag & Drop Contact Form Builder ·…
- CVE-2024-5426Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVGPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2024-4703One Page Express Companion <= 1.6.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcodehorearadu One Page Express Companion
- CVE-2024-4488Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scriptingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-4489Royal Elementor Addons and Templates <= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploadswproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-4451Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcodeextendthemes Colibri Page Builder
- CVE-2024-5003WP Stacker <= 1.8.5 - Stored XSS via CSRFWP Stacker
- CVE-2024-4756WP Backpack <= 2.1 - Admin+ Stored XSSWP Backpack
- CVE-2024-4621ArForms < 6.6 - Admin+ Stored XSSARForms - Premium WordPress Form Builder Plugin
- CVE-2024-3288Logo Slider < 4.0.0 - Contributor+ Stored XSSLogo Slider
- CVE-2023-6491Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modificationwpchill Strong Testimonials
- CVE-2024-4354TablePress – Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebindtobiasbg TablePress – Tables in WordPress made easy
- CVE-2024-4042Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributepickplugins Post Grid
- CVE-2024-5640Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widgetbdthemes Prime Slider – Addons for Elementor
- CVE-2024-5612Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal WidgetEssential Addons for Elementor Pro
- CVE-2024-36082SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an admCodePeople Music Store - WordPress eCommerce
- CVE-2024-1988Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scriptingpickplugins Post Grid
- CVE-2024-5425WP jQuery Lightbox <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attributefirelightwp LightPress Lightbox
- CVE-2024-5607GDPR CCPA Compliance & Cookie Consent Banner <= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scriptingninjateam GDPR CCPA Compliance & Cookie Consent Banner
- CVE-2024-3987WP Mobile Menu – The Mobile-Friendly Responsive Menu <= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alttakanakui WP Mobile Menu – The Mobile-Friendly Responsive M…
- CVE-2024-1768Clever Fox <= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingnayrathemes Clever Fox
- CVE-2023-6876Clever Fox – One Click Website Importer by Nayra Themes <= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-themenayrathemes Clever Fox
- CVE-2024-1689WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivationthemefarmer WooCommerce Tools
- CVE-2022-4968netplan leaks the private key of wireguard to local users.Canonical Netplan
- CVE-2024-31958An issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400.
- CVE-2024-37383Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- CVE-2024-37384Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.