# CVEs published 2024-06-07

70 CVEs were published on June 7, 2024: 6 critical, 23 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-0444](https://cve.now/CVE-2024-0444.md): GStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.5, GStreamer)
- [CVE-2023-7261](https://cve.now/CVE-2023-7261.md): Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation (CVSS 7.3, Google Omaha)
- [CVE-2024-1694](https://cve.now/CVE-2024-1694.md): Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access (CVSS 7.8, Google Omaha)
- [CVE-2024-5745](https://cve.now/CVE-2024-5745.md): itsourcecode Bakery Online Ordering System unrestricted upload (CVSS 6.9, itsourcecode Bakery Online Ordering System)
- [CVE-2024-37163](https://cve.now/CVE-2024-37163.md): SkyScrape Secure API Requests (CVSS 6.4, oslabs-beta SkyScraper)
- [CVE-2024-32503](https://cve.now/CVE-2024-32503.md): An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, E (CVSS 8.4)
- [CVE-2024-36773](https://cve.now/CVE-2024-36773.md): A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted pay (CVSS 4.8)
- [CVE-2024-36788](https://cve.now/CVE-2024-36788.md): Netgear WNR614 JNR1010V2 N300-V1.1.0.54\_1.0.1 does not properly set the HTTPOnly flag for cookies. (CVSS 5.9)
- [CVE-2024-36790](https://cve.now/CVE-2024-36790.md): Netgear WNR614 JNR1010V2/N300-V1.1.0.54\_1.0.1 was discovered to store credentials in plaintext. (CVSS 8.8)
- [CVE-2024-36789](https://cve.now/CVE-2024-36789.md): An issue in Netgear WNR614 JNR1010V2/N300-V1.1.0.54\_1.0.1 allows attackers to create passwords that do not conform to defined security stand (CVSS 8.1)
- [CVE-2024-37162](https://cve.now/CVE-2024-37162.md): zsa Generates Error Messages Containing Sensitive Information (CVSS 4.0, IdoPesok zsa · zsa)
- [CVE-2024-36787](https://cve.now/CVE-2024-36787.md): An issue in Netgear WNR614 JNR1010V2 N300-V1.1.0.54\_1.0.1 allows attackers to bypass authentication and access the administrative interface (CVSS 8.8)
- [CVE-2024-36792](https://cve.now/CVE-2024-36792.md): An issue in the implementation of the WPS in Netgear WNR614 JNR1010V2/N300-V1.1.0.54\_1.0.1 allows attackers to gain access to the router's p (CVSS 8.2)
- [CVE-2024-37160](https://cve.now/CVE-2024-37160.md): Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata (CVSS 4.8, getformwork formwork · getformwork/formwork)
- [CVE-2024-31878](https://cve.now/CVE-2024-31878.md): IBM i information disclosure (CVSS 5.3, IBM i)
- [CVE-2024-36673](https://cve.now/CVE-2024-36673.md): Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. (CVSS 9.8)
- [CVE-2024-5382](https://cve.now/CVE-2024-5382.md): Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \<= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification (CVSS 6.5, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-5599](https://cve.now/CVE-2024-5599.md): FileOrganizer \<= 1.0.7 - Sensitive Information Exposure via Directory Listing (CVSS 7.5, softaculous FileOrganizer – WordPress File Manager)
- [CVE-2024-5542](https://cve.now/CVE-2024-5542.md): Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \<= 2.0.6.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via Navigation Menu Widget (CVSS 7.2, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-5438](https://cve.now/CVE-2024-5438.md): Tutor LMS – eLearning and online course solution \<= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-5734](https://cve.now/CVE-2024-5734.md): itsourcecode Online Discussion Forum poster.php unrestricted upload (CVSS 5.3, itsourcecode Online Discussion Forum)
- [CVE-2024-5733](https://cve.now/CVE-2024-5733.md): itsourcecode Online Discussion Forum register\_me.php sql injection (CVSS 6.9, itsourcecode Online Discussion Forum)
- [CVE-2024-4610](https://cve.now/CVE-2024-4610.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 7.4, KEV, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel Driv…)
- [CVE-2024-5637](https://cve.now/CVE-2024-5637.md): Market Exporter \<= 2.0.19 - Missing Authorization to Arbitrary File Deletion (CVSS 7.5, vanyukov Market Exporter)
- [CVE-2024-5732](https://cve.now/CVE-2024-5732.md): Clash Proxy Port improper authentication (CVSS 6.9, Clash)
- [CVE-2024-5645](https://cve.now/CVE-2024-5645.md): Envo Extra \<= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4, envothemes Envo Extra)
- [CVE-2024-5481](https://cve.now/CVE-2024-5481.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc\_dir Function (CVSS 6.8, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2023-5424](https://cve.now/CVE-2023-5424.md): WS Form LITE \<= 1.9.217 - Unauthenticated CSV Injection (CVSS 4.7, westguard WS Form LITE – Drag & Drop Contact Form Builder ·…)
- [CVE-2024-5426](https://cve.now/CVE-2024-5426.md): Photo Gallery by 10Web – Mobile-Friendly Image Gallery \<= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG (CVSS 6.4, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2024-4703](https://cve.now/CVE-2024-4703.md): One Page Express Companion \<= 1.6.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via one\_page\_express\_contact\_form Shortcode (CVSS 6.4, horearadu One Page Express Companion)
- [CVE-2024-4488](https://cve.now/CVE-2024-4488.md): Royal Elementor Addons and Templates \<= 1.3.976 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-4489](https://cve.now/CVE-2024-4489.md): Royal Elementor Addons and Templates \<= 1.3.976 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-4451](https://cve.now/CVE-2024-4451.md): Colibri Page Builder \<= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri\_video\_player Shortcode (CVSS 6.4, extendthemes Colibri Page Builder)
- [CVE-2024-5003](https://cve.now/CVE-2024-5003.md): WP Stacker \<= 1.8.5 - Stored XSS via CSRF (CVSS 5.4, WP Stacker)
- [CVE-2024-4756](https://cve.now/CVE-2024-4756.md): WP Backpack \<= 2.1 - Admin+ Stored XSS (CVSS 5.4, WP Backpack)
- [CVE-2024-4621](https://cve.now/CVE-2024-4621.md): ArForms \< 6.6 - Admin+ Stored XSS (CVSS 4.8, ARForms - Premium WordPress Form Builder Plugin)
- [CVE-2024-4620](https://cve.now/CVE-2024-4620.md): ArForms \< 6.6 - Unauthenticated RCE (CVSS 9.8, ARForms - Premium WordPress Form Builder Plugin)
- [CVE-2024-3288](https://cve.now/CVE-2024-3288.md): Logo Slider \< 4.0.0 - Contributor+ Stored XSS (CVSS 5.4, Logo Slider)
- [CVE-2024-3592](https://cve.now/CVE-2024-3592.md): Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress \<= 9.0.1 - Authenticated (Contributor+) SQL Injection (CVSS 9.9, expresstech Quiz and Survey Master (QSM) – Easy Quiz and Su…)
- [CVE-2023-6491](https://cve.now/CVE-2023-6491.md): Strong Testimonials \<= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification (CVSS 4.3, wpchill Strong Testimonials)
- [CVE-2024-4354](https://cve.now/CVE-2024-4354.md): TablePress – Tables in WordPress made easy \<= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind (CVSS 6.4, tobiasbg TablePress – Tables in WordPress made easy)
- [CVE-2024-4042](https://cve.now/CVE-2024-4042.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel - Combo Blocks \<= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute (CVSS 6.4, pickplugins Post Grid)
- [CVE-2024-4902](https://cve.now/CVE-2024-4902.md): Tutor LMS – eLearning and online course solution \<= 2.7.1 -Authenticated (Administrator+) SQL Injection (CVSS 7.2, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-5640](https://cve.now/CVE-2024-5640.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2024-5612](https://cve.now/CVE-2024-5612.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget (CVSS 6.4, Essential Addons for Elementor Pro)
- [CVE-2024-36082](https://cve.now/CVE-2024-36082.md): SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an adm (CVSS 6.5, CodePeople Music Store - WordPress eCommerce)
- [CVE-2024-37385](https://cve.now/CVE-2024-37385.md): Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im\_convert\_path and im\_identify\_path. (CVSS 9.8)
- [CVE-2024-1988](https://cve.now/CVE-2024-1988.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \<= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pickplugins Post Grid)
- [CVE-2024-5425](https://cve.now/CVE-2024-5425.md): WP jQuery Lightbox \<= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Attribute (CVSS 6.4, firelightwp LightPress Lightbox)
- [CVE-2024-4887](https://cve.now/CVE-2024-4887.md): Qi Addons For Elementor \<= 1.7.2 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, qodeinteractive Qi Addons For Elementor)
- [CVE-2024-5607](https://cve.now/CVE-2024-5607.md): GDPR CCPA Compliance & Cookie Consent Banner \<= 2.7.0 - Missing Authorization to Settings Update and Stored Cross-Site Scripting (CVSS 5.4, ninjateam GDPR CCPA Compliance & Cookie Consent Banner)
- [CVE-2024-3987](https://cve.now/CVE-2024-3987.md): WP Mobile Menu – The Mobile-Friendly Responsive Menu \<= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt (CVSS 5.4, takanakui WP Mobile Menu – The Mobile-Friendly Responsive M…)
- [CVE-2024-1768](https://cve.now/CVE-2024-1768.md): Clever Fox \<= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nayrathemes Clever Fox)
- [CVE-2023-32475](https://cve.now/CVE-2023-32475.md): Dell BIOS contains a missing support for integrity check vulnerability. (CVSS 7.6, Dell CPG BIOS)
- [CVE-2023-6876](https://cve.now/CVE-2023-6876.md): Clever Fox – One Click Website Importer by Nayra Themes \<= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-theme (CVSS 5.4, nayrathemes Clever Fox)
- [CVE-2024-1689](https://cve.now/CVE-2024-1689.md): WooCommerce Tools \<= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation (CVSS 4.3, themefarmer WooCommerce Tools)
- [CVE-2022-4968](https://cve.now/CVE-2022-4968.md): netplan leaks the private key of wireguard to local users. (CVSS 6.5, Canonical Netplan)
- [CVE-2023-49221](https://cve.now/CVE-2023-49221.md): Precor touchscreen console P62, P80, and P82 could allow a remote attacker (within the local network) to bypass security restrictions, and a (CVSS 7.8)
- [CVE-2023-49222](https://cve.now/CVE-2023-49222.md): Precor touchscreen console P82 contains a private SSH key that corresponds to a default public key. (CVSS 8.8)
- [CVE-2023-49223](https://cve.now/CVE-2023-49223.md): Precor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is stor (CVSS 8.8)
- [CVE-2023-49224](https://cve.now/CVE-2023-49224.md): Precor touchscreen console P62, P80, and P82 contains a default SSH public key in the authorized\_keys file. (CVSS 8.0)
- [CVE-2024-30162](https://cve.now/CVE-2024-30162.md): Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\\core\\modules\\a (CVSS 7.2)
- [CVE-2024-30163](https://cve.now/CVE-2024-30163.md): Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\\nexus\\modules\\front\\store\\ (CVSS 9.8)
- [CVE-2024-31958](https://cve.now/CVE-2024-31958.md): An issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400. (CVSS 6.8)
- [CVE-2024-31959](https://cve.now/CVE-2024-31959.md): An issue was discovered in Samsung Mobile Processor Exynos 2200, Exynos 1480, Exynos 2400. (CVSS 8.4)
- [CVE-2024-32502](https://cve.now/CVE-2024-32502.md): An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, E (CVSS 8.4)
- [CVE-2024-36827](https://cve.now/CVE-2024-36827.md): An XML External Entity (XXE) vulnerability in the ebookmeta.get\_metadata function of ebookmeta before v1.2.8 allows attackers to access sens (CVSS 7.5, ebookmeta)
- [CVE-2024-37383](https://cve.now/CVE-2024-37383.md): Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. (CVSS 6.1, KEV)
- [CVE-2024-37384](https://cve.now/CVE-2024-37384.md): Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. (CVSS 6.1)
- [CVE-2024-37388](https://cve.now/CVE-2024-37388.md): An XML External Entity (XXE) vulnerability in the ebookmeta.get\_metadata function of lxml before v4.9.1 allows attackers to access sensitive (CVSS 9.1, ebookmeta)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.