CVEs published June 10, 2024
146 CVEs were published on June 10, 2024: 21 critical, 54 high. 1 is now in CISA KEV.
- Published
- 146
- Critical
- 21
- High
- 54
- Medium
- 64
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 87
Most affected products
- salesagility SuiteCRM
- 13
- Apple macOS
- 8
- Trend Micro Apex One
- 7
- Apple iOS and iPadOS · Apple macOS +2
- 6
- Apple iOS and iPadOS · Apple macOS +3
- 6
- Apple Safari · Apple iOS and iPadOS +4
- 5
- Pandora FMS
- 4
- Apple iOS and iPadOS
- 3
- Apple iOS and iPadOS · Apple macOS
- 3
- Apple iOS and iPadOS · Apple macOS +1
- 3
Critical 21
- CVE-2024-27811The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-27832The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-27844The issue was addressed with improved checks.Apple Safari · Apple macOS +1
- CVE-2024-36415SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code executionsalesagility SuiteCRM
- CVE-2024-36412SuiteCRM unauthenticated SQL Injectionsalesagility SuiteCRM
- CVE-2024-36411SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controllersalesagility SuiteCRM
- CVE-2024-36410SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller salesagility SuiteCRM
- CVE-2024-36409SuiteCRM authenticated SQL Injection in TreeData entrypointsalesagility SuiteCRM
- CVE-2024-36408SuiteCRM authenticated SQL Injection in Alertssalesagility SuiteCRM
- CVE-2024-35746WordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerabilityAsghar Hatampoor BuddyPress Cover
- CVE-2024-37051GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023JetBrains IntelliJ IDEA · JetBrains Aqua +11
- CVE-2024-35677WordPress MegaMenu plugin <= 2.3.12 - Unauthenticated Local File Inclusion vulnerabilityStylemixThemes MegaMenu
- CVE-2024-34762Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerabilityWPENGINE Advanced Custom Fields PRO
- CVE-2024-35307Argument Injection Leading to Remote Code Execution in Realtime Graph ExtensionPandora FMS
- CVE-2024-35304System command injection through Netflow functionPandora FMS
- CVE-2024-3700Hardcoded password in Estomed Sp. z o.o. Simple Care softwareEstomed Sp. z o.o. Simple Care
- CVE-2024-3699Hardcoded password in drEryk GabinetdrEryk sp. z o.o. drEryk Gabinet
- CVE-2024-1228Hardcoded password in Eurosoft PrzychodniaEuroSoft Sp. z o. o. Eurosoft Przychodnia
- CVE-2024-31611SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
- CVE-2024-32167Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the f
- CVE-2024-37393Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input.
High 54
- CVE-2024-36471Apache Allura: sensitive information exposure via DNS rebindingApache Software Foundation Apache Allura
- CVE-2024-37166ghtml Cross-Site Scripting (XSS) vulnerabilitygurgunday ghtml · ghtml
- CVE-2024-35242Composer vulnerable to command injection via malicious git/hg branch namescomposer · composer/composer
- CVE-2024-37289An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatioTrend Micro Apex One
- CVE-2024-36358A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate priTrend Micro Deep Security Agent
- CVE-2024-36305A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalTrend Micro Apex One
- CVE-2024-36304A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalaTrend Micro Apex One
- CVE-2024-36303An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2024-36302An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2024-35241Composer vulnerable to command injection via malicious git branch namecomposer · composer/composer
- CVE-2024-32849Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionaTrend Micro Maximum Security
- CVE-2024-27851The issue was addressed with improved bounds checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-27831An out-of-bounds write issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-27857An out-of-bounds access issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-27800This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-27836The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-27820The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-27840The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-27817The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-27801The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-27802An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-27855The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-27808The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-27812A logic issue was addressed with improved file handling.Apple visionOS
- CVE-2024-27828The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2024-27833An integer overflow was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-27848This issue was addressed with improved permissions checking.Apple iOS and iPadOS · Apple macOS
- CVE-2024-36418SuiteCRM authenticated RCE using connectorssalesagility SuiteCRM
- CVE-2024-36416SuiteCRM v4 API Excessive log data DOSsalesagility SuiteCRM
- CVE-2024-36414SuiteCRM authenticated Server-Side Request Forgerysalesagility SuiteCRM
- CVE-2024-36413SuiteCRM authenticated Reflected Cross-Site Scriptingsalesagility SuiteCRM
- CVE-2022-48578An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2022-48683An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2022-32897A memory corruption issue was addressed with improved validation.Apple macOS
- CVE-2024-23299The issue was addressed with improved checks.Apple macOS
- CVE-2024-5597Fuji Electric Monitouch V-SFT Type ConfusionFuji Electric Monitouch V-SFT
- CVE-2024-35754WordPress Ovic Importer plugin <= 1.6.3 - Arbitrary File Download vulnerabilityOvic Team Ovic Importer
- CVE-2024-35745WordPress Strategery Migrations plugin <= 1.0 - Arbitrary File Deletion vulnerabilityGabriel Somoza / Joseph Fitzgibbons Strategery Migrations
- CVE-2024-35744WordPress Upunzipper plugin <= 1.0.0 - Arbitrary File Deletion vulnerabilityRavidhu Dissanayake Upunzipper
- CVE-2024-35743WordPress SC filechecker plugin <= 0.6 - Arbitrary File Deletion vulnerabilitySiteclean SC filechecker
- CVE-2024-5102Elevation of Privelage via symlinked file in Avast AntivirusAvast Antivirus
- CVE-2024-35658WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerabilityThemeHigh Checkout Field Editor for WooCommerce
- CVE-2024-34800WordPress Crafthemes Demo Import plugin <= 3.3 - Arbitrary plugin Installation vulnerabilityCrafthemes Demo Import
- CVE-2024-34761Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerabilityWPENGINE Advanced Custom Fields PRO
- CVE-2024-36972af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.Linux
- CVE-2024-35306OS Command injection in Ajax PHP files through HTTP RequestPandora FMS
- CVE-2024-35305Unauth Time-Based SQL Injection via APIPandora FMS
- CVE-2024-5785Command injection vulnerability in Comtrend routerComtrend WLD71-T1_v2.0.201820
- CVE-2024-36971net: fix __dst_negative_advice() raceLinux
- CVE-2024-26507An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to esc
- CVE-2024-34332An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent t
- CVE-2024-36528nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /adnukeviet/nukeviet
- CVE-2024-37014Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and plangflow
- CVE-2024-37880The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a tim
Medium, low and unrated 71
- CVE-2024-22261SQL Injection in Harbor scan log APIHarbor · github.com/goharbor/harbor
- CVE-2024-22244Harbor Open Redirect URLHarbor · github.com/goharbor/harbor
- CVE-2022-37020HP PC BIOS May 2024 Security Updates for Potential Stack Buffer OverflowsHP PC products
- CVE-2022-37019HP PC BIOS May 2024 Security Updates for Potential Stack Buffer OverflowsHP PC products
- CVE-2024-37169@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapperjasonraimondi url-to-png · @jmondi/url-to-png
- CVE-2024-37168@grpc/grpc-js can allocate memory for incoming messages well above configured limitsgrpc-node · @grpc/grpc-js
- CVE-2024-36473Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to loTrend Micro VPN Proxy One Pro
- CVE-2024-36359A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to esTrend Micro InterScan Web Security Virtual Appliance
- CVE-2024-36307A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose senTrend Micro Apex One
- CVE-2024-36306A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to cTrend Micro Apex One
- CVE-2024-36419SuiteCRM-Core Host Header Injection in /legacy salesagility SuiteCRM-Core
- CVE-2024-27830This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-27806This issue was addressed with improved environment sanitization.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-27807The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2024-27850This issue was addressed with improvements to the noise injection algorithm.Apple Safari · Apple iOS and iPadOS +2
- CVE-2024-27885This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2024-27814This issue was addressed through improved state management.Apple watchOS
- CVE-2024-27838The issue was addressed by adding additional logic.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-23251An authentication issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-27819The issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS
- CVE-2024-27815An out-of-bounds write issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-27799This issue was addressed with additional entitlement checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-27845A privacy issue was addressed with improved handling of temporary files.Apple iOS and iPadOS
- CVE-2024-23282The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-27805An issue was addressed with improved validation of environment variables.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-36417SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFramesalesagility SuiteCRM
- CVE-2024-22279GoRouter Denial of Service AttackCloud Foundry Routing Release
- CVE-2022-32933An information disclosure issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2023-40389The issue was addressed with improved restriction of data container access.Apple macOS
- CVE-2024-27792This issue was addressed by adding an additional prompt for user consent.Apple macOS
- CVE-2024-3850Uniview NVR301-04S2-P4 Cross-site ScriptingUniview NVR301-04S2-P4
- CVE-2024-35749WordPress Under Construction / Maintenance Mode from Acurax plugin <= 2.6 - IP Bypass vulnerabilityUnder Construction / Maintenance Mode from Acurax
- CVE-2024-36407SuiteCRM unauthenticated user password reset on php7salesagility SuiteCRM
- CVE-2024-35747WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerabilitywpdevart Contact Form Builder, Contact Widget
- CVE-2024-35728WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerabilityThemeisle PPOM for WooCommerce
- CVE-2024-35712WordPress Database Cleaner: Clean, Optimize & Repair plugin <= 1.0.5 - Arbitrary File Read vulnerabilityJordy Meow Database Cleaner
- CVE-2024-35680WordPress YITH WooCommerce Product Add-Ons plugin <= 4.9.2 - Content Injection vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
- CVE-2024-35650WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerabilityMelaPress Login Security
- CVE-2024-36406SuiteCRM vulnerable to open redirectssalesagility SuiteCRM
- CVE-2024-4403CSRF in restart_program in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-36405Control-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other optionsopen-quantum-safe liboqs
- CVE-2024-5786Cross-Site Request Forgery vulnerability in Comtrend routerComtrend WLD71-T1_v2.0.201820
- CVE-2024-28833Missing brute-force protection for two factor authenticationCheckmk
- CVE-2024-4744WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerabilityAvirtum iPages Flipbook
- CVE-2024-4745WordPress Giveaways and Contests by RafflePress plugin <= 1.12.4 - Broken Access Control vulnerabilityGiveaways and Contests by RafflePress
- CVE-2024-22296WordPress 12 Step Meeting List plugin <= 3.14.28 - Broken Access Control vulnerabilityCode for Recovery 12 Step Meeting List
- CVE-2024-22298WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerabilityTMS Amelia
- CVE-2024-21751WordPress RabbitLoader plugin <= 2.19.13 - Broken Access Control vulnerabilityRabbitLoader
- CVE-2024-23524WordPress PilotPress plugin <= 2.0.30 - Broken Access Control vulnerabilityONTRAPORT PilotPress
- CVE-2024-4746WordPress Netgsm plugin <= 2.9.32 - Broken Access Control + CSRF vulnerabilityNetgsm
- CVE-2024-35717WordPress Media Slider plugin <= 1.3.9 - Broken Access Control vulnerabilityA WP Life Media Slider – Photo Sleder, Video Slider, Link S…
- CVE-2024-35720WordPress Album Gallery – WordPress Gallery plugin <= 1.5.7 - Broken Access Control vulnerabilityA WP Life Album Gallery – WordPress Gallery
- CVE-2024-35721WordPress Image Gallery plugin <= 1.4.5 - Broken Access Control vulnerabilityA WP Life Image Gallery – Lightbox Gallery, Responsive Phot…
- CVE-2024-35722WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.4.0 - Broken Access Control vulnerabilityA WP Life Slider Responsive Slideshow – Image slider, Galle…
- CVE-2024-35723WordPress Dashboard To-Do List plugin <= 1.2.0 - Broken Access Control vulnerabilityAndrew Dashboard To-Do List
- CVE-2024-35724WordPress Bosa Elementor Addons and Templates for WooCommerce plugin <= 1.0.12 - Broken Access Control vulnerabilityBosa Themes Bosa Elementor Addons and Templates for WooComm…
- CVE-2024-35725WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.6 - Broken Access Control vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2024-35726WordPress WooBuddy plugin <= 3.4.19 - Broken Access Control vulnerabilityThemeKraft WooBuddy
- CVE-2024-35727WordPress Extra Product Options for WooCommerce plugin <= 3.0.6 - Broken Access Control vulnerabilityactpro Extra Product Options for WooCommerce
- CVE-2024-35729WordPress Tickera plugin <= 3.5.2.6 - Broken Access Control vulnerabilityTickera
- CVE-2024-35735WordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerabilityCodePeople WP Time Slots Booking Form
- CVE-2024-35741WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerabilityAwesome Support Team Awesome Support
- CVE-2024-35742WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Broken Access Control vulnerabilityCode Parrots Easy Forms for Mailchimp
- CVE-2024-4328CSRF in clear_personality_files_list in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2022-45168An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2022-45176An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2024-31612Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access adminis
- CVE-2024-31613BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head_code" or name="foot_code."
- CVE-2024-33850Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room.
- CVE-2024-35474A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server,
- CVE-2024-36531nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.