# CVEs published 2024-06-10 146 CVEs were published on June 10, 2024: 21 critical, 54 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2024-22261](https://cve.now/CVE-2024-22261.md): SQL Injection in Harbor scan log API (CVSS 2.7, Harbor · github.com/goharbor/harbor) - [CVE-2024-22244](https://cve.now/CVE-2024-22244.md): Harbor Open Redirect URL (CVSS 4.3, Harbor · github.com/goharbor/harbor) - [CVE-2022-37020](https://cve.now/CVE-2022-37020.md): HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows (CVSS 6.8, HP PC products) - [CVE-2022-37019](https://cve.now/CVE-2022-37019.md): HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows (CVSS 6.8, HP PC products) - [CVE-2024-36471](https://cve.now/CVE-2024-36471.md): Apache Allura: sensitive information exposure via DNS rebinding (CVSS 7.5, Apache Software Foundation Apache Allura) - [CVE-2024-37169](https://cve.now/CVE-2024-37169.md): @jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper (CVSS 5.3, jasonraimondi url-to-png · @jmondi/url-to-png) - [CVE-2024-37168](https://cve.now/CVE-2024-37168.md): @grpc/grpc-js can allocate memory for incoming messages well above configured limits (CVSS 5.3, grpc-node · @grpc/grpc-js) - [CVE-2024-37166](https://cve.now/CVE-2024-37166.md): ghtml Cross-Site Scripting (XSS) vulnerability (CVSS 8.9, gurgunday ghtml · ghtml) - [CVE-2024-35242](https://cve.now/CVE-2024-35242.md): Composer vulnerable to command injection via malicious git/hg branch names (CVSS 8.8, composer · composer/composer) - [CVE-2024-37289](https://cve.now/CVE-2024-37289.md): An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installatio (CVSS 7.8, Trend Micro Apex One) - [CVE-2024-36473](https://cve.now/CVE-2024-36473.md): Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to lo (CVSS 5.3, Trend Micro VPN Proxy One Pro) - [CVE-2024-36359](https://cve.now/CVE-2024-36359.md): A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to es (CVSS 5.4, Trend Micro InterScan Web Security Virtual Appliance) - [CVE-2024-36358](https://cve.now/CVE-2024-36358.md): A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate pri (CVSS 7.8, Trend Micro Deep Security Agent) - [CVE-2024-36307](https://cve.now/CVE-2024-36307.md): A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sen (CVSS 4.7, Trend Micro Apex One) - [CVE-2024-36306](https://cve.now/CVE-2024-36306.md): A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to c (CVSS 6.1, Trend Micro Apex One) - [CVE-2024-36305](https://cve.now/CVE-2024-36305.md): A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal (CVSS 7.8, Trend Micro Apex One) - [CVE-2024-36304](https://cve.now/CVE-2024-36304.md): A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escala (CVSS 7.8, Trend Micro Apex One) - [CVE-2024-36303](https://cve.now/CVE-2024-36303.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One) - [CVE-2024-36302](https://cve.now/CVE-2024-36302.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One) - [CVE-2024-35241](https://cve.now/CVE-2024-35241.md): Composer vulnerable to command injection via malicious git branch name (CVSS 8.8, composer · composer/composer) - [CVE-2024-32849](https://cve.now/CVE-2024-32849.md): Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentiona (CVSS 7.8, Trend Micro Maximum Security) - [CVE-2024-36419](https://cve.now/CVE-2024-36419.md): SuiteCRM-Core Host Header Injection in /legacy (CVSS 4.3, salesagility SuiteCRM-Core) - [CVE-2024-27830](https://cve.now/CVE-2024-27830.md): This issue was addressed through improved state management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2024-27851](https://cve.now/CVE-2024-27851.md): The issue was addressed with improved bounds checks. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2024-27806](https://cve.now/CVE-2024-27806.md): This issue was addressed with improved environment sanitization. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-27811](https://cve.now/CVE-2024-27811.md): The issue was addressed with improved checks. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2024-27807](https://cve.now/CVE-2024-27807.md): The issue was addressed with improved checks. (CVSS 4.3, Apple iOS and iPadOS) - [CVE-2024-27850](https://cve.now/CVE-2024-27850.md): This issue was addressed with improvements to the noise injection algorithm. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2024-27885](https://cve.now/CVE-2024-27885.md): This issue was addressed with improved validation of symlinks. (CVSS 6.3, Apple macOS) - [CVE-2024-27831](https://cve.now/CVE-2024-27831.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-27857](https://cve.now/CVE-2024-27857.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-27800](https://cve.now/CVE-2024-27800.md): This issue was addressed by removing the vulnerable code. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2024-27836](https://cve.now/CVE-2024-27836.md): The issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1) - [CVE-2024-27820](https://cve.now/CVE-2024-27820.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2024-27840](https://cve.now/CVE-2024-27840.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2024-27817](https://cve.now/CVE-2024-27817.md): The issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-27801](https://cve.now/CVE-2024-27801.md): The issue was addressed with improved checks. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2024-27814](https://cve.now/CVE-2024-27814.md): This issue was addressed through improved state management. (CVSS 2.4, Apple watchOS) - [CVE-2024-27802](https://cve.now/CVE-2024-27802.md): An out-of-bounds read was addressed with improved input validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-27855](https://cve.now/CVE-2024-27855.md): The issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS) - [CVE-2024-27838](https://cve.now/CVE-2024-27838.md): The issue was addressed by adding additional logic. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2024-23251](https://cve.now/CVE-2024-23251.md): An authentication issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS · Apple macOS +1) - [CVE-2024-27819](https://cve.now/CVE-2024-27819.md): The issue was addressed by restricting options offered on a locked device. (CVSS 2.4, Apple iOS and iPadOS) - [CVE-2024-27815](https://cve.now/CVE-2024-27815.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 5.9, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2024-27799](https://cve.now/CVE-2024-27799.md): This issue was addressed with additional entitlement checks. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS) - [CVE-2024-27808](https://cve.now/CVE-2024-27808.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +4) - [CVE-2024-27832](https://cve.now/CVE-2024-27832.md): The issue was addressed with improved checks. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS +3) - [CVE-2024-27845](https://cve.now/CVE-2024-27845.md): A privacy issue was addressed with improved handling of temporary files. (CVSS 3.3, Apple iOS and iPadOS) - [CVE-2024-27812](https://cve.now/CVE-2024-27812.md): A logic issue was addressed with improved file handling. (CVSS 7.5, Apple visionOS) - [CVE-2024-23282](https://cve.now/CVE-2024-23282.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1) - [CVE-2024-27828](https://cve.now/CVE-2024-27828.md): The issue was addressed with improved memory handling. (CVSS 7.0, Apple iOS and iPadOS · Apple tvOS +2) - [CVE-2024-27805](https://cve.now/CVE-2024-27805.md): An issue was addressed with improved validation of environment variables. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2) - [CVE-2024-27844](https://cve.now/CVE-2024-27844.md): The issue was addressed with improved checks. (CVSS 9.1, Apple Safari · Apple macOS +1) - [CVE-2024-27833](https://cve.now/CVE-2024-27833.md): An integer overflow was addressed with improved input validation. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +2) - [CVE-2024-27848](https://cve.now/CVE-2024-27848.md): This issue was addressed with improved permissions checking. (CVSS 7.4, Apple iOS and iPadOS · Apple macOS) - [CVE-2024-36418](https://cve.now/CVE-2024-36418.md): SuiteCRM authenticated RCE using connectors (CVSS 8.6, salesagility SuiteCRM) - [CVE-2024-36416](https://cve.now/CVE-2024-36416.md): SuiteCRM v4 API Excessive log data DOS (CVSS 8.6, salesagility SuiteCRM) - [CVE-2024-36417](https://cve.now/CVE-2024-36417.md): SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame (CVSS 5.7, salesagility SuiteCRM) - [CVE-2024-36415](https://cve.now/CVE-2024-36415.md): SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution (CVSS 9.1, salesagility SuiteCRM) - [CVE-2024-22279](https://cve.now/CVE-2024-22279.md): GoRouter Denial of Service Attack (CVSS 5.9, Cloud Foundry Routing Release) - [CVE-2024-36414](https://cve.now/CVE-2024-36414.md): SuiteCRM authenticated Server-Side Request Forgery (CVSS 7.7, salesagility SuiteCRM) - [CVE-2024-36413](https://cve.now/CVE-2024-36413.md): SuiteCRM authenticated Reflected Cross-Site Scripting (CVSS 8.9, salesagility SuiteCRM) - [CVE-2024-36412](https://cve.now/CVE-2024-36412.md): SuiteCRM unauthenticated SQL Injection (CVSS 10.0, salesagility SuiteCRM) - [CVE-2024-36411](https://cve.now/CVE-2024-36411.md): SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller (CVSS 9.6, salesagility SuiteCRM) - [CVE-2022-48578](https://cve.now/CVE-2022-48578.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 7.1, Apple macOS) - [CVE-2022-32933](https://cve.now/CVE-2022-32933.md): An information disclosure issue was addressed by removing the vulnerable code. (CVSS 5.3, Apple macOS) - [CVE-2022-48683](https://cve.now/CVE-2022-48683.md): An access issue was addressed with additional sandbox restrictions. (CVSS 8.6, Apple macOS) - [CVE-2023-40389](https://cve.now/CVE-2023-40389.md): The issue was addressed with improved restriction of data container access. (CVSS 5.5, Apple macOS) - [CVE-2022-32897](https://cve.now/CVE-2022-32897.md): A memory corruption issue was addressed with improved validation. (CVSS 8.1, Apple macOS) - [CVE-2024-27792](https://cve.now/CVE-2024-27792.md): This issue was addressed by adding an additional prompt for user consent. (CVSS 5.5, Apple macOS) - [CVE-2024-23299](https://cve.now/CVE-2024-23299.md): The issue was addressed with improved checks. (CVSS 8.6, Apple macOS) - [CVE-2024-36410](https://cve.now/CVE-2024-36410.md): SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller (CVSS 9.6, salesagility SuiteCRM) - [CVE-2024-36409](https://cve.now/CVE-2024-36409.md): SuiteCRM authenticated SQL Injection in TreeData entrypoint (CVSS 9.6, salesagility SuiteCRM) - [CVE-2024-5597](https://cve.now/CVE-2024-5597.md): Fuji Electric Monitouch V-SFT Type Confusion (CVSS 7.8, Fuji Electric Monitouch V-SFT) - [CVE-2024-3850](https://cve.now/CVE-2024-3850.md): Uniview NVR301-04S2-P4 Cross-site Scripting (CVSS 5.4, Uniview NVR301-04S2-P4) - [CVE-2024-36408](https://cve.now/CVE-2024-36408.md): SuiteCRM authenticated SQL Injection in Alerts (CVSS 9.6, salesagility SuiteCRM) - [CVE-2024-35754](https://cve.now/CVE-2024-35754.md): WordPress Ovic Importer plugin \<= 1.6.3 - Arbitrary File Download vulnerability (CVSS 7.5, Ovic Team Ovic Importer) - [CVE-2024-35749](https://cve.now/CVE-2024-35749.md): WordPress Under Construction / Maintenance Mode from Acurax plugin \<= 2.6 - IP Bypass vulnerability (CVSS 3.7, Under Construction / Maintenance Mode from Acurax) - [CVE-2024-36407](https://cve.now/CVE-2024-36407.md): SuiteCRM unauthenticated user password reset on php7 (CVSS 3.7, salesagility SuiteCRM) - [CVE-2024-35747](https://cve.now/CVE-2024-35747.md): WordPress Contact Form Builder, Contact Widget plugin \<= 2.1.7 - Bypass Vulnerability vulnerability (CVSS 5.3, wpdevart Contact Form Builder, Contact Widget) - [CVE-2024-35746](https://cve.now/CVE-2024-35746.md): WordPress BuddyPress Cover plugin \<= 2.1.4.2 - Arbitrary File Upload vulnerability (CVSS 10.0, Asghar Hatampoor BuddyPress Cover) - [CVE-2024-35745](https://cve.now/CVE-2024-35745.md): WordPress Strategery Migrations plugin \<= 1.0 - Arbitrary File Deletion vulnerability (CVSS 7.5, Gabriel Somoza / Joseph Fitzgibbons Strategery Migrations) - [CVE-2024-35744](https://cve.now/CVE-2024-35744.md): WordPress Upunzipper plugin \<= 1.0.0 - Arbitrary File Deletion vulnerability (CVSS 8.6, Ravidhu Dissanayake Upunzipper) - [CVE-2024-35743](https://cve.now/CVE-2024-35743.md): WordPress SC filechecker plugin \<= 0.6 - Arbitrary File Deletion vulnerability (CVSS 8.6, Siteclean SC filechecker) - [CVE-2024-35728](https://cve.now/CVE-2024-35728.md): WordPress Product Addons & Fields for WooCommerce plugin \<= 32.0.20 - Content Injection vulnerability (CVSS 5.3, Themeisle PPOM for WooCommerce) - [CVE-2024-5102](https://cve.now/CVE-2024-5102.md): Elevation of Privelage via symlinked file in Avast Antivirus (CVSS 7.3, Avast Antivirus) - [CVE-2024-37051](https://cve.now/CVE-2024-37051.md): GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023 (CVSS 9.3, JetBrains IntelliJ IDEA · JetBrains Aqua +11) - [CVE-2024-35712](https://cve.now/CVE-2024-35712.md): WordPress Database Cleaner: Clean, Optimize & Repair plugin \<= 1.0.5 - Arbitrary File Read vulnerability (CVSS 4.9, Jordy Meow Database Cleaner) - [CVE-2024-35680](https://cve.now/CVE-2024-35680.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.9.2 - Content Injection vulnerability (CVSS 5.3, YITHEMES YITH WooCommerce Product Add-Ons) - [CVE-2024-35677](https://cve.now/CVE-2024-35677.md): WordPress MegaMenu plugin \<= 2.3.12 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, StylemixThemes MegaMenu) - [CVE-2024-35658](https://cve.now/CVE-2024-35658.md): WordPress Checkout Field Editor for WooCommerce (Pro) plugin \<= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerability (CVSS 8.6, ThemeHigh Checkout Field Editor for WooCommerce) - [CVE-2024-35650](https://cve.now/CVE-2024-35650.md): WordPress MelaPress Login Security plugin \<= 1.3.0 - Remote File Inclusion vulnerability (CVSS 4.9, MelaPress Login Security) - [CVE-2024-34800](https://cve.now/CVE-2024-34800.md): WordPress Crafthemes Demo Import plugin \<= 3.3 - Arbitrary plugin Installation vulnerability (CVSS 7.6, Crafthemes Demo Import) - [CVE-2024-34762](https://cve.now/CVE-2024-34762.md): Wordpress Advanced Custom Fields Pro plugin \< 6.2.10 - Contributor+ Local File Inclusion vulnerability (CVSS 9.9, WPENGINE Advanced Custom Fields PRO) - [CVE-2024-34761](https://cve.now/CVE-2024-34761.md): Wordpress Advanced Custom Fields Pro plugin \< 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability (CVSS 8.5, WPENGINE Advanced Custom Fields PRO) - [CVE-2024-36406](https://cve.now/CVE-2024-36406.md): SuiteCRM vulnerable to open redirects (CVSS 5.4, salesagility SuiteCRM) - [CVE-2024-36972](https://cve.now/CVE-2024-36972.md): af\_unix: Update unix\_sk(sk)-\>oob\_skb under sk\_receive\_queue lock. (CVSS 7.8, Linux) - [CVE-2024-4403](https://cve.now/CVE-2024-4403.md): CSRF in restart\_program in parisneo/lollms-webui (CVSS 4.4, parisneo/lollms-webui) - [CVE-2024-35307](https://cve.now/CVE-2024-35307.md): Argument Injection Leading to Remote Code Execution in Realtime Graph Extension (CVSS 9.4, Pandora FMS) - [CVE-2024-35306](https://cve.now/CVE-2024-35306.md): OS Command injection in Ajax PHP files through HTTP Request (CVSS 8.7, Pandora FMS) - [CVE-2024-35305](https://cve.now/CVE-2024-35305.md): Unauth Time-Based SQL Injection via API (CVSS 8.9, Pandora FMS) - [CVE-2024-35304](https://cve.now/CVE-2024-35304.md): System command injection through Netflow function (CVSS 9.3, Pandora FMS) - [CVE-2024-36405](https://cve.now/CVE-2024-36405.md): Control-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other options (CVSS 5.9, open-quantum-safe liboqs) - [CVE-2024-5786](https://cve.now/CVE-2024-5786.md): Cross-Site Request Forgery vulnerability in Comtrend router (CVSS 6.5, Comtrend WLD71-T1\_v2.0.201820) - [CVE-2024-5785](https://cve.now/CVE-2024-5785.md): Command injection vulnerability in Comtrend router (CVSS 8.0, Comtrend WLD71-T1\_v2.0.201820) - [CVE-2024-28833](https://cve.now/CVE-2024-28833.md): Missing brute-force protection for two factor authentication (CVSS 5.9, Checkmk) - [CVE-2024-3700](https://cve.now/CVE-2024-3700.md): Hardcoded password in Estomed Sp. z o.o. Simple Care software (CVSS 9.3, Estomed Sp. z o.o. Simple Care) - [CVE-2024-3699](https://cve.now/CVE-2024-3699.md): Hardcoded password in drEryk Gabinet (CVSS 9.3, drEryk sp. z o.o. drEryk Gabinet) - [CVE-2024-1228](https://cve.now/CVE-2024-1228.md): Hardcoded password in Eurosoft Przychodnia (CVSS 9.3, EuroSoft Sp. z o. o. Eurosoft Przychodnia) - [CVE-2024-36971](https://cve.now/CVE-2024-36971.md): net: fix \_\_dst\_negative\_advice() race (CVSS 7.8, KEV, Linux) - [CVE-2024-4744](https://cve.now/CVE-2024-4744.md): WordPress iPages Flipbook plugin \<= 1.5.1 - Broken Access Control vulnerability (CVSS 5.3, Avirtum iPages Flipbook) - [CVE-2024-4745](https://cve.now/CVE-2024-4745.md): WordPress Giveaways and Contests by RafflePress plugin \<= 1.12.4 - Broken Access Control vulnerability (CVSS 4.3, Giveaways and Contests by RafflePress) - [CVE-2024-22296](https://cve.now/CVE-2024-22296.md): WordPress 12 Step Meeting List plugin \<= 3.14.28 - Broken Access Control vulnerability (CVSS 4.3, Code for Recovery 12 Step Meeting List) - [CVE-2024-22298](https://cve.now/CVE-2024-22298.md): WordPress Amelia plugin \<= 1.0.98 - Broken Access Control vulnerability (CVSS 5.3, TMS Amelia) - [CVE-2024-21751](https://cve.now/CVE-2024-21751.md): WordPress RabbitLoader plugin \<= 2.19.13 - Broken Access Control vulnerability (CVSS 5.4, RabbitLoader) - [CVE-2024-23524](https://cve.now/CVE-2024-23524.md): WordPress PilotPress plugin \<= 2.0.30 - Broken Access Control vulnerability (CVSS 5.3, ONTRAPORT PilotPress) - [CVE-2024-4746](https://cve.now/CVE-2024-4746.md): WordPress Netgsm plugin \<= 2.9.32 - Broken Access Control + CSRF vulnerability (CVSS 4.3, Netgsm) - [CVE-2024-35717](https://cve.now/CVE-2024-35717.md): WordPress Media Slider plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 4.3, A WP Life Media Slider – Photo Sleder, Video Slider, Link S…) - [CVE-2024-35720](https://cve.now/CVE-2024-35720.md): WordPress Album Gallery – WordPress Gallery plugin \<= 1.5.7 - Broken Access Control vulnerability (CVSS 4.3, A WP Life Album Gallery – WordPress Gallery) - [CVE-2024-35721](https://cve.now/CVE-2024-35721.md): WordPress Image Gallery plugin \<= 1.4.5 - Broken Access Control vulnerability (CVSS 4.3, A WP Life Image Gallery – Lightbox Gallery, Responsive Phot…) - [CVE-2024-35722](https://cve.now/CVE-2024-35722.md): WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3, A WP Life Slider Responsive Slideshow – Image slider, Galle…) - [CVE-2024-35723](https://cve.now/CVE-2024-35723.md): WordPress Dashboard To-Do List plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 4.3, Andrew Dashboard To-Do List) - [CVE-2024-35724](https://cve.now/CVE-2024-35724.md): WordPress Bosa Elementor Addons and Templates for WooCommerce plugin \<= 1.0.12 - Broken Access Control vulnerability (CVSS 4.3, Bosa Themes Bosa Elementor Addons and Templates for WooComm…) - [CVE-2024-35725](https://cve.now/CVE-2024-35725.md): WordPress LA-Studio Element Kit for Elementor plugin \<= 1.3.6 - Broken Access Control vulnerability (CVSS 4.3, LA-Studio Element Kit for Elementor) - [CVE-2024-35726](https://cve.now/CVE-2024-35726.md): WordPress WooBuddy plugin \<= 3.4.19 - Broken Access Control vulnerability (CVSS 4.3, ThemeKraft WooBuddy) - [CVE-2024-35727](https://cve.now/CVE-2024-35727.md): WordPress Extra Product Options for WooCommerce plugin \<= 3.0.6 - Broken Access Control vulnerability (CVSS 4.3, actpro Extra Product Options for WooCommerce) - [CVE-2024-35729](https://cve.now/CVE-2024-35729.md): WordPress Tickera plugin \<= 3.5.2.6 - Broken Access Control vulnerability (CVSS 5.3, Tickera) - [CVE-2024-35735](https://cve.now/CVE-2024-35735.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.11 - Broken Access Control vulnerability (CVSS 5.3, CodePeople WP Time Slots Booking Form) - [CVE-2024-35741](https://cve.now/CVE-2024-35741.md): WordPress Awesome Support plugin \<= 6.1.7 - Broken Access Control vulnerability (CVSS 4.3, Awesome Support Team Awesome Support) - [CVE-2024-35742](https://cve.now/CVE-2024-35742.md): WordPress Easy Forms for Mailchimp plugin \<= 6.9.0 - Broken Access Control vulnerability (CVSS 5.3, Code Parrots Easy Forms for Mailchimp) - [CVE-2024-4328](https://cve.now/CVE-2024-4328.md): CSRF in clear\_personality\_files\_list in parisneo/lollms-webui (CVSS 4.0, parisneo/lollms-webui) - [CVE-2022-45168](https://cve.now/CVE-2022-45168.md): An issue was discovered in LIVEBOX Collaboration vDesk through v018. (CVSS 6.5) - [CVE-2022-45176](https://cve.now/CVE-2022-45176.md): An issue was discovered in LIVEBOX Collaboration vDesk through v018. (CVSS 6.1) - [CVE-2024-26507](https://cve.now/CVE-2024-26507.md): An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to esc (CVSS 7.8) - [CVE-2024-31611](https://cve.now/CVE-2024-31611.md): SeaCMS 12.9 has a file deletion vulnerability via admin\_template.php. (CVSS 9.1) - [CVE-2024-31612](https://cve.now/CVE-2024-31612.md): Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access adminis (CVSS 5.4) - [CVE-2024-31613](https://cve.now/CVE-2024-31613.md): BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name="head\_code" or name="foot\_code." (CVSS 5.4) - [CVE-2024-32167](https://cve.now/CVE-2024-32167.md): Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Arbitrary file deletion vulnerability as the backend settings have the f (CVSS 9.1) - [CVE-2024-33850](https://cve.now/CVE-2024-33850.md): Pexip Infinity before 34.1 has Improper Access Control for persons in a waiting room. (CVSS 4.3) - [CVE-2024-34332](https://cve.now/CVE-2024-34332.md): An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent t (CVSS 7.8) - [CVE-2024-35474](https://cve.now/CVE-2024-35474.md): A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, (CVSS 6.5) - [CVE-2024-36528](https://cve.now/CVE-2024-36528.md): nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /ad (CVSS 8.8, nukeviet/nukeviet) - [CVE-2024-36531](https://cve.now/CVE-2024-36531.md): nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload. (CVSS 5.7) - [CVE-2024-37014](https://cve.now/CVE-2024-37014.md): Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom\_component" endpoint and p (CVSS 8.8, langflow) - [CVE-2024-37393](https://cve.now/CVE-2024-37393.md): Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. (CVSS 9.8) - [CVE-2024-37880](https://cve.now/CVE-2024-37880.md): The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a tim (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-06-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.