CVEs published June 11, 2024
226 CVEs were published on June 11, 2024: 14 critical, 81 high. 2 are now in CISA KEV.
- Published
- 226
- Critical
- 14
- High
- 81
- Medium
- 126
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 113
Most affected products
- Microsoft Windows
- 28
- Google Chrome
- 18
- Cybozu Garoon
- 8
- Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- 8
- Mozilla Firefox
- 8
- Mozilla Firefox · Mozilla Thunderbird
- 8
- Siemens SINEC Traffic Analyzer
- 7
- hiroaki-miyashita Custom Field Template
- 4
- aimeos-core · aimeos/aimeos-core
- 2
- BeyondTrust BeyondInsight PasswordSafe
- 2
Critical 14
- CVE-2024-35225Jupyter Server Proxy has a reflected XSS issue in host parameterjupyterhub jupyter-server-proxy · jupyter-server-proxy
- CVE-2024-35213Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)BlackBerry QNX Software Development Platform
- CVE-2024-30080Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-2012vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or codHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-2013An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers withouHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-5701Memory safety bugs present in Firefox 126.Mozilla Firefox
- CVE-2024-5699In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be Mozilla Firefox
- CVE-2024-5695If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been tMozilla Firefox
- CVE-2024-36266A vulnerability has been identified in PowerSys (All versions < V3.11).Siemens PowerSys
- CVE-2024-3549Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injectionpr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2024-31401Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege Cybozu Garoon
- CVE-2024-36360OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier.Keisuke Nakayama awkblog
- CVE-2024-29855Hard-coded JWT secret allows authentication bypass in Veeam Recovery OrchestratorVeeam Recovery Orchestrator
- CVE-2024-34405Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL
High 81
- CVE-2024-5847Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2024-5846Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2024-5845Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-5844Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read Google Chrome
- CVE-2024-5843Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a mGoogle Chrome
- CVE-2024-5842Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UIGoogle Chrome
- CVE-2024-5841Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-5839Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heGoogle Chrome
- CVE-2024-5838Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted Google Chrome
- CVE-2024-5837Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viGoogle Chrome
- CVE-2024-5836Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicGoogle Chrome
- CVE-2024-5833Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access viGoogle Chrome
- CVE-2024-5832Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2024-5831Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2024-5830Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafteGoogle Chrome
- CVE-2024-33606MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL SchemeMicroDicom DICOM Viewer
- CVE-2024-28877MicroDicom DICOM Viewer Stack-based Buffer OverflowMicroDicom DICOM Viewer
- CVE-2023-4727Ca: token authentication bypass vulnerabilitykeycloak · Red Hat Certificate System 10.4 EUS for RHEL-8 +1
- CVE-2024-37301document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injectionadfinis document-merge-service · document-merge-service
- CVE-2024-28020A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management.Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-4190OpenText ArcSight Logger Stored XSSOpenText ArcSight Logger
- CVE-2024-37325Azure Science Virtual Machine (DSVM) Elevation of Privilege VulnerabilityMicrosoft Azure Data Science Virtual Machines
- CVE-2024-35265Windows Perception Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-35254Azure Monitor Agent Elevation of Privilege VulnerabilityMicrosoft Azure Monitor
- CVE-2024-35252Azure Storage Movement Client Library Denial of Service VulnerabilityMicrosoft Azure Storage · Microsoft.Azure.Storage.DataMovem…
- CVE-2024-35249Microsoft Dynamics 365 Business Central Remote Code Execution VulnerabilityMicrosoft Dynamics 365 Business Central 2023 Release Wave ·…
- CVE-2024-35248Microsoft Dynamics 365 Business Central Elevation of Privilege VulnerabilityMicrosoft Dynamics 365 Business Central 2023 Release Wave ·…
- CVE-2024-30104Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2024-30103Microsoft Outlook Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office +1
- CVE-2024-30102Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2024-30101Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2024-30100Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-30099Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30097Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30095Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30094Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30093Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30091Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30090Microsoft Streaming Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30089Microsoft Streaming Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30088Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30087Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30086Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30085Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30084Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30083Windows Standards-Based Storage Management Service Denial of Service VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2024-30068Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30064Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2024-30062Windows Standards-Based Storage Management Service Remote Code Execution VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2024-35250Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30082Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30078Windows Wi-Fi Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30077Windows OLE Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30075Windows Link Layer Topology Discovery Protocol Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsoft W…
- CVE-2024-30074Windows Link Layer Topology Discovery Protocol Remote Code Execution VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsoft W…
- CVE-2024-30072Microsoft Event Trace Log File Parsing Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30070DHCP Server Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-37293aws-deployment-framework's potential risk can lead to privilege escalationawslabs aws-deployment-framework
- CVE-2023-52233WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerabilityPost SMTP Mailer/Email Log
- CVE-2024-24703WordPress MultiVendorX plugin <= 4.0.25 - Broken Access Control vulnerabilityMultiVendorX WC Marketplace
- CVE-2024-37295Aimeos Core remote code execution in web server contextaimeos-core · aimeos/aimeos-core
- CVE-2024-23110A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.Fortinet FortiOS
- CVE-2024-28021A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation.Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-2011A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but canHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-5694An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap.Mozilla Firefox
- CVE-2024-5700Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-5696By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-5688If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-5702Memory corruption in the networking stack could have led to a potentially exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-35303A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0012), Tecnomatix Plant Simulation V2404 (AllSiemens Tecnomatix Plant Simulation
- CVE-2024-35292A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ESSiemens SIMATIC S7-200 SMART CPU CR40 · Siemens SIMATIC… +8
- CVE-2024-35207A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).Siemens SINEC Traffic Analyzer
- CVE-2024-35206A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).Siemens SINEC Traffic Analyzer
- CVE-2023-25799WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilitiesThemeum Tutor LMS
- CVE-2023-7264Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanismhakeemnala Build App Online
- CVE-2024-34688Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)SAP_SE SAP NetWeaver AS Java
- CVE-2024-37177Cross-Site Scripting (XSS) vulnerabilities in SAP Financial ConsolidationSAP_SE SAP Financial Consolidation
- CVE-2024-37130Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking.Dell OpenManage Server Administrator
- CVE-2024-36650TOTOLINK AC1200 Wireless Dual Band Gigabit Router firmware A3100R V4.1.2cu.5247_B20211129, in the cgi function `setNoticeCfg` of the file `/
- CVE-2024-36702libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder_encodeLength function at /asn1/ber_encoder.c.
- CVE-2024-36821Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.
Medium, low and unrated 131
- CVE-2024-5840Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a craftedGoogle Chrome
- CVE-2024-5835Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2024-5834Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a craftGoogle Chrome
- CVE-2024-4669Events Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsnicheaddons Events Addon for Elementor
- CVE-2024-5646Futurio Extra <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widgetfuturiowp Futurio Extra
- CVE-2024-28024A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessibHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-28022A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authenticHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-5851playSMS SMS Schedule cross site scriptingplaySMS
- CVE-2024-23518WordPress ACF Photo Gallery Field plugin <= 2.6 - Broken Access Control vulnerabilityNavneil Naicker ACF Photo Gallery Field
- CVE-2024-32143WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerabilityPodlove Podcast Publisher
- CVE-2024-32146WordPress Aspose.Words – Import and Export word documents plugin <= 6.3.1 - Broken Access Control vulnerabilityAspose.cloud Marketplace Aspose.Words Exporter
- CVE-2024-30052Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio
- CVE-2024-35263Microsoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2024-35253Microsoft Azure File Sync Elevation of Privilege VulnerabilityMicrosoft Azure File Sync
- CVE-2024-30096Windows Cryptographic Services Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-30067Winlogon Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30066Winlogon Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30065Windows Themes Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-30063Windows Distributed File System (DFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29060Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2024-35255Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityMicrosoft Azure Identity Library · Microsoft Authenticat… +8
- CVE-2024-30076Windows Container Manager Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30069Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-34763WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.5 - Broken Access Control vulnerabilitySaleswonder Team: Tobias Builder for WooCommerce reviews sh…
- CVE-2024-34768WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerabilityFastly
- CVE-2024-34799WordPress BookingPress plugin <= 1.0.82 - Appointment Duration Manipulation vulnerabilityRepute Infosystems BookingPress
- CVE-2023-48273WordPress Preloader for Website plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerabilityWP OnlineSupport, Essential Plugin Preloader for Website
- CVE-2023-52227WordPress MailerLite – WooCommerce integration plugin <= 2.0.8 - Broken Access Control vulnerabilityMailerLite – WooCommerce integration
- CVE-2024-34804WordPress Tagembed plugin <= 5.8 - Broken Access Control vulnerabilityTagembed
- CVE-2024-34815WordPress Import and export users and customers plugin <= 1.26.5 - Broken Access Control vulnerabilityJavier Carazo Import and export users and customers
- CVE-2023-52224WordPress Revolut Gateway for WooCommerce plugin <= 4.9.7 - Broken Access Control vulnerabilityRevolut Gateway for WooCommerce
- CVE-2024-34758WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control vulnerabilityWpmet WP Fundraising Donation and Crowdfunding Platform
- CVE-2024-34819WordPress MC Woocommerce Wishlist plugin <= 1.7.2 - Broken Access Control vulnerabilityMoreconvert Team MC Woocommerce Wishlist
- CVE-2024-23503WordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerabilityWPManageNinja Ninja Tables
- CVE-2024-34821WordPress Contact List plugin <= 2.9.87 - Broken Access Control vulnerabilityAnssi Laitila Contact List
- CVE-2024-34753WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerabilitySoftLab Radio Player
- CVE-2023-51519WordPress Slider by Soliloquy – Responsive Image Slider for WordPress plugin <= 2.7.2 - Broken Access Control vulnerabilitySoliloquy Team Slider by Soliloquy
- CVE-2024-32144WordPress Welcart e-Commerce plugin <= 2.9.14 - Broken Access Control vulnerabilityWelcart e-Commerce
- CVE-2024-5812Smart Rule Overwrite Bypass in BeyondInsight PasswordSafeBeyondTrust BeyondInsight PasswordSafe
- CVE-2024-5813SSH Private Key Leak in BeyondInsight PasswordSafeBeyondTrust BeyondInsight PasswordSafe
- CVE-2024-23521WordPress Happyforms plugin <= 1.25.10 - Broken Access Control vulnerabilityHappyforms
- CVE-2023-51682WordPress MC4WP plugin <= 4.9.9 - Broken Access Control vulnerabilityibericode MC4WP
- CVE-2024-34822WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerabilityweDevs weMail
- CVE-2024-34826WordPress CF7 WOW Styler plugin <= 1.6.4 - Broken Access Control vulnerabilitySaleswonder Team: Tobias CF7 WOW Styler
- CVE-2024-34820WordPress If-So Dynamic Content Personalization plugin <= 1.7.1 - Broken Access Control vulnerabilityIf So Plugin If-So Dynamic Content Personalization
- CVE-2024-32148WordPress Pardot plugin <= 2.1.0 - Broken Access Control vulnerabilitySalesforce Pardot
- CVE-2024-37296Aimeos HTML client vulnerable to digital products download without proper payment status checkaimeos ai-client-html · aimeos/ai-client-html
- CVE-2024-35168WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerabilityWP Discourse
- CVE-2023-51498WordPress WooCommerce Canada Post Shipping plugin <= 2.8.3 - Broken Access Control vulnerabilityWooCommerce Canada Post Shipping
- CVE-2024-26010A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.Fortinet FortiOS · Fortinet FortiSwitchManager +2
- CVE-2024-21754A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all verFortinet FortiProxy · Fortinet FortiOS
- CVE-2023-23775Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerabilities [CWE-89] in FortiSOAR 7.2.0 and Fortinet FortiSOAR
- CVE-2023-46720A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 thrFortinet FortiOS
- CVE-2024-23111An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and Fortinet FortiOS · Fortinet FortiProxy
- CVE-2024-31495A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 Fortinet FortiPortal
- CVE-2024-35628WordPress Photo Gallery by 10Web plugin <= 1.8.25 - Broken Access Control vulnerabilityPhoto Gallery Team Photo Gallery by 10Web
- CVE-2022-40225A vulnerability has been identified in SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (Siemens SIPLUS TIM 1531 IRC · Siemens TIM 1531 IRC
- CVE-2024-35663WordPress WP Translate plugin <= 5.3.0 - Broken Access Control vulnerabilityHahnCreativeGroup WP Translate
- CVE-2024-37294Aimeos denial of service vulnerability in SaaS and marketplace setupsaimeos-core · aimeos/aimeos-core
- CVE-2023-52199WordPress ActivityPub plugin <= 1.0.5 - Unauthenticated Broken Access Control vulnerabilityMatthias Pfefferle & Automattic ActivityPub
- CVE-2024-35235Cupsd Listen arbitrary chmod 0140777OpenPrinting cups
- CVE-2024-35665WordPress Insert Post Ads plugin <= 1.3.2 - Broken Access Control vulnerabilitynamithjawahar Insert Post Ads
- CVE-2024-35667WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Broken Access Control vulnerabilityWP EasyCart
- CVE-2024-37161MeterSphere front-end editor stores XSS vulnerabilitymetersphere
- CVE-2024-28023A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2024-5189Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-35671WordPress MJ Update History plugin <= 1.0.4 - Broken Access Control vulnerabilityMinoji MJ Update History
- CVE-2024-35683WordPress Leyka plugin <= 3.31.1 - Broken Access Control vulnerabilityTeplitsa of social technologies Leyka
- CVE-2023-52183WordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerabilityWebToffee WordPress Backup & Migration
- CVE-2024-34442WordPress weDocs plugin <= 2.1.4 - Broken Access Control vulnerabilityweDevs weDocs
- CVE-2024-2461If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessibleHitachi Energy FOX61x · Hitachi Energy XMC20
- CVE-2024-2462Allow attackers to intercept or falsify data exchanges between the client and the serverHitachi Energy FOXMAN-UN · Hitachi Energy FOX61x +4
- CVE-2024-5698By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar.Mozilla Firefox
- CVE-2024-5697A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox.Mozilla Firefox
- CVE-2024-5689In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and dMozilla Firefox
- CVE-2024-5687If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been inMozilla Firefox
- CVE-2024-5693Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of saMozilla Firefox · Mozilla Thunderbird
- CVE-2024-5692On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extMozilla Firefox · Mozilla Thunderbird
- CVE-2024-5691By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-5690By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-35212A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).Siemens SINEC Traffic Analyzer
- CVE-2024-35211A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).Siemens SINEC Traffic Analyzer
- CVE-2024-35210A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).Siemens SINEC Traffic Analyzer
- CVE-2024-35209A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).Siemens SINEC Traffic Analyzer
- CVE-2024-35208A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2).Siemens SINEC Traffic Analyzer
- CVE-2024-33500A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (VSiemens Mendix Applications using Mendix
- CVE-2023-50763A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX0Siemens SIMATIC CP 1542SP-1 · Siemens SIMATIC CP 1543SP-1 +4
- CVE-2023-38533A vulnerability has been identified in TIA Administrator (All versions < V3 SP2).Siemens TIA Administrator
- CVE-2024-35685WordPress Radcliffe 2 theme <= 2.0.17 - Broken Access Control vulnerabilityAnders Norén Radcliffe
- CVE-2023-52179WordPress Product Expiry for WooCommerce plugin <= 2.5 - Broken Access Control vulnerabilityWebCodingPlace Product Expiry for WooCommerce
- CVE-2024-34813WordPress WooCommerce Wishlist plugin <= 1.7.8 - Broken Access Control vulnerabilityMoreconvert Team MC Woocommerce Wishlist
- CVE-2024-5829smallweigit Avue avueUeditor cross site scriptingsmallweigit Avue
- CVE-2024-5584WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameterladela Online Scheduling and Appointment Booking System – B…
- CVE-2024-34824WordPress SportsPress – Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control vulnerabilityThemeBoy SportsPress – Sports Club & League Manager
- CVE-2023-52217WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerabilityweDevs WooCommerce Conversion Tracking
- CVE-2024-24704WordPress Load More Anything plugin <= 3.3.3 - Broken Access Control vulnerabilityAddonMaster Load More Anything
- CVE-2023-52186WordPress WooCommerce Product Vendors plugin <= 2.2.2 - Unauthenticated Broken Access Control vulnerabilityWooCommerce Product Vendors
- CVE-2024-35692WordPress GDPR/CCPA Cookie Consent Banner plugin <= 3.2 - Broken Access Control vulnerabilityTermly Cookie Consent
- CVE-2024-35716WordPress Copymatic plugin <= 1.9 - Broken Access Control vulnerabilityCopymatic – AI Content Writer & Generator
- CVE-2023-33922WordPress Elementor plugin <= 3.13.2 - Broken Access Control vulnerabilityElementor Website Builder
- CVE-2023-28775WordPress Yoast SEO Premium plugin <= 20.4 - Unauthenticated Zapier API Key Reset vulnerabilityYoast SEO Premium
- CVE-2024-5531Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widgetoceanwp Ocean Extra
- CVE-2024-4266MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposureroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2020-11843Potential information leakage in administrator enabled debug modeOpenText NetIQ Access Manager
- CVE-2024-31397Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2.Cybozu Garoon
- CVE-2024-31399Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2.Cybozu Garoon
- CVE-2024-3723Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposurevsourz1td Advanced Contact form 7 DB
- CVE-2024-4319Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosurevsourz1td Advanced Contact form 7 DB
- CVE-2024-31402Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared TCybozu Garoon
- CVE-2024-31398Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2.Cybozu Garoon
- CVE-2024-5530ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widgetdevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2024-31404Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to theCybozu Garoon
- CVE-2024-31403Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the dataCybozu Garoon
- CVE-2024-31400Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0.Cybozu Garoon
- CVE-2024-34691Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)SAP_SE SAP S/4HANA
- CVE-2024-34684Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling)SAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-28164Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)SAP_SE SAP NetWeaver AS Java
- CVE-2024-34690Missing Authorization check in SAP Student Life Cycle Management (SLcM)SAP_SE SAP Student Life Cycle Management
- CVE-2024-37176Missing Authorization check in SAP BW/4HANA Transformation and DTPSAP_SE SAP BW/4HANA Transformation and Data Transfer Process
- CVE-2024-34686Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)SAP_SE SAP CRM WebClient UI
- CVE-2024-34683Unrestricted file upload in SAP Document Builder (HTTP service)SAP_SE SAP Document Builder
- CVE-2024-33001Denial of service (DOS) in SAP NetWeaver and ABAP platformSAP_SE SAP NetWeaver and ABAP platform
- CVE-2024-2473WPS Hide Login <= 1.9.15.2 - Login Page Disclosuretabrisrp WPS Hide Login
- CVE-2024-0653Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritpinghiroaki-miyashita Custom Field Template
- CVE-2023-6748Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Information Exposurehiroaki-miyashita Custom Field Template
- CVE-2024-0627Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Namehiroaki-miyashita Custom Field Template
- CVE-2024-5090SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widgetgpriday SiteOrigin Widgets Bundle
- CVE-2023-6745Custom Field Template <= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodehiroaki-miyashita Custom Field Template
- CVE-2024-37178Cross-Site Scripting (XSS) vulnerabilities in SAP Financial ConsolidationSAP_SE SAP Financial Consolidation
- CVE-2024-26330An issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows.
- CVE-2024-34406Improper exception handling in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to cause a denial of service