# CVEs published 2024-06-11

226 CVEs were published on June 11, 2024: 14 critical, 81 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-35225](https://cve.now/CVE-2024-35225.md): Jupyter Server Proxy has a reflected XSS issue in host parameter (CVSS 9.7, jupyterhub jupyter-server-proxy · jupyter-server-proxy)
- [CVE-2024-5847](https://cve.now/CVE-2024-5847.md): Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-5846](https://cve.now/CVE-2024-5846.md): Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-5845](https://cve.now/CVE-2024-5845.md): Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2024-5844](https://cve.now/CVE-2024-5844.md): Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory read (CVSS 8.8, Google Chrome)
- [CVE-2024-5843](https://cve.now/CVE-2024-5843.md): Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to obfuscate security UI via a m (CVSS 8.8, Google Chrome)
- [CVE-2024-5842](https://cve.now/CVE-2024-5842.md): Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 7.5, Google Chrome)
- [CVE-2024-5841](https://cve.now/CVE-2024-5841.md): Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-5840](https://cve.now/CVE-2024-5840.md): Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass discretionary access control via a crafted (CVSS 6.5, Google Chrome)
- [CVE-2024-5839](https://cve.now/CVE-2024-5839.md): Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit he (CVSS 8.8, Google Chrome)
- [CVE-2024-5838](https://cve.now/CVE-2024-5838.md): Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of bounds memory access via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-5837](https://cve.now/CVE-2024-5837.md): Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access vi (CVSS 8.8, Google Chrome)
- [CVE-2024-5836](https://cve.now/CVE-2024-5836.md): Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malic (CVSS 8.8, Google Chrome)
- [CVE-2024-5835](https://cve.now/CVE-2024-5835.md): Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in speci (CVSS 4.2, Google Chrome)
- [CVE-2024-5834](https://cve.now/CVE-2024-5834.md): Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a craft (CVSS 5.6, Google Chrome)
- [CVE-2024-5833](https://cve.now/CVE-2024-5833.md): Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access vi (CVSS 8.8, Google Chrome)
- [CVE-2024-5832](https://cve.now/CVE-2024-5832.md): Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-5831](https://cve.now/CVE-2024-5831.md): Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-5830](https://cve.now/CVE-2024-5830.md): Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out of bounds memory write via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-4669](https://cve.now/CVE-2024-4669.md): Events Addon for Elementor \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, nicheaddons Events Addon for Elementor)
- [CVE-2024-5646](https://cve.now/CVE-2024-5646.md): Futurio Extra \<= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Text Block Widget (CVSS 6.4, futuriowp Futurio Extra)
- [CVE-2024-33606](https://cve.now/CVE-2024-33606.md): MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme (CVSS 8.8, MicroDicom DICOM Viewer)
- [CVE-2024-28877](https://cve.now/CVE-2024-28877.md): MicroDicom DICOM Viewer Stack-based Buffer Overflow (CVSS 8.8, MicroDicom DICOM Viewer)
- [CVE-2023-4727](https://cve.now/CVE-2023-4727.md): Ca: token authentication bypass vulnerability (CVSS 7.5, keycloak · Red Hat Certificate System 10.4 EUS for RHEL-8 +1)
- [CVE-2024-35213](https://cve.now/CVE-2024-35213.md): Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP) (CVSS 9.0, BlackBerry QNX Software Development Platform)
- [CVE-2024-37301](https://cve.now/CVE-2024-37301.md): document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection (CVSS 7.2, adfinis document-merge-service · document-merge-service)
- [CVE-2024-28020](https://cve.now/CVE-2024-28020.md): A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application and server management. (CVSS 8.0, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-28024](https://cve.now/CVE-2024-28024.md): A vulnerability exists in the FOXMAN-UN/UNEM in which sensitive information is stored in cleartext within a resource that might be accessib (CVSS 4.1, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-28022](https://cve.now/CVE-2024-28022.md): A vulnerability exists in the UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentic (CVSS 6.5, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-4190](https://cve.now/CVE-2024-4190.md): OpenText ArcSight Logger Stored XSS (CVSS 8.4, OpenText ArcSight Logger)
- [CVE-2024-5851](https://cve.now/CVE-2024-5851.md): playSMS SMS Schedule cross site scripting (CVSS 5.3, playSMS)
- [CVE-2024-23518](https://cve.now/CVE-2024-23518.md): WordPress ACF Photo Gallery Field plugin \<= 2.6 - Broken Access Control vulnerability (CVSS 4.3, Navneil Naicker ACF Photo Gallery Field)
- [CVE-2024-32143](https://cve.now/CVE-2024-32143.md): WordPress Podlove Podcast Publisher plugin \<= 4.1.0 - Broken Access Control vulnerability (CVSS 4.3, Podlove Podcast Publisher)
- [CVE-2024-32146](https://cve.now/CVE-2024-32146.md): WordPress Aspose.Words – Import and Export word documents plugin \<= 6.3.1 - Broken Access Control vulnerability (CVSS 4.3, Aspose.cloud Marketplace Aspose.Words Exporter)
- [CVE-2024-30052](https://cve.now/CVE-2024-30052.md): Visual Studio Remote Code Execution Vulnerability (CVSS 4.7, Microsoft Visual Studio)
- [CVE-2024-37325](https://cve.now/CVE-2024-37325.md): Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Azure Data Science Virtual Machines)
- [CVE-2024-35265](https://cve.now/CVE-2024-35265.md): Windows Perception Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-35263](https://cve.now/CVE-2024-35263.md): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (CVSS 5.7, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-35254](https://cve.now/CVE-2024-35254.md): Azure Monitor Agent Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Azure Monitor)
- [CVE-2024-35253](https://cve.now/CVE-2024-35253.md): Microsoft Azure File Sync Elevation of Privilege Vulnerability (CVSS 4.4, Microsoft Azure File Sync)
- [CVE-2024-35252](https://cve.now/CVE-2024-35252.md): Azure Storage Movement Client Library Denial of Service Vulnerability (CVSS 7.5, Microsoft Azure Storage · Microsoft.Azure.Storage.DataMovem…)
- [CVE-2024-35249](https://cve.now/CVE-2024-35249.md): Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics 365 Business Central 2023 Release Wave ·…)
- [CVE-2024-35248](https://cve.now/CVE-2024-35248.md): Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Dynamics 365 Business Central 2023 Release Wave ·…)
- [CVE-2024-30104](https://cve.now/CVE-2024-30104.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2024-30103](https://cve.now/CVE-2024-30103.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 8.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2024-30102](https://cve.now/CVE-2024-30102.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.3, Microsoft 365 Apps for Enterprise)
- [CVE-2024-30101](https://cve.now/CVE-2024-30101.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.5, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2024-30100](https://cve.now/CVE-2024-30100.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-30099](https://cve.now/CVE-2024-30099.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-30097](https://cve.now/CVE-2024-30097.md): Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-30096](https://cve.now/CVE-2024-30096.md): Windows Cryptographic Services Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30095](https://cve.now/CVE-2024-30095.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30094](https://cve.now/CVE-2024-30094.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30093](https://cve.now/CVE-2024-30093.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-30091](https://cve.now/CVE-2024-30091.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30090](https://cve.now/CVE-2024-30090.md): Microsoft Streaming Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-30089](https://cve.now/CVE-2024-30089.md): Microsoft Streaming Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30088](https://cve.now/CVE-2024-30088.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, KEV, Microsoft Windows)
- [CVE-2024-30087](https://cve.now/CVE-2024-30087.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30086](https://cve.now/CVE-2024-30086.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30085](https://cve.now/CVE-2024-30085.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30084](https://cve.now/CVE-2024-30084.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-30083](https://cve.now/CVE-2024-30083.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2024-30068](https://cve.now/CVE-2024-30068.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-30067](https://cve.now/CVE-2024-30067.md): Winlogon Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30066](https://cve.now/CVE-2024-30066.md): Winlogon Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30065](https://cve.now/CVE-2024-30065.md): Windows Themes Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-30064](https://cve.now/CVE-2024-30064.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows Server)
- [CVE-2024-30063](https://cve.now/CVE-2024-30063.md): Windows Distributed File System (DFS) Remote Code Execution Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-30062](https://cve.now/CVE-2024-30062.md): Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2024-29060](https://cve.now/CVE-2024-29060.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Visual Studio)
- [CVE-2024-35255](https://cve.now/CVE-2024-35255.md): Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Azure Identity Library · Microsoft Authenticat… +8)
- [CVE-2024-35250](https://cve.now/CVE-2024-35250.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-30082](https://cve.now/CVE-2024-30082.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30080](https://cve.now/CVE-2024-30080.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2024-30078](https://cve.now/CVE-2024-30078.md): Windows Wi-Fi Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-30077](https://cve.now/CVE-2024-30077.md): Windows OLE Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-30076](https://cve.now/CVE-2024-30076.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-30075](https://cve.now/CVE-2024-30075.md): Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows Server 2008 R2 Service Pack · Microsoft W…)
- [CVE-2024-30074](https://cve.now/CVE-2024-30074.md): Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows Server 2008 R2 Service Pack · Microsoft W…)
- [CVE-2024-30072](https://cve.now/CVE-2024-30072.md): Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-30070](https://cve.now/CVE-2024-30070.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-30069](https://cve.now/CVE-2024-30069.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2024-34763](https://cve.now/CVE-2024-34763.md): WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin \<= 1.01.5 - Broken Access Control vulnerability (CVSS 5.3, Saleswonder Team: Tobias Builder for WooCommerce reviews sh…)
- [CVE-2024-37293](https://cve.now/CVE-2024-37293.md): aws-deployment-framework's potential risk can lead to privilege escalation (CVSS 7.6, awslabs aws-deployment-framework)
- [CVE-2024-34768](https://cve.now/CVE-2024-34768.md): WordPress Fastly plugin \<= 1.2.25 - Broken Access Control vulnerability (CVSS 5.3, Fastly)
- [CVE-2024-34799](https://cve.now/CVE-2024-34799.md): WordPress BookingPress plugin \<= 1.0.82 - Appointment Duration Manipulation vulnerability (CVSS 6.5, Repute Infosystems BookingPress)
- [CVE-2023-48273](https://cve.now/CVE-2023-48273.md): WordPress Preloader for Website plugin \<= 1.2.2 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3, WP OnlineSupport, Essential Plugin Preloader for Website)
- [CVE-2023-52227](https://cve.now/CVE-2023-52227.md): WordPress MailerLite – WooCommerce integration plugin \<= 2.0.8 - Broken Access Control vulnerability (CVSS 4.3, MailerLite – WooCommerce integration)
- [CVE-2024-34804](https://cve.now/CVE-2024-34804.md): WordPress Tagembed plugin \<= 5.8 - Broken Access Control vulnerability (CVSS 5.4, Tagembed)
- [CVE-2024-34815](https://cve.now/CVE-2024-34815.md): WordPress Import and export users and customers plugin \<= 1.26.5 - Broken Access Control vulnerability (CVSS 5.4, Javier Carazo Import and export users and customers)
- [CVE-2023-52224](https://cve.now/CVE-2023-52224.md): WordPress Revolut Gateway for WooCommerce plugin \<= 4.9.7 - Broken Access Control vulnerability (CVSS 4.3, Revolut Gateway for WooCommerce)
- [CVE-2024-34758](https://cve.now/CVE-2024-34758.md): WordPress FundEngine – Donation and Crowdfunding Platform plugin \<= 1.6.4 - Broken Access Control vulnerability (CVSS 5.3, Wpmet WP Fundraising Donation and Crowdfunding Platform)
- [CVE-2024-34819](https://cve.now/CVE-2024-34819.md): WordPress MC Woocommerce Wishlist plugin \<= 1.7.2 - Broken Access Control vulnerability (CVSS 5.3, Moreconvert Team MC Woocommerce Wishlist)
- [CVE-2024-23503](https://cve.now/CVE-2024-23503.md): WordPress Ninja Tables plugin \<= 5.0.6 - Broken Access Control vulnerability (CVSS 4.3, WPManageNinja Ninja Tables)
- [CVE-2023-52233](https://cve.now/CVE-2023-52233.md): WordPress POST SMTP Mailer plugin \<= 2.8.6 - Broken Access Control on API vulnerability (CVSS 8.6, Post SMTP Mailer/Email Log)
- [CVE-2024-34821](https://cve.now/CVE-2024-34821.md): WordPress Contact List plugin \<= 2.9.87 - Broken Access Control vulnerability (CVSS 5.3, Anssi Laitila Contact List)
- [CVE-2024-34753](https://cve.now/CVE-2024-34753.md): WordPress Radio Player plugin \<= 2.0.73 - Broken Access Control vulnerability (CVSS 5.3, SoftLab Radio Player)
- [CVE-2023-51519](https://cve.now/CVE-2023-51519.md): WordPress Slider by Soliloquy – Responsive Image Slider for WordPress plugin \<= 2.7.2 - Broken Access Control vulnerability (CVSS 4.3, Soliloquy Team Slider by Soliloquy)
- [CVE-2024-32144](https://cve.now/CVE-2024-32144.md): WordPress Welcart e-Commerce plugin \<= 2.9.14 - Broken Access Control vulnerability (CVSS 5.4, Welcart e-Commerce)
- [CVE-2024-5812](https://cve.now/CVE-2024-5812.md): Smart Rule Overwrite Bypass in BeyondInsight PasswordSafe (CVSS 3.3, BeyondTrust BeyondInsight PasswordSafe)
- [CVE-2024-5813](https://cve.now/CVE-2024-5813.md): SSH Private Key Leak in BeyondInsight PasswordSafe (CVSS 5.9, BeyondTrust BeyondInsight PasswordSafe)
- [CVE-2024-23521](https://cve.now/CVE-2024-23521.md): WordPress Happyforms plugin \<= 1.25.10 - Broken Access Control vulnerability (CVSS 5.3, Happyforms)
- [CVE-2023-51682](https://cve.now/CVE-2023-51682.md): WordPress MC4WP plugin \<= 4.9.9 - Broken Access Control vulnerability (CVSS 5.3, ibericode MC4WP)
- [CVE-2024-34822](https://cve.now/CVE-2024-34822.md): WordPress weMail plugin \<= 1.14.2 - Broken Access Control vulnerability (CVSS 5.3, weDevs weMail)
- [CVE-2024-34826](https://cve.now/CVE-2024-34826.md): WordPress CF7 WOW Styler plugin \<= 1.6.4 - Broken Access Control vulnerability (CVSS 6.3, Saleswonder Team: Tobias CF7 WOW Styler)
- [CVE-2024-34820](https://cve.now/CVE-2024-34820.md): WordPress If-So Dynamic Content Personalization plugin \<= 1.7.1 - Broken Access Control vulnerability (CVSS 6.5, If So Plugin If-So Dynamic Content Personalization)
- [CVE-2024-24703](https://cve.now/CVE-2024-24703.md): WordPress MultiVendorX plugin \<= 4.0.25 - Broken Access Control vulnerability (CVSS 8.6, MultiVendorX WC Marketplace)
- [CVE-2024-32148](https://cve.now/CVE-2024-32148.md): WordPress Pardot plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 4.3, Salesforce Pardot)
- [CVE-2024-37296](https://cve.now/CVE-2024-37296.md): Aimeos HTML client vulnerable to digital products download without proper payment status check (CVSS 5.3, aimeos ai-client-html · aimeos/ai-client-html)
- [CVE-2024-35168](https://cve.now/CVE-2024-35168.md): WordPress WP Discourse plugin \<= 2.5.1 - Broken Access Control vulnerability (CVSS 4.3, WP Discourse)
- [CVE-2024-37295](https://cve.now/CVE-2024-37295.md): Aimeos Core remote code execution in web server context (CVSS 7.2, aimeos-core · aimeos/aimeos-core)
- [CVE-2023-51498](https://cve.now/CVE-2023-51498.md): WordPress WooCommerce Canada Post Shipping plugin \<= 2.8.3 - Broken Access Control vulnerability (CVSS 5.3, WooCommerce Canada Post Shipping)
- [CVE-2024-26010](https://cve.now/CVE-2024-26010.md): A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0. (CVSS 6.7, Fortinet FortiOS · Fortinet FortiSwitchManager +2)
- [CVE-2024-21754](https://cve.now/CVE-2024-21754.md): A use of password hash with insufficient computational effort vulnerability \[CWE-916\] affecting FortiOS version 7.4.3 and below, 7.2 all ver (CVSS 1.7, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2023-23775](https://cve.now/CVE-2023-23775.md): Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerabilities \[CWE-89\] in FortiSOAR 7.2.0 and (CVSS 5.9, Fortinet FortiSOAR)
- [CVE-2023-46720](https://cve.now/CVE-2023-46720.md): A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 thr (CVSS 6.3, Fortinet FortiOS)
- [CVE-2024-23111](https://cve.now/CVE-2024-23111.md): An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability \[CWE-79\] in FortiOS version 7.4.3 and (CVSS 6.2, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2024-23110](https://cve.now/CVE-2024-23110.md): A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4. (CVSS 7.4, Fortinet FortiOS)
- [CVE-2024-31495](https://cve.now/CVE-2024-31495.md): A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 (CVSS 3.9, Fortinet FortiPortal)
- [CVE-2024-35628](https://cve.now/CVE-2024-35628.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.25 - Broken Access Control vulnerability (CVSS 4.3, Photo Gallery Team Photo Gallery by 10Web)
- [CVE-2022-40225](https://cve.now/CVE-2022-40225.md): A vulnerability has been identified in SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions \< V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) ( (CVSS 6.5, Siemens SIPLUS TIM 1531 IRC · Siemens TIM 1531 IRC)
- [CVE-2024-35663](https://cve.now/CVE-2024-35663.md): WordPress WP Translate plugin \<= 5.3.0 - Broken Access Control vulnerability (CVSS 5.4, HahnCreativeGroup WP Translate)
- [CVE-2024-37294](https://cve.now/CVE-2024-37294.md): Aimeos denial of service vulnerability in SaaS and marketplace setups (CVSS 5.5, aimeos-core · aimeos/aimeos-core)
- [CVE-2023-52199](https://cve.now/CVE-2023-52199.md): WordPress ActivityPub plugin \<= 1.0.5 - Unauthenticated Broken Access Control vulnerability (CVSS 6.5, Matthias Pfefferle & Automattic ActivityPub)
- [CVE-2024-35235](https://cve.now/CVE-2024-35235.md): Cupsd Listen arbitrary chmod 0140777 (CVSS 4.4, OpenPrinting cups)
- [CVE-2024-35665](https://cve.now/CVE-2024-35665.md): WordPress Insert Post Ads plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.3, namithjawahar Insert Post Ads)
- [CVE-2024-35667](https://cve.now/CVE-2024-35667.md): WordPress Shopping Cart & eCommerce Store plugin \<= 5.5.19 - Broken Access Control vulnerability (CVSS 5.3, WP EasyCart)
- [CVE-2024-37161](https://cve.now/CVE-2024-37161.md): MeterSphere front-end editor stores XSS vulnerability (CVSS 4.0, metersphere)
- [CVE-2024-28023](https://cve.now/CVE-2024-28023.md): A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unint (CVSS 5.7, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-5189](https://cve.now/CVE-2024-5189.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-35671](https://cve.now/CVE-2024-35671.md): WordPress MJ Update History plugin \<= 1.0.4 - Broken Access Control vulnerability (CVSS 4.3, Minoji MJ Update History)
- [CVE-2024-35683](https://cve.now/CVE-2024-35683.md): WordPress Leyka plugin \<= 3.31.1 - Broken Access Control vulnerability (CVSS 5.3, Teplitsa of social technologies Leyka)
- [CVE-2023-52183](https://cve.now/CVE-2023-52183.md): WordPress WordPress Backup & Migration plugin \<= 1.4.3 - Broken Access Control vulnerability (CVSS 5.4, WebToffee WordPress Backup & Migration)
- [CVE-2024-34442](https://cve.now/CVE-2024-34442.md): WordPress weDocs plugin \<= 2.1.4 - Broken Access Control vulnerability (CVSS 5.3, weDevs weDocs)
- [CVE-2024-28021](https://cve.now/CVE-2024-28021.md): A vulnerability exists in the FOXMAN-UN/UNEM server that affects the message queueing mechanism’s certificate validation. (CVSS 7.4, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-2011](https://cve.now/CVE-2024-2011.md): A heap-based buffer overflow vulnerability exists in the FOXMAN-UN/UNEM that if exploited will generally lead to a denial of service but can (CVSS 8.6, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-2012](https://cve.now/CVE-2024-2012.md): vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or cod (CVSS 9.1, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-2013](https://cve.now/CVE-2024-2013.md): An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers withou (CVSS 10.0, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM)
- [CVE-2024-2461](https://cve.now/CVE-2024-2461.md): If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible (CVSS 6.9, Hitachi Energy FOX61x · Hitachi Energy XMC20)
- [CVE-2024-2462](https://cve.now/CVE-2024-2462.md): Allow attackers to intercept or falsify data exchanges between the client and the server (CVSS 6.8, Hitachi Energy FOXMAN-UN · Hitachi Energy FOX61x +4)
- [CVE-2024-5701](https://cve.now/CVE-2024-5701.md): Memory safety bugs present in Firefox 126. (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-5699](https://cve.now/CVE-2024-5699.md): In violation of spec, cookie prefixes such as \`\_\_Secure\` were being ignored if they were not correctly capitalized - by spec they should be (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-5698](https://cve.now/CVE-2024-5698.md): By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. (CVSS 5.4, Mozilla Firefox)
- [CVE-2024-5697](https://cve.now/CVE-2024-5697.md): A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. (CVSS 5.3, Mozilla Firefox)
- [CVE-2024-5695](https://cve.now/CVE-2024-5695.md): If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been t (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-5694](https://cve.now/CVE-2024-5694.md): An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. (CVSS 7.5, Mozilla Firefox)
- [CVE-2024-5689](https://cve.now/CVE-2024-5689.md): In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and d (CVSS 4.3, Mozilla Firefox)
- [CVE-2024-5687](https://cve.now/CVE-2024-5687.md): If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been in (CVSS 5.3, Mozilla Firefox)
- [CVE-2024-5700](https://cve.now/CVE-2024-5700.md): Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. (CVSS 7.0, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-5696](https://cve.now/CVE-2024-5696.md): By manipulating the text in an \`&lt;input&gt;\` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. (CVSS 8.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-5693](https://cve.now/CVE-2024-5693.md): Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of sa (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-5692](https://cve.now/CVE-2024-5692.md): On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed ext (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-5691](https://cve.now/CVE-2024-5691.md): By tricking the browser with a \`X-Frame-Options\` header, a sandboxed iframe could have presented a button that, if clicked by a user, would (CVSS 4.7, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-5690](https://cve.now/CVE-2024-5690.md): By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-5688](https://cve.now/CVE-2024-5688.md): If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-5702](https://cve.now/CVE-2024-5702.md): Memory corruption in the networking stack could have led to a potentially exploitable crash. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-36266](https://cve.now/CVE-2024-36266.md): A vulnerability has been identified in PowerSys (All versions \< V3.11). (CVSS 9.3, Siemens PowerSys)
- [CVE-2024-35303](https://cve.now/CVE-2024-35303.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions \< V2302.0012), Tecnomatix Plant Simulation V2404 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-35292](https://cve.now/CVE-2024-35292.md): A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES (CVSS 8.2, Siemens SIMATIC S7-200 SMART CPU CR40 · Siemens SIMATIC… +8)
- [CVE-2024-35212](https://cve.now/CVE-2024-35212.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V1.2). (CVSS 6.2, Siemens SINEC Traffic Analyzer)
- [CVE-2024-35211](https://cve.now/CVE-2024-35211.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V1.2). (CVSS 5.5, Siemens SINEC Traffic Analyzer)
- [CVE-2024-35210](https://cve.now/CVE-2024-35210.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V1.2). (CVSS 5.1, Siemens SINEC Traffic Analyzer)
- [CVE-2024-35209](https://cve.now/CVE-2024-35209.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V1.2). (CVSS 6.2, Siemens SINEC Traffic Analyzer)
- [CVE-2024-35208](https://cve.now/CVE-2024-35208.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V1.2). (CVSS 6.3, Siemens SINEC Traffic Analyzer)
- [CVE-2024-35207](https://cve.now/CVE-2024-35207.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V1.2). (CVSS 7.8, Siemens SINEC Traffic Analyzer)
- [CVE-2024-35206](https://cve.now/CVE-2024-35206.md): A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions \< V1.2). (CVSS 7.7, Siemens SINEC Traffic Analyzer)
- [CVE-2024-33500](https://cve.now/CVE-2024-33500.md): A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions \< V10.11.0), Mendix Applications using Mendix 10 (V (CVSS 5.9, Siemens Mendix Applications using Mendix)
- [CVE-2023-50763](https://cve.now/CVE-2023-50763.md): A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions \< V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX0 (CVSS 4.9, Siemens SIMATIC CP 1542SP-1 · Siemens SIMATIC CP 1543SP-1 +4)
- [CVE-2023-38533](https://cve.now/CVE-2023-38533.md): A vulnerability has been identified in TIA Administrator (All versions \< V3 SP2). (CVSS 3.3, Siemens TIA Administrator)
- [CVE-2024-35685](https://cve.now/CVE-2024-35685.md): WordPress Radcliffe 2 theme \<= 2.0.17 - Broken Access Control vulnerability (CVSS 5.3, Anders Norén Radcliffe)
- [CVE-2023-52179](https://cve.now/CVE-2023-52179.md): WordPress Product Expiry for WooCommerce plugin \<= 2.5 - Broken Access Control vulnerability (CVSS 5.4, WebCodingPlace Product Expiry for WooCommerce)
- [CVE-2024-34813](https://cve.now/CVE-2024-34813.md): WordPress WooCommerce Wishlist plugin \<= 1.7.8 - Broken Access Control vulnerability (CVSS 5.3, Moreconvert Team MC Woocommerce Wishlist)
- [CVE-2024-5829](https://cve.now/CVE-2024-5829.md): smallweigit Avue avueUeditor cross site scripting (CVSS 5.3, smallweigit Avue)
- [CVE-2024-5584](https://cve.now/CVE-2024-5584.md): WordPress Online Booking and Scheduling Plugin – Bookly \<= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter (CVSS 6.4, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2024-34824](https://cve.now/CVE-2024-34824.md): WordPress SportsPress – Sports Club & League Manager plugin \<= 2.7.20 - Broken Access Control vulnerability (CVSS 4.3, ThemeBoy SportsPress – Sports Club & League Manager)
- [CVE-2023-52217](https://cve.now/CVE-2023-52217.md): WordPress WooCommerce Conversion Tracking plugin \<= 2.0.11 - Broken Access Control vulnerability (CVSS 4.3, weDevs WooCommerce Conversion Tracking)
- [CVE-2024-24704](https://cve.now/CVE-2024-24704.md): WordPress Load More Anything plugin \<= 3.3.3 - Broken Access Control vulnerability (CVSS 5.4, AddonMaster Load More Anything)
- [CVE-2023-52186](https://cve.now/CVE-2023-52186.md): WordPress WooCommerce Product Vendors plugin \<= 2.2.2 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3, WooCommerce Product Vendors)
- [CVE-2024-35692](https://cve.now/CVE-2024-35692.md): WordPress GDPR/CCPA Cookie Consent Banner plugin \<= 3.2 - Broken Access Control vulnerability (CVSS 5.3, Termly Cookie Consent)
- [CVE-2024-35716](https://cve.now/CVE-2024-35716.md): WordPress Copymatic plugin \<= 1.9 - Broken Access Control vulnerability (CVSS 6.5, Copymatic – AI Content Writer & Generator)
- [CVE-2023-33922](https://cve.now/CVE-2023-33922.md): WordPress Elementor plugin \<= 3.13.2 - Broken Access Control vulnerability (CVSS 4.3, Elementor Website Builder)
- [CVE-2023-28775](https://cve.now/CVE-2023-28775.md): WordPress Yoast SEO Premium plugin \<= 20.4 - Unauthenticated Zapier API Key Reset vulnerability (CVSS 5.3, Yoast SEO Premium)
- [CVE-2023-25799](https://cve.now/CVE-2023-25799.md): WordPress Tutor LMS plugin \<= 2.1.8 - Multiple Broken Access Control vulnerabilities (CVSS 8.3, Themeum Tutor LMS)
- [CVE-2024-5531](https://cve.now/CVE-2024-5531.md): Ocean Extra \<= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget (CVSS 6.4, oceanwp Ocean Extra)
- [CVE-2024-4266](https://cve.now/CVE-2024-4266.md): MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor \<= 3.8.8 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2020-11843](https://cve.now/CVE-2020-11843.md): Potential information leakage in administrator enabled debug mode (CVSS 6.5, OpenText NetIQ Access Manager)
- [CVE-2024-3549](https://cve.now/CVE-2024-3549.md): Blog2Social: Social Media Auto Post & Scheduler \<= 7.4.1 - Authenticated (Subscriber+) SQL Injection (CVSS 9.9, pr-gateway Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2024-31397](https://cve.now/CVE-2024-31397.md): Improper handling of extra values issue exists in Cybozu Garoon 5.0.0 to 5.15.2. (CVSS 4.9, Cybozu Garoon)
- [CVE-2024-31399](https://cve.now/CVE-2024-31399.md): Excessive platform resource consumption within a loop issue exists in Cybozu Garoon 5.0.0 to 5.15.2. (CVSS 5.3, Cybozu Garoon)
- [CVE-2024-3723](https://cve.now/CVE-2024-3723.md): Advanced Contact form 7 DB \<= 2.0.2 - Sensitive Information Exposure (CVSS 5.3, vsourz1td Advanced Contact form 7 DB)
- [CVE-2024-4319](https://cve.now/CVE-2024-4319.md): Advanced Contact form 7 DB \<= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure (CVSS 5.3, vsourz1td Advanced Contact form 7 DB)
- [CVE-2024-31402](https://cve.now/CVE-2024-31402.md): Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker to delete the data of Shared T (CVSS 4.3, Cybozu Garoon)
- [CVE-2024-31398](https://cve.now/CVE-2024-31398.md): Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.2. (CVSS 4.3, Cybozu Garoon)
- [CVE-2024-5530](https://cve.now/CVE-2024-5530.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget (CVSS 6.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-31404](https://cve.now/CVE-2024-31404.md): Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.5.0 to 6.0.0, which may allow a user who can log in to the (CVSS 4.3, Cybozu Garoon)
- [CVE-2024-31403](https://cve.now/CVE-2024-31403.md): Incorrect authorization vulnerability in Cybozu Garoon 5.0.0 to 6.0.0 allows a remote authenticated attacker to alter and/or obtain the data (CVSS 5.4, Cybozu Garoon)
- [CVE-2024-31401](https://cve.now/CVE-2024-31401.md): Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege (CVSS 9.0, Cybozu Garoon)
- [CVE-2024-31400](https://cve.now/CVE-2024-31400.md): Insertion of sensitive information into sent data issue exists in Cybozu Garoon 5.0.0 to 5.15.0. (CVSS 6.5, Cybozu Garoon)
- [CVE-2024-36360](https://cve.now/CVE-2024-36360.md): OS command injection vulnerability exists in awkblog v0.0.1 (commit hash:7b761b192d0e0dc3eef0f30630e00ece01c8d552) and earlier. (CVSS 9.8, Keisuke Nakayama awkblog)
- [CVE-2024-29855](https://cve.now/CVE-2024-29855.md): Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator (CVSS 9.0, Veeam Recovery Orchestrator)
- [CVE-2023-7264](https://cve.now/CVE-2023-7264.md): Build App Online \<= 1.0.22 - Account Takeover via Weak Password Reset Mechanism (CVSS 8.1, hakeemnala Build App Online)
- [CVE-2024-34691](https://cve.now/CVE-2024-34691.md): Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) (CVSS 6.5, SAP\_SE SAP S/4HANA)
- [CVE-2024-34684](https://cve.now/CVE-2024-34684.md): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling) (CVSS 3.7, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2024-28164](https://cve.now/CVE-2024-28164.md): Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures) (CVSS 5.3, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2024-34690](https://cve.now/CVE-2024-34690.md): Missing Authorization check in SAP Student Life Cycle Management (SLcM) (CVSS 5.4, SAP\_SE SAP Student Life Cycle Management)
- [CVE-2024-37176](https://cve.now/CVE-2024-37176.md): Missing Authorization check in SAP BW/4HANA Transformation and DTP (CVSS 5.5, SAP\_SE SAP BW/4HANA Transformation and Data Transfer Process)
- [CVE-2024-34686](https://cve.now/CVE-2024-34686.md): Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) (CVSS 6.1, SAP\_SE SAP CRM WebClient UI)
- [CVE-2024-34683](https://cve.now/CVE-2024-34683.md): Unrestricted file upload in SAP Document Builder (HTTP service) (CVSS 6.5, SAP\_SE SAP Document Builder)
- [CVE-2024-33001](https://cve.now/CVE-2024-33001.md): Denial of service (DOS) in SAP NetWeaver and ABAP platform (CVSS 6.5, SAP\_SE SAP NetWeaver and ABAP platform)
- [CVE-2024-34688](https://cve.now/CVE-2024-34688.md): Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) (CVSS 7.5, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2024-2473](https://cve.now/CVE-2024-2473.md): WPS Hide Login \<= 1.9.15.2 - Login Page Disclosure (CVSS 5.3, tabrisrp WPS Hide Login)
- [CVE-2024-0653](https://cve.now/CVE-2024-0653.md): Custom Field Template \<= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping (CVSS 4.4, hiroaki-miyashita Custom Field Template)
- [CVE-2023-6748](https://cve.now/CVE-2023-6748.md): Custom Field Template \<= 2.6.1 - Authenticated(Contributor+) Information Exposure (CVSS 4.3, hiroaki-miyashita Custom Field Template)
- [CVE-2024-0627](https://cve.now/CVE-2024-0627.md): Custom Field Template \<= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name (CVSS 6.4, hiroaki-miyashita Custom Field Template)
- [CVE-2024-5090](https://cve.now/CVE-2024-5090.md): SiteOrigin Widgets Bundle \<= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget (CVSS 6.4, gpriday SiteOrigin Widgets Bundle)
- [CVE-2023-6745](https://cve.now/CVE-2023-6745.md): Custom Field Template \<= 2.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, hiroaki-miyashita Custom Field Template)
- [CVE-2024-37178](https://cve.now/CVE-2024-37178.md): Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation (CVSS 5.0, SAP\_SE SAP Financial Consolidation)
- [CVE-2024-37177](https://cve.now/CVE-2024-37177.md): Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation (CVSS 8.1, SAP\_SE SAP Financial Consolidation)
- [CVE-2024-37130](https://cve.now/CVE-2024-37130.md): Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. (CVSS 7.3, Dell OpenManage Server Administrator)
- [CVE-2024-26330](https://cve.now/CVE-2024-26330.md): An issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows. (CVSS 6.5)
- [CVE-2024-34405](https://cve.now/CVE-2024-34405.md): Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL (CVSS 9.1)
- [CVE-2024-34406](https://cve.now/CVE-2024-34406.md): Improper exception handling in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to cause a denial of service (CVSS 5.3)
- [CVE-2024-36650](https://cve.now/CVE-2024-36650.md): TOTOLINK AC1200 Wireless Dual Band Gigabit Router firmware A3100R V4.1.2cu.5247\_B20211129, in the cgi function \`setNoticeCfg\` of the file \`/ (CVSS 7.5)
- [CVE-2024-36702](https://cve.now/CVE-2024-36702.md): libiec61850 v1.5 was discovered to contain a heap overflow via the BerEncoder\_encodeLength function at /asn1/ber\_encoder.c. (CVSS 7.4)
- [CVE-2024-36821](https://cve.now/CVE-2024-36821.md): Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.