CVEs published June 12, 2024
112 CVEs were published on June 12, 2024: 11 critical, 19 high.
- Published
- 112
- Critical
- 11
- High
- 19
- Medium
- 77
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Schneider Electric Sage
- 6
- GitLab
- 4
- IBM Db2 for Linux, UNIX and Windows
- 3
- Jan Syski MegaBIP
- 3
- Palo Alto Networks Cortex XDR Agent
- 3
- SourceCodester Employee and Visitor Gate Pass Logging System
- 3
- codename065 Download Manager
- 2
- Dell CPG BIOS
- 2
- freeipa · Red Hat Enterprise Linux
- 2
- FunnelKit Checkout
- 2
Critical 11
- CVE-2024-37036CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and paSchneider Electric Sage
- CVE-2024-36265Apache Submarine Server Core: authorization bypassApache Software Foundation Apache Submarine Server Core… +1
- CVE-2024-36264Apache Submarine Commons Utils: default secretApache Software Foundation Apache Submarine Commons Util… +1
- CVE-2024-1659Arbitrary File Upload in MegaBIPJan Syski MegaBIP
- CVE-2024-1577Remote Code Execution in MegaBIPJan Syski MegaBIP
- CVE-2024-1576SQL Injection in MegaBIPJan Syski MegaBIP
- CVE-2024-5211Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-4898InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User CreationInstaWP Connect – 1-click WP Staging & Migration
- CVE-2024-4315LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-36761naga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs.
- CVE-2024-36840SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive
High 19
- CVE-2024-3468Deserialization of Untrusted Data in AVEVA PI Web APIAVEVA PI Web API
- CVE-2024-3467Deserialization of Untrusted Data in AVEVA PI Asset Framework ClientAVEVA PI Asset Framework Client
- CVE-2024-0865CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administratiSchneider Electric EcoStruxure IT Gateway
- CVE-2024-2747CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user reSchneider Electric Easergy Studio
- CVE-2024-37038CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interfaceSchneider Electric Sage
- CVE-2024-37037CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticateSchneider Electric Sage
- CVE-2024-37300Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0jupyterhub oauthenticator · oauthenticator
- CVE-2024-28964Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools.Dell Common Event Enabler
- CVE-2024-34065@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypassstrapi · @strapi/plugin-users-permissions
- CVE-2024-36263Apache Submarine Server Core: SQL injectionApache Software Foundation Apache Submarine Server Core · o…
- CVE-2024-25949Dell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability.Dell SmartFabric OS10 Software
- CVE-2024-4845Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]icegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2023-48280WordPress Consensu.io plugin <= 1.0.1 - Broken Access Control vulnerabilityConsensu.io
- CVE-2024-5154Cri-o: malicious container can create symlink on hostcri-o · Red Hat OpenShift Container Platform +2
- CVE-2024-3183Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute forcefreeipa · Red Hat Enterprise Linux
- CVE-2024-2698Freeipa: delegation rules allow a proxy service to impersonate any user to access another target servicefreeipa · Red Hat Enterprise Linux
- CVE-2024-5543Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injectioncontrid Slideshow Gallery LITE
- CVE-2024-36856RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management.
- CVE-2024-37665An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST req
Medium, low and unrated 82
- CVE-2024-1736Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-1495Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-1963Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-4201Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-5798Vault Incorrectly Validated JSON Web Tokens (JWT) Audience ClaimsHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-29267IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2024-31881IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2024-28762IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2024-5559CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attaSchneider Electric PowerLogic P5
- CVE-2024-37040CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to Schneider Electric Sage
- CVE-2024-37039CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially craSchneider Electric Sage
- CVE-2024-5560CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a sSchneider Electric Sage
- CVE-2024-5898itsourcecode Payroll Management System print_payroll.php sql injectionitsourcecode Payroll Management System
- CVE-2024-5909Cortex XDR Agent: Local Windows User Can Disable the AgentPalo Alto Networks Cortex XDR Agent
- CVE-2024-5557CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attackeSchneider Electric SpaceLogic AS-P · Schneider Electric Spa…
- CVE-2024-5908GlobalProtect App: Encrypted Credential Exposure via Log FilesPalo Alto Networks GlobalProtect App
- CVE-2024-5907Cortex XDR Agent: Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks Cortex XDR Agent
- CVE-2024-5558CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker aSchneider Electric SpaceLogic AS-P · Schneider Electric Spa…
- CVE-2024-5906Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web InterfacePalo Alto Networks Prisma Cloud Compute
- CVE-2024-5905Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the AgentPalo Alto Networks Cortex XDR Agent
- CVE-2024-5759Improper privilege managementTenable Security Center
- CVE-2024-5897SourceCodester Employee and Visitor Gate Pass Logging System cross site scriptingSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-1891Stored Cross Site ScriptingTenable Security Center
- CVE-2024-5896SourceCodester Employee and Visitor Gate Pass Logging System save_users sql injectionSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-37297WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration formswoocommerce · woocommerce/woocommerce
- CVE-2024-2300HP Advance Mobile Application – Potential Information DisclosureHP Advance Mobile Application
- CVE-2024-5895SourceCodester Employee and Visitor Gate Pass Logging System delete_users sql injectionSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2024-5894SourceCodester Online Eyewear Shop manage_product.php sql injectionSourceCodester Online Eyewear Shop
- CVE-2024-31217@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handlingstrapi · @strapi/plugin-upload
- CVE-2024-29181@strapi/plugin-content-manager leaks data via relations via the Admin Panelstrapi · @strapi/plugin-content-manager
- CVE-2024-5893SourceCodester Cab Management System sql injectionSourceCodester Cab Management System
- CVE-2024-37304NuGetGallery's Markdown Autolinks Processing Vulnerable to Cross-site ScriptingNuGetGallery
- CVE-2024-23445Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictionsElasticsearch
- CVE-2024-5891Quay: unauthorized user may authenticate via oauth application tokenRed Hat Quay
- CVE-2024-5313CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface.Schneider Electric EVlink Home Smart
- CVE-2024-5056CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and pSchneider Electric Modicon M340 · Schneider Electric Net… +1
- CVE-2024-5674Newsletter - API v1 and v2 addon for Newsletter <= 2.4.5 - Missing Authorization to Email Subscribers ManagementThe Newsletter Team Newsletter - API v1 and v2 addon for Ne…
- CVE-2024-3492Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodesnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2024-1766Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scriptingcodename065 Download Manager
- CVE-2023-40209WordPress Highcompress Image Compressor plugin <= 6.0.0 - Broken Access Control vulnerabilityHimalaya Saxena Highcompress Image Compressor
- CVE-2023-40603WordPress Simple Org Chart plugin <= 2.3.4 - Broken Access Control vulnerabilityGangesh Matta Simple Org Chart
- CVE-2023-41240WordPress Pricing Deals for WooCommercePricing Deals for WooCommerce plugin <= 2.0.3.2 - Broken Access Control vulnerabilityVark Pricing Deals for WooCommerce
- CVE-2023-44234WordPress WP GPX Maps plugin <= 1.7.08 - Broken Access Control vulnerabilityBastianon Massimo WP GPX Map
- CVE-2023-25030WordPress Buy Me a Coffee plugin <= 3.7 - Broken Access Control vulnerabilityBuy Me a Coffee
- CVE-2023-38395WordPress WP Clone Menu plugin <= 1.0.1 - Broken Access Control vulnerabilityAfzal Multani WP Clone Menu
- CVE-2023-40672WordPress Sticky Social Media Icons plugin <= 2.1 - Broken Access Control vulnerabilityHardik Chavada Sticky Social Media Icons
- CVE-2024-2092Elementor Addon Elements <= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widgetwpvibes Addon Elements for Elementor
- CVE-2023-47845WordPress Grab & Save plugin <= 1.0.4 - Cross-Site Request Forgery (CSRF) vulnerabilityLim Kai Yang Grab & Save
- CVE-2023-51413WordPress Piotnet Forms plugin <= 1.0.29 - Broken Access Control vulnerabilityPiotnet Forms
- CVE-2023-47828WordPress wpMandrill plugin <= 1.33 - Broken Access Control vulnerabilitywpMandrill
- CVE-2023-51524WordPress weForms plugin <= 1.6.18 - Broken Access Control vulnerabilityweForms
- CVE-2023-51526WordPress Simple Staff List plugin <= 2.2.4 - Broken Access Control vulnerabilityBrett Shumaker Simple Staff List
- CVE-2023-51537WordPress Awesome Support plugin <= 6.1.5 - Broken Access Control vulnerabilityAwesome Support Team Awesome Support
- CVE-2023-51670WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Arbitrary Plugin Activation vulnerabilityFunnelKit Checkout
- CVE-2024-5742Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned filenano · Red Hat Enterprise Linux
- CVE-2023-51671WordPress FunnelKit Checkout plugin <= 3.10.3 - Authenticated Plugin Settings Change vulnerabilityFunnelKit Checkout
- CVE-2023-51679WordPress BulkGate SMS Plugin for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerabilityBulkGate SMS Plugin for WooCommerce
- CVE-2023-51680WordPress Quotes for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerabilityTechnoVama Quotes for WooCommerce
- CVE-2023-52117WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerabilityMetagauss ProfileGrid
- CVE-2023-52177WordPress Integrate Google Drive plugin <= 1.3.3 - Broken Access Control vulnerabilitySoftLab Integrate Google Drive
- CVE-2024-5468WordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletionstylemix Pearl – Header Builder
- CVE-2024-5266Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodescodename065 Download Manager
- CVE-2024-3925Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick eventsbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-5739The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability.LINE client for iOS
- CVE-2024-28970Dell Client BIOS contains an Out-of-bounds Write vulnerability.Dell CPG BIOS
- CVE-2024-0160Dell Client Platform contains an incorrect authorization vulnerability.Dell CPG BIOS
- CVE-2024-4924Sassy social share < 3.3.63 Admin+ Stored Cross-Site scriptingSocial Sharing Plugin
- CVE-2024-0427Arforms < 6.4.1 - Reflected XSSARForms - Premium WordPress Form Builder Plugin
- CVE-2024-5892Divi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploadbadhonrocks Divi Torque Lite – Divi Theme, Divi Builder & E…
- CVE-2024-36454Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 aFsas Technologies IPCOM EX2 Series · Fsas Technologies IPCO…
- CVE-2024-3559Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]mgibbs189 Custom Field Suite
- CVE-2024-4564CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetscodexpert CoDesigner – All in One Elementor WooCommerce Bui…
- CVE-2024-5553Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-4892BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingBuddyPress
- CVE-2024-36103OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent atELECOM CO. WRC-X5400GS-B · ELECOM CO. WRC-X5400GSA-B
- CVE-2023-49559An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the github.com/vektah/gqlparser/v2 · github.com/vektah/gqlparser
- CVE-2024-22855A cross-site scripting (XSS) vulnerability in the User Maintenance section of ITSS iMLog v1.307 allows attackers to execute arbitrary web sc
- CVE-2024-24051Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts t
- CVE-2024-36523An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own or
- CVE-2024-36691Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users
- CVE-2024-37629SummerNote v0.9.1 is vulnerable to Cross Site Scripting (XSS) via the Code View Function.summernote
- CVE-2024-37878Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime