# CVEs published 2024-06-12

112 CVEs were published on June 12, 2024: 11 critical, 19 high. Days are UTC.

- [CVE-2024-1736](https://cve.now/CVE-2024-1736.md): Uncontrolled Resource Consumption in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-1495](https://cve.now/CVE-2024-1495.md): Uncontrolled Resource Consumption in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-1963](https://cve.now/CVE-2024-1963.md): Uncontrolled Resource Consumption in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-4201](https://cve.now/CVE-2024-4201.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 4.4, GitLab)
- [CVE-2024-3468](https://cve.now/CVE-2024-3468.md): Deserialization of Untrusted Data in AVEVA PI Web API (CVSS 8.4, AVEVA PI Web API)
- [CVE-2024-3467](https://cve.now/CVE-2024-3467.md): Deserialization of Untrusted Data in AVEVA PI Asset Framework Client (CVSS 7.0, AVEVA PI Asset Framework Client)
- [CVE-2024-5798](https://cve.now/CVE-2024-5798.md): Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims (CVSS 2.6, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2023-29267](https://cve.now/CVE-2023-29267.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-31881](https://cve.now/CVE-2024-31881.md): IBM Db2 denial of service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-28762](https://cve.now/CVE-2024-28762.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-0865](https://cve.now/CVE-2024-0865.md): CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrati (CVSS 7.8, Schneider Electric EcoStruxure IT Gateway)
- [CVE-2024-5559](https://cve.now/CVE-2024-5559.md): CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an atta (CVSS 6.1, Schneider Electric PowerLogic P5)
- [CVE-2024-2747](https://cve.now/CVE-2024-2747.md): CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user re (CVSS 7.8, Schneider Electric Easergy Studio)
- [CVE-2024-37040](https://cve.now/CVE-2024-37040.md): CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to (CVSS 5.4, Schneider Electric Sage)
- [CVE-2024-37039](https://cve.now/CVE-2024-37039.md): CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially cra (CVSS 5.9, Schneider Electric Sage)
- [CVE-2024-37038](https://cve.now/CVE-2024-37038.md): CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface (CVSS 7.5, Schneider Electric Sage)
- [CVE-2024-37037](https://cve.now/CVE-2024-37037.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticate (CVSS 8.1, Schneider Electric Sage)
- [CVE-2024-37036](https://cve.now/CVE-2024-37036.md): CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and pa (CVSS 9.8, Schneider Electric Sage)
- [CVE-2024-5560](https://cve.now/CVE-2024-5560.md): CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a s (CVSS 5.3, Schneider Electric Sage)
- [CVE-2024-5898](https://cve.now/CVE-2024-5898.md): itsourcecode Payroll Management System print\_payroll.php sql injection (CVSS 5.3, itsourcecode Payroll Management System)
- [CVE-2024-5909](https://cve.now/CVE-2024-5909.md): Cortex XDR Agent: Local Windows User Can Disable the Agent (CVSS 6.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2024-5557](https://cve.now/CVE-2024-5557.md): CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacke (CVSS 4.5, Schneider Electric SpaceLogic AS-P · Schneider Electric Spa…)
- [CVE-2024-5908](https://cve.now/CVE-2024-5908.md): GlobalProtect App: Encrypted Credential Exposure via Log Files (CVSS 5.5, Palo Alto Networks GlobalProtect App)
- [CVE-2024-5907](https://cve.now/CVE-2024-5907.md): Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability (CVSS 5.2, Palo Alto Networks Cortex XDR Agent)
- [CVE-2024-5558](https://cve.now/CVE-2024-5558.md): CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker a (CVSS 6.4, Schneider Electric SpaceLogic AS-P · Schneider Electric Spa…)
- [CVE-2024-5906](https://cve.now/CVE-2024-5906.md): Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 4.8, Palo Alto Networks Prisma Cloud Compute)
- [CVE-2024-5905](https://cve.now/CVE-2024-5905.md): Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the Agent (CVSS 2.0, Palo Alto Networks Cortex XDR Agent)
- [CVE-2024-5759](https://cve.now/CVE-2024-5759.md): Improper privilege management (CVSS 5.4, Tenable Security Center)
- [CVE-2024-5897](https://cve.now/CVE-2024-5897.md): SourceCodester Employee and Visitor Gate Pass Logging System cross site scripting (CVSS 6.9, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-1891](https://cve.now/CVE-2024-1891.md): Stored Cross Site Scripting (CVSS 3.5, Tenable Security Center)
- [CVE-2024-5896](https://cve.now/CVE-2024-5896.md): SourceCodester Employee and Visitor Gate Pass Logging System save\_users sql injection (CVSS 6.9, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-37300](https://cve.now/CVE-2024-37300.md): Globus \`identity\_provider\` restriction ignored when used with \`allow\_all\` in JupyterHub 5.0 (CVSS 8.1, jupyterhub oauthenticator · oauthenticator)
- [CVE-2024-37297](https://cve.now/CVE-2024-37297.md): WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms (CVSS 5.4, woocommerce · woocommerce/woocommerce)
- [CVE-2024-28964](https://cve.now/CVE-2024-28964.md): Dell Common Event Enabler, version 8.9.10.0 and prior, contain an insecure deserialization vulnerability in CAVATools. (CVSS 7.8, Dell Common Event Enabler)
- [CVE-2024-2300](https://cve.now/CVE-2024-2300.md): HP Advance Mobile Application – Potential Information Disclosure (CVSS 6.2, HP Advance Mobile Application)
- [CVE-2024-5895](https://cve.now/CVE-2024-5895.md): SourceCodester Employee and Visitor Gate Pass Logging System delete\_users sql injection (CVSS 5.3, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-5894](https://cve.now/CVE-2024-5894.md): SourceCodester Online Eyewear Shop manage\_product.php sql injection (CVSS 6.9, SourceCodester Online Eyewear Shop)
- [CVE-2024-34065](https://cve.now/CVE-2024-34065.md): @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass (CVSS 7.1, strapi · @strapi/plugin-users-permissions)
- [CVE-2024-31217](https://cve.now/CVE-2024-31217.md): @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling (CVSS 5.3, strapi · @strapi/plugin-upload)
- [CVE-2024-29181](https://cve.now/CVE-2024-29181.md): @strapi/plugin-content-manager leaks data via relations via the Admin Panel (CVSS 2.3, strapi · @strapi/plugin-content-manager)
- [CVE-2024-5893](https://cve.now/CVE-2024-5893.md): SourceCodester Cab Management System sql injection (CVSS 5.3, SourceCodester Cab Management System)
- [CVE-2024-37304](https://cve.now/CVE-2024-37304.md): NuGetGallery's Markdown Autolinks Processing Vulnerable to Cross-site Scripting (CVSS 6.1, NuGetGallery)
- [CVE-2024-36265](https://cve.now/CVE-2024-36265.md): Apache Submarine Server Core: authorization bypass (CVSS 9.8, Apache Software Foundation Apache Submarine Server Core… +1)
- [CVE-2024-36264](https://cve.now/CVE-2024-36264.md): Apache Submarine Commons Utils: default secret (CVSS 9.8, Apache Software Foundation Apache Submarine Commons Util… +1)
- [CVE-2024-36263](https://cve.now/CVE-2024-36263.md): Apache Submarine Server Core: SQL injection (CVSS 8.1, Apache Software Foundation Apache Submarine Server Core · o…)
- [CVE-2024-23445](https://cve.now/CVE-2024-23445.md): Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions (CVSS 6.5, Elasticsearch)
- [CVE-2024-1659](https://cve.now/CVE-2024-1659.md): Arbitrary File Upload in MegaBIP (CVSS 9.3, Jan Syski MegaBIP)
- [CVE-2024-1577](https://cve.now/CVE-2024-1577.md): Remote Code Execution in MegaBIP (CVSS 9.3, Jan Syski MegaBIP)
- [CVE-2024-1576](https://cve.now/CVE-2024-1576.md): SQL Injection in MegaBIP (CVSS 9.3, Jan Syski MegaBIP)
- [CVE-2024-5891](https://cve.now/CVE-2024-5891.md): Quay: unauthorized user may authenticate via oauth application token (CVSS 4.2, Red Hat Quay)
- [CVE-2024-25949](https://cve.now/CVE-2024-25949.md): Dell OS10 Networking Switches, versions10.5.6.x, 10.5.5.x, 10.5.4.x and 10.5.3.x ,contain an improper authorization vulnerability. (CVSS 8.8, Dell SmartFabric OS10 Software)
- [CVE-2024-5313](https://cve.now/CVE-2024-5313.md): CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. (CVSS 6.5, Schneider Electric EVlink Home Smart)
- [CVE-2024-5056](https://cve.now/CVE-2024-5056.md): CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and p (CVSS 6.5, Schneider Electric Modicon M340 · Schneider Electric Net… +1)
- [CVE-2024-5211](https://cve.now/CVE-2024-5211.md): Path Traversal to Arbitrary File Read/Delete/Overwrite, DoS Attack, and Admin Account Takeover in mintplex-labs/anything-llm (CVSS 9.1, mintplex-labs/anything-llm)
- [CVE-2024-5674](https://cve.now/CVE-2024-5674.md): Newsletter - API v1 and v2 addon for Newsletter \<= 2.4.5 - Missing Authorization to Email Subscribers Management (CVSS 6.5, The Newsletter Team Newsletter - API v1 and v2 addon for Ne…)
- [CVE-2024-3492](https://cve.now/CVE-2024-3492.md): Events Manager – Calendar, Bookings, Tickets, and more! \<= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event\_category Shortcodes (CVSS 6.4, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2024-1766](https://cve.now/CVE-2024-1766.md): Download Manager \<= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting (CVSS 4.4, codename065 Download Manager)
- [CVE-2024-4898](https://cve.now/CVE-2024-4898.md): InstaWP Connect – 1-click WP Staging & Migration \<= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User Creation (CVSS 9.8, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2023-40209](https://cve.now/CVE-2023-40209.md): WordPress Highcompress Image Compressor plugin \<= 6.0.0 - Broken Access Control vulnerability (CVSS 6.5, Himalaya Saxena Highcompress Image Compressor)
- [CVE-2023-40603](https://cve.now/CVE-2023-40603.md): WordPress Simple Org Chart plugin \<= 2.3.4 - Broken Access Control vulnerability (CVSS 5.3, Gangesh Matta Simple Org Chart)
- [CVE-2023-41240](https://cve.now/CVE-2023-41240.md): WordPress Pricing Deals for WooCommercePricing Deals for WooCommerce plugin \<= 2.0.3.2 - Broken Access Control vulnerability (CVSS 5.3, Vark Pricing Deals for WooCommerce)
- [CVE-2023-44234](https://cve.now/CVE-2023-44234.md): WordPress WP GPX Maps plugin \<= 1.7.08 - Broken Access Control vulnerability (CVSS 4.3, Bastianon Massimo WP GPX Map)
- [CVE-2023-25030](https://cve.now/CVE-2023-25030.md): WordPress Buy Me a Coffee plugin \<= 3.7 - Broken Access Control vulnerability (CVSS 4.3, Buy Me a Coffee)
- [CVE-2023-38395](https://cve.now/CVE-2023-38395.md): WordPress WP Clone Menu plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.4, Afzal Multani WP Clone Menu)
- [CVE-2023-40672](https://cve.now/CVE-2023-40672.md): WordPress Sticky Social Media Icons plugin \<= 2.1 - Broken Access Control vulnerability (CVSS 5.4, Hardik Chavada Sticky Social Media Icons)
- [CVE-2024-2092](https://cve.now/CVE-2024-2092.md): Elementor Addon Elements \<= 1.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget (CVSS 5.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-4845](https://cve.now/CVE-2024-4845.md): Icegram Express \<= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options\[list\_id\] (CVSS 8.8, icegram Email Subscribers & Newsletters – Email Marketing,…)
- [CVE-2023-47845](https://cve.now/CVE-2023-47845.md): WordPress Grab & Save plugin \<= 1.0.4 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Lim Kai Yang Grab & Save)
- [CVE-2023-48280](https://cve.now/CVE-2023-48280.md): WordPress Consensu.io plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 7.5, Consensu.io)
- [CVE-2023-51413](https://cve.now/CVE-2023-51413.md): WordPress Piotnet Forms plugin \<= 1.0.29 - Broken Access Control vulnerability (CVSS 5.3, Piotnet Forms)
- [CVE-2023-47828](https://cve.now/CVE-2023-47828.md): WordPress wpMandrill plugin \<= 1.33 - Broken Access Control vulnerability (CVSS 4.3, wpMandrill)
- [CVE-2023-51524](https://cve.now/CVE-2023-51524.md): WordPress weForms plugin \<= 1.6.18 - Broken Access Control vulnerability (CVSS 4.3, weForms)
- [CVE-2023-51526](https://cve.now/CVE-2023-51526.md): WordPress Simple Staff List plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 4.3, Brett Shumaker Simple Staff List)
- [CVE-2023-51537](https://cve.now/CVE-2023-51537.md): WordPress Awesome Support plugin \<= 6.1.5 - Broken Access Control vulnerability (CVSS 5.3, Awesome Support Team Awesome Support)
- [CVE-2023-51670](https://cve.now/CVE-2023-51670.md): WordPress FunnelKit Checkout plugin \<= 3.10.3 - Authenticated Arbitrary Plugin Activation vulnerability (CVSS 4.3, FunnelKit Checkout)
- [CVE-2024-5742](https://cve.now/CVE-2024-5742.md): Nano: running \`chmod\` and \`chown\` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file (CVSS 6.7, nano · Red Hat Enterprise Linux)
- [CVE-2024-5154](https://cve.now/CVE-2024-5154.md): Cri-o: malicious container can create symlink on host (CVSS 8.1, cri-o · Red Hat OpenShift Container Platform +2)
- [CVE-2023-51671](https://cve.now/CVE-2023-51671.md): WordPress FunnelKit Checkout plugin \<= 3.10.3 - Authenticated Plugin Settings Change vulnerability (CVSS 5.4, FunnelKit Checkout)
- [CVE-2023-51679](https://cve.now/CVE-2023-51679.md): WordPress BulkGate SMS Plugin for WooCommerce plugin \<= 3.0.2 - Broken Access Control vulnerability (CVSS 5.4, BulkGate SMS Plugin for WooCommerce)
- [CVE-2023-51680](https://cve.now/CVE-2023-51680.md): WordPress Quotes for WooCommerce plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 4.3, TechnoVama Quotes for WooCommerce)
- [CVE-2023-52117](https://cve.now/CVE-2023-52117.md): WordPress ProfileGrid plugin \<= 5.6.6 - Broken Access Control vulnerability (CVSS 4.3, Metagauss ProfileGrid)
- [CVE-2023-52177](https://cve.now/CVE-2023-52177.md): WordPress Integrate Google Drive plugin \<= 1.3.3 - Broken Access Control vulnerability (CVSS 5.4, SoftLab Integrate Google Drive)
- [CVE-2024-5468](https://cve.now/CVE-2024-5468.md): WordPress Header Builder Plugin – Pearl \<= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion (CVSS 6.5, stylemix Pearl – Header Builder)
- [CVE-2024-5266](https://cve.now/CVE-2024-5266.md): Download Manager \<= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, codename065 Download Manager)
- [CVE-2024-3183](https://cve.now/CVE-2024-3183.md): Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force (CVSS 8.1, freeipa · Red Hat Enterprise Linux)
- [CVE-2024-2698](https://cve.now/CVE-2024-2698.md): Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service (CVSS 8.8, freeipa · Red Hat Enterprise Linux)
- [CVE-2024-3925](https://cve.now/CVE-2024-3925.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-5739](https://cve.now/CVE-2024-5739.md): The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. (CVSS 6.1, LINE client for iOS)
- [CVE-2024-28970](https://cve.now/CVE-2024-28970.md): Dell Client BIOS contains an Out-of-bounds Write vulnerability. (CVSS 4.7, Dell CPG BIOS)
- [CVE-2024-0160](https://cve.now/CVE-2024-0160.md): Dell Client Platform contains an incorrect authorization vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2024-4924](https://cve.now/CVE-2024-4924.md): Sassy social share \< 3.3.63 Admin+ Stored Cross-Site scripting (CVSS 6.1, Social Sharing Plugin)
- [CVE-2024-0427](https://cve.now/CVE-2024-0427.md): Arforms \< 6.4.1 - Reflected XSS (CVSS 6.3, ARForms - Premium WordPress Form Builder Plugin)
- [CVE-2024-5892](https://cve.now/CVE-2024-5892.md): Divi Torque Lite – Divi Theme and Extra Theme \<= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 6.4, badhonrocks Divi Torque Lite – Divi Theme, Divi Builder & E…)
- [CVE-2024-36454](https://cve.now/CVE-2024-36454.md): Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 a (CVSS 5.3, Fsas Technologies IPCOM EX2 Series · Fsas Technologies IPCO…)
- [CVE-2024-3559](https://cve.now/CVE-2024-3559.md): Custom Field Suite \<= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs\[post\_content\] (CVSS 6.4, mgibbs189 Custom Field Suite)
- [CVE-2024-4564](https://cve.now/CVE-2024-4564.md): CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More \<= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, codexpert CoDesigner – All in One Elementor WooCommerce Bui…)
- [CVE-2024-5553](https://cve.now/CVE-2024-5553.md): Premium Addons for Elementor \<= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 4.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-5543](https://cve.now/CVE-2024-5543.md): Slideshow Gallery LITE \<= 1.8.1 - Authenticated (Contributor+) SQL Injection (CVSS 8.1, contrid Slideshow Gallery LITE)
- [CVE-2024-4892](https://cve.now/CVE-2024-4892.md): BuddyPress \<= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, BuddyPress)
- [CVE-2024-4315](https://cve.now/CVE-2024-4315.md): LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollms (CVSS 9.1, parisneo/lollms · lollms)
- [CVE-2024-36103](https://cve.now/CVE-2024-36103.md): OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent at (CVSS 6.8, ELECOM CO. WRC-X5400GS-B · ELECOM CO. WRC-X5400GSA-B)
- [CVE-2023-49559](https://cve.now/CVE-2023-49559.md): An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the (CVSS 3.7, github.com/vektah/gqlparser/v2 · github.com/vektah/gqlparser)
- [CVE-2024-22855](https://cve.now/CVE-2024-22855.md): A cross-site scripting (XSS) vulnerability in the User Maintenance section of ITSS iMLog v1.307 allows attackers to execute arbitrary web sc (CVSS 5.4)
- [CVE-2024-24051](https://cve.now/CVE-2024-24051.md): Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts t (CVSS 5.5)
- [CVE-2024-36523](https://cve.now/CVE-2024-36523.md): An access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in the application after deleting their own or (CVSS 6.5)
- [CVE-2024-36691](https://cve.now/CVE-2024-36691.md): Insecure permissions in the AdminController.AjaxSave() method of PPGo\_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users (CVSS 6.3)
- [CVE-2024-36761](https://cve.now/CVE-2024-36761.md): naga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs. (CVSS 9.8)
- [CVE-2024-36840](https://cve.now/CVE-2024-36840.md): SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive (CVSS 9.1)
- [CVE-2024-36856](https://cve.now/CVE-2024-36856.md): RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. (CVSS 7.5)
- [CVE-2024-37629](https://cve.now/CVE-2024-37629.md): SummerNote v0.9.1 is vulnerable to Cross Site Scripting (XSS) via the Code View Function. (CVSS 6.1, summernote)
- [CVE-2024-37665](https://cve.now/CVE-2024-37665.md): An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST req (CVSS 8.8)
- [CVE-2024-37878](https://cve.now/CVE-2024-37878.md): Cross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary code via the /TWCMS-gh-pages/twcms/runtime (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.