CVEs published June 14, 2024
156 CVEs were published on June 14, 2024: 18 critical, 55 high.
- Published
- 156
- Critical
- 18
- High
- 55
- Medium
- 74
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Toshiba Tec e-Studio multi-function peripheral
- 43
- nextcloud security-advisories
- 12
- Huawei HarmonyOS · Huawei EMUI
- 7
- ASUS Download Master
- 5
- Rockwell Automation FactoryTalk® View SE
- 3
- ASUS ZenWiFi XT8 · ASUS RT-AX88U +4
- 2
- HCL Software DRYiCE Optibot Reset Station
- 2
- itsourcecode Online Bookstore
- 2
- Mattermost · mattermost-desktop
- 2
- Pray For Me
- 2
Critical 18
- CVE-2024-5671Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution anTrellix Intrusion Prevention System (IPS) Manager
- CVE-2024-2472LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDORLatePoint Plugin
- CVE-2024-3912ASUS Router - Upload arbitrary firmwareASUS DSL-N17U · ASUS DSL-N55U_C1 +20
- CVE-2024-5577Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusionmcnardelli Where I Was, Where I Will Be
- CVE-2024-4936Canto <= 3.0.8 - Unauthenticated Remote File Inclusionflightbycanto Canto
- CVE-2024-27174insecure uploadToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27173insecure uploadToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27172Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-3080ASUS Router - Improper AuthenticationASUS ZenWiFi XT8 · ASUS RT-AX88U +4
- CVE-2024-27145Multiple Post-authenticated Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27144Pre-authenticated Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27143Pre-authenticated Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-33374Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal with
- CVE-2024-33375LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.
- CVE-2024-34539Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server.
- CVE-2024-37637TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg.
- CVE-2024-37642TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /fo
- CVE-2024-37831Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll_items.php via the ID parameter.
High 55
- CVE-2024-37369Rockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File PermissionsRockwell Automation FactoryTalk® View SE
- CVE-2024-5659Rockwell Automation Multicast Request Causes major nonrecoverable fault on Select ControllersRockwell Automation ControlLogix® · Rockwell Automation… +3
- CVE-2024-37882Nextcloud Server can reshare read&share only folder with more permissionsnextcloud security-advisories
- CVE-2024-37313Nextcloud server allows the by-pass the second factornextcloud security-advisories
- CVE-2024-34694LNbits improperly handles potential network and payment failures when using Eclair backendlnbits
- CVE-2024-37368Rockwell Automation FactoryTalk® View SE v11 Information Leakage Vulnerability via Authentication RestrictionRockwell Automation FactoryTalk® View SE
- CVE-2024-37367Rockwell Automation FactoryTalk® View SE v12 Information Leakage Vulnerability via Authentication RestrictionRockwell Automation FactoryTalk® View SE
- CVE-2024-2024Folders Pro <= 3.0.2 - Authenticated(Author+) Arbitrary File Upload via handle_folders_file_uploadPremio Folders Pro
- CVE-2024-36459Cross-Site Scripting Vulnerability in Symantec SiteMinder Web AgentBroadcom Symantec SiteMinder
- CVE-2024-5685Broken Function Level Authorization (BFLA) in snipe/snipe-itsnipe-it · snipe/snipe-it
- CVE-2024-36503Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-36502Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-36500Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentialitHuawei HarmonyOS · Huawei EMUI
- CVE-2024-5995Soar Cloud HR Portal - Insufficient Session ExpirationSoar Cloud HR Portal
- CVE-2024-31163ASUS Download Master - Buffer OverflowASUS Download Master
- CVE-2024-31162ASUS Download Master - OS Command InjectionASUS Download Master
- CVE-2024-4404ElementsKit PRO <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgerywpmet ElementsKit Pro
- CVE-2024-5551WP STAGING PRO - Backup Duplicator & Migration <= 5.6.0 - Cross-Site Request Forgery to Limited Local File InclusionWPStaging WP STAGING Pro WordPress Backup Plugin
- CVE-2024-1094Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalationarraytics Timetics – Appointment Booking & Scheduling
- CVE-2024-3498Incorrect Permission Assignment Privilege Escalation VulnerabilityToshiba Tec e-Studio multi-function peripheral
- CVE-2024-3497Directory Traversal Remote Code Execution VulnerabilityToshiba Tec e-Studio multi-function peripheral
- CVE-2024-3496Authentication Bypass VulnerabilityToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27178Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27177Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27176Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27171Insecure permissionsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27170Hardcoded credentials for WebDAV accessToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27169Lack of authenticationToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27168Hardcoded keys used to generate authentication cookiesToshiba Tec e-Studio multi-function peripheral
- CVE-2024-31161ASUS Download Master - Arbitrary File UploadASUS Download Master
- CVE-2024-27167Insecure permissionsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27166Insecure permissionsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27165Local Privilege EscalationToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27164Hardcoded credentialsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27158Hardcoded root passwordToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27155Local Privilege Escalation and Remote Code Execution using insecure permissionsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27153Local Privilege Escalation and Remote Code ExecutionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27152Local Privilege Escalation and Remote Code Execution using insecure permissionsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27151Local Privilege Escalation and Remote Code Execution using insecure permissionsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27150Local Privilege Escalation and Remote Code Execution using insecure LD_LIBRARY_PATHToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27149Local Privilege Escalation and Remote Code Execution using insecure LD_PRELOADToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27148Local Privilege Escalation and Remote Code Execution using insecure PATHToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27147Local Privilege Escalation and Remote Code Execution using snmpdToshiba Tec e-Studio multi-function peripheral
- CVE-2024-3079ASUS Router - Stack-based Buffer OverflowASUS ZenWiFi XT8 · ASUS RT-AX88U +4
- CVE-2024-24320Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information a
- CVE-2024-33377LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page.
- CVE-2024-36597Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.
- CVE-2024-36598An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.
- CVE-2024-36600Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image fi
- CVE-2024-37639TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via eport in the function setIpPortFilterRules.
- CVE-2024-37640TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWiFiEasyGuestCfg.
- CVE-2024-37641TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule
- CVE-2024-37643TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formPasswordAut
- CVE-2024-37644TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attacker
- CVE-2024-37645TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formSysLog .
Medium, low and unrated 83
- CVE-2024-30120HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web applicationHCL Software DRYiCE Optibot Reset Station
- CVE-2024-21988CVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale)NetApp StorageGRID
- CVE-2024-30119HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security HeaderHCL Software DRYiCE Optibot Reset Station
- CVE-2024-6003Guangdong Baolun Electronics IP Network Broadcasting Service Platform maps sql injectionGuangdong Baolun Electronics IP Network Broadcasting Servic…
- CVE-2024-37889MyFinances Allows Unauthorized Access to Other Customer DataTreyWW MyFinances
- CVE-2024-37888The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionalitymlewand ckeditor-plugin-openlink
- CVE-2024-37887Nextcloud Server's events information leaked with shared calendars on recurrence exceptionsnextcloud security-advisories
- CVE-2024-37886Nextcloud user_oidc's ID4me does not validate signature or expirationnextcloud security-advisories
- CVE-2024-37885Code injection in Nextcloud Desktop Client for macOSnextcloud security-advisories
- CVE-2024-37884Nextcloud Server's users can delete old versions of read-only shared filesnextcloud security-advisories
- CVE-2024-37883Nextcloud Deck can access comments and attachments of deleted cardsnextcloud security-advisories
- CVE-2024-37317Nextcloud Notes app can be tricked into using a received share created before the user logged innextcloud security-advisories
- CVE-2024-37316Nextcloud Calendar's event create can create attachments that link to other websitesnextcloud security-advisories
- CVE-2024-37315Nextcloud Server's read-only users can restore old versionsnextcloud security-advisories
- CVE-2024-37314Nextcloud Photos' shared albums have no restriction on photo removalnextcloud security-advisories
- CVE-2024-37312Nextcloud user_oidc app's ID4me feature is available even when disablednextcloud security-advisories
- CVE-2024-23442Kibana open redirect issueElastic Kibana
- CVE-2024-5731A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination Trellix Intrusion Prevention System (IPS) Manager
- CVE-2024-2023Folders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_uploadpremio Folders – Unlimited Folders to Organize Media Librar…
- CVE-2023-51376WordPress ProjectHuddle Client Site plugin <= 1.0.34 - Broken Access Control vulnerabilityBrainstorm Force ProjectHuddle Client Site
- CVE-2024-34012Local privilege escalation due to insecure folder permissions.Acronis Cloud Manager
- CVE-2024-37182Lack of permissions prompting when opening external URLsMattermost · mattermost-desktop
- CVE-2024-36287Bypass of TCC restrictions on macOSMattermost · mattermost-desktop
- CVE-2024-4863Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameterstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-25142Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-5961Reflected XSS in 2ClickPortalTrol InterMedia Sp. z o.o. Sp. k. 2ClickPortal
- CVE-2024-5465Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-5464Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affecHuawei HarmonyOS · Huawei EMUI
- CVE-2024-36501Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-36499Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect servicHuawei HarmonyOS · Huawei EMUI
- CVE-2024-5994WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpgmaps WP Go Maps
- CVE-2024-5155Inquiry Cart <= 3.4.2 - Stored XSS via CSRFInquiry cart
- CVE-2024-4751WP Prayer II <= 2.4.7 - Settings Update via CSRFWP Prayer II
- CVE-2024-4480WP Prayer II <= 2.4.7 - Email Settings Update via CSRFWP Prayer II
- CVE-2024-4271SVGator <= 1.2.6 - Stored XSS via SVG UploadSVGator
- CVE-2024-4270SVGMagic <= 1.1 - Stored XSS via SVG UploadSVGMagic
- CVE-2024-4005Social Pixel <= 2.1 - Admin+ Stored XSSSocial Pixel
- CVE-2024-3993AZAN Plugin <= 0.6 - Stored XSS via CSRFAZAN Plugin
- CVE-2024-3992Amen <= 3.3.1 - Admin+ Stored XSSAmen
- CVE-2024-3978WordPress Jitsi Shortcode <= 0.1 - Contributor+ Stored XSS via ShortcodeWordPress Jitsi Shortcode
- CVE-2024-3977WordPress Jitsi Shortcode <= 0.1 - Admin+ Stored XSSWordPress Jitsi Shortcode
- CVE-2024-3972Similarity <= 3.0 - Stored XSS via CSRFSimilarity
- CVE-2024-3971Similarity <= 3.0 - Plugin Reset via CSRFSimilarity
- CVE-2024-3966Pray For Me <= 1.0.4 - Unauthenticated Stored XSSPray For Me
- CVE-2024-3965Pray For Me <= 1.0.4 - Settings Update via CSRFPray For Me
- CVE-2024-3754Alemha Watermarker <= 1.3.1 - Author+ Stored XSSAlemha watermarker
- CVE-2024-2218LuckyWP Table of Contents <= 2.1.4 - Admin+ Stored XSSLuckyWP Table of Contents
- CVE-2024-1295The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Accessevents-calendar-pro · The Events Calendar
- CVE-2023-51377WordPress Everest Forms plugin <= 2.0.3 - Broken Access Control vulnerabilityWPEverest Everest Forms
- CVE-2023-51495WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerabilityWooCommerce Warranty Requests
- CVE-2023-51496WordPress WooCommerce Warranty Requests plugin <= 2.2.7 - Broken Access Control vulnerabilityWooCommerce Warranty Requests
- CVE-2024-2122FooGallery <= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URLfooplugins Gallery by FooGallery
- CVE-2024-23504WordPress Ninja Tables plugin <= 5.0.5 - Broken Access Control vulnerabilityWPManageNinja Ninja Tables
- CVE-2023-51497WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.9 - Broken Access Control vulnerabilityWooCommerce Ship to Multiple Addresses
- CVE-2024-27180TOCTOU vulnerabilityToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27179Session disclosure inside the log filesToshiba Tec e-Studio multi-function peripheral
- CVE-2024-5469Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-27175Local File InclusionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-31160ASUS Download Master - Stored XSSASUS Download Master
- CVE-2024-27163Leak of admin password and passwordsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27162DOM-based XSSToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27161Hardcoded password used to encrypt filesToshiba Tec e-Studio multi-function peripheral
- CVE-2023-6492Simple Sitemap <= 3.5.13 - Cross-Site Request Forgery via admin_noticesdgwyer Simple Sitemap – Create a Responsive HTML Sitemap
- CVE-2024-0892Schema App Structured Data <= 2.2.0 - Cross-Site Request Forgeryvberkel Schema App Structured Data
- CVE-2024-27160Hardcoded password used to encrypt logs and use of weak cipherToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27159Hardcoded password used to encrypt logsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-31159ASUS Download Master - Reflected XSSASUS Download Master
- CVE-2024-27157Leak of authentication sessions in secure logsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27156Leak of authentication sessions in secure logsToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27154Passwords are stored in clear-text logs.Toshiba Tec e-Studio multi-function peripheral
- CVE-2024-27146Lack of privileges separationToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27142Pre-authenticated XXE injectionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-27141Pre-authenticated Time-Based Blind XXE injectionToshiba Tec e-Studio multi-function peripheral
- CVE-2024-5985SourceCodester Best Online News Portal index.php sql injectionSourceCodester Best Online News Portal
- CVE-2024-5984itsourcecode Online Bookstore book.php sql injectionitsourcecode Online Bookstore
- CVE-2024-5983itsourcecode Online Bookstore bookPerPub.php sql injectionitsourcecode Online Bookstore
- CVE-2023-51507WordPress Quiz And Survey Master plugin <= 8.1.16 - Broken Access Control vulnerabilityExpressTech Quiz And Survey Master
- CVE-2024-5981itsourcecode Online House Rental System manage_user.php sql injectionitsourcecode Online House Rental System
- CVE-2023-51516WordPress Business Directory Plugin – Easy Listing Directories for WordPress plugin <= 6.3.9 - Broken Access Control vulnerabilityBusiness Directory Team Business Directory Plugin
- CVE-2023-51523WordPress WooCommerce Easy Duplicate Product plugin <= 0.3.0.7 - Broken Access Control vulnerabilityWriterSystem WooCommerce Easy Duplicate Product
- CVE-2024-33373An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for
- CVE-2024-36599A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa
- CVE-2024-36656In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.