# CVEs published 2024-06-14

156 CVEs were published on June 14, 2024: 18 critical, 55 high. Days are UTC.

- [CVE-2024-30120](https://cve.now/CVE-2024-30120.md): HCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application (CVSS 2.9, HCL Software DRYiCE Optibot Reset Station)
- [CVE-2024-21988](https://cve.now/CVE-2024-21988.md): CVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 5.3, NetApp StorageGRID)
- [CVE-2024-30119](https://cve.now/CVE-2024-30119.md): HCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header (CVSS 3.7, HCL Software DRYiCE Optibot Reset Station)
- [CVE-2024-6003](https://cve.now/CVE-2024-6003.md): Guangdong Baolun Electronics IP Network Broadcasting Service Platform maps sql injection (CVSS 6.9, Guangdong Baolun Electronics IP Network Broadcasting Servic…)
- [CVE-2024-37889](https://cve.now/CVE-2024-37889.md): MyFinances Allows Unauthorized Access to Other Customer Data (CVSS 6.5, TreyWW MyFinances)
- [CVE-2024-37888](https://cve.now/CVE-2024-37888.md): The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality (CVSS 6.1, mlewand ckeditor-plugin-openlink)
- [CVE-2024-37369](https://cve.now/CVE-2024-37369.md): Rockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File Permissions (CVSS 8.5, Rockwell Automation FactoryTalk® View SE)
- [CVE-2024-5659](https://cve.now/CVE-2024-5659.md): Rockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers (CVSS 8.3, Rockwell Automation ControlLogix® · Rockwell Automation… +3)
- [CVE-2024-37887](https://cve.now/CVE-2024-37887.md): Nextcloud Server's events information leaked with shared calendars on recurrence exceptions (CVSS 3.5, nextcloud security-advisories)
- [CVE-2024-37886](https://cve.now/CVE-2024-37886.md): Nextcloud user\_oidc's ID4me does not validate signature or expiration (CVSS 5.4, nextcloud security-advisories)
- [CVE-2024-37885](https://cve.now/CVE-2024-37885.md): Code injection in Nextcloud Desktop Client for macOS (CVSS 3.8, nextcloud security-advisories)
- [CVE-2024-37884](https://cve.now/CVE-2024-37884.md): Nextcloud Server's users can delete old versions of read-only shared files (CVSS 3.5, nextcloud security-advisories)
- [CVE-2024-37883](https://cve.now/CVE-2024-37883.md): Nextcloud Deck can access comments and attachments of deleted cards (CVSS 4.3, nextcloud security-advisories)
- [CVE-2024-37882](https://cve.now/CVE-2024-37882.md): Nextcloud Server can reshare read&share only folder with more permissions (CVSS 8.1, nextcloud security-advisories)
- [CVE-2024-37317](https://cve.now/CVE-2024-37317.md): Nextcloud Notes app can be tricked into using a received share created before the user logged in (CVSS 4.6, nextcloud security-advisories)
- [CVE-2024-37316](https://cve.now/CVE-2024-37316.md): Nextcloud Calendar's event create can create attachments that link to other websites (CVSS 4.6, nextcloud security-advisories)
- [CVE-2024-37315](https://cve.now/CVE-2024-37315.md): Nextcloud Server's read-only users can restore old versions (CVSS 3.5, nextcloud security-advisories)
- [CVE-2024-37314](https://cve.now/CVE-2024-37314.md): Nextcloud Photos' shared albums have no restriction on photo removal (CVSS 3.5, nextcloud security-advisories)
- [CVE-2024-37313](https://cve.now/CVE-2024-37313.md): Nextcloud server allows the by-pass the second factor (CVSS 7.3, nextcloud security-advisories)
- [CVE-2024-37312](https://cve.now/CVE-2024-37312.md): Nextcloud user\_oidc app's ID4me feature is available even when disabled (CVSS 6.3, nextcloud security-advisories)
- [CVE-2024-34694](https://cve.now/CVE-2024-34694.md): LNbits improperly handles potential network and payment failures when using Eclair backend (CVSS 8.1, lnbits)
- [CVE-2024-37368](https://cve.now/CVE-2024-37368.md): Rockwell Automation FactoryTalk® View SE v11 Information Leakage Vulnerability via Authentication Restriction (CVSS 8.2, Rockwell Automation FactoryTalk® View SE)
- [CVE-2024-23442](https://cve.now/CVE-2024-23442.md): Kibana open redirect issue (CVSS 6.1, Elastic Kibana)
- [CVE-2024-37367](https://cve.now/CVE-2024-37367.md): Rockwell Automation FactoryTalk® View SE v12 Information Leakage Vulnerability via Authentication Restriction (CVSS 8.2, Rockwell Automation FactoryTalk® View SE)
- [CVE-2024-5731](https://cve.now/CVE-2024-5731.md): A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination (CVSS 6.8, Trellix Intrusion Prevention System (IPS) Manager)
- [CVE-2024-5671](https://cve.now/CVE-2024-5671.md): Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution an (CVSS 9.8, Trellix Intrusion Prevention System (IPS) Manager)
- [CVE-2024-2024](https://cve.now/CVE-2024-2024.md): Folders Pro \<= 3.0.2 - Authenticated(Author+) Arbitrary File Upload via handle\_folders\_file\_upload (CVSS 8.8, Premio Folders Pro)
- [CVE-2024-2023](https://cve.now/CVE-2024-2023.md): Folders \<= 3.0 and Folders Pro \<= 3.0.2 - Directory Traversal via handle\_folders\_file\_upload (CVSS 4.3, premio Folders – Unlimited Folders to Organize Media Librar…)
- [CVE-2024-36459](https://cve.now/CVE-2024-36459.md): Cross-Site Scripting Vulnerability in Symantec SiteMinder Web Agent (CVSS 8.4, Broadcom Symantec SiteMinder)
- [CVE-2023-51376](https://cve.now/CVE-2023-51376.md): WordPress ProjectHuddle Client Site plugin \<= 1.0.34 - Broken Access Control vulnerability (CVSS 4.3, Brainstorm Force ProjectHuddle Client Site)
- [CVE-2024-5685](https://cve.now/CVE-2024-5685.md): Broken Function Level Authorization (BFLA) in snipe/snipe-it (CVSS 7.6, snipe-it · snipe/snipe-it)
- [CVE-2024-34012](https://cve.now/CVE-2024-34012.md): Local privilege escalation due to insecure folder permissions. (CVSS 4.4, Acronis Cloud Manager)
- [CVE-2024-2472](https://cve.now/CVE-2024-2472.md): LatePoint Plugin \<= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR (CVSS 9.1, LatePoint Plugin)
- [CVE-2024-3912](https://cve.now/CVE-2024-3912.md): ASUS Router - Upload arbitrary firmware (CVSS 9.8, ASUS DSL-N17U · ASUS DSL-N55U\_C1 +20)
- [CVE-2024-37182](https://cve.now/CVE-2024-37182.md): Lack of permissions prompting when opening external URLs (CVSS 4.7, Mattermost · mattermost-desktop)
- [CVE-2024-36287](https://cve.now/CVE-2024-36287.md): Bypass of TCC restrictions on macOS (CVSS 3.8, Mattermost · mattermost-desktop)
- [CVE-2024-4863](https://cve.now/CVE-2024-4863.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-25142](https://cve.now/CVE-2024-25142.md): Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache (CVSS 5.5, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-5961](https://cve.now/CVE-2024-5961.md): Reflected XSS in 2ClickPortal (CVSS 5.3, Trol InterMedia Sp. z o.o. Sp. k. 2ClickPortal)
- [CVE-2024-5577](https://cve.now/CVE-2024-5577.md): Where I Was, Where I Will Be \<= 1.1.1 - Unauthenticated Remote File Inclusion (CVSS 9.8, mcnardelli Where I Was, Where I Will Be)
- [CVE-2024-5465](https://cve.now/CVE-2024-5465.md): Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 5.9, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-5464](https://cve.now/CVE-2024-5464.md): Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affec (CVSS 4.0, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-36503](https://cve.now/CVE-2024-36503.md): Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 7.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-36502](https://cve.now/CVE-2024-36502.md): Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect availability. (CVSS 7.9, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-36501](https://cve.now/CVE-2024-36501.md): Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity. (CVSS 5.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-36500](https://cve.now/CVE-2024-36500.md): Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect service confidentialit (CVSS 7.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-5995](https://cve.now/CVE-2024-5995.md): Soar Cloud HR Portal - Insufficient Session Expiration (CVSS 8.8, Soar Cloud HR Portal)
- [CVE-2024-36499](https://cve.now/CVE-2024-36499.md): Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect servic (CVSS 6.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2024-5994](https://cve.now/CVE-2024-5994.md): WP Go Maps (formerly WP Google Maps) \<= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpgmaps WP Go Maps)
- [CVE-2024-31163](https://cve.now/CVE-2024-31163.md): ASUS Download Master - Buffer Overflow (CVSS 7.2, ASUS Download Master)
- [CVE-2024-31162](https://cve.now/CVE-2024-31162.md): ASUS Download Master - OS Command Injection (CVSS 7.2, ASUS Download Master)
- [CVE-2024-5155](https://cve.now/CVE-2024-5155.md): Inquiry Cart \<= 3.4.2 - Stored XSS via CSRF (CVSS 6.1, Inquiry cart)
- [CVE-2024-4751](https://cve.now/CVE-2024-4751.md): WP Prayer II \<= 2.4.7 - Settings Update via CSRF (CVSS 4.3, WP Prayer II)
- [CVE-2024-4480](https://cve.now/CVE-2024-4480.md): WP Prayer II \<= 2.4.7 - Email Settings Update via CSRF (CVSS 6.1, WP Prayer II)
- [CVE-2024-4271](https://cve.now/CVE-2024-4271.md): SVGator \<= 1.2.6 - Stored XSS via SVG Upload (CVSS 4.6, SVGator)
- [CVE-2024-4270](https://cve.now/CVE-2024-4270.md): SVGMagic \<= 1.1 - Stored XSS via SVG Upload (CVSS 5.4, SVGMagic)
- [CVE-2024-4005](https://cve.now/CVE-2024-4005.md): Social Pixel \<= 2.1 - Admin+ Stored XSS (CVSS 5.4, Social Pixel)
- [CVE-2024-3993](https://cve.now/CVE-2024-3993.md): AZAN Plugin \<= 0.6 - Stored XSS via CSRF (CVSS 4.6, AZAN Plugin)
- [CVE-2024-3992](https://cve.now/CVE-2024-3992.md): Amen \<= 3.3.1 - Admin+ Stored XSS (CVSS 4.8, Amen)
- [CVE-2024-3978](https://cve.now/CVE-2024-3978.md): WordPress Jitsi Shortcode \<= 0.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, WordPress Jitsi Shortcode)
- [CVE-2024-3977](https://cve.now/CVE-2024-3977.md): WordPress Jitsi Shortcode \<= 0.1 - Admin+ Stored XSS (CVSS 5.1, WordPress Jitsi Shortcode)
- [CVE-2024-3972](https://cve.now/CVE-2024-3972.md): Similarity \<= 3.0 - Stored XSS via CSRF (CVSS 5.7, Similarity)
- [CVE-2024-3971](https://cve.now/CVE-2024-3971.md): Similarity \<= 3.0 - Plugin Reset via CSRF (CVSS 5.4, Similarity)
- [CVE-2024-3966](https://cve.now/CVE-2024-3966.md): Pray For Me \<= 1.0.4 - Unauthenticated Stored XSS (CVSS 6.1, Pray For Me)
- [CVE-2024-3965](https://cve.now/CVE-2024-3965.md): Pray For Me \<= 1.0.4 - Settings Update via CSRF (CVSS 5.4, Pray For Me)
- [CVE-2024-3754](https://cve.now/CVE-2024-3754.md): Alemha Watermarker \<= 1.3.1 - Author+ Stored XSS (CVSS 4.7, Alemha watermarker)
- [CVE-2024-2218](https://cve.now/CVE-2024-2218.md): LuckyWP Table of Contents \<= 2.1.4 - Admin+ Stored XSS (CVSS 4.6, LuckyWP Table of Contents)
- [CVE-2024-1295](https://cve.now/CVE-2024-1295.md): The Events Calendar (Free \< 6.4.0.1, Pro \< 6.4.0.1) - Contributor+ Arbitrary Events Access (CVSS 6.5, events-calendar-pro · The Events Calendar)
- [CVE-2023-51377](https://cve.now/CVE-2023-51377.md): WordPress Everest Forms plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 5.3, WPEverest Everest Forms)
- [CVE-2023-51495](https://cve.now/CVE-2023-51495.md): WordPress WooCommerce Warranty Requests plugin \<= 2.2.7 - Broken Access Control vulnerability (CVSS 6.5, WooCommerce Warranty Requests)
- [CVE-2023-51496](https://cve.now/CVE-2023-51496.md): WordPress WooCommerce Warranty Requests plugin \<= 2.2.7 - Broken Access Control vulnerability (CVSS 5.3, WooCommerce Warranty Requests)
- [CVE-2024-2122](https://cve.now/CVE-2024-2122.md): FooGallery \<= 2.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Custom URL (CVSS 6.4, fooplugins Gallery by FooGallery)
- [CVE-2024-4404](https://cve.now/CVE-2024-4404.md): ElementsKit PRO \<= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery (CVSS 8.5, wpmet ElementsKit Pro)
- [CVE-2024-5551](https://cve.now/CVE-2024-5551.md): WP STAGING PRO - Backup Duplicator & Migration \<= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion (CVSS 7.5, WPStaging WP STAGING Pro WordPress Backup Plugin)
- [CVE-2024-23504](https://cve.now/CVE-2024-23504.md): WordPress Ninja Tables plugin \<= 5.0.5 - Broken Access Control vulnerability (CVSS 5.3, WPManageNinja Ninja Tables)
- [CVE-2023-51497](https://cve.now/CVE-2023-51497.md): WordPress WooCommerce Ship to Multiple Addresses plugin \<= 3.8.9 - Broken Access Control vulnerability (CVSS 5.4, WooCommerce Ship to Multiple Addresses)
- [CVE-2024-4936](https://cve.now/CVE-2024-4936.md): Canto \<= 3.0.8 - Unauthenticated Remote File Inclusion (CVSS 9.8, flightbycanto Canto)
- [CVE-2024-1094](https://cve.now/CVE-2024-1094.md): Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin \<= 1.0.21 - Missing Authorization to Limited Privilege Escalation (CVSS 7.3, arraytics Timetics – Appointment Booking & Scheduling)
- [CVE-2024-3498](https://cve.now/CVE-2024-3498.md): Incorrect Permission Assignment Privilege Escalation Vulnerability (CVSS 7.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-3497](https://cve.now/CVE-2024-3497.md): Directory Traversal Remote Code Execution Vulnerability (CVSS 8.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-3496](https://cve.now/CVE-2024-3496.md): Authentication Bypass Vulnerability (CVSS 8.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27180](https://cve.now/CVE-2024-27180.md): TOCTOU vulnerability (CVSS 6.7, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27179](https://cve.now/CVE-2024-27179.md): Session disclosure inside the log files (CVSS 4.7, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27178](https://cve.now/CVE-2024-27178.md): Remote Code Execution (CVSS 7.2, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27177](https://cve.now/CVE-2024-27177.md): Remote Code Execution (CVSS 7.2, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27176](https://cve.now/CVE-2024-27176.md): Remote Code Execution (CVSS 7.2, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-5469](https://cve.now/CVE-2024-5469.md): Uncontrolled Resource Consumption in GitLab (CVSS 3.1, GitLab)
- [CVE-2024-27175](https://cve.now/CVE-2024-27175.md): Local File Inclusion (CVSS 4.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27174](https://cve.now/CVE-2024-27174.md): insecure upload (CVSS 9.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27173](https://cve.now/CVE-2024-27173.md): insecure upload (CVSS 9.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27172](https://cve.now/CVE-2024-27172.md): Remote Code Execution (CVSS 9.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27171](https://cve.now/CVE-2024-27171.md): Insecure permissions (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27170](https://cve.now/CVE-2024-27170.md): Hardcoded credentials for WebDAV access (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27169](https://cve.now/CVE-2024-27169.md): Lack of authentication (CVSS 8.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27168](https://cve.now/CVE-2024-27168.md): Hardcoded keys used to generate authentication cookies (CVSS 7.1, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-31161](https://cve.now/CVE-2024-31161.md): ASUS Download Master - Arbitrary File Upload (CVSS 7.2, ASUS Download Master)
- [CVE-2024-27167](https://cve.now/CVE-2024-27167.md): Insecure permissions (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27166](https://cve.now/CVE-2024-27166.md): Insecure permissions (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27165](https://cve.now/CVE-2024-27165.md): Local Privilege Escalation (CVSS 7.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27164](https://cve.now/CVE-2024-27164.md): Hardcoded credentials (CVSS 7.1, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-31160](https://cve.now/CVE-2024-31160.md): ASUS Download Master - Stored XSS (CVSS 4.8, ASUS Download Master)
- [CVE-2024-27163](https://cve.now/CVE-2024-27163.md): Leak of admin password and passwords (CVSS 6.5, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27162](https://cve.now/CVE-2024-27162.md): DOM-based XSS (CVSS 6.1, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27161](https://cve.now/CVE-2024-27161.md): Hardcoded password used to encrypt files (CVSS 6.2, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2023-6492](https://cve.now/CVE-2023-6492.md): Simple Sitemap \<= 3.5.13 - Cross-Site Request Forgery via admin\_notices (CVSS 4.3, dgwyer Simple Sitemap – Create a Responsive HTML Sitemap)
- [CVE-2024-0892](https://cve.now/CVE-2024-0892.md): Schema App Structured Data \<= 2.2.0 - Cross-Site Request Forgery (CVSS 4.3, vberkel Schema App Structured Data)
- [CVE-2024-27160](https://cve.now/CVE-2024-27160.md): Hardcoded password used to encrypt logs and use of weak cipher (CVSS 6.2, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27159](https://cve.now/CVE-2024-27159.md): Hardcoded password used to encrypt logs (CVSS 6.2, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-31159](https://cve.now/CVE-2024-31159.md): ASUS Download Master - Reflected XSS (CVSS 4.8, ASUS Download Master)
- [CVE-2024-27158](https://cve.now/CVE-2024-27158.md): Hardcoded root password (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27157](https://cve.now/CVE-2024-27157.md): Leak of authentication sessions in secure logs (CVSS 6.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27156](https://cve.now/CVE-2024-27156.md): Leak of authentication sessions in secure logs (CVSS 6.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27155](https://cve.now/CVE-2024-27155.md): Local Privilege Escalation and Remote Code Execution using insecure permissions (CVSS 7.7, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27154](https://cve.now/CVE-2024-27154.md): Passwords are stored in clear-text logs. (CVSS 6.2, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27153](https://cve.now/CVE-2024-27153.md): Local Privilege Escalation and Remote Code Execution (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-3080](https://cve.now/CVE-2024-3080.md): ASUS Router - Improper Authentication (CVSS 9.8, ASUS ZenWiFi XT8 · ASUS RT-AX88U +4)
- [CVE-2024-27152](https://cve.now/CVE-2024-27152.md): Local Privilege Escalation and Remote Code Execution using insecure permissions (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27151](https://cve.now/CVE-2024-27151.md): Local Privilege Escalation and Remote Code Execution using insecure permissions (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27150](https://cve.now/CVE-2024-27150.md): Local Privilege Escalation and Remote Code Execution using insecure LD\_LIBRARY\_PATH (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27149](https://cve.now/CVE-2024-27149.md): Local Privilege Escalation and Remote Code Execution using insecure LD\_PRELOAD (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27148](https://cve.now/CVE-2024-27148.md): Local Privilege Escalation and Remote Code Execution using insecure PATH (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27147](https://cve.now/CVE-2024-27147.md): Local Privilege Escalation and Remote Code Execution using snmpd (CVSS 7.4, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27146](https://cve.now/CVE-2024-27146.md): Lack of privileges separation (CVSS 6.7, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27145](https://cve.now/CVE-2024-27145.md): Multiple Post-authenticated Remote Code Execution (CVSS 9.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-3079](https://cve.now/CVE-2024-3079.md): ASUS Router - Stack-based Buffer Overflow (CVSS 7.2, ASUS ZenWiFi XT8 · ASUS RT-AX88U +4)
- [CVE-2024-27144](https://cve.now/CVE-2024-27144.md): Pre-authenticated Remote Code Execution (CVSS 9.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27143](https://cve.now/CVE-2024-27143.md): Pre-authenticated Remote Code Execution (CVSS 9.8, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27142](https://cve.now/CVE-2024-27142.md): Pre-authenticated XXE injection (CVSS 5.9, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-27141](https://cve.now/CVE-2024-27141.md): Pre-authenticated Time-Based Blind XXE injection (CVSS 5.9, Toshiba Tec e-Studio multi-function peripheral)
- [CVE-2024-5985](https://cve.now/CVE-2024-5985.md): SourceCodester Best Online News Portal index.php sql injection (CVSS 5.3, SourceCodester Best Online News Portal)
- [CVE-2024-5984](https://cve.now/CVE-2024-5984.md): itsourcecode Online Bookstore book.php sql injection (CVSS 6.9, itsourcecode Online Bookstore)
- [CVE-2024-5983](https://cve.now/CVE-2024-5983.md): itsourcecode Online Bookstore bookPerPub.php sql injection (CVSS 6.9, itsourcecode Online Bookstore)
- [CVE-2023-51507](https://cve.now/CVE-2023-51507.md): WordPress Quiz And Survey Master plugin \<= 8.1.16 - Broken Access Control vulnerability (CVSS 5.3, ExpressTech Quiz And Survey Master)
- [CVE-2024-5981](https://cve.now/CVE-2024-5981.md): itsourcecode Online House Rental System manage\_user.php sql injection (CVSS 5.3, itsourcecode Online House Rental System)
- [CVE-2023-51516](https://cve.now/CVE-2023-51516.md): WordPress Business Directory Plugin – Easy Listing Directories for WordPress plugin \<= 6.3.9 - Broken Access Control vulnerability (CVSS 5.4, Business Directory Team Business Directory Plugin)
- [CVE-2023-51523](https://cve.now/CVE-2023-51523.md): WordPress WooCommerce Easy Duplicate Product plugin \<= 0.3.0.7 - Broken Access Control vulnerability (CVSS 4.3, WriterSystem WooCommerce Easy Duplicate Product)
- [CVE-2024-24320](https://cve.now/CVE-2024-24320.md): Directory Traversal vulnerability in Mgt-commerce CloudPanel v.2.0.0 thru v.2.4.0 allows a remote attacker to obtain sensitive information a (CVSS 8.8)
- [CVE-2024-33373](https://cve.now/CVE-2024-33373.md): An issue in the LB-LINK BL-W1210M v2.0 router allows attackers to bypass password complexity requirements and set single digit passwords for (CVSS 6.3)
- [CVE-2024-33374](https://cve.now/CVE-2024-33374.md): Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal with (CVSS 9.8)
- [CVE-2024-33375](https://cve.now/CVE-2024-33375.md): LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware. (CVSS 9.8)
- [CVE-2024-33377](https://cve.now/CVE-2024-33377.md): LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. (CVSS 8.1)
- [CVE-2024-34539](https://cve.now/CVE-2024-34539.md): Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. (CVSS 9.4)
- [CVE-2024-36597](https://cve.now/CVE-2024-36597.md): Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client\_id parameter at clientStatus.php. (CVSS 8.8)
- [CVE-2024-36598](https://cve.now/CVE-2024-36598.md): An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file. (CVSS 8.1)
- [CVE-2024-36599](https://cve.now/CVE-2024-36599.md): A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa (CVSS 6.1)
- [CVE-2024-36600](https://cve.now/CVE-2024-36600.md): Buffer Overflow Vulnerability in libcdio 2.2.0 (fixed in 2.3.0) allows an attacker to execute arbitrary code via a crafted ISO 9660 image fi (CVSS 8.4)
- [CVE-2024-36656](https://cve.now/CVE-2024-36656.md): In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack. (CVSS 6.1)
- [CVE-2024-37637](https://cve.now/CVE-2024-37637.md): TOTOLINK A3700R V9.1.2u.6165\_20211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg. (CVSS 9.8)
- [CVE-2024-37639](https://cve.now/CVE-2024-37639.md): TOTOLINK A3700R V9.1.2u.6165\_20211012 was discovered to contain a stack overflow via eport in the function setIpPortFilterRules. (CVSS 8.8)
- [CVE-2024-37640](https://cve.now/CVE-2024-37640.md): TOTOLINK A3700R V9.1.2u.6165\_20211012 was discovered to contain a stack overflow via ssid5g in the function setWiFiEasyGuestCfg. (CVSS 8.8)
- [CVE-2024-37641](https://cve.now/CVE-2024-37641.md): TRENDnet TEW-814DAP v1\_(FW1.01B01) was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule (CVSS 8.8)
- [CVE-2024-37642](https://cve.now/CVE-2024-37642.md): TRENDnet TEW-814DAP v1\_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4\_ping, ipv6\_ping parameter at /fo (CVSS 9.1)
- [CVE-2024-37643](https://cve.now/CVE-2024-37643.md): TRENDnet TEW-814DAP v1\_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formPasswordAut (CVSS 8.8)
- [CVE-2024-37644](https://cve.now/CVE-2024-37644.md): TRENDnet TEW-814DAP v1\_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attacker (CVSS 8.8)
- [CVE-2024-37645](https://cve.now/CVE-2024-37645.md): TRENDnet TEW-814DAP v1\_(FW1.01B01) was discovered to contain a stack overflow vulnerability via the submit-url parameter at /formSysLog . (CVSS 8.8)
- [CVE-2024-37831](https://cve.now/CVE-2024-37831.md): Itsourcecode Payroll Management System 1.0 is vulnerable to SQL Injection in payroll\_items.php via the ID parameter. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.