CVEs published June 15, 2024
30 CVEs were published on June 15, 2024: 3 critical, 5 high.
- Published
- 30
- Critical
- 3
- High
- 5
- Medium
- 21
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- IBM i
- 2
- itsourcecode Online Book Store
- 2
- popupbuilder Popup Builder – Create highly converting, mobi…
- 2
- tagDiv Composer
- 2
- Video Gallery – YouTube Playlist, Channel Gallery by YotuWP
- 2
- WPWeb WooCommerce - Social Login
- 2
- ZKTeco ZKBio CVSecurity
- 2
- 3uu Shariff Wrapper
- 1
- baden03 Collapse-O-Matic
- 1
- FooEvents for WooCommerce
- 1
Critical 3
- CVE-2024-4258Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File InclusionVideo Gallery – YouTube Playlist, Channel Gallery by YotuWP
- CVE-2024-3105Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Executionthemeisle Woody Code Snippets – Insert PHP, CSS, JS, and He…
- CVE-2024-5871WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object InjectionWPWeb WooCommerce - Social Login
High 5
- CVE-2024-27275IBM i privilege escalationIBM i
- CVE-2024-6000FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File UploadFooEvents for WooCommerce
- CVE-2023-6696Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposurepopupbuilder Popup Builder – Create highly converting, mobi…
- CVE-2024-3813tagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via ShortcodetagDiv Composer
- CVE-2024-2544Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actionspopupbuilder Popup Builder – Create highly converting, mobi…
Medium, low and unrated 22
- CVE-2024-6016itsourcecode Online Laundry Management System admin_class.php sql injectionitsourcecode Online Laundry Management System
- CVE-2024-6015itsourcecode Online House Rental System manage_user.php sql injectionitsourcecode Online House Rental System
- CVE-2024-6014itsourcecode Document Management System edithis.php sql injectionitsourcecode Document Management System
- CVE-2024-6013itsourcecode Online Book Store admin_delete.php sql injectionitsourcecode Online Book Store
- CVE-2024-6009itsourcecode Event Calendar process.php regDelete sql injectionitsourcecode Event Calendar
- CVE-2024-6008itsourcecode Online Book Store edit_book.php sql injectionitsourcecode Online Book Store
- CVE-2024-31870IBM i information disclosureIBM i
- CVE-2024-6007Netentsec NS-ASG Application Security Gateway deleteiscgwrouteconf.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-6006ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scriptingZKTeco ZKBio CVSecurity
- CVE-2024-5611Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetjetmonsters Stratum Widgets for Elementor
- CVE-2024-6005ZKTeco ZKBio CVSecurity V5000 Department Section cross site scriptingZKTeco ZKBio CVSecurity
- CVE-2024-4095Collapse-O-Matic <= 1.8.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebaden03 Collapse-O-Matic
- CVE-2024-4551Video Gallery – YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via ShortcodeVideo Gallery – YouTube Playlist, Channel Gallery by YotuWP
- CVE-2024-2695Shariff Wrapper <= 4.6.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode3uu Shariff Wrapper
- CVE-2024-5858Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Updatequantumcloud AI Infographic Maker
- CVE-2024-1399Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodegloriafood Restaurant Menu – Food Ordering System – Table R…
- CVE-2024-5868WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient RandomnessWPWeb WooCommerce - Social Login
- CVE-2024-4479Jeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgetsjegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…
- CVE-2024-3815Newspaper <= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment MetaNewspaper - News & WooCommerce WordPress Theme
- CVE-2024-3814tagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment MetatagDiv Composer
- CVE-2024-5263ElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgetswpmet ElementsKit Pro
- CVE-2024-38394Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying devic