CVEs published June 16, 2024
26 CVEs were published on June 16, 2024: 10 critical, 7 high.
- Published
- 26
- Critical
- 10
- High
- 7
- Medium
- 9
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Feng Office
- 1
- itsourcecode Gym Management System
- 1
- itsourcecode Real Estate Management System
- 1
- langchain-experimental
- 1
- org.sonarsource.sonarqube:sonar-web
- 1
- Vantiva MediaAccess DGA2232
- 1
Critical 10
- CVE-2024-34451Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For heade
- CVE-2024-38395In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is no
- CVE-2024-38396An issue was discovered in iTerm2 3.5.x before 3.5.2.
- CVE-2024-38428url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in whi
- CVE-2024-38439Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLogin
- CVE-2024-38441Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in
- CVE-2024-38448htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may
- CVE-2024-38462iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 ref
- CVE-2024-38466Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.
- CVE-2024-38468Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.
High 7
- CVE-2024-38427In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTa
- CVE-2024-38440Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly u
- CVE-2024-38457Xenforo before 2.2.16 allows CSRF.
- CVE-2024-38458Xenforo before 2.2.16 allows code injection.
- CVE-2024-38459langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step.langchain-experimental
- CVE-2024-38461irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.
- CVE-2024-38467Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API.
Medium, low and unrated 9
- CVE-2024-6042itsourcecode Real Estate Management System property-detail.php sql injectionitsourcecode Real Estate Management System
- CVE-2024-6041itsourcecode Gym Management System manage_user.php sql injectionitsourcecode Gym Management System
- CVE-2024-6039Feng Office Workspaces sql injectionFeng Office
- CVE-2024-36397Vantiva - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Vantiva MediaAccess DGA2232
- CVE-2023-27636Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.
- CVE-2024-38443C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common
- CVE-2024-38454ExpressionEngine before 7.4.11 allows XSS.
- CVE-2024-38460In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartexorg.sonarsource.sonarqube:sonar-web
- CVE-2024-38465Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus erro