# CVEs published 2024-06-16 26 CVEs were published on June 16, 2024: 10 critical, 7 high. Days are UTC. - [CVE-2024-6042](https://cve.now/CVE-2024-6042.md): itsourcecode Real Estate Management System property-detail.php sql injection (CVSS 6.9, itsourcecode Real Estate Management System) - [CVE-2024-6041](https://cve.now/CVE-2024-6041.md): itsourcecode Gym Management System manage\_user.php sql injection (CVSS 5.3, itsourcecode Gym Management System) - [CVE-2024-6039](https://cve.now/CVE-2024-6039.md): Feng Office Workspaces sql injection (CVSS 5.3, Feng Office) - [CVE-2024-36397](https://cve.now/CVE-2024-36397.md): Vantiva - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 6.1, Vantiva MediaAccess DGA2232) - [CVE-2023-27636](https://cve.now/CVE-2023-27636.md): Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor. (CVSS 6.5) - [CVE-2024-34451](https://cve.now/CVE-2024-34451.md): Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For heade (CVSS 9.1) - [CVE-2024-38395](https://cve.now/CVE-2024-38395.md): In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is no (CVSS 9.8) - [CVE-2024-38396](https://cve.now/CVE-2024-38396.md): An issue was discovered in iTerm2 3.5.x before 3.5.2. (CVSS 9.8) - [CVE-2024-38427](https://cve.now/CVE-2024-38427.md): In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTa (CVSS 8.8) - [CVE-2024-38428](https://cve.now/CVE-2024-38428.md): url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in whi (CVSS 9.1) - [CVE-2024-38439](https://cve.now/CVE-2024-38439.md): Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf\[PASSWDLEN\] to '\\0' in FPLogin (CVSS 9.8) - [CVE-2024-38440](https://cve.now/CVE-2024-38440.md): Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation violation, because of incorrectly u (CVSS 7.5) - [CVE-2024-38441](https://cve.now/CVE-2024-38441.md): Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf\[len\] to '\\0' in FPMapName in (CVSS 9.8) - [CVE-2024-38443](https://cve.now/CVE-2024-38443.md): C/sorting/binary\_insertion\_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common (CVSS 6.2) - [CVE-2024-38448](https://cve.now/CVE-2024-38448.md): htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may (CVSS 9.1) - [CVE-2024-38454](https://cve.now/CVE-2024-38454.md): ExpressionEngine before 7.4.11 allows XSS. (CVSS 6.1) - [CVE-2024-38457](https://cve.now/CVE-2024-38457.md): Xenforo before 2.2.16 allows CSRF. (CVSS 8.8) - [CVE-2024-38458](https://cve.now/CVE-2024-38458.md): Xenforo before 2.2.16 allows code injection. (CVSS 8.8) - [CVE-2024-38459](https://cve.now/CVE-2024-38459.md): langchain\_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. (CVSS 7.8, langchain-experimental) - [CVE-2024-38460](https://cve.now/CVE-2024-38460.md): In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartex (CVSS 4.9, org.sonarsource.sonarqube:sonar-web) - [CVE-2024-38461](https://cve.now/CVE-2024-38461.md): irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory. (CVSS 7.5) - [CVE-2024-38462](https://cve.now/CVE-2024-38462.md): iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 ref (CVSS 9.8) - [CVE-2024-38465](https://cve.now/CVE-2024-38465.md): Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus erro (CVSS 4.0) - [CVE-2024-38466](https://cve.now/CVE-2024-38466.md): Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password. (CVSS 9.8) - [CVE-2024-38467](https://cve.now/CVE-2024-38467.md): Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API. (CVSS 7.5) - [CVE-2024-38468](https://cve.now/CVE-2024-38468.md): Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API. (CVSS 9.8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2024-06-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.