CVEs published June 17, 2024
75 CVEs were published on June 17, 2024: 13 critical, 19 high. 1 is now in CISA KEV.
- Published
- 75
- Critical
- 13
- High
- 19
- Medium
- 41
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- GPAC
- 4
- FreeFrom K.K. "FreeFrom - the nostr client" App for Android…
- 3
- D-Link G403 · D-Link G415 +13
- 2
- Devolutions Remote Desktop Manager
- 2
- evmos · github.com/evmos/evmos +17
- 2
- PHPVibe
- 2
- Python Software Foundation CPython
- 2
- SourceCodester Best House Rental Management System
- 2
- @abw/badger-database
- 1
- @akbr/update
- 1
Critical 13
- CVE-2024-37902Path thraversal in DeepJavaLibrarydeepjavalibrary djl · ai.djl:api
- CVE-2024-6057Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that Devolutions Remote Desktop Manager
- CVE-2024-6048Openfind MailGates and MailAudit - OS Command InjectionOpenfind MailGates · Openfind MailAudit
- CVE-2024-6047GeoVision EOL device - OS Command InjectionGeoVision GV_DSP_LPR_V2 · GeoVision GV_IPCAMD_GV_BX1500 +17
- CVE-2024-5163Improper permission settings in com.transsion.carlcareTECNO com.transsion.carlcare
- CVE-2023-37057An issue in JLINK Unionman Technology Co.
- CVE-2023-37058Insecure Permissions vulnerability in JLINK Unionman Technology Co.
- CVE-2024-34833Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload.
- CVE-2024-36543Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for io.strimzi:strimzi
- CVE-2024-36573almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@al@almela/obx
- CVE-2024-36575A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.
- CVE-2024-36580A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.@cdr0/sg
- CVE-2024-36582alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)@alexbinary/object-deep-assign
High 19
- CVE-2024-6080Intelbras InControl incontrolWebcam Service unquoted search pathIntelbras InControl
- CVE-2024-37305Buffer overflow in deserialization in oqs-provider open-quantum-safe oqs-provider
- CVE-2024-37896SQL injection vulnerability in Gin-vue-adminflipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…
- CVE-2024-37890Denial of service when handling a request with many HTTP headers in wswebsockets ws · ws
- CVE-2024-36973misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe()Linux
- CVE-2024-0397Memory race condition in ssl.SSLContext certificate store methodsPython Software Foundation CPython
- CVE-2024-4032Incorrect IPv4 and IPv6 private rangesPython Software Foundation CPython
- CVE-2024-5650DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation.Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP
- CVE-2024-6045D-Link router - Hidden BackdoorD-Link G403 · D-Link G415 +13
- CVE-2024-36577apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.@apphp/object-resolver
- CVE-2024-36581A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.@abw/badger-database
- CVE-2024-36583A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.
- CVE-2024-37619StrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec_group_id parameter at /spec/inde
- CVE-2024-37621StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/inde
- CVE-2024-37794Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file.
- CVE-2024-37795A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing t
- CVE-2024-37840SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remot
- CVE-2024-37848SQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin_delete.p
- CVE-2024-38449A Directory Traversal vulnerability in KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and possibly earlier versions allows remote au
Medium, low and unrated 43
- CVE-2024-6083PHPVibe Media Upload Page upload-mp3.php unrestricted uploadPHPVibe
- CVE-2024-6082PHPVibe Global Options Page functionalities.global.php cross site scriptingPHPVibe
- CVE-2024-6067SourceCodester Music Class Enrollment System sql injectionSourceCodester Music Class Enrollment System
- CVE-2024-6066SourceCodester Best House Rental Management System payment_report.php sql injectionSourceCodester Best House Rental Management System
- CVE-2024-6065itsourcecode Bakery Online Ordering System index.php sql injectionitsourcecode Bakery Online Ordering System
- CVE-2024-6064GPAC MP4Box loader_xmt.c xmt_node_end use after freeGPAC
- CVE-2024-6063GPAC MP4Box dmx_m2ts.c m2tsdmx_on_event null pointer dereferenceGPAC
- CVE-2024-37893MFA bypass in oauth flow in Firefly IIIfirefly-iii · grumpydictator/firefly-iii
- CVE-2024-6062GPAC MP4Box load_text.c swf_svg_add_iso_sample null pointer dereferenceGPAC
- CVE-2024-6061GPAC MP4Box isoffin_read.c isoffin_process infinite loopGPAC
- CVE-2024-37895API Key Leak in lobe-chatlobehub lobe-chat · @lobehub/chat
- CVE-2024-37891Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3urllib3
- CVE-2024-6059Ingenico Estate Manager News Feed messages cross site scriptingIngenico Estate Manager
- CVE-2018-25103Use-after-free vulnerabilities in lighttpd <= 1.4.50lighttpd
- CVE-2024-6058LabVantage LIMS cross site scriptingLabVantage LIMS
- CVE-2024-6056nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancynasirkhan Laravel Starter
- CVE-2024-37159Evmos is missing create validator checkevmos · github.com/evmos/evmos +17
- CVE-2024-37158Evmos is missing precompile checksevmos · github.com/evmos/evmos +17
- CVE-2024-6055Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on WinDevolutions Remote Desktop Manager
- CVE-2024-5741XSS in inventory viewCheckmk
- CVE-2024-36289Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS.FreeFrom K.K. "FreeFrom - the nostr client" App for Android…
- CVE-2024-36279Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" AFreeFrom K.K. "FreeFrom - the nostr client" App for Android…
- CVE-2024-36277Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iFreeFrom K.K. "FreeFrom - the nostr client" App for Android…
- CVE-2024-4305PostX < 4.1.0 - Contributor+ Stored XSSPost Grid Gutenberg Blocks and WordPress Blog Plugin
- CVE-2024-3236Easy Notify Lite < 1.1.33 - Contributor+ Stored XSSPopup Builder
- CVE-2024-6044D-Link router - Arbitrary File ReadingD-Link G403 · D-Link G415 +13
- CVE-2024-6043SourceCodester Best House Rental Management System admin_class.php login sql injectionSourceCodester Best House Rental Management System
- CVE-2024-36527puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal.
- CVE-2024-36574A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-jso@allanlancioni/flatten-json
- CVE-2024-36578akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.@akbr/update
- CVE-2024-37620PHPVOD v4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /view/admin/view.php.
- CVE-2024-37622Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.
- CVE-2024-37623Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange
- CVE-2024-37624Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php.
- CVE-2024-37625zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.php
- CVE-2024-37661TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks.
- CVE-2024-37662TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks.
- CVE-2024-37663Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks.
- CVE-2024-37664Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks.
- CVE-2024-37798Cross-site scripting (XSS) vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 all
- CVE-2024-37828A stored cross-site scripting (XSS) in Vermeg Agile Reporter v23.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2024-38469zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php.
- CVE-2024-38470zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php.