# CVEs published 2024-06-17

75 CVEs were published on June 17, 2024: 13 critical, 19 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-6083](https://cve.now/CVE-2024-6083.md): PHPVibe Media Upload Page upload-mp3.php unrestricted upload (CVSS 5.3, PHPVibe)
- [CVE-2024-6082](https://cve.now/CVE-2024-6082.md): PHPVibe Global Options Page functionalities.global.php cross site scripting (CVSS 5.1, PHPVibe)
- [CVE-2024-6080](https://cve.now/CVE-2024-6080.md): Intelbras InControl incontrolWebcam Service unquoted search path (CVSS 8.5, Intelbras InControl)
- [CVE-2024-6067](https://cve.now/CVE-2024-6067.md): SourceCodester Music Class Enrollment System sql injection (CVSS 5.3, SourceCodester Music Class Enrollment System)
- [CVE-2024-6066](https://cve.now/CVE-2024-6066.md): SourceCodester Best House Rental Management System payment\_report.php sql injection (CVSS 5.3, SourceCodester Best House Rental Management System)
- [CVE-2024-6065](https://cve.now/CVE-2024-6065.md): itsourcecode Bakery Online Ordering System index.php sql injection (CVSS 6.9, itsourcecode Bakery Online Ordering System)
- [CVE-2024-6064](https://cve.now/CVE-2024-6064.md): GPAC MP4Box loader\_xmt.c xmt\_node\_end use after free (CVSS 4.8, GPAC)
- [CVE-2024-6063](https://cve.now/CVE-2024-6063.md): GPAC MP4Box dmx\_m2ts.c m2tsdmx\_on\_event null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2024-37305](https://cve.now/CVE-2024-37305.md): Buffer overflow in deserialization in oqs-provider (CVSS 8.2, open-quantum-safe oqs-provider)
- [CVE-2024-37893](https://cve.now/CVE-2024-37893.md): MFA bypass in oauth flow in Firefly III (CVSS 5.9, firefly-iii · grumpydictator/firefly-iii)
- [CVE-2024-37896](https://cve.now/CVE-2024-37896.md): SQL injection vulnerability in Gin-vue-admin (CVSS 8.8, flipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…)
- [CVE-2024-6062](https://cve.now/CVE-2024-6062.md): GPAC MP4Box load\_text.c swf\_svg\_add\_iso\_sample null pointer dereference (CVSS 4.8, GPAC)
- [CVE-2024-6061](https://cve.now/CVE-2024-6061.md): GPAC MP4Box isoffin\_read.c isoffin\_process infinite loop (CVSS 4.8, GPAC)
- [CVE-2024-37895](https://cve.now/CVE-2024-37895.md): API Key Leak in lobe-chat (CVSS 5.7, lobehub lobe-chat · @lobehub/chat)
- [CVE-2024-37902](https://cve.now/CVE-2024-37902.md): Path thraversal in DeepJavaLibrary (CVSS 10.0, deepjavalibrary djl · ai.djl:api)
- [CVE-2024-37891](https://cve.now/CVE-2024-37891.md): Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 (CVSS 4.4, urllib3)
- [CVE-2024-37890](https://cve.now/CVE-2024-37890.md): Denial of service when handling a request with many HTTP headers in ws (CVSS 7.5, websockets ws · ws)
- [CVE-2024-6059](https://cve.now/CVE-2024-6059.md): Ingenico Estate Manager News Feed messages cross site scripting (CVSS 5.1, Ingenico Estate Manager)
- [CVE-2018-25103](https://cve.now/CVE-2018-25103.md): Use-after-free vulnerabilities in lighttpd \<= 1.4.50 (CVSS 5.3, lighttpd)
- [CVE-2024-6058](https://cve.now/CVE-2024-6058.md): LabVantage LIMS cross site scripting (CVSS 5.3, LabVantage LIMS)
- [CVE-2024-36973](https://cve.now/CVE-2024-36973.md): misc: microchip: pci1xxxx: fix double free in the error handling of gp\_aux\_bus\_probe() (CVSS 8.4, Linux)
- [CVE-2024-6056](https://cve.now/CVE-2024-6056.md): nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancy (CVSS 6.3, nasirkhan Laravel Starter)
- [CVE-2024-0397](https://cve.now/CVE-2024-0397.md): Memory race condition in ssl.SSLContext certificate store methods (CVSS 7.4, Python Software Foundation CPython)
- [CVE-2024-4032](https://cve.now/CVE-2024-4032.md): Incorrect IPv4 and IPv6 private ranges (CVSS 7.5, Python Software Foundation CPython)
- [CVE-2024-37159](https://cve.now/CVE-2024-37159.md): Evmos is missing create validator check (CVSS 3.5, evmos · github.com/evmos/evmos +17)
- [CVE-2024-37158](https://cve.now/CVE-2024-37158.md): Evmos is missing precompile checks (CVSS 3.5, evmos · github.com/evmos/evmos +17)
- [CVE-2024-6057](https://cve.now/CVE-2024-6057.md): Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that (CVSS 9.8, Devolutions Remote Desktop Manager)
- [CVE-2024-6055](https://cve.now/CVE-2024-6055.md): Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Win (CVSS 4.7, Devolutions Remote Desktop Manager)
- [CVE-2024-5741](https://cve.now/CVE-2024-5741.md): XSS in inventory view (CVSS 6.5, Checkmk)
- [CVE-2024-36289](https://cve.now/CVE-2024-36289.md): Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. (CVSS 5.3, FreeFrom K.K. "FreeFrom - the nostr client" App for Android…)
- [CVE-2024-36279](https://cve.now/CVE-2024-36279.md): Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" A (CVSS 5.3, FreeFrom K.K. "FreeFrom - the nostr client" App for Android…)
- [CVE-2024-36277](https://cve.now/CVE-2024-36277.md): Improper verification of cryptographic signature issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and i (CVSS 5.3, FreeFrom K.K. "FreeFrom - the nostr client" App for Android…)
- [CVE-2024-6048](https://cve.now/CVE-2024-6048.md): Openfind MailGates and MailAudit - OS Command Injection (CVSS 9.8, Openfind MailGates · Openfind MailAudit)
- [CVE-2024-5650](https://cve.now/CVE-2024-5650.md): DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. (CVSS 8.5, Yokogawa Electric CENTUM CS · Yokogawa Electric CENTUM VP)
- [CVE-2024-4305](https://cve.now/CVE-2024-4305.md): PostX \< 4.1.0 - Contributor+ Stored XSS (CVSS 6.8, Post Grid Gutenberg Blocks and WordPress Blog Plugin)
- [CVE-2024-3236](https://cve.now/CVE-2024-3236.md): Easy Notify Lite \< 1.1.33 - Contributor+ Stored XSS (CVSS 5.4, Popup Builder)
- [CVE-2024-6047](https://cve.now/CVE-2024-6047.md): GeoVision EOL device - OS Command Injection (CVSS 9.8, KEV, GeoVision GV\_DSP\_LPR\_V2 · GeoVision GV\_IPCAMD\_GV\_BX1500 +17)
- [CVE-2024-6045](https://cve.now/CVE-2024-6045.md): D-Link router - Hidden Backdoor (CVSS 8.8, D-Link G403 · D-Link G415 +13)
- [CVE-2024-5163](https://cve.now/CVE-2024-5163.md): Improper permission settings in com.transsion.carlcare (CVSS 9.8, TECNO com.transsion.carlcare)
- [CVE-2024-6044](https://cve.now/CVE-2024-6044.md): D-Link router - Arbitrary File Reading (CVSS 6.5, D-Link G403 · D-Link G415 +13)
- [CVE-2024-6043](https://cve.now/CVE-2024-6043.md): SourceCodester Best House Rental Management System admin\_class.php login sql injection (CVSS 6.9, SourceCodester Best House Rental Management System)
- [CVE-2023-37057](https://cve.now/CVE-2023-37057.md): An issue in JLINK Unionman Technology Co. (CVSS 9.8)
- [CVE-2023-37058](https://cve.now/CVE-2023-37058.md): Insecure Permissions vulnerability in JLINK Unionman Technology Co. (CVSS 9.8)
- [CVE-2024-34833](https://cve.now/CVE-2024-34833.md): Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload. (CVSS 9.8)
- [CVE-2024-36527](https://cve.now/CVE-2024-36527.md): puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. (CVSS 6.5)
- [CVE-2024-36543](https://cve.now/CVE-2024-36543.md): Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for (CVSS 9.8, io.strimzi:strimzi)
- [CVE-2024-36573](https://cve.now/CVE-2024-36573.md): almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@al (CVSS 9.8, @almela/obx)
- [CVE-2024-36574](https://cve.now/CVE-2024-36574.md): A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-jso (CVSS 6.3, @allanlancioni/flatten-json)
- [CVE-2024-36575](https://cve.now/CVE-2024-36575.md): A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor. (CVSS 9.8)
- [CVE-2024-36577](https://cve.now/CVE-2024-36577.md): apphp js-object-resolver \< 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty. (CVSS 8.3, @apphp/object-resolver)
- [CVE-2024-36578](https://cve.now/CVE-2024-36578.md): akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js. (CVSS 5.9, @akbr/update)
- [CVE-2024-36580](https://cve.now/CVE-2024-36580.md): A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code. (CVSS 9.8, @cdr0/sg)
- [CVE-2024-36581](https://cve.now/CVE-2024-36581.md): A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm. (CVSS 7.6, @abw/badger-database)
- [CVE-2024-36582](https://cve.now/CVE-2024-36582.md): alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js) (CVSS 9.8, @alexbinary/object-deep-assign)
- [CVE-2024-36583](https://cve.now/CVE-2024-36583.md): A Prototype Pollution issue in byondreal accessor \<= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index. (CVSS 8.1)
- [CVE-2024-37619](https://cve.now/CVE-2024-37619.md): StrongShop v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the spec\_group\_id parameter at /spec/inde (CVSS 7.6)
- [CVE-2024-37620](https://cve.now/CVE-2024-37620.md): PHPVOD v4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /view/admin/view.php. (CVSS 6.1)
- [CVE-2024-37621](https://cve.now/CVE-2024-37621.md): StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/inde (CVSS 7.2)
- [CVE-2024-37622](https://cve.now/CVE-2024-37622.md): Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. (CVSS 6.1)
- [CVE-2024-37623](https://cve.now/CVE-2024-37623.md): Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl\_kaoqin\_locationchange (CVSS 6.1)
- [CVE-2024-37624](https://cve.now/CVE-2024-37624.md): Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /chajian/inputChajian.php. (CVSS 6.1)
- [CVE-2024-37625](https://cve.now/CVE-2024-37625.md): zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /index.php (CVSS 6.3)
- [CVE-2024-37661](https://cve.now/CVE-2024-37661.md): TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks. (CVSS 6.3)
- [CVE-2024-37662](https://cve.now/CVE-2024-37662.md): TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. (CVSS 6.3)
- [CVE-2024-37663](https://cve.now/CVE-2024-37663.md): Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. (CVSS 4.1)
- [CVE-2024-37664](https://cve.now/CVE-2024-37664.md): Redmi router RB03 v1.0.57 is vulnerable to TCP DoS or hijacking attacks. (CVSS 5.2)
- [CVE-2024-37794](https://cve.now/CVE-2024-37794.md): Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file. (CVSS 7.5)
- [CVE-2024-37795](https://cve.now/CVE-2024-37795.md): A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing t (CVSS 7.5)
- [CVE-2024-37798](https://cve.now/CVE-2024-37798.md): Cross-site scripting (XSS) vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 all (CVSS 5.9)
- [CVE-2024-37828](https://cve.now/CVE-2024-37828.md): A stored cross-site scripting (XSS) in Vermeg Agile Reporter v23.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 4.8)
- [CVE-2024-37840](https://cve.now/CVE-2024-37840.md): SQL injection vulnerability in processscore.php in Itsourcecode Learning Management System Project In PHP With Source Code v1.0 allows remot (CVSS 8.8)
- [CVE-2024-37848](https://cve.now/CVE-2024-37848.md): SQL Injection vulnerability in Online-Bookstore-Project-In-PHP v1.0 allows a local attacker to execute arbitrary code via the admin\_delete.p (CVSS 8.4)
- [CVE-2024-38449](https://cve.now/CVE-2024-38449.md): A Directory Traversal vulnerability in KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and possibly earlier versions allows remote au (CVSS 7.7)
- [CVE-2024-38469](https://cve.now/CVE-2024-38469.md): zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php. (CVSS 6.3)
- [CVE-2024-38470](https://cve.now/CVE-2024-38470.md): zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.