CVEs published June 18, 2024
65 CVEs were published on June 18, 2024: 3 critical, 19 high. 1 is now in CISA KEV.
- Published
- 65
- Critical
- 3
- High
- 19
- Medium
- 38
- Low
- 3
- Unrated
- 2
- Now in CISA KEV
- 1
- Fix available
- 20
Most affected products
- Actiontec WCB6200Q
- 5
- Moodle · moodle/moodle
- 5
- Linux
- 4
- Fsas Technologies FUJITSU Business Application ID Link M… +1
- 3
- itsourcecode Pool of Bethesda Online Reservation System
- 3
- JetBrains YouTrack
- 3
- VMware vCenter Server · VMware Cloud Foundation
- 3
- itsourcecode Simple Online Hotel Reservation System
- 2
- spa-cartcms
- 2
- 389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +6
- 1
Critical 3
- CVE-2024-37080vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.VMware vCenter Server · VMware Cloud Foundation
- CVE-2024-37079vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.VMware vCenter Server · VMware Cloud Foundation
- CVE-2024-37802CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Patient Info module
High 19
- CVE-2024-6146Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution VulnerabilityActiontec WCB6200Q
- CVE-2024-6145Actiontec WCB6200Q Cookie Format String Remote Code Execution VulnerabilityActiontec WCB6200Q
- CVE-2024-6144Actiontec WCB6200Q Multipart Boundary Stack-based Buffer Overflow Remote Code Execution VulnerabilityActiontec WCB6200Q
- CVE-2024-6143Actiontec WCB6200Q uh_tcp_recv_header Buffer Overflow Remote Code Execution VulnerabilityActiontec WCB6200Q
- CVE-2024-6142Actiontec WCB6200Q uh_tcp_recv_content Buffer Overflow Remote Code Execution VulnerabilityActiontec WCB6200Q
- CVE-2024-38276moodle: CSRF risks due to misuse of confirm_sesskeyMoodle · moodle/moodle
- CVE-2024-38275moodle: HTTP authorization header is preserved between "emulated redirects"Moodle · moodle/moodle
- CVE-2024-36977usb: dwc3: Wait unconditionally after issuing EndXfer commandLinux
- CVE-2024-36974net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAPLinux
- CVE-2022-23829A potential weakness in AMD SPI protection features may allow a malicious attacker with Ring0 (kernel mode) access to bypass the native SystAMD Ryzen™ Threadripper™ PRO Processors 5900 WX-Series… +17
- CVE-2024-21685This High severity Information Disclosure vulnerability was introduced in versions 9.4.0, 9.12.0, and 9.15.0 of Jira Core Data Center.Atlassian Jira Core Data Center
- CVE-2024-5275Hard-coded password in FileCatalyst Direct 3.8.10 Build 138 TransferAgent (and earlier) and FileCatalyst Workflow 5.1.6 Build 130 (and earlier)Fortra FileCatalyst Direct · Fortra FileCatalyst Workflow
- CVE-2023-47726IBM QRadar Suite improper input validationIBM QRadar Suite Software · IBM Cloud Pak for Security
- CVE-2024-33620Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR.Fsas Technologies FUJITSU Business Application ID Link M… +1
- CVE-2024-37081The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.VMware vCenter Server · VMware Cloud Foundation
- CVE-2023-5527Business Directory Plugin <= 6.4.3 - Authenticated (Author+) CSV Injectionstrategy11team Business Directory Plugin – Easy Listing Dir…
- CVE-2024-22002CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the insta
- CVE-2024-37821An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitradolibarr/dolibarr
- CVE-2024-38347CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Room Information mod
Medium, low and unrated 43
- CVE-2024-5970MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcodemaxfoundry MaxGalleria
- CVE-2024-6129spa-cartcms Username login observable behavioral discrepancyspa-cartcms
- CVE-2024-6128spa-cartcms Checkout Page checkout behavioral workflowspa-cartcms
- CVE-2024-38277moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keysMoodle · moodle/moodle
- CVE-2024-38274moodle: stored XSS via calendar's event title when deleting the eventMoodle · moodle/moodle
- CVE-2024-38273moodle: BigBlueButton web service leaks meeting joining information to users who should not have accessMoodle · moodle/moodle
- CVE-2024-36976Revert "media: v4l2-ctrls: show all owned controls in log_status"Linux
- CVE-2024-36975KEYS: trusted: Do not use WARN when encode failsLinux
- CVE-2024-37904Denial of service from maliciously configured Git repository in Minderstacklok minder · github.com/stacklok/minder
- CVE-2024-38351Password auth and OAuth2 unverified email linkingpocketbase · github.com/pocketbase/pocketbase
- CVE-2024-6116itsourcecode Simple Online Hotel Reservation System edit_room.php unrestricted uploaditsourcecode Simple Online Hotel Reservation System
- CVE-2024-6115itsourcecode Simple Online Hotel Reservation System add_room.php unrestricted uploaditsourcecode Simple Online Hotel Reservation System
- CVE-2024-6114itsourcecode Monbela Tourist Inn Online Reservation System controller.php unrestricted uploaditsourcecode Monbela Tourist Inn Online Reservation System
- CVE-2024-6112itsourcecode Pool of Bethesda Online Reservation System index.php sql injectionitsourcecode Pool of Bethesda Online Reservation System
- CVE-2024-6111itsourcecode Pool of Bethesda Online Reservation System login.php sql injectionitsourcecode Pool of Bethesda Online Reservation System
- CVE-2024-5967Keycloak: leak of configured ldap bind credentials through the keycloak admin consolekeycloak · Red Hat Build of Keycloak +3
- CVE-2024-6110itsourcecode Magbanua Beach Resort Online Reservation System controller.php unrestricted uploaditsourcecode Magbanua Beach Resort Online Reservation System
- CVE-2024-6109itsourcecode Tailoring Management System addmeasurement.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-38507In JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleJetBrains Hub
- CVE-2024-38506In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsJetBrains YouTrack
- CVE-2024-38505In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteJetBrains YouTrack
- CVE-2024-38504In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articlesJetBrains YouTrack
- CVE-2024-5953389-ds-base: malformed userpassword hash may cause denial of service389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +6
- CVE-2024-6108Genexis Tilgin Home Gateway Login cross site scriptingGenexis Tilgin Home Gateway
- CVE-2024-5899Improper trust check in Bazel Build intellij pluginBazelBuild intellij plugin · github.com/bazelbuild/intellij
- CVE-2024-5533Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingElegant Themes Divi
- CVE-2024-0066Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client (AxAxis Communications AB AXIS OS
- CVE-2024-5172Expert Invoice <= 1.0.2 -Admin+ Stored XSSExpert Invoice
- CVE-2024-4094Simple Share Buttons Adder < 8.5.1 - Admin+ Stored XSSSimple Share Buttons Adder
- CVE-2024-3276FooBox (Free and Premium) < 2.7.28 - Admin+ Stored XSSLightbox & Modal Popup WordPress Plugin · foobox-image-ligh…
- CVE-2024-34024Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR.Fsas Technologies FUJITSU Business Application ID Link M… +1
- CVE-2024-33622Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR.Fsas Technologies FUJITSU Business Application ID Link M… +1
- CVE-2024-5860Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket DeletionTickera – Sell Tickets & Manage Events
- CVE-2024-5541Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Updatevowelweb Ibtana – WordPress Website Builder
- CVE-2024-1634Scheduling Plugin – Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnectionstartbooking Scheduling Plugin – Online Booking for WordPre…
- CVE-2024-0845PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via renderredlettuce PDF Viewer for Elementor
- CVE-2024-4375Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcodeaverta Master Slider – Responsive Touch Slider
- CVE-2024-6084itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted uploaditsourcecode Pool of Bethesda Online Reservation System
- CVE-2024-37791DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id.
- CVE-2024-37799CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_
- CVE-2024-37800CodeProjects Restaurant Reservation System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Date
- CVE-2024-37803Multiple stored cross-site scripting (XSS) vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to e
- CVE-2024-38348CodeProjects Health Care hospital Management System v1.0 was discovered to contain a SQL injection vulnerability in the Staff Info module vi