CVEs published June 19, 2024
223 CVEs were published on June 19, 2024: 16 critical, 86 high.
- Published
- 223
- Critical
- 16
- High
- 86
- Medium
- 58
- Low
- 1
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 55
Most affected products
- Linux
- 121
- Google Chrome
- 4
- Crocoblock JetElements For Elementor
- 3
- dzikoysk reposilite · com.reposilite:reposilite-backend
- 3
- RICOH COMPANY Ricoh Streamline NX PC Client
- 3
- ali2woo AliExpress Dropshipping Plugin for WooCommerce & Wo…
- 2
- robosoft Robo Gallery – Photo & Image Slider
- 2
- Saturday Drive Ninja Forms
- 2
- ThemeFusion Avada
- 2
- ThemePunch OHG Slider Revolution
- 2
Critical 16
- CVE-2021-47587net: systemport: Add global locking for descriptor lifecycleLinux
- CVE-2023-39312WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerabilityThemeFusion Avada
- CVE-2024-38570gfs2: Fix potential glock use-after-free on unmountLinux
- CVE-2024-38558net: openvswitch: fix overwriting ct original tuple for ICMPv6Linux
- CVE-2024-38544RDMA/rxe: Fix seg fault in rxe_comp_queue_pktLinux
- CVE-2024-37124Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client.RICOH COMPANY Ricoh Streamline NX PC Client
- CVE-2024-36480Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier.CVE-2024-36480 Ricoh Streamline NX PC Client
- CVE-2024-5853Image Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File UploadImage Optimizer, Resizer and CDN – Sirv
- CVE-2024-3229Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Uploadwordpresschef Salon Booking System – Free Version
- CVE-2024-5021WordPress Picture / Portfolio / Media Gallery <= 3.0.1 - Unauthenticated Server-Side Request Forgerynimble3 WordPress Picture / Portfolio / Media Gallery
- CVE-2024-33836In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .
- CVE-2024-34990In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer ca
- CVE-2024-34994In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFee
- CVE-2024-36678In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection.
- CVE-2024-36679In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection.
- CVE-2024-36684In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection.
High 86
- CVE-2024-6102Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruptioGoogle Chrome
- CVE-2024-6101Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory accessGoogle Chrome
- CVE-2024-6100Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2024-6103Use after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-5182Path Traversal in mudler/localaimudler/localai · github.com/go-skynet/LocalAI
- CVE-2024-38355Unhandled 'error' event in socket.iosocketio socket.io · socket.io
- CVE-2024-36117Path traversal while serving Reposilite javadoc expanded filesdzikoysk reposilite · com.reposilite:reposilite-backend
- CVE-2024-36116Path traversal in Reposilite javadoc file expansiondzikoysk reposilite · com.reposilite:reposilite-backend
- CVE-2024-36115Stored Cross site scripting in Reposilite artifactsdzikoysk reposilite · com.reposilite:reposilite-backend
- CVE-2024-32030Remote code execution via JNDI resolution in JMX metrics collection in Kafka UIprovectus kafka-ui
- CVE-2021-47616RDMA: Fix use-after-free in rxe_queue_cleanupLinux
- CVE-2021-47614RDMA/irdma: Fix a user-after-free in add_pble_prmLinux
- CVE-2021-47613i2c: virtio: fix completion handlingLinux
- CVE-2021-47611mac80211: validate extended element ID is presentLinux
- CVE-2024-34444WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerabilityThemePunch OHG Slider Revolution
- CVE-2021-47605vduse: fix memory corruption in vduse_dev_ioctl()Linux
- CVE-2021-47604vduse: check that offset is within bounds in get_config()Linux
- CVE-2021-47600dm btree remove: fix use after free in rebalance_children()Linux
- CVE-2021-47598sch_cake: do not call cake_destroy() from cake_init()Linux
- CVE-2021-47588sit: do not call ipip6_dev_free() from sit_init_net()Linux
- CVE-2021-47580scsi: scsi_debug: Fix type in min_t to avoid stack OOBLinux
- CVE-2021-47577io-wq: check for wq exit after adding new worker task_workLinux
- CVE-2021-47576scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()Linux
- CVE-2024-22263Arbitrary File Write Vulnerability in Spring Cloud Data FlowSpring by VMware Tanzu Spring Cloud Skipper
- CVE-2023-36515WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2023-36516WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2023-38393WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerabilitySaturday Drive Ninja Forms
- CVE-2024-38616wifi: carl9170: re-fix fortified-memset warningLinux
- CVE-2024-38614openrisc: traps: Don't send signals to kernel mode threadsLinux
- CVE-2024-38612ipv6: sr: fix invalid unregister error pathLinux
- CVE-2024-38611media: i2c: et8ek8: Don't strip remove function when driver is builtinLinux
- CVE-2024-38610drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map()Linux
- CVE-2023-36684WordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerabilityBrainstorm Force Convert Pro
- CVE-2024-38606crypto: qat - validate slices count returned by FWLinux
- CVE-2024-38605ALSA: core: Fix NULL module pointer assignment at card initLinux
- CVE-2024-38599jffs2: prevent xattr node from overflowing the eraseblockLinux
- CVE-2024-38592drm/mediatek: Init `ddp_comp` with devm_kcalloc()Linux
- CVE-2024-38590RDMA/hns: Modify the print level of CQE errorLinux
- CVE-2024-38329IBM Storage Protect for Virtual Environments: Data Protection for VMware security bypassIBM Storage Protect for Virtual Environments: Data Protecti…
- CVE-2024-38588ftrace: Fix possible use-after-free issue in ftrace_location()Linux
- CVE-2024-38587speakup: Fix sizeof() vs ARRAY_SIZE() bugLinux
- CVE-2024-38583nilfs2: fix use-after-free of timer for log writer threadLinux
- CVE-2024-38581drm/amdgpu/mes: fix use-after-free issueLinux
- CVE-2024-38580epoll: be better about file lifetimesLinux
- CVE-2024-38578ecryptfs: Fix buffer size for tag 66 packetLinux
- CVE-2024-38577rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflowLinux
- CVE-2024-38576rcu: Fix buffer overflow in print_cpu_stall_info()Linux
- CVE-2024-38573cppc_cpufreq: Fix possible null pointer dereferenceLinux
- CVE-2024-38572wifi: ath12k: fix out-of-bound access of qmi_invoke_handler()Linux
- CVE-2024-38569drivers/perf: hisi_pcie: Fix out-of-bound access when valid event groupLinux
- CVE-2024-38568drivers/perf: hisi: hns3: Fix out-of-bound access when valid event groupLinux
- CVE-2024-38564bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATELinux
- CVE-2024-38562wifi: nl80211: Avoid address calculations via out of bounds array indexingLinux
- CVE-2024-38556net/mlx5: Add a timeout to acquire the command queue semaphoreLinux
- CVE-2024-38555net/mlx5: Discard command completions in internal errorLinux
- CVE-2024-38552drm/amd/display: Fix potential index out of bounds in color transformation functionLinux
- CVE-2024-38545RDMA/hns: Fix UAF for cq async eventLinux
- CVE-2024-38542RDMA/mana_ib: boundary check before installing cq callbacksLinux
- CVE-2024-38541of: module: add buffer overflow check in of_modalias()Linux
- CVE-2024-38539RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siwLinux
- CVE-2024-38538net: bridge: xmit: make sure we have at least eth header len bytesLinux
- CVE-2024-36979net: bridge: mst: fix vlan use-after-freeLinux
- CVE-2023-38386WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerabilitySaturday Drive Ninja Forms
- CVE-2023-37870WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerabilityWooCommerce Warranty Requests
- CVE-2023-35049WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerabilityWooCommerce Stripe Payment Gateway
- CVE-2023-39998WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerabilityMuffingroup Betheme
- CVE-2023-40004Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress pluginsServMask All-in-One WP Migration Box Extension · ServMas… +2
- CVE-2023-40608WordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerabilityPaid Memberships Pro CCBill Gateway
- CVE-2023-45658WordPress Nexter theme <= 2.0.3 - Broken Access Control vulnerabilityPOSIMYTH Nexter
- CVE-2023-46146WordPress Themify Ultra theme <= 7.3.5 - Multiple Broken Access Control vulnerabilityThemify Ultra
- CVE-2023-46148WordPress Themify Ultra theme <= 7.3.5 - Authenticated Arbitrary Settings Change vulnerabilityThemify Ultra
- CVE-2023-47770WordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerabilityMuffin Group Betheme
- CVE-2023-47771WordPress Essential Grid plugin <= 3.0.18 - Multiple Authenticated Broken Access Control vulnerabilityThemePunch OHG Essential Grid
- CVE-2023-47783WordPress Thrive Theme Builder theme < 3.24.0 - Multiple Authenticated Broken Access Control vulnerabilityThrive Themes Thrive Theme Builder
- CVE-2023-48759WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerabilityCrocoblock JetElements For Elementor
- CVE-2023-48760WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerabilityCrocoblock JetElements For Elementor
- CVE-2024-35780WordPress Page Builder: Live Composer plugin <= 1.5.42 - Contributor+ PHP Object Injection vulnerabilityLive Composer Team Page Builder: Live Composer
- CVE-2024-36978net: sched: sch_multiq: fix possible OOB write in multiq_tune()Linux · :linux_kernel:
- CVE-2024-6132Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Uploadraajtram Pexels: Free Stock Photos
- CVE-2024-5574WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusioncodevibrant WP Magazine Modules Lite
- CVE-2024-5343Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Cross-Site Request Forgery to Post Creation and Limited Data Lossrobosoft Robo Gallery – Photo & Image Slider
- CVE-2024-2381AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Uploadali2woo AliExpress Dropshipping Plugin for WooCommerce & Wo…
- CVE-2024-5724Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injectionwebhuntinfotech Photo Video Gallery Master
- CVE-2024-6125Login with phone number <= 1.7.34 - Insecure Password Reset Mechanismglboy OTP Login With Phone Number, OTP Verification
- CVE-2024-36677In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to e
- CVE-2024-36680In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection.
Medium, low and unrated 121
- CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elementstinymce · tinymce/tinymce +1
- CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp optiontinymce · tinymce/tinymce +1
- CVE-2024-38358Symlink bypasses filesystem sandbox in wasmerwasmerio wasmer · wasmer
- CVE-2021-47612nfc: fix segfault in nfc_genl_dump_devices_doneLinux
- CVE-2021-47610drm/msm: Fix null ptr access msm_ioctl_gem_submit()Linux
- CVE-2021-47609firmware: arm_scpi: Fix string overflow in SCPI genpd driverLinux
- CVE-2021-47608bpf: Fix kernel address leakage in atomic fetchLinux
- CVE-2021-47607bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux regLinux
- CVE-2021-47606net: netlink: af_netlink: Prevent empty skb by adding a check on len.Linux
- CVE-2021-47603audit: improve robustness of the audit queue handlingLinux
- CVE-2021-47602mac80211: track only QoS data frames for admission controlLinux
- CVE-2021-47601tee: amdtee: fix an IS_ERR() vs NULL bugLinux
- CVE-2021-47599btrfs: use latest_dev in btrfs_show_devnameLinux
- CVE-2021-47597inet_diag: fix kernel-infoleak for UDP socketsLinux
- CVE-2021-47596net: hns3: fix use-after-free bug in hclgevf_send_mbx_msgLinux
- CVE-2021-47595net/sched: sch_ets: don't remove idle classes from the round-robin listLinux
- CVE-2021-47594mptcp: never allow the PM to close a listener subflowLinux
- CVE-2021-47593mptcp: clear 'kern' flag from fallback socketsLinux
- CVE-2021-47592net: stmmac: fix tc flower deletion for VLAN priority Rx steeringLinux
- CVE-2021-47591mptcp: remove tcp ulp setsockopt supportLinux
- CVE-2024-34443WordPress Slider Revolution plugin < 6.7.11 - Cross Site Scripting (XSS) vulnerabilityThemePunch OHG Slider Revolution
- CVE-2021-47590mptcp: fix deadlock in __mptcp_push_pending()Linux
- CVE-2021-47589igbvf: fix double free in `igbvf_probe`Linux
- CVE-2021-47586net: stmmac: dwmac-rk: fix oob read in rk_gmac_setupLinux
- CVE-2021-47585btrfs: fix memory leak in __add_inode_ref()Linux
- CVE-2021-47584iocost: Fix divide-by-zero on donation from low hweight cgroupLinux
- CVE-2021-47583media: mxl111sf: change mutex_init() locationLinux
- CVE-2021-47582USB: core: Make do_proc_control() and do_proc_bulk() killableLinux
- CVE-2021-47579ovl: fix warning in ovl_create_real()Linux
- CVE-2021-47578scsi: scsi_debug: Don't call kcalloc() if size arg is zeroLinux
- CVE-2023-25697WordPress GamiPress plugin <= 2.5.6 - CSRF Leading to Settings Change VulnerabilityGamiPress
- CVE-2022-45832WordPress Attorney theme <= 3 - Unauth. Arbitrary Content Deletion vulnerabilityHennessey Digital Attorney
- CVE-2023-38394WordPress Jupiter X Core plugin <= 3.3.0 - Multiple Auth. Broken Access Control vulnerabilityArtbees JupiterX Core
- CVE-2023-39310WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerabilityThemeFusion Fusion Builder
- CVE-2024-38618ALSA: timer: Set lower bound of start tick timeLinux
- CVE-2024-38617kunit/fortify: Fix mismatched kvalloc()/vfree() usageLinux
- CVE-2024-38615cpufreq: exit() callback is optionalLinux
- CVE-2024-38613m68k: Fix spinlock race in kernel thread creationLinux
- CVE-2024-38609wifi: mt76: connac: check for null before dereferencingLinux
- CVE-2024-38608net/mlx5e: Fix netif state handlingLinux
- CVE-2023-36676WordPress Spectra plugin <= 2.6.6 - Broken Access Control vulnerabilityBrainstorm Force Spectra
- CVE-2023-36683WordPress Schema Pro plugin <= 2.7.8 - Broken Access Control vulnerabilityWP SCHEMA PRO Schema Pro
- CVE-2024-38607macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"Linux
- CVE-2024-38604block: refine the EOF check in blkdev_iomap_beginLinux
- CVE-2024-38603drivers/perf: hisi: hns3: Actually use devm_add_action_or_reset()Linux
- CVE-2024-38602ax25: Fix reference count leak issues of ax25_devLinux
- CVE-2024-38601ring-buffer: Fix a race between readers and resize checksLinux
- CVE-2024-23443A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously craftedElastic Kibana
- CVE-2023-37869WordPress Premium Addons PRO plugin <= 2.9.0 - Broken Access Control vulnerabilityPremium Addons PRO
- CVE-2024-38600ALSA: Fix deadlocks with kctl removals at disconnectionLinux
- CVE-2024-38598md: fix resync softlockup when bitmap size is less than array sizeLinux
- CVE-2024-38597eth: sungem: remove .ndo_poll_controller to avoid deadlocksLinux
- CVE-2024-38596af_unix: Fix data races in unix_release_sock/unix_stream_sendmsgLinux
- CVE-2024-38595net/mlx5: Fix peer devlink set for SF representor devlink portLinux
- CVE-2024-38594net: stmmac: move the EST lock to struct stmmac_privLinux
- CVE-2024-38593net: micrel: Fix receiving the timestamp in the frame for lan8841Linux
- CVE-2024-38591RDMA/hns: Fix deadlock on SRQ async events.Linux
- CVE-2024-38589netrom: fix possible dead-lock in nr_rt_ioctl()Linux
- CVE-2023-37872WordPress WooCommerce Ship to Multiple Addresses plugin <= 3.8.5 - Broken Access Control vulnerabilityWooCommerce Ship to Multiple Addresses
- CVE-2024-38586r8169: Fix possible ring buffer corruption on fragmented Tx packets.Linux
- CVE-2024-38585tools/nolibc/stdlib: fix memory error in realloc()Linux
- CVE-2024-38584net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()Linux
- CVE-2024-38582nilfs2: fix potential hang in nilfs_detach_log_writer()Linux
- CVE-2024-38579crypto: bcm - Fix pointer arithmeticLinux
- CVE-2024-38575wifi: brcmfmac: pcie: handle randbuf allocation failureLinux
- CVE-2024-38574libbpf: Prevent null-pointer dereference when prog to load has no BTFLinux
- CVE-2024-38571thermal/drivers/tsens: Fix null pointer dereferenceLinux
- CVE-2024-38567wifi: carl9170: add a proper sanity check for endpointsLinux
- CVE-2024-38566bpf: Fix verifier assumptions about socket->skLinux
- CVE-2024-38565wifi: ar5523: enable proper endpoint verificationLinux
- CVE-2024-38563wifi: mt76: mt7996: fix potential memory leakage when reading chip temperatureLinux
- CVE-2024-38561kunit: Fix kthread referenceLinux
- CVE-2024-38560scsi: bfa: Ensure the copied buf is NUL terminatedLinux
- CVE-2024-38559scsi: qedf: Ensure the copied buf is NUL terminatedLinux
- CVE-2024-38557net/mlx5: Reload only IB representors upon lag disable/enableLinux
- CVE-2024-38554ax25: Fix reference count leak issue of net_deviceLinux
- CVE-2024-38553net: fec: remove .ndo_poll_controller to avoid deadlocksLinux
- CVE-2024-38551ASoC: mediatek: Assign dummy when codec not specified for a DAI linkLinux
- CVE-2024-38550ASoC: kirkwood: Fix potential NULL dereferenceLinux
- CVE-2024-38549drm/mediatek: Add 0 size check to mtk_drm_gem_objLinux
- CVE-2024-38548drm: bridge: cdns-mhdp8546: Fix possible null pointer dereferenceLinux
- CVE-2024-38547media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binariesLinux
- CVE-2024-38546drm: vc4: Fix possible null pointer dereferenceLinux
- CVE-2024-38543lib/test_hmm.c: handle src_pfns and dst_pfns allocation failureLinux
- CVE-2024-38540bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwqLinux
- CVE-2023-36512WordPress AutomateWoo plugin <= 5.7.5 - Broken Access Control vulnerabilityAutomateWoo
- CVE-2023-35050WordPress Elementor Pro plugin <= 3.13.0 - Auth. Broken Access Control vulnerabilityElementor Pro
- CVE-2023-41805Broken Access Control vulnerability in multiple Brainstorm Force pluginsBrainstorm Force Premium Starter Templates · Brainstorm For…
- CVE-2023-39922WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerabilityThemeFusion Avada
- CVE-2023-39990WordPress Paid Memberships Pro plugin <= 1.2.3 - Broken Access Control vulnerabilityPaid Memberships Pro
- CVE-2023-39993WordPress ElementsKit Lite plugin <= 2.9.0 - Broken Access Control vulnerabilityWpmet Elements kit Elementor addons
- CVE-2023-44148WordPress Astra Bulk Edit plugin <= 1.2.7 - Broken Access Control vulnerabilityBrainstorm Force Astra Bulk Edit
- CVE-2023-44151WordPress Pre-Publish Checklist plugin <= 1.1.1 - Broken Access Control vulnerabilityBrainstorm Force Pre-Publish Checklist
- CVE-2023-47681WordPress WooCommerce Checkout Manager plugin <= 7.3.0 - Broken Access Control vulnerabilityQuadLayers WooCommerce Checkout Manager
- CVE-2023-47788WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerabilityAutomattic Jetpack
- CVE-2023-48761WordPress JetElements For Elementor plugin <= 2.6.13 - Broken Access Control vulnerabilityCrocoblock JetElements For Elementor
- CVE-2024-35765WordPress Greenshift – animation and page builder blocks plugin <= 8.8.9.1 - Cross Site Scripting (XSS) vulnerabilityWpsoul Greenshift – animation and page builder blocks
- CVE-2023-50900WordPress Master Slider plugin <= 3.9.10 - Cross Site Request Forgery (CSRF) vulnerabilityAverta Master Slider
- CVE-2024-5676Paradox IP150 Internet Module Cross-Site Request ForgeryParadox Security Systems (Bahamas) IP150 Internet Module
- CVE-2024-4632WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce CartFlows – Funnel Builder & Checkout Plugi…
- CVE-2023-6495YARPP – Yet Another Related Posts Plugin <= 5.30.9 - Authenticated(Administrator+) Cross-Site Scriptingjeffparker YARPP – Yet Another Related Posts Plugin
- CVE-2024-0383WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'brechtvds WP Recipe Maker
- CVE-2024-0789WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypassflorent73 WP Maintenance
- CVE-2024-1407Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modificationstrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2024-3894Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Titlerobosoft Robo Gallery – Photo & Image Slider
- CVE-2024-37387Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client.RICOH COMPANY Ricoh Streamline NX PC Client
- CVE-2024-36252Improper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier.RICOH COMPANY Ricoh Streamline NX PC Client
- CVE-2024-37881SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirectEG Secure Solutions SiteGuard WP Plugin
- CVE-2024-5208Uncontrolled Resource Consumption in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2023-6692Ultimate Blocks – WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metaboxultimateblocks Ultimate Blocks – 25+ Gutenberg Blocks for B…
- CVE-2024-35298Improper authorization in handler for custom URL scheme issue in 'ZOZOTOWN' App for Android versions prior to 7.39.6 allows an attacker to l'ZOZOTOWN' App for Android
- CVE-2024-4623Blogmentor – Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameterauburnforest Blogmentor – Blog Layouts for Elementor
- CVE-2024-5768MIMO Woocommerce Order Tracking <= 1.0.2 - Missing Authorization to Authenticated (Contributor+) Stored Cross-Site Scriptingsurakrai MIMO Woocommerce Order Tracking
- CVE-2024-5649Universal Slider <= 1.6.5 - Authenticated (Contributor+) PHP Object Injectionwebhuntinfotech Universal Slider
- CVE-2024-3984EmbedSocial – Social Media Feeds, Reviews and Galleries <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site ScriptingEmbedSocial – Social Media Feeds, Reviews and Galleries
- CVE-2024-4873Replace Image <= 1.1.10 - Insecure Direct Object Referenceaspengrovestudios Replace Image
- CVE-2024-4541Custom Product List Table <= 3.0.0 - Cross-Site Request Forgeryviitorcloudvc Custom Product List Table
- CVE-2024-4663OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parametergarbowza OSM Map Widget for Elementor
- CVE-2024-4787Cost Calculator Builder PRO <= 3.1.75 - Unauthenticated Arbitrary Email SendingStylemixThemes Cost Calculator Builder PRO
- CVE-2024-4450AliExpress Dropshipping with AliNext Lite <= 3.3.6 - Missing Authorization via Several Functionsali2woo AliExpress Dropshipping Plugin for WooCommerce & Wo…
- CVE-2024-34993In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaSh