CVEs published June 20, 2024
158 CVEs were published on June 20, 2024: 6 critical, 47 high.
- Published
- 158
- Critical
- 6
- High
- 47
- Medium
- 66
- Low
- 1
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- Linux
- 67
- Absolute Software Secure Access
- 10
- Ruijie RG-UAC
- 4
- Kiuwan SAST
- 3
- LG Electronics SuperSign CMS
- 3
- mgibbs189 Custom Field Suite
- 3
- Westermo L210-F2G Lynx
- 3
- itsourcecode Tailoring Management System
- 2
- LabVantage LIMS
- 2
- Microsoft Edge
- 2
Critical 6
- CVE-2024-37899Disabling a user account changes its author, allowing RCE from user account in XWikixwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2022-48711tipc: improve size validations for received domain recordsLinux
- CVE-2024-4098Shariff Wrapper <= 4.6.13 - Unauthenticated Local File Inclusion3uu Shariff Wrapper
- CVE-2024-3605WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injectionthimpress WP Hotel Booking
- CVE-2024-5432Lifeline Donation <= 1.2.6 - Authentication Bypasswebinnane Lifeline Donation
- CVE-2024-37699An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.
High 47
- CVE-2024-32943Westermo L210-F2G Lynx Improper Control of Interaction FrequencyWestermo L210-F2G Lynx
- CVE-2024-35246Westermo L210-F2G Lynx Improper Control of Interaction FrequencyWestermo L210-F2G Lynx
- CVE-2024-5746A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator GitHub Enterprise Server
- CVE-2024-6154Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation VulnerabilityParallels Desktop
- CVE-2024-6153Parallels Desktop Updater Protection Mechanism Failure Software Downgrade VulnerabilityParallels Desktop
- CVE-2024-6147Poly Plantronics Hub Link Following Local Privilege Escalation VulnerabilityPoly Plantronics Hub
- CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listenerundertow · Red Hat EAP +13
- CVE-2024-37222WordPress Master Slider plugin <= 3.10.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAverta Master Slider
- CVE-2024-6189Tenda A301 WifiExtraSet fromSetWirelessRepeat stack-based overflowTenda A301
- CVE-2024-37532IBM WebSphere Application Server identity spoofingIBM WebSphere Application Server
- CVE-2023-49113Sensitive Data Stored Insecurely in Kiuwan SAST Local AnalyzerKiuwan SAST Local Analyzer
- CVE-2023-49110XML External Entity Injection in Kiuwan SASTKiuwan SAST
- CVE-2023-52883drm/amdgpu: Fix possible null pointer dereferenceLinux
- CVE-2022-48771drm/vmwgfx: Fix stale file descriptors on failed usercopyLinux
- CVE-2022-48762arm64: extable: fix load_unaligned_zeropad() reg indicesLinux
- CVE-2022-48759rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdevLinux
- CVE-2022-48754phylib: fix potential use-after-freeLinux
- CVE-2022-48751net/smc: Transitional solution for clcsock race issueLinux
- CVE-2022-48748net: bridge: vlan: fix memory leak in __allowed_ingressLinux
- CVE-2022-48747block: Fix wrong offset in bio_truncate()Linux
- CVE-2022-48744net/mlx5e: Avoid field-overflowing memcpy()Linux
- CVE-2022-48743net: amd-xgbe: Fix skb data length underflowLinux
- CVE-2022-48742rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()Linux
- CVE-2022-48739ASoC: hdmi-codec: Fix OOB memory accessesLinux
- CVE-2022-48735ALSA: hda: Fix UAF of leds class devs at unbindingLinux
- CVE-2022-48733btrfs: fix use-after-free after failure to create a snapshotLinux
- CVE-2022-48729IB/hfi1: Fix panic with larger ipoib send_queue_sizeLinux
- CVE-2022-48727KVM: arm64: Avoid consuming a stale esr value when SError occurLinux
- CVE-2022-48726RDMA/ucma: Protect mc during concurrent multicast leavesLinux
- CVE-2022-48721net/smc: Forward wakeup to smc socket waitqueue after fallbackLinux
- CVE-2022-48720net: macsec: Fix offload support for NETDEV_UNREGISTER eventLinux
- CVE-2022-48717ASoC: max9759: fix underflow in speaker_gain_control_put()Linux
- CVE-2022-48716ASoC: codecs: wcd938x: fix incorrect used of portidLinux
- CVE-2021-47620Bluetooth: refactor malicious adv data checkLinux
- CVE-2024-28147Unrestricted Upload of Files in edu-sharingmetaVentis edu-sharing
- CVE-2024-38620Bluetooth: HCI: Remove HCI_AMP supportLinux
- CVE-2023-25646Permission and Access Control Vulnerability in ZTE H388XZTE ZXHN H388X
- CVE-2024-4565Advanced Custom Fields < 6.3 - Contributor+ Custom Field AccessAdvanced Custom Fields
- CVE-2024-5605Media Library Assistant <= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameterdglingren Media Library Assistant
- CVE-2024-3562Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Fieldmgibbs189 Custom Field Suite
- CVE-2024-3561Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Fieldmgibbs189 Custom Field Suite
- CVE-2024-3597Export WP Page to Static HTML/CSS <= 2.2.2 - Open Redirectrecorp Export WordPress Pages to Static HTML & PDF — Static…
- CVE-2022-45929Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change
- CVE-2024-29390Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-
- CVE-2024-37626A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface
- CVE-2024-37676An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.
- CVE-2024-37818Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.@strapi/strapi
Medium, low and unrated 105
- CVE-2024-38361Permissions processing error in spacedbauthzed spicedb · github.com/authzed/spicedb
- CVE-2024-38359Lightning Network Daemon Onion Bomblightningnetwork lnd · github.com/lightningnetwork/lnd
- CVE-2024-37183Westermo L210-F2G Lynx Cleartext Transmission of Sensitive InformationWestermo L210-F2G Lynx
- CVE-2024-38082Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-38093Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-37897Insufficient access control for password reset in sftpgodrakkan sftpgo · github.com/drakkan/sftpgo/v2 +1
- CVE-2024-37352Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37351Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37350Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37349Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37348Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37347Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37346Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06Absolute Software Secure Access
- CVE-2024-37345Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37344Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-37343Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06Absolute Software Secure Access
- CVE-2024-6196itsourcecode Banking Management System admin_class.php sql injectionitsourcecode Banking Management System
- CVE-2024-6195itsourcecode Tailoring Management System orderadd.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-6194itsourcecode Tailoring Management System editmeasurement.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-6193itsourcecode Vehicle Management System driverprofile.php sql injectionitsourcecode Vehicle Management System
- CVE-2024-6192itsourcecode Loan Management System Login Page login.php sql injectionitsourcecode Loan Management System
- CVE-2024-6191itsourcecode Student Management System Login Page login.php sql injectionitsourcecode Student Management System
- CVE-2024-6190itsourcecode Farm Management System Login index.php sql injectionitsourcecode Farm Management System
- CVE-2024-5156Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeUX-themes Flatsome
- CVE-2024-6188Parsec Automation TrackSYS pagedefinition direct requestParsec Automation TrackSYS
- CVE-2024-6187Ruijie RG-UAC sub_commit.php os command injectionRuijie RG-UAC
- CVE-2023-49112Insecure Direct Object Reference in Kiuwan SASTKiuwan SAST
- CVE-2023-49111Reflected Cross-Site-Scripting in Kiuwan SASTKiuwan SAST
- CVE-2024-6186Ruijie RG-UAC commit.php os command injectionRuijie RG-UAC
- CVE-2021-4439isdn: cpai: check ctr->cnr to avoid array index out of boundLinux
- CVE-2024-6185Ruijie RG-UAC commit.php get_ip_addr_details os command injectionRuijie RG-UAC
- CVE-2024-6184Ruijie RG-UAC reboot_commit.php os command injectionRuijie RG-UAC
- CVE-2024-6183EZ-Suite EZ-Partner Forgot Password cross site scriptingEZ-Suite EZ-Partner
- CVE-2022-48770bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()Linux
- CVE-2022-48769efi: runtime: avoid EFIv2 runtime services on Apple x86 machinesLinux
- CVE-2022-48768tracing/histogram: Fix a potential memory leak for kstrdup()Linux
- CVE-2022-48767ceph: properly put ceph_string reference after async create attemptLinux
- CVE-2022-48766drm/amd/display: Wrap dcn301_calculate_wm_and_dlg for FPU.Linux
- CVE-2022-48765KVM: LAPIC: Also cancel preemption timer during SET_LAPICLinux
- CVE-2022-48764KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2}Linux
- CVE-2022-48763KVM: x86: Forcibly leave nested virt when SMM state is toggledLinux
- CVE-2022-48761usb: xhci-plat: fix crash when suspend if remote wake enableLinux
- CVE-2022-48760USB: core: Fix hang in usb_kill_urb by adding memory barriersLinux
- CVE-2022-48758scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()Linux
- CVE-2022-48757net: fix information leakage in /proc/net/ptypeLinux
- CVE-2022-48756drm/msm/dsi: invalid parameter check in msm_dsi_phy_enableLinux
- CVE-2022-48755powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06Linux
- CVE-2022-48753block: fix memory leak in disk_register_independent_access_rangesLinux
- CVE-2022-48752powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pendingLinux
- CVE-2022-48750hwmon: (nct6775) Fix crash in clear_caseopenLinux
- CVE-2022-48749drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pccLinux
- CVE-2022-48746net/mlx5e: Fix handling of wrong devices during bond neteventLinux
- CVE-2022-48745net/mlx5: Use del_timer_sync in fw reset flow of halting pollLinux
- CVE-2022-48741ovl: fix NULL pointer dereference in copy up warningLinux
- CVE-2022-48740selinux: fix double free of cond_list on error pathsLinux
- CVE-2022-48738ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()Linux
- CVE-2022-48734btrfs: fix deadlock between quota disable and qgroup rescan workerLinux
- CVE-2022-48732drm/nouveau: fix off by one in BIOS boundary checkingLinux
- CVE-2022-48731mm/kmemleak: avoid scanning potential huge holesLinux
- CVE-2022-48730dma-buf: heaps: Fix potential spectre v1 gadgetLinux
- CVE-2022-48728IB/hfi1: Fix AIP early init panicLinux
- CVE-2022-48725RDMA/siw: Fix refcounting leak in siw_create_qp()Linux
- CVE-2022-48724iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()Linux
- CVE-2022-48723spi: uniphier: fix reference count leak in uniphier_spi_probe()Linux
- CVE-2022-48722net: ieee802154: ca8210: Stop leaking skb'sLinux
- CVE-2022-48719net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_workLinux
- CVE-2022-48718drm: mxsfb: Fix NULL pointer dereferenceLinux
- CVE-2022-48715scsi: bnx2fc: Make bnx2fc_recv_frame() mp safeLinux
- CVE-2022-48714bpf: Use VM_MAP instead of VM_ALLOC for ringbufLinux
- CVE-2022-48713perf/x86/intel/pt: Fix crash with stop filters in single-range modeLinux
- CVE-2022-48712ext4: fix error handling in ext4_fc_record_modified_inode()Linux
- CVE-2021-47619i40e: Fix queues reservation for XDPLinux
- CVE-2024-5036Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingshaonsina Sina Extension for Elementor
- CVE-2024-6182LabVantage LIMS cross site scriptingLabVantage LIMS
- CVE-2024-6181LabVantage LIMS cross site scriptingLabVantage LIMS
- CVE-2021-47618ARM: 9170/1: fix panic when kasan and kprobe are enabledLinux
- CVE-2021-47617PCI: pciehp: Fix infinite loop in IRQ handler upon power faultLinux
- CVE-2024-34693Apache Superset: Server arbitrary file readApache Software Foundation Apache Superset · apache-superset
- CVE-2024-29013Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) viaSonicWall SonicOS
- CVE-2024-29012Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoSSonicWall SonicOS
- CVE-2024-38619usb-storage: alauda: Check whether the media is initializedLinux
- CVE-2024-5522HTML5 Video Player < 2.5.27 - Unauthenticated SQLiHTML5 Video Player
- CVE-2024-5475Responsive video embed < 0.5.1 - Contributor+ Stored XSSResponsive video embed
- CVE-2024-6113itsourcecode Monbela Tourist Inn Online Reservation System login.php sql injectionitsourcecode Monbela Tourist Inn Online Reservation System
- CVE-2024-5686WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members WidgetWPZOOM Addons for Elementor – Starter Templates & Widgets
- CVE-2024-4390Depicter <= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generationaverta Depicter — Popup & Slider Builder
- CVE-2024-5213Exposure of Sensitive Information in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-1168SEOPress – On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URLrainbowgeek SEOPress – On-site SEO & Analytics
- CVE-2023-3204Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Updateextendthemes Materialis
- CVE-2024-3558Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]mgibbs189 Custom Field Suite
- CVE-2024-4626JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parametersjetmonsters JetWidgets For Elementor
- CVE-2024-4742Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL InjectionYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2024-3627Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpointskraftplugins Wheel of Life: Coaching and Assessment Tool fo…
- CVE-2024-3602Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer <= 1.1.0 - Missing Authorizationpromolayerpopupbuilder Promolayer – Popup Builder & Abandon…
- CVE-2024-6179XSS vulnerability in LG SuperSign CMSLG Electronics SuperSign CMS
- CVE-2024-6178XSS vulnerability in LG SuperSign CMSLG Electronics SuperSign CMS
- CVE-2024-6177XSS vulnerability in LG SuperSign CMSLG Electronics SuperSign CMS
- CVE-2024-6176Port scanning vulnerability in LG SuperSign CMSLG Electronics LG SuperSign CMS
- CVE-2022-41324Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read acc
- CVE-2024-28397An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.js2py
- CVE-2024-30848Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script
- CVE-2024-31586A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0.
- CVE-2024-33335SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file.
- CVE-2024-36071Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the insta
- CVE-2024-37674Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter