# CVEs published 2024-06-20

158 CVEs were published on June 20, 2024: 6 critical, 47 high. Days are UTC.

- [CVE-2024-38361](https://cve.now/CVE-2024-38361.md): Permissions processing error in spacedb (CVSS 3.7, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2024-38359](https://cve.now/CVE-2024-38359.md): Lightning Network Daemon Onion Bomb (CVSS 6.5, lightningnetwork lnd · github.com/lightningnetwork/lnd)
- [CVE-2024-37899](https://cve.now/CVE-2024-37899.md): Disabling a user account changes its author, allowing RCE from user account in XWiki (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2024-32943](https://cve.now/CVE-2024-32943.md): Westermo L210-F2G Lynx Improper Control of Interaction Frequency (CVSS 7.5, Westermo L210-F2G Lynx)
- [CVE-2024-35246](https://cve.now/CVE-2024-35246.md): Westermo L210-F2G Lynx Improper Control of Interaction Frequency (CVSS 7.5, Westermo L210-F2G Lynx)
- [CVE-2024-37183](https://cve.now/CVE-2024-37183.md): Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Information (CVSS 5.7, Westermo L210-F2G Lynx)
- [CVE-2024-5746](https://cve.now/CVE-2024-5746.md): A Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with the Site Administrator (CVSS 7.6, GitHub Enterprise Server)
- [CVE-2024-6154](https://cve.now/CVE-2024-6154.md): Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability (CVSS 8.2, Parallels Desktop)
- [CVE-2024-6153](https://cve.now/CVE-2024-6153.md): Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability (CVSS 7.8, Parallels Desktop)
- [CVE-2024-6147](https://cve.now/CVE-2024-6147.md): Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Poly Plantronics Hub)
- [CVE-2024-38082](https://cve.now/CVE-2024-38082.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.7, Microsoft Edge)
- [CVE-2024-38093](https://cve.now/CVE-2024-38093.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2024-37897](https://cve.now/CVE-2024-37897.md): Insufficient access control for password reset in sftpgo (CVSS 5.4, drakkan sftpgo · github.com/drakkan/sftpgo/v2 +1)
- [CVE-2024-37352](https://cve.now/CVE-2024-37352.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 4.5, Absolute Software Secure Access)
- [CVE-2024-37351](https://cve.now/CVE-2024-37351.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 4.5, Absolute Software Secure Access)
- [CVE-2024-37350](https://cve.now/CVE-2024-37350.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 6.5, Absolute Software Secure Access)
- [CVE-2024-37349](https://cve.now/CVE-2024-37349.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 4.5, Absolute Software Secure Access)
- [CVE-2024-37348](https://cve.now/CVE-2024-37348.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 4.5, Absolute Software Secure Access)
- [CVE-2024-37347](https://cve.now/CVE-2024-37347.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 4.5, Absolute Software Secure Access)
- [CVE-2024-37346](https://cve.now/CVE-2024-37346.md): Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06 (CVSS 4.9, Absolute Software Secure Access)
- [CVE-2024-37345](https://cve.now/CVE-2024-37345.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 5.3, Absolute Software Secure Access)
- [CVE-2024-37344](https://cve.now/CVE-2024-37344.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 4.5, Absolute Software Secure Access)
- [CVE-2024-37343](https://cve.now/CVE-2024-37343.md): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (CVSS 4.8, Absolute Software Secure Access)
- [CVE-2024-6196](https://cve.now/CVE-2024-6196.md): itsourcecode Banking Management System admin\_class.php sql injection (CVSS 6.9, itsourcecode Banking Management System)
- [CVE-2024-6195](https://cve.now/CVE-2024-6195.md): itsourcecode Tailoring Management System orderadd.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-6194](https://cve.now/CVE-2024-6194.md): itsourcecode Tailoring Management System editmeasurement.php sql injection (CVSS 5.3, itsourcecode Tailoring Management System)
- [CVE-2024-6193](https://cve.now/CVE-2024-6193.md): itsourcecode Vehicle Management System driverprofile.php sql injection (CVSS 6.9, itsourcecode Vehicle Management System)
- [CVE-2024-6192](https://cve.now/CVE-2024-6192.md): itsourcecode Loan Management System Login Page login.php sql injection (CVSS 6.9, itsourcecode Loan Management System)
- [CVE-2024-6162](https://cve.now/CVE-2024-6162.md): Undertow: url-encoded request path information can be broken on ajp-listener (CVSS 7.5, undertow · Red Hat EAP +13)
- [CVE-2024-6191](https://cve.now/CVE-2024-6191.md): itsourcecode Student Management System Login Page login.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2024-6190](https://cve.now/CVE-2024-6190.md): itsourcecode Farm Management System Login index.php sql injection (CVSS 6.9, itsourcecode Farm Management System)
- [CVE-2024-37222](https://cve.now/CVE-2024-37222.md): WordPress Master Slider plugin \<= 3.10.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Averta Master Slider)
- [CVE-2024-5156](https://cve.now/CVE-2024-5156.md): Flatsome \<= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, UX-themes Flatsome)
- [CVE-2024-6189](https://cve.now/CVE-2024-6189.md): Tenda A301 WifiExtraSet fromSetWirelessRepeat stack-based overflow (CVSS 8.7, Tenda A301)
- [CVE-2024-6188](https://cve.now/CVE-2024-6188.md): Parsec Automation TrackSYS pagedefinition direct request (CVSS 6.9, Parsec Automation TrackSYS)
- [CVE-2024-37532](https://cve.now/CVE-2024-37532.md): IBM WebSphere Application Server identity spoofing (CVSS 8.8, IBM WebSphere Application Server)
- [CVE-2024-6187](https://cve.now/CVE-2024-6187.md): Ruijie RG-UAC sub\_commit.php os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2023-49113](https://cve.now/CVE-2023-49113.md): Sensitive Data Stored Insecurely in Kiuwan SAST Local Analyzer (CVSS 7.8, Kiuwan SAST Local Analyzer)
- [CVE-2023-49112](https://cve.now/CVE-2023-49112.md): Insecure Direct Object Reference in Kiuwan SAST (CVSS 6.5, Kiuwan SAST)
- [CVE-2023-49111](https://cve.now/CVE-2023-49111.md): Reflected Cross-Site-Scripting in Kiuwan SAST (CVSS 6.5, Kiuwan SAST)
- [CVE-2024-6186](https://cve.now/CVE-2024-6186.md): Ruijie RG-UAC commit.php os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2023-49110](https://cve.now/CVE-2023-49110.md): XML External Entity Injection in Kiuwan SAST (CVSS 7.2, Kiuwan SAST)
- [CVE-2021-4439](https://cve.now/CVE-2021-4439.md): isdn: cpai: check ctr-\>cnr to avoid array index out of bound (no CVSS, Linux)
- [CVE-2024-6185](https://cve.now/CVE-2024-6185.md): Ruijie RG-UAC commit.php get\_ip\_addr\_details os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2023-52883](https://cve.now/CVE-2023-52883.md): drm/amdgpu: Fix possible null pointer dereference (CVSS 7.5, Linux)
- [CVE-2024-6184](https://cve.now/CVE-2024-6184.md): Ruijie RG-UAC reboot\_commit.php os command injection (CVSS 5.3, Ruijie RG-UAC)
- [CVE-2024-6183](https://cve.now/CVE-2024-6183.md): EZ-Suite EZ-Partner Forgot Password cross site scripting (CVSS 6.9, EZ-Suite EZ-Partner)
- [CVE-2022-48771](https://cve.now/CVE-2022-48771.md): drm/vmwgfx: Fix stale file descriptors on failed usercopy (CVSS 7.8, Linux)
- [CVE-2022-48770](https://cve.now/CVE-2022-48770.md): bpf: Guard against accessing NULL pt\_regs in bpf\_get\_task\_stack() (no CVSS, Linux)
- [CVE-2022-48769](https://cve.now/CVE-2022-48769.md): efi: runtime: avoid EFIv2 runtime services on Apple x86 machines (no CVSS, Linux)
- [CVE-2022-48768](https://cve.now/CVE-2022-48768.md): tracing/histogram: Fix a potential memory leak for kstrdup() (no CVSS, Linux)
- [CVE-2022-48767](https://cve.now/CVE-2022-48767.md): ceph: properly put ceph\_string reference after async create attempt (CVSS 5.3, Linux)
- [CVE-2022-48766](https://cve.now/CVE-2022-48766.md): drm/amd/display: Wrap dcn301\_calculate\_wm\_and\_dlg for FPU. (no CVSS, Linux)
- [CVE-2022-48765](https://cve.now/CVE-2022-48765.md): KVM: LAPIC: Also cancel preemption timer during SET\_LAPIC (no CVSS, Linux)
- [CVE-2022-48764](https://cve.now/CVE-2022-48764.md): KVM: x86: Free kvm\_cpuid\_entry2 array on post-KVM\_RUN KVM\_SET\_CPUID{,2} (CVSS 5.3, Linux)
- [CVE-2022-48763](https://cve.now/CVE-2022-48763.md): KVM: x86: Forcibly leave nested virt when SMM state is toggled (no CVSS, Linux)
- [CVE-2022-48762](https://cve.now/CVE-2022-48762.md): arm64: extable: fix load\_unaligned\_zeropad() reg indices (CVSS 7.8, Linux)
- [CVE-2022-48761](https://cve.now/CVE-2022-48761.md): usb: xhci-plat: fix crash when suspend if remote wake enable (CVSS 5.3, Linux)
- [CVE-2022-48760](https://cve.now/CVE-2022-48760.md): USB: core: Fix hang in usb\_kill\_urb by adding memory barriers (no CVSS, Linux)
- [CVE-2022-48759](https://cve.now/CVE-2022-48759.md): rpmsg: char: Fix race between the release of rpmsg\_ctrldev and cdev (CVSS 7.8, Linux)
- [CVE-2022-48758](https://cve.now/CVE-2022-48758.md): scsi: bnx2fc: Flush destroy\_work queue before calling bnx2fc\_interface\_put() (no CVSS, Linux)
- [CVE-2022-48757](https://cve.now/CVE-2022-48757.md): net: fix information leakage in /proc/net/ptype (no CVSS, Linux)
- [CVE-2022-48756](https://cve.now/CVE-2022-48756.md): drm/msm/dsi: invalid parameter check in msm\_dsi\_phy\_enable (no CVSS, Linux)
- [CVE-2022-48755](https://cve.now/CVE-2022-48755.md): powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 (no CVSS, Linux)
- [CVE-2022-48754](https://cve.now/CVE-2022-48754.md): phylib: fix potential use-after-free (CVSS 7.8, Linux)
- [CVE-2022-48753](https://cve.now/CVE-2022-48753.md): block: fix memory leak in disk\_register\_independent\_access\_ranges (CVSS 5.3, Linux)
- [CVE-2022-48752](https://cve.now/CVE-2022-48752.md): powerpc/perf: Fix power\_pmu\_disable to call clear\_pmi\_irq\_pending only if PMI is pending (no CVSS, Linux)
- [CVE-2022-48751](https://cve.now/CVE-2022-48751.md): net/smc: Transitional solution for clcsock race issue (CVSS 7.8, Linux)
- [CVE-2022-48750](https://cve.now/CVE-2022-48750.md): hwmon: (nct6775) Fix crash in clear\_caseopen (no CVSS, Linux)
- [CVE-2022-48749](https://cve.now/CVE-2022-48749.md): drm/msm/dpu: invalid parameter check in dpu\_setup\_dspp\_pcc (no CVSS, Linux)
- [CVE-2022-48748](https://cve.now/CVE-2022-48748.md): net: bridge: vlan: fix memory leak in \_\_allowed\_ingress (CVSS 7.5, Linux)
- [CVE-2022-48747](https://cve.now/CVE-2022-48747.md): block: Fix wrong offset in bio\_truncate() (CVSS 7.5, Linux)
- [CVE-2022-48746](https://cve.now/CVE-2022-48746.md): net/mlx5e: Fix handling of wrong devices during bond netevent (no CVSS, Linux)
- [CVE-2022-48745](https://cve.now/CVE-2022-48745.md): net/mlx5: Use del\_timer\_sync in fw reset flow of halting poll (no CVSS, Linux)
- [CVE-2022-48744](https://cve.now/CVE-2022-48744.md): net/mlx5e: Avoid field-overflowing memcpy() (CVSS 7.5, Linux)
- [CVE-2022-48743](https://cve.now/CVE-2022-48743.md): net: amd-xgbe: Fix skb data length underflow (CVSS 8.1, Linux)
- [CVE-2022-48742](https://cve.now/CVE-2022-48742.md): rtnetlink: make sure to refresh master\_dev/m\_ops in \_\_rtnl\_newlink() (CVSS 7.8, Linux)
- [CVE-2022-48741](https://cve.now/CVE-2022-48741.md): ovl: fix NULL pointer dereference in copy up warning (no CVSS, Linux)
- [CVE-2022-48740](https://cve.now/CVE-2022-48740.md): selinux: fix double free of cond\_list on error paths (no CVSS, Linux)
- [CVE-2022-48739](https://cve.now/CVE-2022-48739.md): ASoC: hdmi-codec: Fix OOB memory accesses (CVSS 7.1, Linux)
- [CVE-2022-48738](https://cve.now/CVE-2022-48738.md): ASoC: ops: Reject out of bounds values in snd\_soc\_put\_volsw() (no CVSS, Linux)
- [CVE-2022-48735](https://cve.now/CVE-2022-48735.md): ALSA: hda: Fix UAF of leds class devs at unbinding (CVSS 7.8, Linux)
- [CVE-2022-48734](https://cve.now/CVE-2022-48734.md): btrfs: fix deadlock between quota disable and qgroup rescan worker (no CVSS, Linux)
- [CVE-2022-48733](https://cve.now/CVE-2022-48733.md): btrfs: fix use-after-free after failure to create a snapshot (CVSS 7.8, Linux)
- [CVE-2022-48732](https://cve.now/CVE-2022-48732.md): drm/nouveau: fix off by one in BIOS boundary checking (no CVSS, Linux)
- [CVE-2022-48731](https://cve.now/CVE-2022-48731.md): mm/kmemleak: avoid scanning potential huge holes (CVSS 5.5, Linux)
- [CVE-2022-48730](https://cve.now/CVE-2022-48730.md): dma-buf: heaps: Fix potential spectre v1 gadget (no CVSS, Linux)
- [CVE-2022-48729](https://cve.now/CVE-2022-48729.md): IB/hfi1: Fix panic with larger ipoib send\_queue\_size (CVSS 7.8, Linux)
- [CVE-2022-48728](https://cve.now/CVE-2022-48728.md): IB/hfi1: Fix AIP early init panic (no CVSS, Linux)
- [CVE-2022-48727](https://cve.now/CVE-2022-48727.md): KVM: arm64: Avoid consuming a stale esr value when SError occur (CVSS 7.3, Linux)
- [CVE-2022-48726](https://cve.now/CVE-2022-48726.md): RDMA/ucma: Protect mc during concurrent multicast leaves (CVSS 7.8, Linux)
- [CVE-2022-48725](https://cve.now/CVE-2022-48725.md): RDMA/siw: Fix refcounting leak in siw\_create\_qp() (no CVSS, Linux)
- [CVE-2022-48724](https://cve.now/CVE-2022-48724.md): iommu/vt-d: Fix potential memory leak in intel\_setup\_irq\_remapping() (no CVSS, Linux)
- [CVE-2022-48723](https://cve.now/CVE-2022-48723.md): spi: uniphier: fix reference count leak in uniphier\_spi\_probe() (no CVSS, Linux)
- [CVE-2022-48722](https://cve.now/CVE-2022-48722.md): net: ieee802154: ca8210: Stop leaking skb's (no CVSS, Linux)
- [CVE-2022-48721](https://cve.now/CVE-2022-48721.md): net/smc: Forward wakeup to smc socket waitqueue after fallback (CVSS 7.8, Linux)
- [CVE-2022-48720](https://cve.now/CVE-2022-48720.md): net: macsec: Fix offload support for NETDEV\_UNREGISTER event (CVSS 7.8, Linux)
- [CVE-2022-48719](https://cve.now/CVE-2022-48719.md): net, neigh: Do not trigger immediate probes on NUD\_FAILED from neigh\_managed\_work (no CVSS, Linux)
- [CVE-2022-48718](https://cve.now/CVE-2022-48718.md): drm: mxsfb: Fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2022-48717](https://cve.now/CVE-2022-48717.md): ASoC: max9759: fix underflow in speaker\_gain\_control\_put() (CVSS 7.1, Linux)
- [CVE-2022-48716](https://cve.now/CVE-2022-48716.md): ASoC: codecs: wcd938x: fix incorrect used of portid (CVSS 7.8, Linux)
- [CVE-2022-48715](https://cve.now/CVE-2022-48715.md): scsi: bnx2fc: Make bnx2fc\_recv\_frame() mp safe (no CVSS, Linux)
- [CVE-2022-48714](https://cve.now/CVE-2022-48714.md): bpf: Use VM\_MAP instead of VM\_ALLOC for ringbuf (no CVSS, Linux)
- [CVE-2022-48713](https://cve.now/CVE-2022-48713.md): perf/x86/intel/pt: Fix crash with stop filters in single-range mode (no CVSS, Linux)
- [CVE-2022-48712](https://cve.now/CVE-2022-48712.md): ext4: fix error handling in ext4\_fc\_record\_modified\_inode() (no CVSS, Linux)
- [CVE-2022-48711](https://cve.now/CVE-2022-48711.md): tipc: improve size validations for received domain records (CVSS 9.8, Linux)
- [CVE-2021-47620](https://cve.now/CVE-2021-47620.md): Bluetooth: refactor malicious adv data check (CVSS 8.1, Linux)
- [CVE-2021-47619](https://cve.now/CVE-2021-47619.md): i40e: Fix queues reservation for XDP (no CVSS, Linux)
- [CVE-2024-5036](https://cve.now/CVE-2024-5036.md): Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) \<= 3.5.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, shaonsina Sina Extension for Elementor)
- [CVE-2024-6182](https://cve.now/CVE-2024-6182.md): LabVantage LIMS cross site scripting (CVSS 5.3, LabVantage LIMS)
- [CVE-2024-6181](https://cve.now/CVE-2024-6181.md): LabVantage LIMS cross site scripting (CVSS 5.3, LabVantage LIMS)
- [CVE-2021-47618](https://cve.now/CVE-2021-47618.md): ARM: 9170/1: fix panic when kasan and kprobe are enabled (no CVSS, Linux)
- [CVE-2021-47617](https://cve.now/CVE-2021-47617.md): PCI: pciehp: Fix infinite loop in IRQ handler upon power fault (no CVSS, Linux)
- [CVE-2024-28147](https://cve.now/CVE-2024-28147.md): Unrestricted Upload of Files in edu-sharing (CVSS 7.4, metaVentis edu-sharing)
- [CVE-2024-34693](https://cve.now/CVE-2024-34693.md): Apache Superset: Server arbitrary file read (CVSS 6.8, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-29013](https://cve.now/CVE-2024-29013.md): Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via (CVSS 5.3, SonicWall SonicOS)
- [CVE-2024-29012](https://cve.now/CVE-2024-29012.md): Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS (CVSS 4.9, SonicWall SonicOS)
- [CVE-2024-38620](https://cve.now/CVE-2024-38620.md): Bluetooth: HCI: Remove HCI\_AMP support (CVSS 8.8, Linux)
- [CVE-2024-4098](https://cve.now/CVE-2024-4098.md): Shariff Wrapper \<= 4.6.13 - Unauthenticated Local File Inclusion (CVSS 9.8, 3uu Shariff Wrapper)
- [CVE-2024-38619](https://cve.now/CVE-2024-38619.md): usb-storage: alauda: Check whether the media is initialized (no CVSS, Linux)
- [CVE-2023-25646](https://cve.now/CVE-2023-25646.md): Permission and Access Control Vulnerability in ZTE H388X (CVSS 7.1, ZTE ZXHN H388X)
- [CVE-2024-5522](https://cve.now/CVE-2024-5522.md): HTML5 Video Player \< 2.5.27 - Unauthenticated SQLi (CVSS 6.5, HTML5 Video Player)
- [CVE-2024-5475](https://cve.now/CVE-2024-5475.md): Responsive video embed \< 0.5.1 - Contributor+ Stored XSS (CVSS 5.4, Responsive video embed)
- [CVE-2024-4565](https://cve.now/CVE-2024-4565.md): Advanced Custom Fields \< 6.3 - Contributor+ Custom Field Access (CVSS 7.5, Advanced Custom Fields)
- [CVE-2024-6113](https://cve.now/CVE-2024-6113.md): itsourcecode Monbela Tourist Inn Online Reservation System login.php sql injection (CVSS 6.9, itsourcecode Monbela Tourist Inn Online Reservation System)
- [CVE-2024-5686](https://cve.now/CVE-2024-5686.md): WPZOOM Addons for Elementor (Templates, Widgets) \<= 1.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget (CVSS 6.4, WPZOOM Addons for Elementor – Starter Templates & Widgets)
- [CVE-2024-4390](https://cve.now/CVE-2024-4390.md): Depicter \<= 3.0.2 - Authenticated (Contributor+) Arbitrary Nonce Generation (CVSS 6.5, averta Depicter — Popup & Slider Builder)
- [CVE-2024-5605](https://cve.now/CVE-2024-5605.md): Media Library Assistant \<= 3.16 - Authenticated (Contributor+) SQL Injection via order Parameter (CVSS 8.8, dglingren Media Library Assistant)
- [CVE-2024-5213](https://cve.now/CVE-2024-5213.md): Exposure of Sensitive Information in mintplex-labs/anything-llm (CVSS 5.3, mintplex-labs/anything-llm)
- [CVE-2024-3562](https://cve.now/CVE-2024-3562.md): Custom Field Suite \<= 2.6.7 - Authenticated (Contributor+) PHP Code Injection via Loop Custom Field (CVSS 8.8, mgibbs189 Custom Field Suite)
- [CVE-2024-1168](https://cve.now/CVE-2024-1168.md): SEOPress – On-site SEO \<= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL (CVSS 6.4, rainbowgeek SEOPress – On-site SEO & Analytics)
- [CVE-2024-3561](https://cve.now/CVE-2024-3561.md): Custom Field Suite \<= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field (CVSS 8.8, mgibbs189 Custom Field Suite)
- [CVE-2023-3204](https://cve.now/CVE-2023-3204.md): Materialis \<= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update (CVSS 6.5, extendthemes Materialis)
- [CVE-2024-3558](https://cve.now/CVE-2024-3558.md): Custom Field Suite \<= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs\[post\_title\] (CVSS 6.4, mgibbs189 Custom Field Suite)
- [CVE-2024-3597](https://cve.now/CVE-2024-3597.md): Export WP Page to Static HTML/CSS \<= 2.2.2 - Open Redirect (CVSS 7.1, recorp Export WordPress Pages to Static HTML & PDF — Static…)
- [CVE-2024-3605](https://cve.now/CVE-2024-3605.md): WP Hotel Booking \<= 2.1.0 - Unauthenticated SQL Injection (CVSS 10.0, thimpress WP Hotel Booking)
- [CVE-2024-4626](https://cve.now/CVE-2024-4626.md): JetWidgets For Elementor \<= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout\_type and id Parameters (CVSS 6.4, jetmonsters JetWidgets For Elementor)
- [CVE-2024-5432](https://cve.now/CVE-2024-5432.md): Lifeline Donation \<= 1.2.6 - Authentication Bypass (CVSS 9.8, webinnane Lifeline Donation)
- [CVE-2024-4742](https://cve.now/CVE-2024-4742.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress \<= 1.2.5 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-3627](https://cve.now/CVE-2024-3627.md): Wheel of Life: Coaching and Assessment Tool for Life Coach \<= 1.1.7 - Missing Authorization on Several AJAX Endpoints (CVSS 5.4, kraftplugins Wheel of Life: Coaching and Assessment Tool fo…)
- [CVE-2024-3602](https://cve.now/CVE-2024-3602.md): Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer \<= 1.1.0 - Missing Authorization (CVSS 4.3, promolayerpopupbuilder Promolayer – Popup Builder & Abandon…)
- [CVE-2024-6179](https://cve.now/CVE-2024-6179.md): XSS vulnerability in LG SuperSign CMS (CVSS 4.8, LG Electronics SuperSign CMS)
- [CVE-2024-6178](https://cve.now/CVE-2024-6178.md): XSS vulnerability in LG SuperSign CMS (CVSS 4.8, LG Electronics SuperSign CMS)
- [CVE-2024-6177](https://cve.now/CVE-2024-6177.md): XSS vulnerability in LG SuperSign CMS (CVSS 4.8, LG Electronics SuperSign CMS)
- [CVE-2024-6176](https://cve.now/CVE-2024-6176.md): Port scanning vulnerability in LG SuperSign CMS (CVSS 4.8, LG Electronics LG SuperSign CMS)
- [CVE-2022-41324](https://cve.now/CVE-2022-41324.md): Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read acc (CVSS 6.5)
- [CVE-2022-45929](https://cve.now/CVE-2022-45929.md): Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change (CVSS 8.8)
- [CVE-2024-28397](https://cve.now/CVE-2024-28397.md): An issue in the component js2py.disable\_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. (CVSS 5.3, js2py)
- [CVE-2024-29390](https://cve.now/CVE-2024-29390.md): Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add- (CVSS 7.3)
- [CVE-2024-30848](https://cve.now/CVE-2024-30848.md): Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script (CVSS 6.1)
- [CVE-2024-31586](https://cve.now/CVE-2024-31586.md): A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. (CVSS 6.1)
- [CVE-2024-33335](https://cve.now/CVE-2024-33335.md): SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file. (CVSS 6.3)
- [CVE-2024-36071](https://cve.now/CVE-2024-36071.md): Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the insta (CVSS 6.3)
- [CVE-2024-37626](https://cve.now/CVE-2024-37626.md): A command injection issue in TOTOLINK A6000R V1.0.1-B20201211.2000 firmware allows a remote attacker to execute arbitrary code via the iface (CVSS 8.8)
- [CVE-2024-37674](https://cve.now/CVE-2024-37674.md): Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter (CVSS 5.5)
- [CVE-2024-37676](https://cve.now/CVE-2024-37676.md): An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header\_populateFromSettings function. (CVSS 8.4)
- [CVE-2024-37699](https://cve.now/CVE-2024-37699.md): An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption. (CVSS 9.8)
- [CVE-2024-37818](https://cve.now/CVE-2024-37818.md): Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/\_next/image. (CVSS 8.6, @strapi/strapi)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.