CVEs published June 21, 2024
137 CVEs were published on June 21, 2024: 11 critical, 26 high.
- Published
- 137
- Critical
- 11
- High
- 26
- Medium
- 72
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Linux
- 40
- SourceCodester Food Ordering Management System
- 5
- laurent22 joplin
- 4
- Widget Bundle
- 3
- WP Logs Book
- 3
- CB
- 2
- John West Slideshow SE
- 2
- Live Composer Team Page Builder: Live Composer
- 2
- Online Booking & Scheduling Calendar for WordPress by vcita
- 2
- PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
- 2
Critical 11
- CVE-2020-27352When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result sCanonical snapd
- CVE-2024-35767WordPress Squeeze plugin <= 1.4 - Arbitrary File Upload vulnerabilityBogdan Bendziukov Squeeze
- CVE-2023-38389WordPress Jupiter X Core plugin <= 3.3.8 - Unauthenticated Account Takeover vulnerabilityArtbees JupiterX Core
- CVE-2023-45197Adminer and AdminerEvo vulnerable to directory traversal and file uploadAdminer · AdminerEvo
- CVE-2024-36288SUNRPC: Fix loop termination condition in gss_free_in_token_pages()Linux
- CVE-2024-6027Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameterthemifyme Themify – WooCommerce Product Filter
- CVE-2024-5756Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optinicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2012-6664Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read
- CVE-2014-5470Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data
- CVE-2024-34989In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFP
- CVE-2024-36532Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's t
High 26
- CVE-2023-37898Safe mode Cross-site Scripting (XSS) vulnerability in Joplinlaurent22 joplin
- CVE-2023-38506Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplinlaurent22 joplin
- CVE-2023-39517Cross site scripting (XSS) when clicking on an untrusted `<map>` link in Joplinlaurent22 joplin
- CVE-2023-45673Arbitrary code execution on click of PDF links in Joplinlaurent22 joplin
- CVE-2024-37212WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - CSRF to PHP Object Injection vulnerabilityAli2Woo Lite
- CVE-2024-6240Improper privilege management vulnerability in Parallels DesktopParallels Desktop
- CVE-2022-43453WordPress WP Tools plugin <= 3.41 - Auth. Broken Access Control vulnerabilityBill Minozzi WP Tools
- CVE-2024-6239Poppler: pdfinfo: crash in broken documents when using -dests parameterpoppler · Red Hat Enterprise Linux
- CVE-2024-35766WordPress WPPizza – A Restaurant Plugin plugin <= 3.18.13 - Reflected Cross Site Scripting (XSS) vulnerabilityollybach WPPizza
- CVE-2024-36477tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer bufferLinux
- CVE-2024-39277dma-mapping: benchmark: handle NUMA_NO_NODE correctlyLinux
- CVE-2024-38659enic: Validate length of nl attributes in enic_set_vf_portLinux
- CVE-2024-38635soundwire: cadence: fix invalid PDI offsetLinux
- CVE-2024-38628usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.Linux
- CVE-2024-38626fuse: clear FR_SENT when re-adding requests into pending listLinux
- CVE-2024-38623fs/ntfs3: Use variable length array instead of fixed sizeLinux
- CVE-2024-38388ALSA: hda/cs_dsp_ctl: Use private_free for control cleanupLinux
- CVE-2024-38381nfc: nci: Fix uninit-value in nci_rx_workLinux
- CVE-2024-36286netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()Linux
- CVE-2024-33619efi: libstub: only free priv.runtime_map when allocatedLinux
- CVE-2024-31890IBM i privilege escalationIBM i
- CVE-2024-2003Local Privilege Escalation in Quarantine of ESET products for WindowsESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +11
- CVE-2024-5455The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusionposimyththemes The Plus Addons for Elementor Page Builder P…
- CVE-2024-5503WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusioncodevibrant WP Blog Post Layouts
- CVE-2021-47621ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.io.github.classgraph:classgraph
- CVE-2024-35537TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS v5.0.0 was discovered to insecurely handle the RSA key pair, allowing attackers
Medium, low and unrated 100
- CVE-2024-6120Sparkle Demo Importer <= 1.4.7 - Missing Authorization to Authorized(Subscriber+) Post/Pages/Attachements Deletion and Demo Data Importsparklewpthemes Sparkle Demo Importer
- CVE-2024-6241Pear Admin Boot getDictItems sql injectionPear Admin Boot
- CVE-2024-35781WordPress Word Balloon plugin <= 4.21.1 - Local File Inclusion vulnerabilityYAHMAN Word Balloon
- CVE-2024-35778WordPress Slideshow SE plugin <= 2.5.17 - Auth. Limited Local File Inclusion vulnerabilityJohn West Slideshow SE
- CVE-2022-44593WordPress Solid Security plugin <= 9.3.1 - IP Spoofing Leading to Denial of Service vulnerabilitySolidWP Solid Security
- CVE-2022-44587WordPress WP 2FA plugin <= 2.6.3 - Sensitive Data Exposure via Log File vulnerabilityWP 2FA
- CVE-2022-38055WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerabilitygVectors Team wpForo Forum
- CVE-2024-37118WordPress Uncanny Automator Pro plugin <= 5.3 - Cross Site Request Forgery (CSRF) Leading to License Settings Reset vulnerabilityUncanny Owl Uncanny Automator Pro
- CVE-2024-37198WordPress Digital Newspaper theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerabilityblazethemes Digital Newspaper
- CVE-2024-37227WordPress Newsletters plugin <= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerabilityTribulant Newsletters
- CVE-2024-37230WordPress Book Landing Page theme <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityRara Theme Book Landing Page
- CVE-2023-51375WordPress EmbedPress plugin <= 3.8.3 - Broken Access Control vulnerabilityWPDeveloper EmbedPress
- CVE-2022-45803WordPress Gutenberg Forms plugin <= 2.2.8.3 - Auth. Broken Access Control vulnerabilityNikolay Strikhar WordPress Form Builder Plugin – Gutenberg…
- CVE-2024-35770WordPress Vimeography plugin <= 2.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityDave Kiss Vimeography: Vimeo Video Gallery WordPress Plugin
- CVE-2024-35771WordPress Customizr theme <= 4.4.21 - Cross Site Request Forgery (CSRF) vulnerabilitypresscustomizr Customizr
- CVE-2024-35772WordPress Hueman theme <= 3.7.24 - Cross Site Request Forgery (CSRF) vulnerabilitypresscustomizr Hueman
- CVE-2024-35776WordPress phpinfo() WP plugin <= 5.0 - Unauthenticated Data Exposure vulnerabilityExeebit phpinfo() WP
- CVE-2024-5059WordPress Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure vulnerabilityA WP Life Event Management Tickets Booking
- CVE-2024-35757WordPress Easy Age Verify plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability5 Star Plugins Easy Age Verify
- CVE-2024-35758WordPress Interface theme <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityTheme Horse Interface
- CVE-2024-35759WordPress WP Job Portal plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilitywpjobportal WP Job Portal
- CVE-2024-35760WordPress WP Job Portal plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilitywpjobportal WP Job Portal
- CVE-2024-35761WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.4.0 - Cross Site Scripting (XSS) vulnerabilityOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2024-35762WordPress Serious Slider plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityCryout Creations Serious Slider
- CVE-2024-35763WordPress Excellent theme <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityTheme Freesia Excellent
- CVE-2024-35764WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerabilityandy_moyle Church Admin
- CVE-2024-35768WordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerabilityLive Composer Team Page Builder: Live Composer
- CVE-2024-35769WordPress Slideshow SE plugin <= 2.5.17 - Cross Site Scripting (XSS) vulnerabilityJohn West Slideshow SE
- CVE-2024-35774WordPress DImage 360 plugin <= 2.0 - Cross Site Scripting (XSS) vulnerabilityD’arteweb DImage
- CVE-2024-35779WordPress Page Builder: Live Composer plugin <= 1.5.42 - Contributor+ Shortcode Cross Site Scripting (XSS) vulnerabilityLive Composer Team Page Builder: Live Composer
- CVE-2024-5058WordPress Typing Text plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityWPDeveloper Typing Text
- CVE-2024-36481tracing/probes: fix error check in parse_btf_field()Linux
- CVE-2024-34777dma-mapping: benchmark: fix node id validationLinux
- CVE-2024-38780dma-buf/sw-sync: don't enable IRQ from sync_print_obj()Linux
- CVE-2024-38662bpf: Allow delete from sockmap/sockhash only if update is allowedLinux
- CVE-2024-3036Communication DoS vulnerabilityABB 800xA Base
- CVE-2024-38637greybus: lights: check return of get_channel_from_modeLinux
- CVE-2024-38636f2fs: multidev: fix to recognize valid zero block addressLinux
- CVE-2024-38634serial: max3100: Lock port->lock when calling uart_handle_cts_change()Linux
- CVE-2024-38633serial: max3100: Update uart_driver_registered on driver removalLinux
- CVE-2024-38632vfio/pci: fix potential memory leak in vfio_intx_enable()Linux
- CVE-2024-38631iio: adc: PAC1934: fix accessing out of bounds array indexLinux
- CVE-2024-38630watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_triggerLinux
- CVE-2024-38629dmaengine: idxd: Avoid unnecessary destruction of file_idaLinux
- CVE-2024-38627stm class: Fix a double free in stm_register_device()Linux
- CVE-2024-38625fs/ntfs3: Check 'folio' pointer for NULLLinux
- CVE-2024-38624fs/ntfs3: Use 64 bit variable to avoid 32 bit overflowLinux
- CVE-2024-38622drm/msm/dpu: Add callback function pointer check before its callLinux
- CVE-2024-38621media: stk1160: fix bounds checking in stk1160_copy_video()Linux
- CVE-2024-38390drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting failsLinux
- CVE-2024-37356tcp: Fix shift-out-of-bounds in dctcp_update_alpha().Linux
- CVE-2024-36489tls: fix missing memory barrier in tls_initLinux
- CVE-2024-36484net: relax socket state check at accept time.Linux
- CVE-2024-36478null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'Linux
- CVE-2024-36281net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rulesLinux
- CVE-2024-36270netfilter: tproxy: bail out if IP has been disabled on the deviceLinux
- CVE-2024-36244net/sched: taprio: extend minimum interval restriction to entire cycle tooLinux
- CVE-2024-33621ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outboundLinux
- CVE-2024-31076genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offlineLinux
- CVE-2023-52884Input: cyapa - add missing input core locking to suspend/resume functionsLinux
- CVE-2024-5859Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site ScriptingOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2024-5945WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVGshortpixel WP SVG Images
- CVE-2024-6225Amelia <= 1.1.5 & Amelia (Pro) <= 7.5.1 - Authenticated (Admin+) Stored Cross-Site Scriptingameliabooking Booking for Appointments and Events Calendar…
- CVE-2024-5191Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploadwpmudev Branda – White Label & Branding, Free Login Page Cu…
- CVE-2024-5639User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Updatecozmoslabs User Profile Picture
- CVE-2024-5448PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Contributor+ Stored XSSPayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
- CVE-2024-5447PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Admin+ Stored XSSPayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
- CVE-2024-4970Widget Bundle <= 2.0.0 - Admin+ Stored XSSWidget Bundle
- CVE-2024-4969Widget Bundle <= 2.0.0 - Widget Disable/Enable via CSRFWidget Bundle
- CVE-2024-4755Google CSE <= 1.0.7 - Admin+ Stored XSSGoogle CSE
- CVE-2024-4616Widget Bundle <= 2.0.0 - Unauthencated Reflected XSSWidget Bundle
- CVE-2024-4477WP Logs Book <= 1.0.1 - Unauthenticated Stored XSSWP Logs Book
- CVE-2024-4475WP Logs Book <= 1.0.1 - Log Clearing via CSRFWP Logs Book
- CVE-2024-4474WP Logs Book <= 1.0.1 - Disable Logging via CSRFWP Logs Book
- CVE-2024-4384CSSable Countdown <= 1.5 - Admin+ Stored XSSCSSable Countdown
- CVE-2024-4382CB (legacy) <= 0.9.4.18 - Code/Timeframe/Booking Deletion via CSRFCB
- CVE-2024-4381CB (legacy) <= 0.9.4.18 - Admin+ Stored XSSCB
- CVE-2024-4377DOP Shortcodes <= 1.2 - Contributor+ Stored XSS via ShortcodeDOP Shortcodes
- CVE-2024-3961ConvertKit <= 2.4.9 - Missing AuthorizationKit (formerly ConvertKit) – Email Newsletter, Email Marketi…
- CVE-2023-3352Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletionwpmudev Smush – Image Optimization, Compression, Lazy Load,…
- CVE-2024-1955Hide Dashboard Notifications <= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modificationwprepublic Hide Dashboard Notifications
- CVE-2024-1639License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposuresaadiqbal License Manager for WooCommerce
- CVE-2024-3610WP Child Theme Generator <= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activationwen-solutions WP Child Theme Generator
- CVE-2024-5344The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widgetposimyththemes The Plus Addons for Elementor Page Builder P…
- CVE-2024-6218itsourcecode Vehicle Management System busprofile.php sql injectionitsourcecode Vehicle Management System
- CVE-2024-6217SourceCodester Food Ordering Management System user-router.php sql injectionSourceCodester Food Ordering Management System
- CVE-2024-6216SourceCodester Food Ordering Management System add-users.php sql injectionSourceCodester Food Ordering Management System
- CVE-2024-6215SourceCodester Food Ordering Management System view-ticket-admin.php sql injectionSourceCodester Food Ordering Management System
- CVE-2024-6214SourceCodester Food Ordering Management System add-item.php sql injectionSourceCodester Food Ordering Management System
- CVE-2024-6213SourceCodester Food Ordering Management System Login Panel login.php sql injectionSourceCodester Food Ordering Management System
- CVE-2024-6212SourceCodester Simple Student Attendance System student_form.php get_student cross site scriptingSourceCodester Simple Student Attendance System
- CVE-2022-42974In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting (XSS) a
- CVE-2024-34452CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.
- CVE-2024-37654An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR,
- CVE-2024-37671Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via
- CVE-2024-37672Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via
- CVE-2024-37673Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via
- CVE-2024-37675Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via
- CVE-2024-38873An issue was discovered in the friendlycaptcha_official (aka Integration of Friendly Captcha) extension before 0.1.4 for TYPO3.studiomitte/friendlycaptcha
- CVE-2024-38874An issue was discovered in the events2 (aka Events 2) extension before 8.3.8 and 9.x before 9.0.6 for TYPO3.jweiland/events2