CVEs published June 24, 2024
96 CVEs were published on June 24, 2024: 19 critical, 31 high.
- Published
- 96
- Critical
- 19
- High
- 31
- Medium
- 39
- Low
- 0
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- Linux
- 14
- lahirudanushka School Management System
- 6
- Bludit
- 5
- Google Chrome
- 4
- Faronics WINSelect
- 3
- Membership Software WishList Member X
- 3
- Adminer · AdminerEvo
- 2
- Mia Technology Mia-Med Health Aplication
- 2
- Next4Biz CRM & BPM Software Business Process Manangement
- 2
- Renesas rcar_gen3_v2.5
- 2
Critical 19
- CVE-2024-38369XWiki programming rights may be inherited by inclusion xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…
- CVE-2024-38373FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response ParserFreeRTOS-Plus-TCP
- CVE-2024-37228WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerabilityInstaWP Connect
- CVE-2024-37109WordPress WishList Member X plugin < 3.26.7 - Authenticated Arbitrary PHP Code Execution vulnerabilityMembership Software WishList Member X
- CVE-2024-37091WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerabilityStylemixThemes Consulting Elementor Widgets · StylemixTheme…
- CVE-2024-37089WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerabilityStylemixThemes Consulting Elementor Widgets
- CVE-2024-29868Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token GenerationApache Software Foundation Apache StreamPipes · org.apache.…
- CVE-2024-6160SQL Injection in MegaBIPJan Syski MegaBIP
- CVE-2024-36497Unhashed Storage of PasswordFaronics WINSelect
- CVE-2024-5683Remote Code Execution in Next4Biz's BPMNext4Biz CRM & BPM Software Business Process Manangement
- CVE-2023-50029PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers
- CVE-2024-33278Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrar
- CVE-2024-33879An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019.
- CVE-2024-33898Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability.
- CVE-2024-34313An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.
- CVE-2024-34988SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Add
- CVE-2024-36681SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitiv
- CVE-2024-37759DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Vi
- CVE-2024-38902H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as roo
High 31
- CVE-2024-6293Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-6292Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-6291Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2024-6290Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-6287Incorrect Address Range CalculationsRenesas rcar_gen3_v2.5
- CVE-2024-6285Integer Underflow in Memory Range Check in Renesas RCARRenesas rcar_gen3_v2.5
- CVE-2024-33687Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions.OMRON NJ Series CPU Unit · OMRON NX Series CPU Unit
- CVE-2024-34027f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lockLinux
- CVE-2024-33847f2fs: compress: don't allow unaligned truncation on released compress inodeLinux
- CVE-2024-32936media: ti: j721e-csi2rx: Fix races while restarting DMALinux
- CVE-2024-39292um: Add winch to winch_handlers before registering winch IRQLinux
- CVE-2024-4748RCE in CruddiyCRUDDIY
- CVE-2024-38663blk-cgroup: fix list corruption from resetting io statLinux
- CVE-2024-38384blk-cgroup: fix list corruption from reorder of WRITE ->lqueuedLinux
- CVE-2024-37231WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerabilitySalon booking system
- CVE-2024-37111WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Denial of Service Attack vulnerabilityMembership Software WishList Member X
- CVE-2024-5862User Enumeration in Mia Technology's Mia-Med Health AplicationMia Technology Mia-Med Health Aplication
- CVE-2024-37107WordPress WishList Member X plugin < 3.26.7 - Authenticated Privilege Escalation vulnerabilityMembership Software WishList Member X
- CVE-2024-37092WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerabilityStylemixThemes Consulting Elementor Widgets
- CVE-2024-36496Hardcoded CredentialsFaronics WINSelect
- CVE-2024-36495Read/Write Permissions for Everyone on Configuration FileFaronics WINSelect
- CVE-2024-24551Bludit - Remote Code Execution (RCE) through Image APIBludit
- CVE-2024-24550Bludit - Remote Code Execution (RCE) through File APIBludit
- CVE-2024-4499CSRF Vulnerability in parisneo/lollms XTTS Serverparisneo/lollms
- CVE-2024-33881An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019.
- CVE-2024-34991In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (
- CVE-2024-34992SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules f
- CVE-2024-36682In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while S
- CVE-2024-36683SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers t
- CVE-2024-37677An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitiv
- CVE-2024-37732Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.
Medium, low and unrated 46
- CVE-2024-22168Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web AppsWestern Digital My Cloud Home web app · SanDisk ibi web… +2
- CVE-2023-45195Adminer and AdminerEvo SSRFAdminer · AdminerEvo
- CVE-2023-45196Adminer and AdminerEvo denial of service via HTTP redirectAdminer · AdminerEvo
- CVE-2023-49793Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`Ericsson codechecker · codechecker
- CVE-2024-6104go-retryablehttp can leak basic auth credentials to log filesHashiCorp Shared library · github.com/hashicorp/go-retryabl…
- CVE-2024-37026drm/xe: Only use reserved BCS instances for usm migrate exec queueLinux
- CVE-2024-37021fpga: manager: add owner module and take its refcountLinux
- CVE-2024-36479fpga: bridge: add owner module and take its refcountLinux
- CVE-2024-35247fpga: region: add owner module and take its refcountLinux
- CVE-2024-34030PCI: of_property: Return error for int_map allocation failureLinux
- CVE-2024-39291drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()Linux
- CVE-2024-38667riscv: prevent pt_regs corruption for secondary idle threadsLinux
- CVE-2024-38664drm: zynqmp_dpsub: Always register bridgeLinux
- CVE-2024-4839CSRF in Servers Configurations in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-37233WordPress Play.ht plugin <= 3.6.4 - Broken Access Control vulnerabilityPlay.ht
- CVE-2024-3264Broken or Risky Cryptographic Algorithm in Mia Technology's Mia-Med Health AplicationMia Technology Mia-Med Health Aplication
- CVE-2024-36038Stored XSSManageEngine OpManager
- CVE-2024-4754Stored XSS in Next4Biz's BPMNext4Biz CRM & BPM Software Business Process Manangement
- CVE-2024-27136Apache JSPWiki: Cross-site scripting vulnerability on upload pageApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2024-24554Bludit - Insecure Token GenerationBludit
- CVE-2024-24553Bludit uses SHA1 as Password Hashing AlgorithmBludit
- CVE-2024-24552Bludit is Vulnerable to Session FixationBludit
- CVE-2024-4900SEOPress < 7.8 - Contributor+ Open RedirectSEOPress
- CVE-2024-4899SEOPress < 7.8 - Contributor+ Stored XSSSEOPress
- CVE-2024-6280SourceCodester Simple Online Bidding System unrestricted uploadSourceCodester Simple Online Bidding System
- CVE-2024-6279lahirudanushka School Management System Exam Results Page examresults-par.php sql injectionlahirudanushka School Management System
- CVE-2024-6278lahirudanushka School Management System Subject Page subject.php sql injectionlahirudanushka School Management System
- CVE-2024-6277lahirudanushka School Management System Student Page student.php sql injectionlahirudanushka School Management System
- CVE-2024-6276lahirudanushka School Management System Teacher Page teacher.php sql injectionlahirudanushka School Management System
- CVE-2024-6275lahirudanushka School Management System Parent Page parent.php sql injectionlahirudanushka School Management System
- CVE-2024-6274lahirudanushka School Management System Attendance Report Page attendancelist.php sql injectionlahirudanushka School Management System
- CVE-2024-3121Remote Code Execution in create_conda_env function in parisneo/lollmsparisneo/lollms · lollms
- CVE-2021-45785TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to re
- CVE-2024-33880An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019.
- CVE-2024-34312Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplid
- CVE-2024-37678Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd.
- CVE-2024-37679Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd.
- CVE-2024-37680Hangzhou Meisoft Information Technology Co., Ltd.
- CVE-2024-37681An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a deni
- CVE-2024-37825An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthen
- CVE-2024-38892An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.
- CVE-2024-38894WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi.
- CVE-2024-38895WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.
- CVE-2024-38896WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi.
- CVE-2024-38897WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.
- CVE-2024-38903H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands.