# CVEs published 2024-06-24

96 CVEs were published on June 24, 2024: 19 critical, 31 high. Days are UTC.

- [CVE-2024-22168](https://cve.now/CVE-2024-22168.md): Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps (CVSS 5.9, Western Digital My Cloud Home web app · SanDisk ibi web… +2)
- [CVE-2024-6293](https://cve.now/CVE-2024-6293.md): Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 7.5, Google Chrome)
- [CVE-2024-6292](https://cve.now/CVE-2024-6292.md): Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 7.5, Google Chrome)
- [CVE-2024-6291](https://cve.now/CVE-2024-6291.md): Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via (CVSS 7.5, Google Chrome)
- [CVE-2024-6290](https://cve.now/CVE-2024-6290.md): Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 7.5, Google Chrome)
- [CVE-2023-45195](https://cve.now/CVE-2023-45195.md): Adminer and AdminerEvo SSRF (CVSS 6.9, Adminer · AdminerEvo)
- [CVE-2023-45196](https://cve.now/CVE-2023-45196.md): Adminer and AdminerEvo denial of service via HTTP redirect (CVSS 6.9, Adminer · AdminerEvo)
- [CVE-2023-49793](https://cve.now/CVE-2023-49793.md): Path traversal in \`CodeChecker server\` in the endpoint of \`CodeChecker store\` (CVSS 6.5, Ericsson codechecker · codechecker)
- [CVE-2024-6104](https://cve.now/CVE-2024-6104.md): go-retryablehttp can leak basic auth credentials to log files (CVSS 6.0, HashiCorp Shared library · github.com/hashicorp/go-retryabl…)
- [CVE-2024-38369](https://cve.now/CVE-2024-38369.md): XWiki programming rights may be inherited by inclusion (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…)
- [CVE-2024-38373](https://cve.now/CVE-2024-38373.md): FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser (CVSS 9.6, FreeRTOS-Plus-TCP)
- [CVE-2024-6287](https://cve.now/CVE-2024-6287.md): Incorrect Address Range Calculations (CVSS 7.5, Renesas rcar\_gen3\_v2.5)
- [CVE-2024-6285](https://cve.now/CVE-2024-6285.md): Integer Underflow in Memory Range Check in Renesas RCAR (CVSS 7.5, Renesas rcar\_gen3\_v2.5)
- [CVE-2024-33687](https://cve.now/CVE-2024-33687.md): Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. (CVSS 7.5, OMRON NJ Series CPU Unit · OMRON NX Series CPU Unit)
- [CVE-2024-37026](https://cve.now/CVE-2024-37026.md): drm/xe: Only use reserved BCS instances for usm migrate exec queue (no CVSS, Linux)
- [CVE-2024-37021](https://cve.now/CVE-2024-37021.md): fpga: manager: add owner module and take its refcount (no CVSS, Linux)
- [CVE-2024-36479](https://cve.now/CVE-2024-36479.md): fpga: bridge: add owner module and take its refcount (no CVSS, Linux)
- [CVE-2024-35247](https://cve.now/CVE-2024-35247.md): fpga: region: add owner module and take its refcount (no CVSS, Linux)
- [CVE-2024-34030](https://cve.now/CVE-2024-34030.md): PCI: of\_property: Return error for int\_map allocation failure (CVSS 4.7, Linux)
- [CVE-2024-34027](https://cve.now/CVE-2024-34027.md): f2fs: compress: fix to cover {reserve,release}\_compress\_blocks() w/ cp\_rwsem lock (CVSS 7.8, Linux)
- [CVE-2024-33847](https://cve.now/CVE-2024-33847.md): f2fs: compress: don't allow unaligned truncation on released compress inode (CVSS 7.1, Linux)
- [CVE-2024-32936](https://cve.now/CVE-2024-32936.md): media: ti: j721e-csi2rx: Fix races while restarting DMA (CVSS 7.8, Linux)
- [CVE-2024-39292](https://cve.now/CVE-2024-39292.md): um: Add winch to winch\_handlers before registering winch IRQ (CVSS 7.8, Linux)
- [CVE-2024-39291](https://cve.now/CVE-2024-39291.md): drm/amdgpu: Fix buffer size in gfx\_v9\_4\_3\_init\_ cp\_compute\_microcode() and rlc\_microcode() (no CVSS, Linux)
- [CVE-2024-38667](https://cve.now/CVE-2024-38667.md): riscv: prevent pt\_regs corruption for secondary idle threads (no CVSS, Linux)
- [CVE-2024-4748](https://cve.now/CVE-2024-4748.md): RCE in Cruddiy (CVSS 8.8, CRUDDIY)
- [CVE-2024-38664](https://cve.now/CVE-2024-38664.md): drm: zynqmp\_dpsub: Always register bridge (no CVSS, Linux)
- [CVE-2024-38663](https://cve.now/CVE-2024-38663.md): blk-cgroup: fix list corruption from resetting io stat (CVSS 7.8, Linux)
- [CVE-2024-38384](https://cve.now/CVE-2024-38384.md): blk-cgroup: fix list corruption from reorder of WRITE -\>lqueued (CVSS 7.8, Linux)
- [CVE-2024-4839](https://cve.now/CVE-2024-4839.md): CSRF in Servers Configurations in parisneo/lollms-webui (CVSS 4.4, parisneo/lollms-webui)
- [CVE-2024-37233](https://cve.now/CVE-2024-37233.md): WordPress Play.ht plugin \<= 3.6.4 - Broken Access Control vulnerability (CVSS 4.3, Play.ht)
- [CVE-2024-3264](https://cve.now/CVE-2024-3264.md): Broken or Risky Cryptographic Algorithm in Mia Technology's Mia-Med Health Aplication (CVSS 5.3, Mia Technology Mia-Med Health Aplication)
- [CVE-2024-37231](https://cve.now/CVE-2024-37231.md): WordPress Salon booking system plugin \<= 9.9 - Arbitrary File Deletion vulnerability (CVSS 8.6, Salon booking system)
- [CVE-2024-37228](https://cve.now/CVE-2024-37228.md): WordPress InstaWP Connect plugin \<= 0.1.0.38 - Arbitrary File Upload vulnerability (CVSS 10.0, InstaWP Connect)
- [CVE-2024-37111](https://cve.now/CVE-2024-37111.md): WordPress WishList Member X plugin \< 3.26.7 - Unauthenticated Denial of Service Attack vulnerability (CVSS 7.5, Membership Software WishList Member X)
- [CVE-2024-5862](https://cve.now/CVE-2024-5862.md): User Enumeration in Mia Technology's Mia-Med Health Aplication (CVSS 7.5, Mia Technology Mia-Med Health Aplication)
- [CVE-2024-37109](https://cve.now/CVE-2024-37109.md): WordPress WishList Member X plugin \< 3.26.7 - Authenticated Arbitrary PHP Code Execution vulnerability (CVSS 9.9, Membership Software WishList Member X)
- [CVE-2024-37107](https://cve.now/CVE-2024-37107.md): WordPress WishList Member X plugin \< 3.26.7 - Authenticated Privilege Escalation vulnerability (CVSS 8.8, Membership Software WishList Member X)
- [CVE-2024-37092](https://cve.now/CVE-2024-37092.md): WordPress Consulting Elementor Widgets plugin \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.5, StylemixThemes Consulting Elementor Widgets)
- [CVE-2024-37091](https://cve.now/CVE-2024-37091.md): WordPress Consulting Elementor Widgets plugin \<= 1.3.0 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, StylemixThemes Consulting Elementor Widgets · StylemixTheme…)
- [CVE-2024-37089](https://cve.now/CVE-2024-37089.md): WordPress Consulting Elementor Widgets plugin \<= 1.3.0 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, StylemixThemes Consulting Elementor Widgets)
- [CVE-2024-36038](https://cve.now/CVE-2024-36038.md): Stored XSS (CVSS 6.3, ManageEngine OpManager)
- [CVE-2024-29868](https://cve.now/CVE-2024-29868.md): Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation (CVSS 9.1, Apache Software Foundation Apache StreamPipes · org.apache.…)
- [CVE-2024-6160](https://cve.now/CVE-2024-6160.md): SQL Injection in MegaBIP (CVSS 9.3, Jan Syski MegaBIP)
- [CVE-2024-36497](https://cve.now/CVE-2024-36497.md): Unhashed Storage of Password (CVSS 9.1, Faronics WINSelect)
- [CVE-2024-36496](https://cve.now/CVE-2024-36496.md): Hardcoded Credentials (CVSS 7.5, Faronics WINSelect)
- [CVE-2024-4754](https://cve.now/CVE-2024-4754.md): Stored XSS in Next4Biz's BPM (CVSS 5.4, Next4Biz CRM & BPM Software Business Process Manangement)
- [CVE-2024-5683](https://cve.now/CVE-2024-5683.md): Remote Code Execution in Next4Biz's BPM (CVSS 9.8, Next4Biz CRM & BPM Software Business Process Manangement)
- [CVE-2024-36495](https://cve.now/CVE-2024-36495.md): Read/Write Permissions for Everyone on Configuration File (CVSS 7.7, Faronics WINSelect)
- [CVE-2024-27136](https://cve.now/CVE-2024-27136.md): Apache JSPWiki: Cross-site scripting vulnerability on upload page (CVSS 6.1, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2024-24554](https://cve.now/CVE-2024-24554.md): Bludit - Insecure Token Generation (CVSS 6.0, Bludit)
- [CVE-2024-24553](https://cve.now/CVE-2024-24553.md): Bludit uses SHA1 as Password Hashing Algorithm (CVSS 5.9, Bludit)
- [CVE-2024-24552](https://cve.now/CVE-2024-24552.md): Bludit is Vulnerable to Session Fixation (CVSS 5.6, Bludit)
- [CVE-2024-24551](https://cve.now/CVE-2024-24551.md): Bludit - Remote Code Execution (RCE) through Image API (CVSS 8.9, Bludit)
- [CVE-2024-24550](https://cve.now/CVE-2024-24550.md): Bludit - Remote Code Execution (RCE) through File API (CVSS 8.9, Bludit)
- [CVE-2024-4900](https://cve.now/CVE-2024-4900.md): SEOPress \< 7.8 - Contributor+ Open Redirect (CVSS 6.1, SEOPress)
- [CVE-2024-4899](https://cve.now/CVE-2024-4899.md): SEOPress \< 7.8 - Contributor+ Stored XSS (CVSS 5.0, SEOPress)
- [CVE-2024-4499](https://cve.now/CVE-2024-4499.md): CSRF Vulnerability in parisneo/lollms XTTS Server (CVSS 7.6, parisneo/lollms)
- [CVE-2024-6280](https://cve.now/CVE-2024-6280.md): SourceCodester Simple Online Bidding System unrestricted upload (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-6279](https://cve.now/CVE-2024-6279.md): lahirudanushka School Management System Exam Results Page examresults-par.php sql injection (CVSS 5.3, lahirudanushka School Management System)
- [CVE-2024-6278](https://cve.now/CVE-2024-6278.md): lahirudanushka School Management System Subject Page subject.php sql injection (CVSS 5.1, lahirudanushka School Management System)
- [CVE-2024-6277](https://cve.now/CVE-2024-6277.md): lahirudanushka School Management System Student Page student.php sql injection (CVSS 5.1, lahirudanushka School Management System)
- [CVE-2024-6276](https://cve.now/CVE-2024-6276.md): lahirudanushka School Management System Teacher Page teacher.php sql injection (CVSS 5.1, lahirudanushka School Management System)
- [CVE-2024-6275](https://cve.now/CVE-2024-6275.md): lahirudanushka School Management System Parent Page parent.php sql injection (CVSS 5.1, lahirudanushka School Management System)
- [CVE-2024-6274](https://cve.now/CVE-2024-6274.md): lahirudanushka School Management System Attendance Report Page attendancelist.php sql injection (CVSS 5.1, lahirudanushka School Management System)
- [CVE-2024-3121](https://cve.now/CVE-2024-3121.md): Remote Code Execution in create\_conda\_env function in parisneo/lollms (CVSS 6.8, parisneo/lollms · lollms)
- [CVE-2021-45785](https://cve.now/CVE-2021-45785.md): TruDesk Help Desk/Ticketing Solution v1.1.11 is vulnerable to a Cross-Site Request Forgery (CSRF) attack which would allow an attacker to re (CVSS 4.3)
- [CVE-2023-50029](https://cve.now/CVE-2023-50029.md): PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers (CVSS 10.0)
- [CVE-2024-33278](https://cve.now/CVE-2024-33278.md): Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388\_24198 allows a remote attacker to execute arbitrar (CVSS 9.8)
- [CVE-2024-33879](https://cve.now/CVE-2024-33879.md): An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. (CVSS 9.8)
- [CVE-2024-33880](https://cve.now/CVE-2024-33880.md): An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. (CVSS 5.3)
- [CVE-2024-33881](https://cve.now/CVE-2024-33881.md): An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. (CVSS 7.5)
- [CVE-2024-33898](https://cve.now/CVE-2024-33898.md): Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. (CVSS 9.8)
- [CVE-2024-34312](https://cve.now/CVE-2024-34312.md): Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplid (CVSS 6.1)
- [CVE-2024-34313](https://cve.now/CVE-2024-34313.md): An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint. (CVSS 9.8)
- [CVE-2024-34988](https://cve.now/CVE-2024-34988.md): SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) \<= 1.0.51 from Buy Add (CVSS 9.8)
- [CVE-2024-34991](https://cve.now/CVE-2024-34991.md): In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information ( (CVSS 7.5)
- [CVE-2024-34992](https://cve.now/CVE-2024-34992.md): SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules f (CVSS 8.8)
- [CVE-2024-36681](https://cve.now/CVE-2024-36681.md): SQL Injection vulnerability in the module "Isotope" (pk\_isotope) \<=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitiv (CVSS 9.8)
- [CVE-2024-36682](https://cve.now/CVE-2024-36682.md): In the module "Theme settings" (pk\_themesettings) \<= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while S (CVSS 7.5)
- [CVE-2024-36683](https://cve.now/CVE-2024-36683.md): SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers t (CVSS 7.3)
- [CVE-2024-37677](https://cve.now/CVE-2024-37677.md): An issue in Shenzhen Weitillage Industrial Co., Ltd the access management specialist V6.62.51215 allows a remote attacker to obtain sensitiv (CVSS 7.5)
- [CVE-2024-37678](https://cve.now/CVE-2024-37678.md): Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. (CVSS 5.3)
- [CVE-2024-37679](https://cve.now/CVE-2024-37679.md): Cross Site Scripting vulnerability in Hangzhou Meisoft Information Technology Co., Ltd. (CVSS 6.1)
- [CVE-2024-37680](https://cve.now/CVE-2024-37680.md): Hangzhou Meisoft Information Technology Co., Ltd. (CVSS 6.3)
- [CVE-2024-37681](https://cve.now/CVE-2024-37681.md): An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a deni (CVSS 6.5)
- [CVE-2024-37732](https://cve.now/CVE-2024-37732.md): Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. (CVSS 8.8)
- [CVE-2024-37759](https://cve.now/CVE-2024-37759.md): DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Vi (CVSS 9.8)
- [CVE-2024-37825](https://cve.now/CVE-2024-37825.md): An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 (fixed in OneStop 3.2.0.27184 Hotfix May 2024) allows unauthen (CVSS 5.4)
- [CVE-2024-38892](https://cve.now/CVE-2024-38892.md): An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component. (CVSS 6.5)
- [CVE-2024-38894](https://cve.now/CVE-2024-38894.md): WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist\_sync.cgi. (CVSS 5.3)
- [CVE-2024-38895](https://cve.now/CVE-2024-38895.md): WAVLINK WN551K1'live\_mfg.shtml enables attackers to obtain sensitive router information. (CVSS 5.3)
- [CVE-2024-38896](https://cve.now/CVE-2024-38896.md): WAVLINK WN551K1 found a command injection vulnerability through the start\_hour parameter of /cgi-bin/nightled.cgi. (CVSS 5.3)
- [CVE-2024-38897](https://cve.now/CVE-2024-38897.md): WAVLINK WN551K1'live\_check.shtml enables attackers to obtain sensitive router information. (CVSS 5.3)
- [CVE-2024-38902](https://cve.now/CVE-2024-38902.md): H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as roo (CVSS 9.8)
- [CVE-2024-38903](https://cve.now/CVE-2024-38903.md): H3C Magic R230 V100R002's udpserver opens port 9034, allowing attackers to execute arbitrary commands. (CVSS 4.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.