CVEs published June 25, 2024
144 CVEs were published on June 25, 2024: 20 critical, 70 high. 2 are now in CISA KEV.
- Published
- 144
- Critical
- 20
- High
- 70
- Medium
- 36
- Low
- 7
- Unrated
- 11
- Now in CISA KEV
- 2
- Fix available
- 78
Most affected products
- Autodesk AutoCAD · Autodesk Civil +1
- 29
- Linux
- 24
- Progress Software WhatsUp Gold
- 15
- The Conduit Contributors Conduit
- 5
- Brocade Fabric OS
- 3
- Moxa OnCell G3150A-LTE Series
- 3
- Rockwell Automation ThinManager® ThinServer™
- 3
- Adobe Experience Manager
- 2
- Automattic WordPress
- 2
- Avaya IP Office
- 2
Critical 20
- CVE-2024-6060An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP reqPhloc Webscopes
- CVE-2024-4885WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-4884WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-4883WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5276SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)Fortra FileCatalyst Workflow
- CVE-2024-5989Rockwell Automation ThinManager® ThinServer™ Improper Input Validation VulnerabilityRockwell Automation ThinManager® ThinServer™
- CVE-2024-5988Rockwell Automation ThinManager® ThinServer™ Improper Input Validation VulnerabilityRockwell Automation ThinManager® ThinServer™
- CVE-2024-5806MOVEit Transfer Authentication Bypass VulnerabilityProgress MOVEit Transfer
- CVE-2024-5805MOVEit Gateway Authentication Bypass VulnerabilityProgress MOVEit Gateway
- CVE-2024-39462clk: bcm: dvp: Assign ->num before accessing ->hwsLinux
- CVE-2024-39293Revert "xsk: Support redirect to any socket bound to the same umem"Linux
- CVE-2024-6303Missing Authorization in ConduitThe Conduit Contributors Conduit
- CVE-2024-5261TLS certificate are not properly verified when utilizing LibreOfficeKitThe Document Foundation LibreOffice
- CVE-2024-6028Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameterays-pro Quiz Maker
- CVE-2024-4197Avaya IP Office One-X Portal File Upload VulnerabilityAvaya IP Office
- CVE-2024-4196Avaya IP Office Web Control RCE VulnerabilityAvaya IP Office
- CVE-2024-6297Several WordPress.org Plugins <= Various Versions - Injected Backdoorwarfareplugins Social Sharing Plugin – Social Warfare ·… +3
- CVE-2023-6198Hard Coded CredentialBaicells Snap Router
- CVE-2024-21741GigaDevice GD32E103C8T6 devices have Incorrect Access Control.
- CVE-2024-35527An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers
High 70
- CVE-2024-5460Brocade Fabric OS versions prior to v9.0 have default community stringsBrocade Fabric OS
- CVE-2024-4869WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP headerwplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…
- CVE-2024-5016WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5015WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5014WhatsUp Gold GetASPReport Server-Side Request Forgery Information DisclosureProgress Software WhatsUp Gold
- CVE-2024-5013WhatsUp Gold InstallController Denial-of-Service VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5012WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-38516Aimeos HTML client may potentially reveal sensitive information in error logaimeos ai-client-html · aimeos/ai-client-html
- CVE-2024-6206A security vulnerability has been identified in HPE Athonet Mobile Core software.Hewlett Packard Enterprise (HPE) HPE Athonet Mobile Core
- CVE-2024-5011WhatsUp Gold TestController Chart denial of service vulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5010WhatsUp Gold TestController multiple information disclosure vulnerabilitiesProgress Software WhatsUp Gold
- CVE-2024-5009WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5008WhatsUp Gold APM Unrestricted File Upload Remote Code Execution VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-4498Path Traversal and RFI Vulnerability in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-6257HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config ManipulationHashiCorp Shared library · github.com/hashicorp/go-getter
- CVE-2024-6238pgAdmin 4 Installation Directory permission issuepgadmin.org pgAdmin
- CVE-2024-5990ThinManager® ThinServer™ Improper Input Validation VulnerabilityRockwell Automation ThinManager® ThinServer™
- CVE-2024-39471drm/amdgpu: add error handle to avoid out-of-boundsLinux
- CVE-2024-39469nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errorsLinux
- CVE-2024-39468smb: client: fix deadlock in smb2_find_smb_tcon()Linux
- CVE-2024-39467f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode()Linux
- CVE-2024-394639p: add missing locking around taking dentry fid listLinux
- CVE-2024-38385genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()Linux
- CVE-2024-38306btrfs: protect folio::private when attaching extent buffer foliosLinux
- CVE-2024-37354btrfs: fix crash on racing fsync and size-extending write into preallocLinux
- CVE-2024-37078nilfs2: fix potential kernel bug due to lack of writeback flag waitingLinux
- CVE-2021-4440x86/xen: Drop USERGS_SYSRET64 paravirt callLinux
- CVE-2024-21827A leftover debug code vulnerability exists in the cli_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 2024Tp-Link ER7206 Omada Gigabit VPN Router
- CVE-2024-6302Improper Handling of Insufficient Permissions or Privileges in ConduitThe Conduit Contributors Conduit
- CVE-2024-5216Denial of Service in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-4640OnCell G3470A-LTE Series: Authenticated Command Injection via sendTestEmailMoxa OnCell G3150A-LTE Series
- CVE-2024-4639OnCell G3470A-LTE Series: Authenticated Command Injection via webDelIPSecMoxa OnCell G3150A-LTE Series
- CVE-2024-4638OnCell G3470A-LTE Series: Authenticated Command Injection via webUploadKeyMoxa OnCell G3470A-LTE Series
- CVE-2024-4757Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRFLogo Manager For Enamad
- CVE-2024-5431WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcodearraytics WPCafe – Restaurant Menu, Online Food Ordering &…
- CVE-2024-37007Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-36999Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23159Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23158Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23157Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23156Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23155Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23154Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23153Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23152Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23151Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23150Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based productsAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-37006Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-37005Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-37004Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-37003Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-37002Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-37001Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-37000Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23149Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23148Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23147Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23146Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23145Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2023-5038Unauthenticated DoSHanwha Vision Co. A-Series, Q-Series, PNM-series Camera
- CVE-2024-23144Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23143Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23142Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23141Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23140Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-21740Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control.
- CVE-2024-37742Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows.
- CVE-2024-37843Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.craftcms/cms
- CVE-2024-37855An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute a
- CVE-2024-38952PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.cpp.
Medium, low and unrated 54
- CVE-2024-38526pdoc embeds link to malicious CDN if math mode is enabledmitmproxy pdoc · pdoc
- CVE-2024-38364DSpace Cross Site Scripting (XSS) via a deposited HTML/XML documentDSpace · org.dspace:dspace-server-webapp
- CVE-2024-29954password management API prints sensitive information in log filesBrocade Fabric OS
- CVE-2024-29953Encoded session passwords on session storage for Virtual Fabric platformsBrocade Fabric OS
- CVE-2024-30112HCL Connections is vulnerable to a cross-site scripting (XSS) vulnerabilityHCL Software Connections
- CVE-2024-5019WhatsUp Gold LoadCSSUsingBasePath Directory Traversal Information Disclosure VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5018WhatsUp Gold LoadUsingBasePath Directory Traversal Information Disclosure VulnerabilityProgress Software WhatsUp Gold
- CVE-2024-5017WhatsUp Gold AppProfileImport path traversal vulnerabilityProgress Software WhatsUp Gold
- CVE-2024-37894Squid vulnerable to heap corruption in ESI assignsquid-cache squid
- CVE-2024-37167Tuleap has improper permissions of the backlog itemsEnalean tuleap
- CVE-2024-6308itsourcecode Simple Online Hotel Reservation System index.php sql injectionitsourcecode Simple Online Hotel Reservation System
- CVE-2024-0171Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability.Dell PowerEdge Platform
- CVE-2023-37541HCL Connections is vulnerable to broken access controlHCL Software Connections
- CVE-2024-39470eventfs: Fix a possible null pointer dereference in eventfs_find_events()Linux
- CVE-2024-39466thermal/drivers/qcom/lmh: Check for SCM availability at probeLinux
- CVE-2024-39465media: mgb4: Fix double debugfs removeLinux
- CVE-2024-39464media: v4l: async: Fix notifier list entry initLinux
- CVE-2024-39461clk: bcm: rpi: Assign ->num before accessing ->hwsLinux
- CVE-2024-39371io_uring: check for non-NULL file pointer in io_file_can_poll()Linux
- CVE-2024-39301net/9p: fix uninit-value in p9_client_rpc()Linux
- CVE-2024-39298mm/memory-failure: fix handling of dissolved but not taken off from buddy pagesLinux
- CVE-2024-39296bonding: fix oops during rmmodLinux
- CVE-2024-39276ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()Linux
- CVE-2024-38661s390/ap: Fix crash in AP internal function modify_bitmap()Linux
- CVE-2022-48772media: lgdt3306a: Add a check against null-pointer-defLinux
- CVE-2024-37087The vCenter Server contains a denial-of-service vulnerability.vCenter Server · VMware Cloud Foundation
- CVE-2024-37086VMware ESXi contains an out-of-bounds read vulnerability.ESXi · VMware Cloud Foundation
- CVE-2024-37085VMware ESXi contains an authentication bypass vulnerability.VMware ESXi · VMware Cloud Foundation
- CVE-2024-5451The7 — Website and eCommerce Builder for WordPress <= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url AttributeDream-Theme The7 — Website and eCommerce Builder for WordPr…
- CVE-2024-32111WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerabilityAutomattic WordPress
- CVE-2024-6299Use of a Key Past its Expiration Date in ConduitThe Conduit Contributors Conduit
- CVE-2024-6301Origin Validation Error in ConduitThe Conduit Contributors Conduit
- CVE-2024-6300Incomplete Cleanup in ConduitThe Conduit Contributors Conduit
- CVE-2024-31111WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityAutomattic WordPress
- CVE-2024-4846Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to aDevolutions Server
- CVE-2024-28832XSS in Crash Report PageCheckmk
- CVE-2024-28831XSS in confirmation pop-upCheckmk
- CVE-2024-6307WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML APIWordPress Foundation WordPress
- CVE-2024-4641OnCell G3470A-LTE Series: Authenticated Format String ErrorsMoxa OnCell G3150A-LTE Series
- CVE-2024-34142Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-34141Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-3249Zita Elementor Site Library <= 1.6.2 - Missing Authorization to Page Creation and Options Modificationwpzita Zita Site Library for Elementor
- CVE-2024-4759Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG UploadMime Types Extended
- CVE-2024-32855Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component.Dell CPG BIOS
- CVE-2024-6295udn News App - Insecure Data Storageudn News App
- CVE-2024-6294udn News App - Sensitive Information Exposureudn News App
- CVE-2024-22385File and Directory Permission Vulnerability in Hitachi Storage Provider for VMware vCenterHitachi Storage Provider for VMware vCenter
- CVE-2024-21739Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control.
- CVE-2024-30931Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via
- CVE-2024-34400An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019.
- CVE-2024-35526An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory
- CVE-2024-36819MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS).
- CVE-2024-37820A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation.github.com/pingcap/tidb
- CVE-2024-38951A buffer overflow in PX4-Autopilot v1.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MavLink message.