# CVEs published 2024-06-25

144 CVEs were published on June 25, 2024: 20 critical, 70 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-5460](https://cve.now/CVE-2024-5460.md): Brocade Fabric OS versions prior to v9.0 have default community strings (CVSS 8.1, Brocade Fabric OS)
- [CVE-2024-38526](https://cve.now/CVE-2024-38526.md): pdoc embeds link to malicious CDN if math mode is enabled (CVSS 0.0, mitmproxy pdoc · pdoc)
- [CVE-2024-38364](https://cve.now/CVE-2024-38364.md): DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document (CVSS 2.6, DSpace · org.dspace:dspace-server-webapp)
- [CVE-2024-29954](https://cve.now/CVE-2024-29954.md): password management API prints sensitive information in log files (CVSS 5.9, Brocade Fabric OS)
- [CVE-2024-4869](https://cve.now/CVE-2024-4869.md): WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) \<= 3.2.0 - Unauthenticated Stored Cross-Site Scripting via Client-IP header (CVSS 7.2, wplegalpages Cookie Banner for GDPR / CCPA – WPLP Cookie Co…)
- [CVE-2024-29953](https://cve.now/CVE-2024-29953.md): Encoded session passwords on session storage for Virtual Fabric platforms (CVSS 4.3, Brocade Fabric OS)
- [CVE-2024-6060](https://cve.now/CVE-2024-6060.md): An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP req (CVSS 9.3, Phloc Webscopes)
- [CVE-2024-30112](https://cve.now/CVE-2024-30112.md): HCL Connections is vulnerable to a cross-site scripting (XSS) vulnerability (CVSS 5.4, HCL Software Connections)
- [CVE-2024-5019](https://cve.now/CVE-2024-5019.md): WhatsUp Gold LoadCSSUsingBasePath Directory Traversal Information Disclosure Vulnerability (CVSS 5.3, Progress Software WhatsUp Gold)
- [CVE-2024-5018](https://cve.now/CVE-2024-5018.md): WhatsUp Gold LoadUsingBasePath Directory Traversal Information Disclosure Vulnerability (CVSS 5.3, Progress Software WhatsUp Gold)
- [CVE-2024-5017](https://cve.now/CVE-2024-5017.md): WhatsUp Gold AppProfileImport path traversal vulnerability (CVSS 6.5, Progress Software WhatsUp Gold)
- [CVE-2024-5016](https://cve.now/CVE-2024-5016.md): WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 7.2, Progress Software WhatsUp Gold)
- [CVE-2024-5015](https://cve.now/CVE-2024-5015.md): WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability (CVSS 7.1, Progress Software WhatsUp Gold)
- [CVE-2024-5014](https://cve.now/CVE-2024-5014.md): WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure (CVSS 7.1, Progress Software WhatsUp Gold)
- [CVE-2024-5013](https://cve.now/CVE-2024-5013.md): WhatsUp Gold InstallController Denial-of-Service Vulnerability (CVSS 7.5, Progress Software WhatsUp Gold)
- [CVE-2024-5012](https://cve.now/CVE-2024-5012.md): WhatsUp Gold Missing Authentication GetWindowsCredential Information Disclosure Vulnerability (CVSS 8.6, Progress Software WhatsUp Gold)
- [CVE-2024-38516](https://cve.now/CVE-2024-38516.md): Aimeos HTML client may potentially reveal sensitive information in error log (CVSS 8.8, aimeos ai-client-html · aimeos/ai-client-html)
- [CVE-2024-6206](https://cve.now/CVE-2024-6206.md): A security vulnerability has been identified in HPE Athonet Mobile Core software. (CVSS 7.5, Hewlett Packard Enterprise (HPE) HPE Athonet Mobile Core)
- [CVE-2024-5011](https://cve.now/CVE-2024-5011.md): WhatsUp Gold TestController Chart denial of service vulnerability (CVSS 7.5, Progress Software WhatsUp Gold)
- [CVE-2024-5010](https://cve.now/CVE-2024-5010.md): WhatsUp Gold TestController multiple information disclosure vulnerabilities (CVSS 7.5, Progress Software WhatsUp Gold)
- [CVE-2024-5009](https://cve.now/CVE-2024-5009.md): WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability (CVSS 8.4, Progress Software WhatsUp Gold)
- [CVE-2024-5008](https://cve.now/CVE-2024-5008.md): WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability (CVSS 8.8, Progress Software WhatsUp Gold)
- [CVE-2024-4498](https://cve.now/CVE-2024-4498.md): Path Traversal and RFI Vulnerability in parisneo/lollms-webui (CVSS 7.7, parisneo/lollms-webui)
- [CVE-2024-4885](https://cve.now/CVE-2024-4885.md): WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability (CVSS 9.8, KEV, Progress Software WhatsUp Gold)
- [CVE-2024-4884](https://cve.now/CVE-2024-4884.md): WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability (CVSS 9.8, Progress Software WhatsUp Gold)
- [CVE-2024-4883](https://cve.now/CVE-2024-4883.md): WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability (CVSS 9.8, Progress Software WhatsUp Gold)
- [CVE-2024-37894](https://cve.now/CVE-2024-37894.md): Squid vulnerable to heap corruption in ESI assign (CVSS 6.3, squid-cache squid)
- [CVE-2024-37167](https://cve.now/CVE-2024-37167.md): Tuleap has improper permissions of the backlog items (CVSS 4.3, Enalean tuleap)
- [CVE-2024-5276](https://cve.now/CVE-2024-5276.md): SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier) (CVSS 9.8, Fortra FileCatalyst Workflow)
- [CVE-2024-6308](https://cve.now/CVE-2024-6308.md): itsourcecode Simple Online Hotel Reservation System index.php sql injection (CVSS 6.9, itsourcecode Simple Online Hotel Reservation System)
- [CVE-2024-6257](https://cve.now/CVE-2024-6257.md): HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation (CVSS 8.4, HashiCorp Shared library · github.com/hashicorp/go-getter)
- [CVE-2024-6238](https://cve.now/CVE-2024-6238.md): pgAdmin 4 Installation Directory permission issue (CVSS 7.4, pgadmin.org pgAdmin)
- [CVE-2024-5990](https://cve.now/CVE-2024-5990.md): ThinManager® ThinServer™ Improper Input Validation Vulnerability (CVSS 8.7, Rockwell Automation ThinManager® ThinServer™)
- [CVE-2024-5989](https://cve.now/CVE-2024-5989.md): Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability (CVSS 9.3, Rockwell Automation ThinManager® ThinServer™)
- [CVE-2024-5988](https://cve.now/CVE-2024-5988.md): Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability (CVSS 9.3, Rockwell Automation ThinManager® ThinServer™)
- [CVE-2024-0171](https://cve.now/CVE-2024-0171.md): Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. (CVSS 5.3, Dell PowerEdge Platform)
- [CVE-2023-37541](https://cve.now/CVE-2023-37541.md): HCL Connections is vulnerable to broken access control (CVSS 3.5, HCL Software Connections)
- [CVE-2024-5806](https://cve.now/CVE-2024-5806.md): MOVEit Transfer Authentication Bypass Vulnerability (CVSS 9.1, Progress MOVEit Transfer)
- [CVE-2024-5805](https://cve.now/CVE-2024-5805.md): MOVEit Gateway Authentication Bypass Vulnerability (CVSS 9.1, Progress MOVEit Gateway)
- [CVE-2024-39471](https://cve.now/CVE-2024-39471.md): drm/amdgpu: add error handle to avoid out-of-bounds (CVSS 7.8, Linux)
- [CVE-2024-39470](https://cve.now/CVE-2024-39470.md): eventfs: Fix a possible null pointer dereference in eventfs\_find\_events() (no CVSS, Linux)
- [CVE-2024-39469](https://cve.now/CVE-2024-39469.md): nilfs2: fix nilfs\_empty\_dir() misjudgment and long loop on I/O errors (CVSS 7.1, Linux)
- [CVE-2024-39468](https://cve.now/CVE-2024-39468.md): smb: client: fix deadlock in smb2\_find\_smb\_tcon() (CVSS 7.5, Linux)
- [CVE-2024-39467](https://cve.now/CVE-2024-39467.md): f2fs: fix to do sanity check on i\_xattr\_nid in sanity\_check\_inode() (CVSS 7.8, Linux)
- [CVE-2024-39466](https://cve.now/CVE-2024-39466.md): thermal/drivers/qcom/lmh: Check for SCM availability at probe (no CVSS, Linux)
- [CVE-2024-39465](https://cve.now/CVE-2024-39465.md): media: mgb4: Fix double debugfs remove (no CVSS, Linux)
- [CVE-2024-39464](https://cve.now/CVE-2024-39464.md): media: v4l: async: Fix notifier list entry init (no CVSS, Linux)
- [CVE-2024-39463](https://cve.now/CVE-2024-39463.md): 9p: add missing locking around taking dentry fid list (CVSS 7.8, Linux)
- [CVE-2024-39462](https://cve.now/CVE-2024-39462.md): clk: bcm: dvp: Assign -\>num before accessing -\>hws (CVSS 9.8, Linux)
- [CVE-2024-39461](https://cve.now/CVE-2024-39461.md): clk: bcm: rpi: Assign -\>num before accessing -\>hws (no CVSS, Linux)
- [CVE-2024-39371](https://cve.now/CVE-2024-39371.md): io\_uring: check for non-NULL file pointer in io\_file\_can\_poll() (no CVSS, Linux)
- [CVE-2024-39301](https://cve.now/CVE-2024-39301.md): net/9p: fix uninit-value in p9\_client\_rpc() (no CVSS, Linux)
- [CVE-2024-39298](https://cve.now/CVE-2024-39298.md): mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (no CVSS, Linux)
- [CVE-2024-39296](https://cve.now/CVE-2024-39296.md): bonding: fix oops during rmmod (no CVSS, Linux)
- [CVE-2024-39293](https://cve.now/CVE-2024-39293.md): Revert "xsk: Support redirect to any socket bound to the same umem" (CVSS 9.8, Linux)
- [CVE-2024-39276](https://cve.now/CVE-2024-39276.md): ext4: fix mb\_cache\_entry's e\_refcnt leak in ext4\_xattr\_block\_cache\_find() (CVSS 5.5, Linux)
- [CVE-2024-38661](https://cve.now/CVE-2024-38661.md): s390/ap: Fix crash in AP internal function modify\_bitmap() (no CVSS, Linux)
- [CVE-2024-38385](https://cve.now/CVE-2024-38385.md): genirq/irqdesc: Prevent use-after-free in irq\_find\_at\_or\_after() (CVSS 7.8, Linux)
- [CVE-2024-38306](https://cve.now/CVE-2024-38306.md): btrfs: protect folio::private when attaching extent buffer folios (CVSS 7.8, Linux)
- [CVE-2024-37354](https://cve.now/CVE-2024-37354.md): btrfs: fix crash on racing fsync and size-extending write into prealloc (CVSS 7.8, Linux)
- [CVE-2024-37078](https://cve.now/CVE-2024-37078.md): nilfs2: fix potential kernel bug due to lack of writeback flag waiting (CVSS 7.8, Linux)
- [CVE-2022-48772](https://cve.now/CVE-2022-48772.md): media: lgdt3306a: Add a check against null-pointer-def (no CVSS, Linux)
- [CVE-2021-4440](https://cve.now/CVE-2021-4440.md): x86/xen: Drop USERGS\_SYSRET64 paravirt call (CVSS 8.8, Linux)
- [CVE-2024-37087](https://cve.now/CVE-2024-37087.md): The vCenter Server contains a denial-of-service vulnerability. (CVSS 5.3, vCenter Server · VMware Cloud Foundation)
- [CVE-2024-37086](https://cve.now/CVE-2024-37086.md): VMware ESXi contains an out-of-bounds read vulnerability. (CVSS 6.8, ESXi · VMware Cloud Foundation)
- [CVE-2024-37085](https://cve.now/CVE-2024-37085.md): VMware ESXi contains an authentication bypass vulnerability. (CVSS 6.8, KEV, VMware ESXi · VMware Cloud Foundation)
- [CVE-2024-21827](https://cve.now/CVE-2024-21827.md): A leftover debug code vulnerability exists in the cli\_server debug functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.4.1 Build 2024 (CVSS 7.2, Tp-Link ER7206 Omada Gigabit VPN Router)
- [CVE-2024-5451](https://cve.now/CVE-2024-5451.md): The7 — Website and eCommerce Builder for WordPress \<= 11.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute (CVSS 6.4, Dream-Theme The7 — Website and eCommerce Builder for WordPr…)
- [CVE-2024-32111](https://cve.now/CVE-2024-32111.md): WordPress core \< 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability (CVSS 5.0, Automattic WordPress)
- [CVE-2024-6299](https://cve.now/CVE-2024-6299.md): Use of a Key Past its Expiration Date in Conduit (CVSS 4.8, The Conduit Contributors Conduit)
- [CVE-2024-6301](https://cve.now/CVE-2024-6301.md): Origin Validation Error in Conduit (CVSS 5.3, The Conduit Contributors Conduit)
- [CVE-2024-6302](https://cve.now/CVE-2024-6302.md): Improper Handling of Insufficient Permissions or Privileges in Conduit (CVSS 8.1, The Conduit Contributors Conduit)
- [CVE-2024-6303](https://cve.now/CVE-2024-6303.md): Missing Authorization in Conduit (CVSS 9.9, The Conduit Contributors Conduit)
- [CVE-2024-6300](https://cve.now/CVE-2024-6300.md): Incomplete Cleanup in Conduit (CVSS 3.7, The Conduit Contributors Conduit)
- [CVE-2024-31111](https://cve.now/CVE-2024-31111.md): WordPress Core \< 6.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Automattic WordPress)
- [CVE-2024-5261](https://cve.now/CVE-2024-5261.md): TLS certificate are not properly verified when utilizing LibreOfficeKit (CVSS 10.0, The Document Foundation LibreOffice)
- [CVE-2024-4846](https://cve.now/CVE-2024-4846.md): Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to a (CVSS 6.3, Devolutions Server)
- [CVE-2024-28832](https://cve.now/CVE-2024-28832.md): XSS in Crash Report Page (CVSS 4.8, Checkmk)
- [CVE-2024-28831](https://cve.now/CVE-2024-28831.md): XSS in confirmation pop-up (CVSS 5.4, Checkmk)
- [CVE-2024-6307](https://cve.now/CVE-2024-6307.md): WordPress Core \< 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API (CVSS 6.4, WordPress Foundation WordPress)
- [CVE-2024-5216](https://cve.now/CVE-2024-5216.md): Denial of Service in mintplex-labs/anything-llm (CVSS 7.5, mintplex-labs/anything-llm)
- [CVE-2024-4641](https://cve.now/CVE-2024-4641.md): OnCell G3470A-LTE Series: Authenticated Format String Errors (CVSS 6.3, Moxa OnCell G3150A-LTE Series)
- [CVE-2024-4640](https://cve.now/CVE-2024-4640.md): OnCell G3470A-LTE Series: Authenticated Command Injection via sendTestEmail (CVSS 7.1, Moxa OnCell G3150A-LTE Series)
- [CVE-2024-4639](https://cve.now/CVE-2024-4639.md): OnCell G3470A-LTE Series: Authenticated Command Injection via webDelIPSec (CVSS 7.1, Moxa OnCell G3150A-LTE Series)
- [CVE-2024-34142](https://cve.now/CVE-2024-34142.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-34141](https://cve.now/CVE-2024-34141.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-4638](https://cve.now/CVE-2024-4638.md): OnCell G3470A-LTE Series: Authenticated Command Injection via webUploadKey (CVSS 7.1, Moxa OnCell G3470A-LTE Series)
- [CVE-2024-6028](https://cve.now/CVE-2024-6028.md): Quiz Maker \<= 6.5.8.3 - Unauthenticated SQL Injection via 'ays\_questions' Parameter (CVSS 9.8, ays-pro Quiz Maker)
- [CVE-2024-3249](https://cve.now/CVE-2024-3249.md): Zita Elementor Site Library \<= 1.6.2 - Missing Authorization to Page Creation and Options Modification (CVSS 4.3, wpzita Zita Site Library for Elementor)
- [CVE-2024-4759](https://cve.now/CVE-2024-4759.md): Mime Types Extended \<= 0.11 - Author+ Stored XSS via SVG Upload (CVSS 5.5, Mime Types Extended)
- [CVE-2024-4757](https://cve.now/CVE-2024-4757.md): Logo Manager For Enamad \<= 0.7.0 - Stored XSS via CSRF (CVSS 8.1, Logo Manager For Enamad)
- [CVE-2024-5431](https://cve.now/CVE-2024-5431.md): WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce \<= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode (CVSS 8.8, arraytics WPCafe – Restaurant Menu, Online Food Ordering &…)
- [CVE-2024-32855](https://cve.now/CVE-2024-32855.md): Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. (CVSS 3.8, Dell CPG BIOS)
- [CVE-2024-4197](https://cve.now/CVE-2024-4197.md): Avaya IP Office One-X Portal File Upload Vulnerability (CVSS 9.9, Avaya IP Office)
- [CVE-2024-4196](https://cve.now/CVE-2024-4196.md): Avaya IP Office Web Control RCE Vulnerability (CVSS 10.0, Avaya IP Office)
- [CVE-2024-37007](https://cve.now/CVE-2024-37007.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-36999](https://cve.now/CVE-2024-36999.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23159](https://cve.now/CVE-2024-23159.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23158](https://cve.now/CVE-2024-23158.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23157](https://cve.now/CVE-2024-23157.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-6297](https://cve.now/CVE-2024-6297.md): Several WordPress.org Plugins \<= Various Versions - Injected Backdoor (CVSS 10.0, warfareplugins Social Sharing Plugin – Social Warfare ·… +3)
- [CVE-2024-23156](https://cve.now/CVE-2024-23156.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23155](https://cve.now/CVE-2024-23155.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23154](https://cve.now/CVE-2024-23154.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23153](https://cve.now/CVE-2024-23153.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23152](https://cve.now/CVE-2024-23152.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23151](https://cve.now/CVE-2024-23151.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23150](https://cve.now/CVE-2024-23150.md): Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-37006](https://cve.now/CVE-2024-37006.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-37005](https://cve.now/CVE-2024-37005.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-37004](https://cve.now/CVE-2024-37004.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-37003](https://cve.now/CVE-2024-37003.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-37002](https://cve.now/CVE-2024-37002.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-37001](https://cve.now/CVE-2024-37001.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-37000](https://cve.now/CVE-2024-37000.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23149](https://cve.now/CVE-2024-23149.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23148](https://cve.now/CVE-2024-23148.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23147](https://cve.now/CVE-2024-23147.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23146](https://cve.now/CVE-2024-23146.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23145](https://cve.now/CVE-2024-23145.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2023-5038](https://cve.now/CVE-2023-5038.md): Unauthenticated DoS (CVSS 8.7, Hanwha Vision Co. A-Series, Q-Series, PNM-series Camera)
- [CVE-2024-6295](https://cve.now/CVE-2024-6295.md): udn News App - Insecure Data Storage (CVSS 3.9, udn News App)
- [CVE-2024-23144](https://cve.now/CVE-2024-23144.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23143](https://cve.now/CVE-2024-23143.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-6294](https://cve.now/CVE-2024-6294.md): udn News App - Sensitive Information Exposure (CVSS 3.9, udn News App)
- [CVE-2023-6198](https://cve.now/CVE-2023-6198.md): Hard Coded Credential (CVSS 9.3, Baicells Snap Router)
- [CVE-2024-22385](https://cve.now/CVE-2024-22385.md): File and Directory Permission Vulnerability in Hitachi Storage Provider for VMware vCenter (CVSS 4.4, Hitachi Storage Provider for VMware vCenter)
- [CVE-2024-23142](https://cve.now/CVE-2024-23142.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23141](https://cve.now/CVE-2024-23141.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23140](https://cve.now/CVE-2024-23140.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-21739](https://cve.now/CVE-2024-21739.md): Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control. (CVSS 5.3)
- [CVE-2024-21740](https://cve.now/CVE-2024-21740.md): Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control. (CVSS 7.4)
- [CVE-2024-21741](https://cve.now/CVE-2024-21741.md): GigaDevice GD32E103C8T6 devices have Incorrect Access Control. (CVSS 9.8)
- [CVE-2024-30931](https://cve.now/CVE-2024-30931.md): Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via (CVSS 6.1)
- [CVE-2024-34400](https://cve.now/CVE-2024-34400.md): An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019. (CVSS 6.1)
- [CVE-2024-35526](https://cve.now/CVE-2024-35526.md): An issue in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers to access sensitive information in the /facade directory (CVSS 5.9)
- [CVE-2024-35527](https://cve.now/CVE-2024-35527.md): An arbitrary file upload vulnerability in /fileupload/upload.cfm in Daemon PTY Limited FarCry Core framework before 7.2.14 allows attackers (CVSS 9.8)
- [CVE-2024-36819](https://cve.now/CVE-2024-36819.md): MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). (CVSS 5.4)
- [CVE-2024-37742](https://cve.now/CVE-2024-37742.md): Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. (CVSS 8.2)
- [CVE-2024-37820](https://cve.now/CVE-2024-37820.md): A nil pointer dereference in PingCAP TiDB v8.2.0-alpha-216-gfe5858b allows attackers to crash the application via expression.inferCollation. (CVSS 5.4, github.com/pingcap/tidb)
- [CVE-2024-37843](https://cve.now/CVE-2024-37843.md): Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. (CVSS 7.5, craftcms/cms)
- [CVE-2024-37855](https://cve.now/CVE-2024-37855.md): An issue in Nepstech Wifi Router xpon (terminal) NTPL-Xpon1GFEVN, hardware verstion 1.0 firmware 2.0.1 allows a remote attacker to execute a (CVSS 8.4)
- [CVE-2024-38951](https://cve.now/CVE-2024-38951.md): A buffer overflow in PX4-Autopilot v1.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MavLink message. (CVSS 6.5)
- [CVE-2024-38952](https://cve.now/CVE-2024-38952.md): PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic\_name parameter at /logger/logged\_topics.cpp. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.