CVEs published June 26, 2024
81 CVEs were published on June 26, 2024: 7 critical, 15 high.
- Published
- 81
- Critical
- 7
- High
- 15
- Medium
- 51
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- GitLab
- 11
- Dell PowerProtect DD
- 10
- Hitachi Vantara Pentaho Business Analytics Server
- 3
- devitemsllc HT Mega Addons for Elementor – Elementor Widget…
- 2
- Frontend Checklist
- 2
- Google Nearby
- 2
- Magarsus Consultancy SSO
- 2
- octobercms october · october/system
- 2
- Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server
- 2
- Apple AirPods
- 1
Critical 7
- CVE-2024-5655Improper Access Control in GitLabGitLab
- CVE-2024-1839Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticaIntrado 911 Emergency Gateway
- CVE-2024-4228SQLi in Magarsus Consultancy's SSOMagarsus Consultancy SSO
- CVE-2024-37252WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerabilityIcegram Email Subscribers & Newsletters
- CVE-2024-5181Command Injection in mudler/localaimudler/localai
- CVE-2024-37734An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.
- CVE-2024-39243An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_sa
High 15
- CVE-2024-4901Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-6323Improper Isolation or Compartmentalization in GitLabGitLab
- CVE-2024-28984Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Hitachi Vantara Pentaho Business Analytics Server
- CVE-2024-28983Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Hitachi Vantara Pentaho Business Analytics Server
- CVE-2024-28982Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceHitachi Vantara Pentaho Business Analytics Server
- CVE-2024-6354Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated userDevolutions Remote Desktop Manager
- CVE-2024-38272Auth Bypass in Quick ShareGoogle Nearby
- CVE-2024-4758Muslim Prayer Time BD <= 2.4 - Settings Reset via CSRFMuslim Prayer Time BD
- CVE-2024-37140Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an aDell PowerProtect DD
- CVE-2024-29176Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability.Dell PowerProtect DD
- CVE-2024-23766An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices.
- CVE-2024-23767An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3.
- CVE-2024-33329A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other se
- CVE-2024-34581The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is
- CVE-2024-36829Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string.
Medium, low and unrated 59
- CVE-2024-1493Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-1816Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-2191Improper Access Control in GitLabGitLab
- CVE-2024-3115Exposure of Sensitive Information to an Unauthorized Actor in GitLabGitLab
- CVE-2024-3959Improper Authorization in GitLabGitLab
- CVE-2024-4011Improper Access Control in GitLabGitLab
- CVE-2024-4557Uncontrolled Resource Consumption in GitLabGitLab
- CVE-2024-5430Improper Access Control in GitLabGitLab
- CVE-2024-37247WordPress jQuery T(-) Countdown Widget plugin <= 2.3.25 - Cross Site Scripting (XSS) vulnerabilitytwinpictures, baden03 jQuery T(-) Countdown Widget
- CVE-2024-37248WordPress Anima theme <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityCryoutCreations Anima
- CVE-2024-6355Genexis Tilgin Fiber Home Gateway HG1522 cross site scriptingGenexis Tilgin Fiber Home Gateway HG1522
- CVE-2024-38527Cross-site Scripting in ZenUMLmermaid-js zenuml-core · @zenuml/core
- CVE-2024-38520SoftEther VPN with L2TP - 2.75x AmplificationSoftEtherVPN
- CVE-2024-38375@fastly/js-compute use-after-free in some host call implementationsfastly js-compute-runtime · @fastly/js-compute
- CVE-2024-39460Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL inJenkins Project Jenkins Bitbucket Branch Source Plugin · or…
- CVE-2024-39459In rare cases Jenkins Plain Credentials Plugin 182.v468b_97b_9dcb_8 and earlier stores secret file credentials unencrypted (only Base64 encoJenkins Project Jenkins Plain Credentials Plugin · org.jenk…
- CVE-2024-39458When Jenkins Structs Plugin 337.v1b_04ea_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnosticJenkins Project Jenkins Structs Plugin · org.jenkins-ci.plu…
- CVE-2024-25637Reflected XSS via X-October-Request-Handler Headeroctobercms october · october/system
- CVE-2024-38271Denial of Service in Quick ShareGoogle Nearby
- CVE-2024-4604Open Redirect in Magarsus Consultancy's SSOMagarsus Consultancy SSO
- CVE-2024-37098WordPress BlossomThemes Email Newsletter plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerabilityBlossom Themes BlossomThemes Email Newsletter
- CVE-2024-6344ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scriptingZKTeco ZKBio CVSecurity
- CVE-2024-28830Automation user secrets written to audit logCheckmk
- CVE-2024-5215HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-5573Easy Table of Contents < 2.0.66 - Admin+ Stored XSSEasy Table of Contents
- CVE-2024-5473 Simple Photoswipe <= 0.1 - Admin+ Stored XSSSimple Photoswipe
- CVE-2024-5199Spotify Play Button <= 1.0 - Contributor+ Stored XSSSpotify Play Button
- CVE-2024-5169Video Widget <= 1.2.3 - Admin+ Stored XSS via WidgetVideo Widget
- CVE-2024-5071Bookster <= 1.1.0 - Unauthenticated Appointment Status UpdateBookster
- CVE-2024-4959Frontend Checklist <= 2.3.2 - Admin+ Stored XSS via ItemsFrontend Checklist
- CVE-2024-4957Frontend Checklist <= 2.3.2 - Admin+ Stored XSSFrontend Checklist
- CVE-2024-3633WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVGWebP & SVG Support
- CVE-2024-5332Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widgettimstrifler Exclusive Addons for Elementor
- CVE-2024-4106A vulnerability has been found in FAST/TOOLS and CI Server.Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server
- CVE-2024-4105A vulnerability has been found in FAST/TOOLS and CI Server.Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server
- CVE-2024-21520Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template fdjangorestframework
- CVE-2024-37141Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability.Dell PowerProtect DD
- CVE-2024-37139Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through itsDell PowerProtect DD
- CVE-2024-37138Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerabiliDell PowerProtect DD
- CVE-2024-27867An authentication issue was addressed with improved state management.Apple AirPods
- CVE-2024-29175Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerabilityDell PowerProtect DD
- CVE-2024-29174Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability.Dell PowerProtect DD
- CVE-2024-29173Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerabDell PowerProtect DD
- CVE-2024-29177Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive informatiDell PowerProtect DD
- CVE-2024-28973Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability.Dell PowerProtect DD
- CVE-2024-5173HT Mega – Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settingsdevitemsllc HT Mega Addons for Elementor – Elementor Widget…
- CVE-2024-24764October Open Redirect for Administrator Accountsoctobercms october · october/system
- CVE-2023-26877File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to th
- CVE-2024-23765An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices.
- CVE-2024-33326A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to e
- CVE-2024-33327A cross-site scripting (XSS) vulnerability in the component UrlAccessibilityEvaluation.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to
- CVE-2024-33328A cross-site scripting (XSS) vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web
- CVE-2024-34580Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection agai
- CVE-2024-35545MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2024-37571Buffer Overflow vulnerability in SAS Broker 9.2 build 1495 allows attackers to cause denial of service or obtain sensitive information via c
- CVE-2024-38949Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 func
- CVE-2024-38950Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to __interceptor_memcpy
- CVE-2024-39241Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview.
- CVE-2024-39242A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload