# CVEs published 2024-06-26

81 CVEs were published on June 26, 2024: 7 critical, 15 high. Days are UTC.

- [CVE-2024-1493](https://cve.now/CVE-2024-1493.md): Uncontrolled Resource Consumption in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-1816](https://cve.now/CVE-2024-1816.md): Uncontrolled Resource Consumption in GitLab (CVSS 5.3, GitLab)
- [CVE-2024-2191](https://cve.now/CVE-2024-2191.md): Improper Access Control in GitLab (CVSS 5.3, GitLab)
- [CVE-2024-3115](https://cve.now/CVE-2024-3115.md): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-3959](https://cve.now/CVE-2024-3959.md): Improper Authorization in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-4011](https://cve.now/CVE-2024-4011.md): Improper Access Control in GitLab (CVSS 3.1, GitLab)
- [CVE-2024-4557](https://cve.now/CVE-2024-4557.md): Uncontrolled Resource Consumption in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-4901](https://cve.now/CVE-2024-4901.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2024-5655](https://cve.now/CVE-2024-5655.md): Improper Access Control in GitLab (CVSS 9.6, GitLab)
- [CVE-2024-5430](https://cve.now/CVE-2024-5430.md): Improper Access Control in GitLab (CVSS 6.8, GitLab)
- [CVE-2024-6323](https://cve.now/CVE-2024-6323.md): Improper Isolation or Compartmentalization in GitLab (CVSS 7.5, GitLab)
- [CVE-2024-28984](https://cve.now/CVE-2024-28984.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 8.8, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2024-28983](https://cve.now/CVE-2024-28983.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 8.8, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2024-28982](https://cve.now/CVE-2024-28982.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 7.1, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2024-37247](https://cve.now/CVE-2024-37247.md): WordPress jQuery T(-) Countdown Widget plugin \<= 2.3.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, twinpictures, baden03 jQuery T(-) Countdown Widget)
- [CVE-2024-37248](https://cve.now/CVE-2024-37248.md): WordPress Anima theme \<= 1.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CryoutCreations Anima)
- [CVE-2024-6355](https://cve.now/CVE-2024-6355.md): Genexis Tilgin Fiber Home Gateway HG1522 cross site scripting (CVSS 6.9, Genexis Tilgin Fiber Home Gateway HG1522)
- [CVE-2024-1839](https://cve.now/CVE-2024-1839.md): Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthentica (CVSS 10.0, Intrado 911 Emergency Gateway)
- [CVE-2024-38527](https://cve.now/CVE-2024-38527.md): Cross-site Scripting in ZenUML (CVSS 5.4, mermaid-js zenuml-core · @zenuml/core)
- [CVE-2024-38520](https://cve.now/CVE-2024-38520.md): SoftEther VPN with L2TP - 2.75x Amplification (CVSS 5.3, SoftEtherVPN)
- [CVE-2024-38375](https://cve.now/CVE-2024-38375.md): @fastly/js-compute use-after-free in some host call implementations (CVSS 5.3, fastly js-compute-runtime · @fastly/js-compute)
- [CVE-2024-39460](https://cve.now/CVE-2024-39460.md): Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in (CVSS 4.3, Jenkins Project Jenkins Bitbucket Branch Source Plugin · or…)
- [CVE-2024-39459](https://cve.now/CVE-2024-39459.md): In rare cases Jenkins Plain Credentials Plugin 182.v468b\_97b\_9dcb\_8 and earlier stores secret file credentials unencrypted (only Base64 enco (CVSS 4.3, Jenkins Project Jenkins Plain Credentials Plugin · org.jenk…)
- [CVE-2024-39458](https://cve.now/CVE-2024-39458.md): When Jenkins Structs Plugin 337.v1b\_04ea\_4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic (CVSS 3.1, Jenkins Project Jenkins Structs Plugin · org.jenkins-ci.plu…)
- [CVE-2024-6354](https://cve.now/CVE-2024-6354.md): Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user (CVSS 7.2, Devolutions Remote Desktop Manager)
- [CVE-2024-25637](https://cve.now/CVE-2024-25637.md): Reflected XSS via X-October-Request-Handler Header (CVSS 3.1, octobercms october · october/system)
- [CVE-2024-38272](https://cve.now/CVE-2024-38272.md): Auth Bypass in Quick Share (CVSS 7.1, Google Nearby)
- [CVE-2024-38271](https://cve.now/CVE-2024-38271.md): Denial of Service in Quick Share (CVSS 5.9, Google Nearby)
- [CVE-2024-4604](https://cve.now/CVE-2024-4604.md): Open Redirect in Magarsus Consultancy's SSO (CVSS 6.1, Magarsus Consultancy SSO)
- [CVE-2024-4228](https://cve.now/CVE-2024-4228.md): SQLi in Magarsus Consultancy's SSO (CVSS 9.8, Magarsus Consultancy SSO)
- [CVE-2024-37098](https://cve.now/CVE-2024-37098.md): WordPress BlossomThemes Email Newsletter plugin \<= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4, Blossom Themes BlossomThemes Email Newsletter)
- [CVE-2024-6344](https://cve.now/CVE-2024-6344.md): ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting (CVSS 4.8, ZKTeco ZKBio CVSecurity)
- [CVE-2024-37252](https://cve.now/CVE-2024-37252.md): WordPress Email Subscribers by Icegram Express plugin \<= 5.7.25 - SQL Injection vulnerability (CVSS 9.3, Icegram Email Subscribers & Newsletters)
- [CVE-2024-28830](https://cve.now/CVE-2024-28830.md): Automation user secrets written to audit log (CVSS 2.7, Checkmk)
- [CVE-2024-5215](https://cve.now/CVE-2024-5215.md): HT Mega – Absolute Addons For Elementor \<= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-5573](https://cve.now/CVE-2024-5573.md): Easy Table of Contents \< 2.0.66 - Admin+ Stored XSS (CVSS 5.9, Easy Table of Contents)
- [CVE-2024-5473](https://cve.now/CVE-2024-5473.md): Simple Photoswipe \<= 0.1 - Admin+ Stored XSS (CVSS 4.0, Simple Photoswipe)
- [CVE-2024-5199](https://cve.now/CVE-2024-5199.md): Spotify Play Button \<= 1.0 - Contributor+ Stored XSS (CVSS 6.1, Spotify Play Button)
- [CVE-2024-5169](https://cve.now/CVE-2024-5169.md): Video Widget \<= 1.2.3 - Admin+ Stored XSS via Widget (CVSS 4.3, Video Widget)
- [CVE-2024-5071](https://cve.now/CVE-2024-5071.md): Bookster \<= 1.1.0 - Unauthenticated Appointment Status Update (CVSS 6.5, Bookster)
- [CVE-2024-4959](https://cve.now/CVE-2024-4959.md): Frontend Checklist \<= 2.3.2 - Admin+ Stored XSS via Items (CVSS 4.8, Frontend Checklist)
- [CVE-2024-4957](https://cve.now/CVE-2024-4957.md): Frontend Checklist \<= 2.3.2 - Admin+ Stored XSS (CVSS 4.3, Frontend Checklist)
- [CVE-2024-4758](https://cve.now/CVE-2024-4758.md): Muslim Prayer Time BD \<= 2.4 - Settings Reset via CSRF (CVSS 7.6, Muslim Prayer Time BD)
- [CVE-2024-3633](https://cve.now/CVE-2024-3633.md): WebP & SVG Support \<= 1.4.0 - Author+ Stored XSS via SVG (CVSS 5.4, WebP & SVG Support)
- [CVE-2024-5332](https://cve.now/CVE-2024-5332.md): Exclusive Addons for Elementor \<= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-4106](https://cve.now/CVE-2024-4106.md): A vulnerability has been found in FAST/TOOLS and CI Server. (CVSS 5.3, Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server)
- [CVE-2024-4105](https://cve.now/CVE-2024-4105.md): A vulnerability has been found in FAST/TOOLS and CI Server. (CVSS 5.8, Yokogawa Electric FAST/TOOLS · Yokogawa Electric CI Server)
- [CVE-2024-21520](https://cve.now/CVE-2024-21520.md): Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break\_long\_headers template f (CVSS 5.3, djangorestframework)
- [CVE-2024-37141](https://cve.now/CVE-2024-37141.md): Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. (CVSS 3.5, Dell PowerProtect DD)
- [CVE-2024-37140](https://cve.now/CVE-2024-37140.md): Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection vulnerability in an a (CVSS 8.8, Dell PowerProtect DD)
- [CVE-2024-37139](https://cve.now/CVE-2024-37139.md): Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an Improper Control of a Resource Through its (CVSS 6.5, Dell PowerProtect DD)
- [CVE-2024-37138](https://cve.now/CVE-2024-37138.md): Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerabili (CVSS 4.1, Dell PowerProtect DD)
- [CVE-2024-27867](https://cve.now/CVE-2024-27867.md): An authentication issue was addressed with improved state management. (CVSS 3.3, Apple AirPods)
- [CVE-2024-29175](https://cve.now/CVE-2024-29175.md): Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability (CVSS 5.9, Dell PowerProtect DD)
- [CVE-2024-29174](https://cve.now/CVE-2024-29174.md): Dell Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.30, LTS 7.10.1.20 contain an SQL Injection vulnerability. (CVSS 4.4, Dell PowerProtect DD)
- [CVE-2024-5181](https://cve.now/CVE-2024-5181.md): Command Injection in mudler/localai (CVSS 9.8, mudler/localai)
- [CVE-2024-29173](https://cve.now/CVE-2024-29173.md): Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerab (CVSS 6.8, Dell PowerProtect DD)
- [CVE-2024-29177](https://cve.now/CVE-2024-29177.md): Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive informati (CVSS 2.7, Dell PowerProtect DD)
- [CVE-2024-29176](https://cve.now/CVE-2024-29176.md): Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. (CVSS 8.8, Dell PowerProtect DD)
- [CVE-2024-28973](https://cve.now/CVE-2024-28973.md): Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Stored Cross-Site Scripting Vulnerability. (CVSS 5.9, Dell PowerProtect DD)
- [CVE-2024-5173](https://cve.now/CVE-2024-5173.md): HT Mega – Absolute Addons For Elementor \<= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-24764](https://cve.now/CVE-2024-24764.md): October Open Redirect for Administrator Accounts (CVSS 3.5, octobercms october · october/system)
- [CVE-2023-26877](https://cve.now/CVE-2023-26877.md): File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to th (CVSS 6.3)
- [CVE-2024-23765](https://cve.now/CVE-2024-23765.md): An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. (CVSS 4.0)
- [CVE-2024-23766](https://cve.now/CVE-2024-23766.md): An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. (CVSS 7.5)
- [CVE-2024-23767](https://cve.now/CVE-2024-23767.md): An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. (CVSS 8.8)
- [CVE-2024-33326](https://cve.now/CVE-2024-33326.md): A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to e (CVSS 6.1)
- [CVE-2024-33327](https://cve.now/CVE-2024-33327.md): A cross-site scripting (XSS) vulnerability in the component UrlAccessibilityEvaluation.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to (CVSS 6.1)
- [CVE-2024-33328](https://cve.now/CVE-2024-33328.md): A cross-site scripting (XSS) vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web (CVSS 6.1)
- [CVE-2024-33329](https://cve.now/CVE-2024-33329.md): A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other se (CVSS 7.5)
- [CVE-2024-34580](https://cve.now/CVE-2024-34580.md): Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection agai (CVSS 5.3)
- [CVE-2024-34581](https://cve.now/CVE-2024-34581.md): The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is (CVSS 7.3)
- [CVE-2024-35545](https://cve.now/CVE-2024-35545.md): MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability. (CVSS 6.1)
- [CVE-2024-36829](https://cve.now/CVE-2024-36829.md): Incorrect access control in Teldat M1 v11.00.05.50.01 allows attackers to obtain sensitive information via a crafted query string. (CVSS 7.5)
- [CVE-2024-37571](https://cve.now/CVE-2024-37571.md): Buffer Overflow vulnerability in SAS Broker 9.2 build 1495 allows attackers to cause denial of service or obtain sensitive information via c (CVSS 4.3)
- [CVE-2024-37734](https://cve.now/CVE-2024-37734.md): An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter. (CVSS 9.8)
- [CVE-2024-38949](https://cve.now/CVE-2024-38949.md): Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to display444as420 func (CVSS 6.5)
- [CVE-2024-38950](https://cve.now/CVE-2024-38950.md): Heap Buffer Overflow vulnerability in Libde265 v1.0.15 allows attackers to crash the application via crafted payload to \_\_interceptor\_memcpy (CVSS 6.5)
- [CVE-2024-39241](https://cve.now/CVE-2024-39241.md): Cross Site Scripting (XSS) vulnerability in skycaiji 2.8 allows attackers to run arbitrary code via /admin/tool/preview. (CVSS 6.1)
- [CVE-2024-39242](https://cve.now/CVE-2024-39242.md): A cross-site scripting (XSS) vulnerability in skycaiji v2.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (CVSS 6.1)
- [CVE-2024-39243](https://cve.now/CVE-2024-39243.md): An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor\_sa (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-06-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.