CVEs published June 27, 2024
111 CVEs were published on June 27, 2024: 21 critical, 37 high.
- Published
- 111
- Critical
- 21
- High
- 37
- Medium
- 51
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- IBM Security Access Manager Docker
- 5
- LabVantage LIMS
- 4
- Markoni-D (Compact) FM Transmitters · Markoni-DH (Exciter+A…
- 4
- stitionai/devika
- 4
- gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- 3
- lunary-ai/lunary
- 3
- parisneo/lollms · lollms
- 3
- berriai/litellm · litellm
- 2
- IBM Security Verify Access
- 2
- IBM Sterling B2B Integrator Standard Edition
- 2
Critical 21
- CVE-2024-6071PTC Creo Elements/Direct License Server Missing AuthorizationPTC Creo Elements/Direct License
- CVE-2024-2973Session Smart Router(SSR): On redundant router deployments API authentication can be bypassedJuniper Networks Session Smart Router · Juniper Networks… +1
- CVE-2024-6127BC Security Empire Path Traversal RCEBC Security Empire
- CVE-2024-2882Missing Authorization in SDG Technologies PnPSCADASDG Technologies PnPSCADA
- CVE-2024-5980Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightninglightning-ai/pytorch-lightning · lightning +1
- CVE-2024-5751Remote Code Execution in BerriAI/litellmberriai/litellm · litellm
- CVE-2024-5826Remote Code Execution via Prompt Injection in vanna-ai/vannavanna-ai/vanna · vanna
- CVE-2024-3330Spotfire Remote Code Execution VulnerabilitySpotfire Analyst · Spotfire Server +1
- CVE-2024-39376Improper Access Control In TELSAT MarKoni FM TransmitterMarkoni-D (Compact) FM Transmitters · Markoni-DH (Exciter+A…
- CVE-2024-39375Use of Client-Side Authentication in TELSAT marKoni FM TransmitterMarkoni-D (Compact) FM Transmitters · Markoni-DH (Exciter+A…
- CVE-2024-39374Use of Hard-coded Credentials in TELSAT marKoni FM TransmitterMarkoni-D (Compact) FM Transmitters · Markoni-DH (Exciter+A…
- CVE-2024-39373Improper Neutralization of Special Elements used in a Command in TELSAT marKoni FM TransmitterMarkoni-D (Compact) FM Transmitters · Markoni-DH (Exciter+A…
- CVE-2024-1107IDOR in Talya Informatics' Travel APPSTalya Informatics Travel APPS
- CVE-2024-5535SSL_select_next_proto buffer overreadOpenSSL
- CVE-2024-0949Improper Access Control in Talya Informatics' ElektrawebTalya Informatics Elektraweb
- CVE-2024-0947Cookies Manipulation in Talya Informatics' ElektrawebTalya Informatics Elektraweb
- CVE-2024-36059Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitra
- CVE-2024-36072Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the loggin
- CVE-2024-39208luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.
- CVE-2024-39669In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects.
- CVE-2024-39705NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download funnltk
High 37
- CVE-2024-4395Lack of Client Validation in Jamf Compliance Editor's Helper Service May Result in Privilege EscalationJamf Compliance Editor
- CVE-2024-38523Hush Line OTP issuescidsg hushline
- CVE-2024-6139Path Traversal in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-5824Path Traversal in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-5885Server-Side Request Forgery (SSRF) in stangirard/quivrstangirard/quivr
- CVE-2024-6085Path Traversal in parisneo/lollmsparisneo/lollms · lollms
- CVE-2024-5822Server-Side Request Forgery (SSRF) in gaizhenbiao/ChuanhuChatGPTgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-5714Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-6038ReDoS Vulnerability in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-6250Absolute Path Traversal in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-5820Unprotected WebSocket in stitionai/devikastitionai/devika
- CVE-2024-6090Path Traversal Vulnerability in gaizhenbiao/chuanhuchatgptgaizhenbiao/chuanhuchatgpt · chuanhuchatgpt
- CVE-2024-5979Denial of Service via Invalid Argument in h2oai/h2o-3h2oai/h2o-3 · h2o
- CVE-2024-4578Privilege escalation in Arista Wireless Access PointsArista Networks Arista Wireless Access Points
- CVE-2023-38370IBM Security Access Manager Docker information disclosureIBM Security Access Manager Docker
- CVE-2023-30997IBM Security Access Manager Docker privilege escalationIBM Security Access Manager Docker
- CVE-2023-30998IBM Security Access Manager Docker privilege escalationIBM Security Access Manager Docker
- CVE-2024-3043Zigbee co-ordinator realignment packet may lead to denial of servicesilabs.com Ember ZNet SDK
- CVE-2024-31916IBM OpenBMC information disclosureIBM OpenBMC
- CVE-2024-24792Panic when parsing invalid palette-color images in golang.org/x/imagegolang.org/x/image/tiff · golang.org/x/image
- CVE-2024-5548Directory Traversal in stitionai/devikastitionai/devika
- CVE-2024-5547Directory Traversal in stitionai/devikastitionai/devika
- CVE-2024-5334Local File Read in stitionai/devikastitionai/devika
- CVE-2024-35260Microsoft Dataverse Remote Code Execution VulnerabilityMicrosoft Power Platform
- CVE-2024-22232Specially crafted url can be created which leads to a directory traversal in the salt file serverVMware Salt Project · salt
- CVE-2024-3111H5P < 1.15.8 - Contributor+ Stored XSSInteractive Content
- CVE-2024-6054Auto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Uploadka-yue Auto Featured Image
- CVE-2016-20022In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint de
- CVE-2023-52892In phpseclib before 1.0.22, 2.x before 2.0.46, and 3.x before 3.0.33, some characters in Subject Alternative Name fields in TLS certificatesphpseclib/phpseclib
- CVE-2024-36073Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the shadow
- CVE-2024-36074Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the Endpoi
- CVE-2024-39130A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function DumpOneStream(
- CVE-2024-39134A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_fetch_disk_trailer()
- CVE-2024-39154idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=del&dataType=word&
- CVE-2024-39158idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/userSys_deal.php?mudi=infoSet.
- CVE-2024-39207lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function.
- CVE-2024-39708An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096 on Windows.
Medium, low and unrated 53
- CVE-2024-5642Buffer overread when using an empty list with SSLContext.set_npn_protocols()Python Software Foundation CPython
- CVE-2024-22276VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability.VMware Cloud Director Object Storage Extension
- CVE-2024-22272VMware Cloud Director contains an Improper Privilege Management vulnerability.VMware Cloud Director
- CVE-2024-22260VMware Workspace One UEM update addresses an information exposure vulnerability.VMware Workspace One UEM
- CVE-2024-3331Spotfire: NTLM token leakageSpotfire Enterprise Runtime for R - Server Edition · Spo… +3
- CVE-2024-5933Cross-site Scripting (XSS) in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-6086Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-5935CSRF Vulnerability in imartinez/privategptimartinez/privategpt
- CVE-2024-5755Email Validation Bypass in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-5936Open Redirect in imartinez/privategptimartinez/privategpt
- CVE-2024-5710Improper Access Control in Team Management in berriai/litellmberriai/litellm · litellm
- CVE-2024-3017Denial of service in multi-protocol gateway - Zigbee + Threadsilabs.com SiSDK
- CVE-2023-38368IBM Security Access Manager Docker information disclosureIBM Security Access Manager Docker
- CVE-2023-38371IBM Security Access Manager Docker information disclosureIBM Security Access Manager Docker
- CVE-2023-42014IBM Sterling B2B Integrator Standard Edition cross-site scriptingIBM Sterling B2B Integrator Standard Edition
- CVE-2023-42011IBM Sterling B2B Integrator Standard Edition tapjackingIBM Sterling B2B Integrator Standard Edition
- CVE-2024-35153IBM WebSphere Application Server cross-site scriptingIBM WebSphere Application Server
- CVE-2023-30430IBM Security Verify Access information disclosureIBM Security Verify Access
- CVE-2024-31883IBM Security Verify Access denial of serviceIBM Security Verify Access
- CVE-2024-6388Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passinCanonical Ubuntu Advantage Desktop Pro
- CVE-2024-6374lahirudanushka School Management System Subject Page subject.php cross site scriptinglahirudanushka School Management System
- CVE-2024-1153SQL Injection Vulnerability in Talya Informatics' Travel APPSTalya Informatics Travel APPS
- CVE-2024-6373itsourcecode Online Food Ordering System addproduct.php unrestricted uploaditsourcecode Online Food Ordering System
- CVE-2024-6372itsourcecode Tailoring Management System customeradd.php sql injectionitsourcecode Tailoring Management System
- CVE-2024-6371itsourcecode Pool of Bethesda Online Reservation System controller.php sql injectionitsourcecode Pool of Bethesda Online Reservation System
- CVE-2024-6370LabVantage LIMS POST Request cross site scriptingLabVantage LIMS
- CVE-2024-6369LabVantage LIMS POST Request cross site scriptingLabVantage LIMS
- CVE-2024-6368LabVantage LIMS POST Request cross site scriptingLabVantage LIMS
- CVE-2024-6367LabVantage LIMS POST Request cross site scriptingLabVantage LIMS
- CVE-2024-6262Portfolio Gallery – Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingawordpresslife Portfolio Filter Gallery
- CVE-2023-7270Local Privilege Escalation via MSI installerSoftMaker Software Office · SoftMaker Software FreeOffice
- CVE-2024-4983The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scriptingposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-5601Create by Mediavine <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcodemischiefmarmot Create
- CVE-2024-22231Syndic cache directory creation is vulnerable to a directory traversal attackVMware Salt Project · salt
- CVE-2024-4704 Contact Form 7 < 5.9.5 - Unauthenticated Open RedirectContact Form
- CVE-2024-4664WP Chat App < 3.6.5 - Admin+ Stored XSSWP Chat App
- CVE-2024-1330Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Accesskadence-blocks-pro
- CVE-2024-6283DethemeKit For Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery WidgetDethemeKit for Elementor
- CVE-2024-4570Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpvibes Addon Elements for Elementor
- CVE-2024-4569Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpvibes Addon Elements for Elementor
- CVE-2024-5289Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widgetstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-28820Buffer overflow in the extract_openvpn_cr function in openvpn-cr.c in openvpn-auth-ldap (aka the Three Rings Auth-LDAP plugin for OpenVPN) 2
- CVE-2024-31802DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.
- CVE-2024-36075The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due t
- CVE-2024-36755D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL.
- CVE-2024-39129Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function PushTSBuf() at /s
- CVE-2024-39132A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function VerifyComma
- CVE-2024-39133Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() f
- CVE-2024-39153idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/info_deal.php?mudi=del&dataType=news&dat
- CVE-2024-39155idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=add.
- CVE-2024-39156idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/keyWord_deal.php?mudi=add.
- CVE-2024-39157idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ipRecord_deal.php?mudi=del&dataType=&dat
- CVE-2024-39209luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.