CVEs published June 28, 2024
79 CVEs were published on June 28, 2024: 7 critical, 22 high.
- Published
- 79
- Critical
- 7
- High
- 22
- Medium
- 41
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Synology Camera Firmware
- 6
- IBM MQ
- 5
- HCL Software DRYiCE AEX
- 4
- Concept Intermedia S@M CMS
- 3
- Nikola Vasilijevski AdmirorFrames
- 3
- bigbluebutton
- 2
- goauthentik authentik
- 2
- IBM Cognos Analytics
- 2
- IBM Security Verify Access Docker
- 2
- IBM Storage Defender - Resiliency Service
- 2
Critical 7
- CVE-2024-5827Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vannavanna-ai/vanna
- CVE-2024-29039Missing check in tpm2_checkquote allows attackers to misrepresent the TPM statetpm2-software tpm2-tools
- CVE-2024-3816SQLi in S@M CMSConcept Intermedia S@M CMS
- CVE-2024-39349A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and itSynology Camera Firmware
- CVE-2019-25211parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.comgithub.com/gin-gonic/gin · github.com/gin-contrib/cors
- CVE-2024-37371In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message
- CVE-2024-39704Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev.
High 22
- CVE-2024-38532TEST_KEY used in example dcp_tool reference implementationusbarmory mxs-dcp
- CVE-2024-38525dd-trace-cpp malformed unicode header values may cause crashDataDog dd-trace-cpp
- CVE-2024-38528Unlimited number of NTS-KE connections can crash ntpd-rs serverpendulum-project ntpd-rs · ntpd
- CVE-2024-5712CSRF Vulnerability in stitionai/devikastitionai/devika
- CVE-2022-27540A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might aHP PC BIOS
- CVE-2024-38514NextChat Server-Side Request Forgery (SSRF)ChatGPTNextWeb ChatGPT-Next-Web
- CVE-2024-38374Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-javacyclonedx-core-java · org.cyclonedx:cyclonedx-core-java
- CVE-2024-38371Insufficient access control for OAuth2 Device Code flow in authentikgoauthentik authentik
- CVE-2024-31912IBM MQ privilege escalationIBM MQ
- CVE-2024-37905Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentikgoauthentik authentik
- CVE-2024-6403Tenda A301 SetOnlineDevName formWifiBasicSet stack-based overflowTenda A301
- CVE-2024-6402Tenda A301 SetOnlineDevName fromSetWirelessRepeat stack-based overflowTenda A301
- CVE-2024-38521Persistent Cross-Site Scripting (XSS) in hushline inboxscidsg hushline
- CVE-2024-5736SSRF in AdmirorFrames Joomla! ExtensionNikola Vasilijevski AdmirorFrames
- CVE-2024-39350A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality.Synology Camera Firmware
- CVE-2024-39348Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1Synology Router Manager
- CVE-2024-39351A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP conSynology Camera Firmware
- CVE-2023-47802A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP blocSynology Camera Firmware
- CVE-2024-37282It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsElastic Cloud Enterprise
- CVE-2024-27628Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- CVE-2024-27629An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly esca
- CVE-2024-37370In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, ca
Medium, low and unrated 50
- CVE-2024-38533ZKsync Era invalid stack addressing conversionmatter-labs era-compiler-vyper
- CVE-2024-29040Fapi Verify Quote: Does not detect if quote was not generated by TPMtpm2-software tpm2-tss
- CVE-2024-39302Some bbb-record-core files installed with wrong file permissionbigbluebutton
- CVE-2024-39307Cross-Site Scripting (XSS) vulnerability via crafted ebooks in KavitaKareadita Kavita
- CVE-2024-38518bbb-web API additional parameters consideredbigbluebutton
- CVE-2024-3995Command Injection in Helix ALMPerforce Helix ALM
- CVE-2022-38383IBM Cloud Pak for Security information disclosureIBM Cloud Pak for Security · IBM QRadar Suite Software
- CVE-2024-25041IBM Cognos Analytics cross-site scriptingIBM Cognos Analytics
- CVE-2024-25053IBM Cognos Analytics improper certificate validationIBM Cognos Analytics
- CVE-2024-38322IBM Storage Defender information disclosureIBM Storage Defender - Resiliency Service
- CVE-2024-25031IBM Storage Defender information disclosureIBM Storage Defender - Resiliency Service
- CVE-2024-35116IBM MQ denial of serviceIBM MQ
- CVE-2024-35156IBM MQ information disclosureIBM MQ
- CVE-2024-35155IBM MQ information disclosureIBM MQ
- CVE-2024-31919IBM MQ denial of serviceIBM MQ
- CVE-2024-38522CSP bypass in Hush Linescidsg hushline
- CVE-2024-35139IBM Security Access Manager Docker information disclosureIBM Security Verify Access Docker
- CVE-2024-35137IBM Security Access Manager Docker information disclosureIBM Security Verify Access Docker
- CVE-2024-29038tpm2 does not detect if quote was not generated by TPMtpm2-software tpm2-tools
- CVE-2024-38531Nix sandbox escapeNixOS nix
- CVE-2024-3801XSS in S@M CMSConcept Intermedia S@M CMS
- CVE-2024-3800XSS in S@M CMSConcept Intermedia S@M CMS
- CVE-2024-5737HTML Injection in AdmirorFrames Joomla! ExtensionNikola Vasilijevski AdmirorFrames
- CVE-2024-5735Full Path Disclosure in AdmirorFrames Joomla! ExtensionNikola Vasilijevski AdmirorFrames
- CVE-2024-5922Scylla lite <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodetislam100 Scylla lite
- CVE-2024-5662Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widgetbdthemes Ultimate Post Kit Addons for Elementor
- CVE-2024-5925Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodetislam100 Theron Lite
- CVE-2024-5424Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parametersgallerycreator Mixed Media Gallery Blocks
- CVE-2024-30135Sensitive Information Disclosure vulnerability affects DRYiCE AEX v10HCL Software DRYiCE AEX
- CVE-2024-6288Conversios.io - All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce <= 7.1.0 - Reflected Cross-Site Scriptingtatvic Conversios: Google Analytics (GA4), Google Ads, Conv…
- CVE-2024-2795SEO SIMPLE PACK <= 3.2.1 - Information Exposurelooswebstudio SEO SIMPLE PACK
- CVE-2024-5796Infinite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via project_url Parameterravichandra Infinite
- CVE-2024-5788Silesia <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcodenattywp Silesia
- CVE-2024-30111Missing Root Detection vulnerability affects DRYiCE AEX v10HCL Software DRYiCE AEX
- CVE-2024-39347Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager (SRM) before 1.2.5-8227-11 and 1.3.1-9346-8Synology Router Manager
- CVE-2024-30110Lack of input validation vulnerability affects DRYiCE AEX v10HCL Software DRYiCE AEX
- CVE-2024-39352A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality.Synology Camera Firmware
- CVE-2023-47803A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings fSynology Camera Firmware
- CVE-2024-5730Pagerank Tools <= 1.1.5 - Reflected XSSPagerank tools
- CVE-2024-5729Simple AL Slider <= 1.2.10 - Reflected XSSSimple AL Slider
- CVE-2024-5728Animated AL List <= 1.0.6 - Reflected XSSAnimated AL List
- CVE-2024-5727Widget4Call <= 1.0.7 - Reflected XSSWidget4Call
- CVE-2024-5570Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings UpdateSimple Photoswipe
- CVE-2024-30109Lack of Clickjacking Protection vulnerability affects DRYiCE AEX v10HCL Software DRYiCE AEX
- CVE-2024-6296Stackable – Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingbfintal Stackable – Page Builder Gutenberg Blocks
- CVE-2024-5864Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Resetbrechtvds Easy Affiliate Links
- CVE-2024-5863Easy Image Collage <= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearancebrechtvds Easy Image Collage
- CVE-2024-37137Dell Key Trust Platform, v3.0.6 and prior, contains Use of a Cryptographic Primitive with a Risky Implementation vulnerability.Dell CloudLink
- CVE-2024-37741OpenPLC 3 through 9cd8f1b allows XSS via an SVG document as a profile picture.
- CVE-2024-39828R74n Sandboxels 1.9 through 1.9.5 allows XSS via a message in a modified saved-game file.