CVEs published June 29, 2024
16 CVEs were published on June 29, 2024: 2 critical, 4 high.
- Published
- 16
- Critical
- 2
- High
- 4
- Medium
- 9
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- amans2k FunnelKit – Funnel Builder for WooCommerce Checkout
- 1
- bhagirath25 Floating Social Buttons
- 1
- carlosfazenda Fast Page & Post Duplicator
- 1
- everthemess Goya
- 1
- flippercode WP Maps – Store Locator,Google Maps,OpenStreetM…
- 1
- Integrated Dell Remote Access Controller
- 1
- netweblogic Events Manager – Calendar, Bookings, Tickets, a…
- 1
- petesheppard84 Extensions for Elementor
- 1
- saadiqbal Advanced File Manager – Ultimate File Manager for…
- 1
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- 1
Critical 2
- CVE-2024-6265UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'stiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2024-39848Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways.
High 4
- CVE-2024-2386WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injectionflippercode WP Maps – Store Locator,Google Maps,OpenStreetM…
- CVE-2024-25943iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulneraIntegrated Dell Remote Access Controller
- CVE-2024-5598Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listingsaadiqbal Advanced File Manager – Ultimate File Manager for…
- CVE-2024-39840Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain
Medium, low and unrated 10
- CVE-2023-4017Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameterseverthemess Goya
- CVE-2024-5819Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributesstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-5790Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widgetthehappymonster Happy Addons for Elementor
- CVE-2024-5666Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameterpetesheppard84 Extensions for Elementor
- CVE-2024-6363Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcodeurkekg Stock Ticker
- CVE-2024-5889Events Manager <= 6.4.8 - Reflected Cross-Site Scriptingnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2024-5192Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploadamans2k FunnelKit – Funnel Builder for WooCommerce Checkout
- CVE-2024-5942Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposurecarlosfazenda Fast Page & Post Duplicator
- CVE-2024-6405Floating Social Buttons <= 1.5 - Cross-Site Request Forgerybhagirath25 Floating Social Buttons
- CVE-2024-39846NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensiti