CVEs published in June 2024

3,276 vulnerabilities, 312 critical, 13 exploited.

• oretnom23 medicine tracker system SourceCodester Medicine Tracker System sql injection CVE-2024-6419 5.3 MediumJune 30, 2024
• medicine tracker system project tracker system, oretnom23 medicine tracker system +1 more SourceCodester Medicine Tracker System sql injection CVE-2024-6418 6.9 MediumJune 30, 2024
• oretnom23 simple online bidding system SourceCodester Simple Online Bidding System sql injection CVE-2024-6417 5.3 MediumJune 30, 2024
• seacms SeaCMS sql injection CVE-2024-6416 5.3 MediumJune 30, 2024
• randombit botan Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters CVE-2024-34703 Fix available 7.5 HighJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server cross-site scripting CVE-2023-50964 5.4 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server cross-site scripting CVE-2024-28794 5.4 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server information disclosure CVE-2023-50953 5.4 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server server-side request forgery CVE-2023-50952 5.4 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server cross-site scripting CVE-2024-28797 6.4 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server data modification CVE-2024-31898 5.4 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server information disclosure CVE-2023-50954 4.3 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server cross-site request forgery CVE-2024-31902 4.3 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server information disclosure CVE-2024-35119 5.3 MediumJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server cross-site scripting CVE-2024-28798 7.2 HighJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server improper authentication CVE-2023-35022 3.3 LowJune 30, 2024
• ibm infosphere information server IBM InfoSphere Information Server cross-site scripting CVE-2024-28795 5.4 MediumJune 30, 2024
• zenml, zenml-io zenml-io/zenml +1 more Reflected XSS through survey redirect parameter in zenml-io/zenml CVE-2024-5062 Fix available 5.3 MediumJune 30, 2024
• ingenico estate manager Ingenico Estate Manager New Widget cross site scripting CVE-2024-6415 5.1 MediumJune 30, 2024
• parsec automation traksys, tracksys +1 more Parsec Automation TrakSYS Export Page contentpage direct request CVE-2024-6414 6.9 MediumJune 30, 2024
• stitionai devika, stitionai/devika +1 more Path Traversal in stitionai/devika CVE-2024-5926 9.1 CriticalJune 30, 2024
• tryton-client Debian tryton-client - security update DLA-3854-1 Fix available No scoreJune 30, 2024
• tryton-server Debian tryton-server - security update DLA-3853-1 Fix available No scoreJune 30, 2024
• flippercode google map, wp maps – store locator,google maps,openstreetmap,mapbox,listing,directory & filters +1 more WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection CVE-2024-2386 8.8 HighJune 29, 2024
• dell idrac9, integrated dell remote access controller 9, integrated dell remote access controller 9 firmware +2 more iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th... CVE-2024-25943 7.6 HighJune 29, 2024
• everthemess goya Goya <= 1.0.8.7 - Unauthenticated Reflected Cross-Site Scripting via Multiple Parameters CVE-2023-4017 6.1 MediumJune 29, 2024
• kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 more Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes CVE-2024-5819 6.4 MediumJune 29, 2024
• thehappymonster happy addons for elementor Happy Addons for Elementor <= 3.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget CVE-2024-5790 6.4 MediumJune 29, 2024
• idioweb extensions for elementor Extensions for Elementor <= 2.0.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter CVE-2024-5666 6.4 MediumJune 29, 2024
• urkekg stock ticker Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode CVE-2024-6363 6.4 MediumJune 29, 2024
• advancedfilemanager advanced file manager, saadiqbal advanced file manager – ultimate file manager for wordpress and document library solution +1 more Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listing CVE-2024-5598 7.5 HighJune 29, 2024
• ayecode userswp, stiofansisland userswp – front-end login form, user registration, user profile & members directory plugin for wp +1 more UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' CVE-2024-6265 9.8 CriticalJune 29, 2024
• netweblogic events manager – calendar, bookings, tickets, and more!, pixelite events manager +1 more Events Manager <= 6.4.8 - Reflected Cross-Site Scripting CVE-2024-5889 6.1 MediumJune 29, 2024
• carlosfazenda page and post clone, fast page & post duplicator +1 more Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure CVE-2024-5942 4.3 MediumJune 29, 2024
• funnelkit funnel builder, amans2k funnelkit – funnel builder for woocommerce checkout +1 more Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting v… CVE-2024-5192 6.4 MediumJune 29, 2024
• bhagirath25 floating social buttons Floating Social Buttons <= 1.5 - Cross-Site Request Forgery CVE-2024-6405 6.1 MediumJune 29, 2024
• libultrahdr OSS-Fuzz Heap-buffer-overflow in ultrahdr::getYuv420Pixel OSV-2024-602 Fix available No scoreJune 29, 2024
• internet2 grouper Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in... CVE-2024-39848 9.1 CriticalJune 29, 2024
• No product listed NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it... CVE-2024-39846 3.5 LowJune 29, 2024
• factorio Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom... CVE-2024-39840 Public exploit 8.8 HighJune 29, 2024
• usbarmory mxs-dcp TEST_KEY used in example dcp_tool reference implementation CVE-2024-38532 7.1 HighJune 28, 2024
• matter-labs era-compiler-vyper ZKsync Era invalid stack addressing conversion CVE-2024-38533 6.5 MediumJune 28, 2024
• datadog dd-trace-cpp dd-trace-cpp malformed unicode header values may cause crash CVE-2024-38525 7.5 HighJune 28, 2024
• bigbluebutton Some bbb-record-core files installed with wrong file permission CVE-2024-39302 3.7 LowJune 28, 2024
• kareadita kavita Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita CVE-2024-39307 3.5 LowJune 28, 2024
• bigbluebutton bbb-web API additional parameters considered CVE-2024-38518 4.6 MediumJune 28, 2024
• perforce helix alm Command Injection in Helix ALM CVE-2024-3995 2.0 LowJune 28, 2024
• pendulum-project ntpd-rs Unlimited number of NTS-KE connections can crash ntpd-rs server CVE-2024-38528 Fix available 7.5 HighJune 28, 2024
• vanna-ai vanna, vanna-ai/vanna +1 more Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna CVE-2024-5827 9.8 CriticalJune 28, 2024
• stitionai devika, stitionai/devika +1 more CSRF Vulnerability in stitionai/devika CVE-2024-5712 8.1 HighJune 28, 2024
• Show olderLoading…