CVEs published in June 2024
3,276 vulnerabilities, 312 critical, 13 exploited.
- metagauss profilegrid, profilegrid – user profiles, groups and communities +1 moreProfileGrid <= 5.8.6 - Missing Authorization4.3 Medium
- duongancol boostify header footer builder for elementorBoostify Header Footer Builder for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter6.4 Medium
- cyberchimps responsive addons, responsive plus – elementor templates & starter sites +1 moreResponsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- shafayat-alam gutenberg blocks and page layouts – attire blocks, wpattire attire blocks +1 moreGutenberg Blocks and Page Layouts – Attire Blocks <= 1.9.2 - Missing Authorization4.3 Medium
- brizy, themefusecom brizy – page builder +1 moreBrizy – Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality6.4 Medium
- ndijkstra mollie formsMollie Forms <= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplication4.3 Medium
- buddyboss platform, unknown buddyboss-platform +1 moreBuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR4.3 Medium
- brizy, themefusecom brizy – page builder +1 moreBrizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL7.4 High
- brizy, themefusecom brizy – page builder +1 moreBrizy – Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form7.2 High
- brizy, themefusecom brizy – page builder, brizy brizy-page builder +2 moreBrizy – Page Builder <= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting7.1 High
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 moreEmail Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash9.8 Critical
- brizy, themefusecom brizy – page builder +1 moreBrizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes6.4 Medium
- themekraft buddyforms, svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft post form registration form profile form for user profiles and content forms +2 moreBuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness6.5 Medium
- projectdiscovery interactshProjectDiscovery Interactsh - Files or Directories Accessible to External Parties9.3 Critical
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API5.3 Medium
- thenewsletterplugin newsletter, newsletter send awesome emails, satollo newsletter – send awesome emails from wordpress +2 moreNewsletter <= 8.3.4 - Unauthenticated Stored Cross-Site Scripting via np16.4 Medium
- bakery online ordering system project online ordering system, itsourcecode bakery online ordering system +1 moreitsourcecode Bakery Online Ordering System index.php sql injection5.3 Medium
- mintplex-labs mintplex-labs/anything-llm, mintplex-labs\/anything-llm, mintplexlabs anythingllm +2 moreSSRF vulnerability in mintplex-labs/anything-llm7.7 High
- crmebSQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive...7.5 High
- cyrusimap cyrus imapCyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause...6.5 Medium
- samsung exynos 1080 firmware, exynos 1280 firmware, exynos 1330 firmware +8 more +10 moreAn issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor,...5.9 Medium
- linuxkeys: Fix linking a duplicate key to a keyring's assoc_array5.7 Medium
- go standard library net/netip, golang go +1 moreUnexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip9.8 Critical
- go standard library archive/zip, golang go +1 moreMishandling of corrupt central directory record in archive/zip5.5 Medium
- bakery online ordering system project online ordering system, itsourcecode bakery online ordering system +1 moreitsourcecode Bakery Online Ordering System index.php sql injection5.3 Medium
- audimex audimexeeCross Site Scripting vulnerability in audimex audimexEE v.15.1.2 and fixed in 15.1.3.9 allows a...5.4 Medium
- lylme spageLyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.9.1 Critical
- netty netty-incubator-codec-ohttpnetty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces5.9 Medium
- envoyproxy envoyEnvoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete()5.9 Medium
- envoyproxy envoyEnvoy crashes in QuicheDataReader::PeekVarInt62Length()5.9 Medium
- envoyproxy envoyEnvoy can enter an endless loop while decompressing Brotli data with extra input7.5 High
- envoyproxy envoyEnvoy affected by a crash (use-after-free) in EnvoyQuicServerStream5.9 Medium
- envoyproxy envoyEnvoy can crash due to uncaught nlohmann JSON exception7.5 High
- envoyproxy envoyEnvoy OOM vector from HTTP async client with unbounded response buffer for mirror response5.7 Medium
- beyondtrust beyondinsightInformation Disclosure in BeyondInsight4.3 Medium
- beyondtrust beyondinsightSSRF In BeyondInsight4.8 Medium
- envoyproxy envoyEnvoy incorrectly accepts HTTP 200 response for entering upgrade mode5.9 Medium
- railsActionText ContentAttachment can Contain Unsanitized HTML6.1 Medium
- railsAction Pack is missing security headers on non-HTML responses5.4 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreImproper Access Control in gaizhenbiao/chuanhuchatgpt7.5 High
- moveaddons move addons for elementorWordPress Move Addons for Elementor plugin <= 1.2.9 - Broken Access Control vulnerability5.3 Medium
- spiffy plugins calendar, spiffyplugins spiffy calendar +1 moreWordPress Spiffy Calendar plugin <= 4.9.10 - Broken Access Control vulnerability5.4 Medium
- rt easy builder – advanced addons for elementor, risethemes rt easy builder +1 moreWordPress RT Easy Builder plugin <= 2.0 - Broken Access Control vulnerability4.3 Medium
- prince integrate google driveWordPress Integrate Google Drive plugin <= 1.3.93 - Broken Access Control vulnerability5.3 Medium
- picture-gallery picture galleryWordPress Picture Gallery plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- netgsmWordPress Netgsm plugin <= 2.9.19 - Broken Access Control vulnerability7.5 High
- code parrots easy forms for mailchimpWordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerability7.5 High
- homebrew janJan path traversal vulnerability9.8 Critical
- homebrew janJan path traversal vulnerability9.8 Critical
- homebrew janJan path traversal vulnerability7.5 High
- Show moreLoading…