CVEs published in June 2024
3,276 vulnerabilities, 312 critical, 13 exploited.
- bulkgate sms plugin for woocommerceWordPress BulkGate SMS Plugin for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability5.4 Medium
- technovama quotes for woocommerceWordPress Quotes for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability4.3 Medium
- metagauss profilegridWordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerability4.3 Medium
- prince integrate google driveWordPress Integrate Google Drive plugin <= 1.3.3 - Broken Access Control vulnerability5.4 Medium
- stylemix pearl – header builderWordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion6.5 Medium
- codename065 download managerDownload Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes6.4 Medium
- bdthemes element pack, element pack – widgets, templates & addons for elementor +1 moreElement Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events6.4 Medium
- line corporation client for ios, linecorp line +1 moreThe in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS)...6.1 Medium
- dell cpg bios, g7 7500 firmware, g7 7700 firmware +12 more +14 moreDell Client BIOS contains an Out-of-bounds Write vulnerability. A local authenticated malicious...4.7 Medium
- dell cpg bios, g3 3500 firmware, g5 5500 firmware +13 more +15 moreDell Client Platform contains an incorrect authorization vulnerability. An attacker with physical...6.8 Medium
- heateor sassy social share, social rocket sharing plugin, unknown social sharing plugin +2 moreSassy social share < 3.3.63 Admin+ Stored Cross-Site scripting6.1 Medium
- reputeinfosystems arforms, unknown arforms - premium wordpress form builder plugin, reputeinfosystems arforms form builder +2 moreArforms < 6.4.1 - Reflected XSS6.3 Medium
- badhonrocks divi torque lite – divi theme, divi builder & extra themeDivi Torque Lite – Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload6.4 Medium
- fsas technologies inc. ipcom ex2 series (v01l0x series), ipcom ve2 series, fujitsu ipcom ex2 sc 3500 firmware +1 more +3 moreUse of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and...5.3 Medium
- custom field suite project field suite, matt gibbs custom field suite +1 moreCustom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_content]6.4 Medium
- codexpert codesigner – all in one elementor woocommerce builderCoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting4.4 Medium
- contrid slideshow gallery liteSlideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection8.1 High
- buddypressBuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- parisneo lollms, parisneo/lollms +1 moreLFI Vulnerability due to Lack of Path Sanitization in parisneo/lollms9.1 Critical
- elecom wrc-x5400gs-b, wrc-x5400gsa-b +1 moreOS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0...6.8 Medium
ndpiOSS-FuzzUNKNOWN READ in ndpi_search_zoomNo scoreminizOSS-FuzzHeap-buffer-overflow in mz_zip_mem_read_funcNo scoreminizOSS-FuzzHeap-buffer-overflow in mz_zip_mem_read_funcNo scorelibicalOSS-FuzzUse-of-uninitialized-value in icalmemory_strdupNo score- twcmsCross Site Scripting vulnerability in TWCMS v.2.0.3 allows a remote attacker to execute arbitrary...6.1 Medium
- wvp gb28181 pro, wvp-pro gb28181 +1 moreAn access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate...8.8 High
- summernoteSummerNote Cross Site Scripting Vulnerability6.1 Medium
- rmqttRMQTT Broker 0.4.0 allows remote attackers to cause a Denial of Service (daemon crash) via a...7.5 High
- boelter blue system managementSQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to...9.1 Critical
- gfx-rs naga, wgpu +1 morenaga v0.14.0 was discovered to contain a stack overflow via the component /wgsl/parse/mod.rs.9.8 Critical
- ppgo jobs project jobsInsecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows...6.3 Medium
- wvp gb28181 pro, wvp-pro gb28181 +1 moreAn access control issue in Wvp GB28181 Pro 2.0 allows users to continue to access information in...6.5 Medium
- monoprice select mini 3d printer v2 firmwareImproper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows...5.5 Medium
- itssglobal imlogA cross-site scripting (XSS) vulnerability in the User Maintenance section of ITSS iMLog v1.307...5.4 Medium
github.com/vektah/gqlparserGo,github.com/vektah/gqlparser/v2Go +1 moregqlparser denial of service vulnerability via the parserDirectives function3.7 Lowlinux-awsUbuntu,linux-oracleUbuntu +1 morelinux-aws, linux-oracle vulnerabilitiesNo score- jupyter server proxy, jupyterhub jupyter-server-proxy, jupyter server proxy +2 moreJupyter Server Proxy has a reflected XSS issue in host parameter9.7 Critical
- google chrome, fedoraproject fedora +1 moreUse after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreHeap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote...8.8 High
- google chrome, fedoraproject fedora +1 moreInappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a...6.5 Medium
- google chrome, fedoraproject fedora +1 moreUse after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 morePolicy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass...6.5 Medium
- google chrome, fedoraproject fedora +1 moreInappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed...6.5 Medium
- google chrome, fedoraproject fedora +1 moreType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform...8.8 High
- google chrome, fedoraproject fedora +1 moreType Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreInappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an...8.8 High
- Show moreLoading…