CVEs published in June 2024
3,276 vulnerabilities, 312 critical, 13 exploited.
- quantumcloud ai infographic makerInfographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update4.3 Medium
- themeisle woody code snippets – insert php, css, js, and header/footer scripts, webcraftic woody ad snippets +1 moreWoody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution9.9 Critical
- gloriafood restaurant menu – food ordering system – table reservation, oracle restaurant menu - food ordering system - table reservation +1 moreRestaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpweb woocommerce - social login, woocommerce social login +1 moreWooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection9.8 Critical
- wpweb woocommerce - social login, wpwebelite woocommerce social login +1 moreWooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness6.5 Medium
- fooevents, fooevents for woocommerce +1 moreFooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload7.1 High
- jegtheme jeg elementor kit, jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpress +1 moreJeg Elementor Kit <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets6.4 Medium
- popupbuilder popup builder – create highly converting, mobile friendly marketing popups., sygnoos popup builder +1 morePopup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure8.1 High
- tagdiv newspaperNewspaper <= 12.6.5 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta5.5 Medium
- tagdiv composertagDiv Composer <= 4.8 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- wpmet elementskit, elementskit pro +1 moreElementsKit Elementor addons and Templates Library <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets6.4 Medium
- tagdiv composertagDiv Composer <= 4.8 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Meta5.5 Medium
- sygnoos popup builder, popupbuilder popup builder – create highly converting, mobile friendly marketing popups. +1 morePopup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions7.4 High
gnome-settings-daemonDebianMismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through...4.3 Medium- ffmpegFFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.6.2 Medium
- ffmpegAn integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows...6.5 Medium
- ffmpegFFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of...9.1 Critical
qt6-qtbaseopenEuler,qt6-baseopenSUSE,qt6-base-docsopenSUSE +2 moreqt6-qtbase security update6.2 Medium- ffmpegFFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec...7.8 High
- node.js, nodejs node +1 moreDue to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a...8.1 High
- matteoenna website content in page or postWebsite Content in Page or Post < 2024.04.09 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- suse opensuse tumbleweedmlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable8.5 High
- No product listedHyperKitty-web-1.3.5-1.1 on GA mediaNo score
curlopenSUSEcurl-7.79.1-1.1 on GA mediaNo score- No product listedlibjavamapscript-7.6.3-1.2 on GA mediaNo score
bcm43xx-firmwareopenSUSE,linux-firmware-raspi2Ubuntu +1 moreCertain Cypress (and Broadcom) Wireless Combo chips such as CYW43455, when a 2021-01-26 Bluetooth...8.8 HighqemuopenSUSEqemu-6.1.0-32.1 on GA mediaNo score- No product listedjupyter-notebook-6.2.0-1.4 on GA mediaNo score
libwebpopenSUSElibwebp-devel-1.2.0-1.4 on GA mediaNo scoretidyopenSUSElibtidy-devel-5.2.0-2.3 on GA mediaNo score- No product listedpython3-jupyter_notebook-4.2.3-1.1 on GA mediaNo score
virtualboxopenSUSEpython-virtualbox-5.1.10-2.5 on GA mediaNo scoreBotanopenSUSElibbotan-1_10-1-1.10.13-1.1 on GA mediaNo scorelibreofficeopenSUSElibreoffice-5.2.3.3-2.2 on GA mediaNo score- No product listedruby2.2-rubygem-puppet-3.8.7-2.2 on GA mediaNo score
MozillaFirefoxopenSUSE,firefox-esropenSUSE +1 moreMozillaFirefox-50.1.0-1.1 on GA mediaNo score- hcl software dryice optibot reset stationHCL DRYiCE Optibot Reset Station is impacted by an Unused Parameter in the web application2.9 Low
- netapp storagegrid, storagegrid (formerly storagegrid webscale) +1 moreCVE-2024-21988 SSH Cryptographic Implementation Vulnerability in StorageGRID (formerly StorageGRID Webscale)5.3 Medium
- hcl software dryice optibot reset stationHCL DRYiCE Optibot Reset Station is impacted by a missing Strict Transport Security Header3.7 Low
- guangdong baolun electronics ip network broadcasting service platformGuangdong Baolun Electronics IP Network Broadcasting Service Platform maps sql injection6.9 Medium
- treyww myfinancesMyFinances Allows Unauthorized Access to Other Customer Data6.5 Medium
- mlewand open link, ckeditor-plugin-openlink +1 moreThe Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality6.1 Medium
- rockwell automation factorytalk® view se, rockwellautomation factorytalk view +1 moreRockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File Permissions8.5 High
- rockwell automation 1756-en4, compact guardlogix 5380, compactlogix 5380 +14 more +16 moreRockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers8.3 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's events information leaked with shared calendars on recurrence exceptions3.5 Low
- kiteworks security-advisories, nextcloud user oidc +1 moreNextcloud user_oidc's ID4me does not validate signature or expiration5.4 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreCode injection in Nextcloud Desktop Client for macOS3.8 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's users can delete old versions of read-only shared files3.5 Low
- nextcloud deck, kiteworks security-advisories +1 moreNextcloud Deck can access comments and attachments of deleted cards4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server can reshare read&share only folder with more permissions8.1 High
- Show moreLoading…