3uu–Shariff Wrapper
  The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘shariff’ shortcode in all versions up to, and including, 4.6.13 due to insufficient input sanitization and output escaping on user supplied attributes such as ‘borderradius’ and ‘timestamp’. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 6.4 CVE-2024-2695
security@wordfence.com
security@wordfence.com A WP Life–Album Gallery WordPress Gallery
  Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: from n/a through 1.5.7. 2024-06-10 4.3 CVE-2024-35720
audit@patchstack.com A WP Life–Media Slider Photo Sleder, Video Slider, Link Slider, Carousal Slideshow
  Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9. 2024-06-10 4.3 CVE-2024-35717
audit@patchstack.com acurax — under_construction_/_maintenance_mode
  Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6. 2024-06-10 5.3 CVE-2024-35749
audit@patchstack.com AddonMaster–Load More Anything
  Missing Authorization vulnerability in AddonMaster Load More Anything.This issue affects Load More Anything: from n/a through 3.3.3. 2024-06-11 5.4 CVE-2024-24704
audit@patchstack.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-20769
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-20784
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26036
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a malicious form. 2024-06-13 5.4 CVE-2024-26037
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the vulnerability. 2024-06-13 5.4 CVE-2024-26039
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the vulnerability. 2024-06-13 5.4 CVE-2024-26053
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26054
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the malicious script. 2024-06-13 5.4 CVE-2024-26055
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form that triggers the malicious script. 2024-06-13 5.4 CVE-2024-26057
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link. 2024-06-13 5.4 CVE-2024-26058
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26060
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26066
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26068
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26070
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26071
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that causes the vulnerable script to execute. 2024-06-13 5.4 CVE-2024-26072
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26074
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26075
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26077
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26078
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26081
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26082
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26083
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26085
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26088
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26092
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26093
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26095
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26110
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26111
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26113
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26114
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26115
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26116
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26121
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-26123
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-34119
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-34120
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36141
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36142
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36143
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36144
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36146
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36147
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36148
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36149
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36150
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36152
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36153
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36154
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36155
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36156
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36158
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36159
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36160
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36161
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36162
psirt@adobe.com adobe — experience_manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 4.8 CVE-2024-26049
psirt@adobe.com Adobe–Acrobat Mobile Sign Android
  Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to access files and directories that are outside the restricted directory and also to overwrite arbitrary files. Exploitation of this issue does not requires user interaction and attack complexity is high. 2024-06-13 6.3 CVE-2024-34129
psirt@adobe.com Adobe–Acrobat Mobile Sign Android
  Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access confidential information. Exploitation of this issue does not require user interaction. 2024-06-13 5.5 CVE-2024-34130
psirt@adobe.com Adobe–Adobe Commerce
  Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted request to the server, which could then cause the server to execute arbitrary code. Exploitation of this issue does not require user interaction. 2024-06-13 6.5 CVE-2024-34111
psirt@adobe.com Adobe–Adobe Commerce
  Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to gain unauthorized access or perform actions with the privileges of another user. Exploitation of this issue does not require user interaction. 2024-06-13 5.3 CVE-2024-34106
psirt@adobe.com Adobe–Adobe Commerce
  Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction. 2024-06-13 5.3 CVE-2024-34107
psirt@adobe.com Adobe–Adobe Commerce
  Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 4.8 CVE-2024-34105
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26086
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, as the victim needs to visit a web page with a maliciously crafted script. 2024-06-13 5.4 CVE-2024-26089
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link. 2024-06-13 5.4 CVE-2024-26090
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that causes the vulnerable script to execute. 2024-06-13 5.4 CVE-2024-26091
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-26117
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, as the victim needs to visit a web page with a maliciously crafted script. 2024-06-13 5.4 CVE-2024-36151
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36157
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36163
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36164
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36165
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36166
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36167
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36168
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36169
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36170
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36171
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36172
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36173
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36174
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36175
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36176
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36177
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36178
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36179
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36180
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, typically in the form of convincing a victim to visit a maliciously crafted web page or to interact with a maliciously modified DOM element within the application. 2024-06-13 5.4 CVE-2024-36181
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36182
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a malicious form. 2024-06-13 5.4 CVE-2024-36183
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a malicious link or to submit a specially crafted form. 2024-06-13 5.4 CVE-2024-36184
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36185
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36186
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36187
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36188
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36189
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form that triggers the vulnerability. 2024-06-13 5.4 CVE-2024-36190
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36191
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36192
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36193
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36194
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36195
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36196
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the vulnerability. 2024-06-13 5.4 CVE-2024-36197
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36198
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36199
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36200
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36201
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36202
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36203
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36204
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36205
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-36206
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36207
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36208
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36209
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-36210
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-36211
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36212
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36213
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36214
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36215
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim’s browser. 2024-06-13 5.4 CVE-2024-36216
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36217
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36218
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36219
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the malicious script. 2024-06-13 5.4 CVE-2024-36220
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36221
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the vulnerability. 2024-06-13 5.4 CVE-2024-36222
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form that causes the vulnerable script to execute. 2024-06-13 5.4 CVE-2024-36224
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36225
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a malicious form. 2024-06-13 5.4 CVE-2024-36227
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link or to submit a form that triggers the vulnerability. 2024-06-13 5.4 CVE-2024-36228
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a malicious form. 2024-06-13 5.4 CVE-2024-36229
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form that causes the execution of the malicious script. 2024-06-13 5.4 CVE-2024-36230
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form that causes the execution of the malicious script. 2024-06-13 5.4 CVE-2024-36231
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. 2024-06-13 5.4 CVE-2024-36232
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a victim to click on a malicious link. 2024-06-13 5.4 CVE-2024-36233
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form that triggers the vulnerability. 2024-06-13 5.4 CVE-2024-36234
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a specially crafted link or to submit a form that causes the execution of the malicious script. 2024-06-13 5.4 CVE-2024-36235
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link. 2024-06-13 5.4 CVE-2024-36236
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue typically requires user interaction, such as convincing a user to click on a malicious link or to interact with a maliciously crafted web page. 2024-06-13 5.4 CVE-2024-36238
psirt@adobe.com Adobe–Adobe Experience Manager
  Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim’s browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a specially crafted link. 2024-06-13 5.4 CVE-2024-36239
psirt@adobe.com Adobe–Audition
  Audition versions 24.2, 23.6.4 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-06-13 5.5 CVE-2024-30276
psirt@adobe.com Adobe–Audition
  Audition versions 24.2, 23.6.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service condition. An attacker could exploit this vulnerability to crash the application, leading to a denial of service. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-06-13 5.5 CVE-2024-30285
psirt@adobe.com Adobe–ColdFusion
  ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawed implementation that compromises the confidentiality of password data. An attacker could exploit this weakness to decrypt or guess passwords, potentially gaining unauthorized access to protected resources. Exploitation of this issue does not require user interaction. 2024-06-13 6.2 CVE-2024-34113
psirt@adobe.com Adobe–Creative Cloud Desktop
  Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to load and execute malicious libraries, leading to arbitrary file delete. Exploitation of this issue requires user interaction. 2024-06-13 5.5 CVE-2024-34116
psirt@adobe.com Adobe–Media Encoder
  Media Encoder versions 23.6.5, 24.3 and earlier Answer: are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-06-13 5.5 CVE-2024-30278
psirt@adobe.com Afzal Multani–WP Clone Menu
  Missing Authorization vulnerability in Afzal Multani WP Clone Menu.This issue affects WP Clone Menu: from n/a through 1.0.1. 2024-06-12 5.4 CVE-2023-38395
audit@patchstack.com aimeos–ai-client-html
  The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn’t succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue. 2024-06-11 5.3 CVE-2024-37296
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com aimeos–aimeos-core
  Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch. 2024-06-11 5.5 CVE-2024-37294
security-advisories@github.com Anders Norn–Radcliffe 2
  Missing Authorization vulnerability in Anders Norén Radcliffe 2.This issue affects Radcliffe 2: from n/a through 2.0.17. 2024-06-11 5.3 CVE-2024-35685
audit@patchstack.com apple — macos
  An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.5. A website may be able to track the websites a user visited in Safari private browsing mode. 2024-06-10 5.3 CVE-2022-32933
product-security@apple.com apple — macos
  The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Ventura 13.6.5, macOS Monterey 12.7.4. An app may be able to access sensitive user data. 2024-06-10 5.5 CVE-2023-40389
product-security@apple.com
product-security@apple.com apple — macos
  This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data. 2024-06-10 5.5 CVE-2024-27792
product-security@apple.com Aspose.cloud Marketplace–Aspose.Words Exporter
  Missing Authorization vulnerability in Aspose.Cloud Marketplace Aspose.Words Exporter.This issue affects Aspose.Words Exporter: from n/a through 6.3.1. 2024-06-11 4.3 CVE-2024-32146
audit@patchstack.com ASUS–Download Master
  The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks. 2024-06-14 4.8 CVE-2024-31159
twcert@cert.org.tw
twcert@cert.org.tw ASUS–Download Master
  The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrative privilege can insert JavaScript code to the parameter for Stored Cross-site scripting attacks. 2024-06-14 4.8 CVE-2024-31160
twcert@cert.org.tw
twcert@cert.org.tw Awesome Support Team–Awesome Support
  Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.5. 2024-06-12 5.3 CVE-2023-51537
audit@patchstack.com baden03–Collapse-O-Matic
  The Collapse-O-Matic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘expand’ and ‘expandsub’ shortcode in all versions up to, and including, 1.8.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 6.4 CVE-2024-4095
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com badhonrocks–Divi Torque Lite Divi Theme and Extra Theme
  The Divi Torque Lite – Divi Theme and Extra Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘support_unfiltered_files_upload’ function in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 6.4 CVE-2024-5892
security@wordfence.com
security@wordfence.com
security@wordfence.com Bastianon Massimo–WP GPX Map
  Missing Authorization vulnerability in Bastianon Massimo WP GPX Map.This issue affects WP GPX Map: from n/a through 1.7.08. 2024-06-12 4.3 CVE-2023-44234
audit@patchstack.com BBS e-Theme–BBS e-Popup
  Missing Authorization vulnerability in BBS e-Theme BBS e-Popup.This issue affects BBS e-Popup: from n/a through 2.4.5. 2024-06-14 6.5 CVE-2023-36504
audit@patchstack.com bdthemes–Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows)
  The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s Creative Button widget in all versions up to, and including, 5.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 6.4 CVE-2024-3925
security@wordfence.com
security@wordfence.com BeyondTrust–BeyondInsight PasswordSafe
  A medium severity vulnerability in BIPS has been identified where an authenticated attacker with high privileges can access the SSH private keys via an information leak in the server response. 2024-06-11 5.9 CVE-2024-5813
13061848-ea10-403d-bd75-c83a022c2891 bradvin–FooGallery Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel
  The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via album gallery custom URLs in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-14 6.4 CVE-2024-2122
security@wordfence.com
security@wordfence.com Brainstorm Force–ProjectHuddle Client Site
  Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34. 2024-06-14 4.3 CVE-2023-51376
audit@patchstack.com brainstormforce–Elementor Header & Footer Builder
  The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url attribute within the plugin’s Site Title widget in all versions up to, and including, 1.6.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-13 6.4 CVE-2024-5757
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com Brett Shumaker–Simple Staff List
  Missing Authorization vulnerability in Brett Shumaker Simple Staff List.This issue affects Simple Staff List: from n/a through 2.2.4. 2024-06-12 4.3 CVE-2023-51526
audit@patchstack.com britner–Gutenberg Blocks with AI by Kadence WP Page Builder Features
  The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parameter in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-14 6.4 CVE-2024-4863
security@wordfence.com
security@wordfence.com
security@wordfence.com Bryan Lee–Kingkong Board
  Missing Authorization vulnerability in Bryan Lee Kingkong Board.This issue affects Kingkong Board: from n/a through 2.1.0.2. 2024-06-14 6.3 CVE-2023-36694
audit@patchstack.com buddypress–BuddyPress
  The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 6.4 CVE-2024-4892
security@wordfence.com
security@wordfence.com
security@wordfence.com BulkGate–BulkGate SMS Plugin for WooCommerce
  Missing Authorization vulnerability in BulkGate BulkGate SMS Plugin for WooCommerce.This issue affects BulkGate SMS Plugin for WooCommerce: from n/a through 3.0.2. 2024-06-12 5.4 CVE-2023-51679
audit@patchstack.com Business Directory Team–Business Directory Plugin
  Missing Authorization vulnerability in Business Directory Team Business Directory Plugin.This issue affects Business Directory Plugin: from n/a through 6.3.9. 2024-06-14 5.4 CVE-2023-51516
audit@patchstack.com Buy Me a Coffee–Buy Me a Coffee
  Missing Authorization vulnerability in Buy Me a Coffee.This issue affects Buy Me a Coffee: from n/a through 3.7. 2024-06-12 4.3 CVE-2023-25030
audit@patchstack.com Code for Recovery–12 Step Meeting List
  Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List.This issue affects 12 Step Meeting List: from n/a through 3.14.28. 2024-06-10 4.3 CVE-2024-22296
audit@patchstack.com Codection–Import and export users and customers
  Missing Authorization vulnerability in Codection Import and export users and customers.This issue affects Import and export users and customers: from n/a through 1.26.5. 2024-06-11 5.4 CVE-2024-34815
audit@patchstack.com codename065–Download Manager
  The Download Manager Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpdm_user_dashboard, wpdm_package, wpdm_packages, wpdm_search_result, and wpdm_tag shortcodes in all versions up to, and including, 3.2.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 6.4 CVE-2024-5266
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com codename065–Download Manager
  The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user’s Display Name in all versions up to, and including, 3.2.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires social engineering to successfully exploit, and the impact would be very limited due to the attacker requiring a user to login as the user with the injected payload for execution. 2024-06-12 4.4 CVE-2024-1766
security@wordfence.com
security@wordfence.com codexpert–CoDesigner The Most Compact and User-Friendly Elementor WooCommerce Builder
  The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s Shop Slider, Tabs Classic, and Image Comparison widgets in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 6.4 CVE-2024-4564
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com Comtrend–Comtrend WLD71-T1_v2.0.201820
  Cross-Site Request Forgery vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application to which he is authenticated. 2024-06-10 6.5 CVE-2024-5786
cve-coordination@incibe.es Contact List PRO–Contact List Easy Business Directory, Staff Directory and Address Book Plugin
  Missing Authorization vulnerability in Contact List PRO Contact List – Easy Business Directory, Staff Directory and Address Book Plugin.This issue affects Contact List – Easy Business Directory, Staff Directory and Address Book Plugin: from n/a through 2.9.87. 2024-06-11 5.3 CVE-2024-34821
audit@patchstack.com contact_form_builder_project — contact_form_builder
  Improper Restriction of Excessive Authentication Attempts vulnerability in wpdevart Contact Form Builder, Contact Widget allows Functionality Bypass.This issue affects Contact Form Builder, Contact Widget: from n/a through 2.1.7. 2024-06-10 5.3 CVE-2024-35747
audit@patchstack.com Copymatic–Copymatic AI Content Writer & Generator
  Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.9. 2024-06-11 6.5 CVE-2024-35716
audit@patchstack.com crate–crate
  CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint (port 4200) permits client-initiated renegotiation. In this scenario, an attacker can exploit this feature to repeatedly request renegotiation of security parameters during an ongoing TLS session. This flaw could lead to excessive consumption of CPU resources, resulting in potential server overload and service disruption. The vulnerability was confirmed using an openssl client where the command `R` initiates renegotiation, followed by the server confirming with `RENEGOTIATING`. This vulnerability allows an attacker to perform a denial of service attack by exhausting server CPU resources through repeated TLS renegotiations. This impacts the availability of services running on the affected server, posing a significant risk to operational stability and security. TLS 1.3 explicitly forbids renegotiation, since it closes a window of opportunity for an attack. Version 5.7.2 of CrateDB contains the fix for the issue. 2024-06-13 5.3 CVE-2024-37309
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com Deepak anand–WP Dummy Content Generator
  Missing Authorization vulnerability in Deepak anand WP Dummy Content Generator.This issue affects WP Dummy Content Generator: from n/a through 2.3.0. 2024-06-14 5.3 CVE-2023-37394
audit@patchstack.com Dell–CPG BIOS
  Dell Client Platform contains an incorrect authorization vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by bypassing BIOS authorization to modify settings in the BIOS. 2024-06-12 6.8 CVE-2024-0160
security_alert@emc.com Dell–CPG BIOS
  Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. 2024-06-13 5.1 CVE-2024-32856
security_alert@emc.com Dell–CPG BIOS
  Dell Client BIOS contains an Out-of-bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to platform denial of service. 2024-06-12 4.7 CVE-2024-28970
security_alert@emc.com Dell–Secure Connect Gateway-Application
  Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal enable REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain Internal APIs applicable only for Admin Users on the application’s backend database that could potentially allow an unauthorized user access to restricted resources and change of state. 2024-06-13 5.4 CVE-2024-28965
security_alert@emc.com Dell–Secure Connect Gateway-Application
  Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application’s backend database that could potentially allow an unauthorized user access to restricted resources and change of state. 2024-06-13 5.4 CVE-2024-28966
security_alert@emc.com Dell–Secure Connect Gateway-Application
  Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application’s backend database that could potentially allow an unauthorized user access to restricted resources and change of state. 2024-06-13 5.4 CVE-2024-28967
security_alert@emc.com Dell–Secure Connect Gateway-Application
  Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST APIs (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application’s backend database that could potentially allow an unauthorized user access to restricted resources and change of state. 2024-06-13 5.4 CVE-2024-28968
security_alert@emc.com Dell–Secure Connect Gateway-Application
  Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal assets REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application’s backend database causing potential unauthorized access and modification of application data. 2024-06-13 5.4 CVE-2024-29168
security_alert@emc.com Dell–Secure Connect Gateway-Application
  Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application’s backend database causing potential unauthorized access and modification of application data. 2024-06-13 5.4 CVE-2024-29169
security_alert@emc.com Dell–Secure Connect Gateway-Application
  Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API (if enabled by Admin user from UI). A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs applicable only for Admin Users on the application’s backend database that could potentially allow an unauthorized user access to restricted resources. 2024-06-13 4.3 CVE-2024-28969
security_alert@emc.com devitemsllc–ShopLentor WooCommerce Builder for Elementor & Gutenberg +12 Modules All in One Solution (formerly WooLentor)
  The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s WL: Product Horizontal Filter widget in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-5530
security@wordfence.com
security@wordfence.com
security@wordfence.com dgwyer–Simple Sitemap Create a Responsive HTML Sitemap
  The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the ‘admin_notices’ hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2024-06-14 4.3 CVE-2023-6492
security@wordfence.com
security@wordfence.com Discourse–WP Discourse
  Missing Authorization vulnerability in Discourse WP Discourse.This issue affects WP Discourse: from n/a through 2.5.1. 2024-06-11 4.3 CVE-2024-35168
audit@patchstack.com Elastic–Elasticsearch
  It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body  restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search restrictions are not enforced during cross cluster search operations and search results may include documents and terms that should not be returned. This issue only affects the API key based security model for remote clusters https://www.elastic.co/guide/en/elasticsearch/reference/8.14/remote-clusters.html#remote-clusters-security-models  that was previously a beta feature and is released as GA with 8.14.0 2024-06-12 6.5 CVE-2024-23445
bressers@elastic.co Elastic–Elasticsearch
  A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature. 2024-06-13 4.9 CVE-2024-37280
bressers@elastic.co Elastic–Kibana
  An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. 2024-06-14 6.1 CVE-2024-23442
bressers@elastic.co Elastic–Kibana
  A flaw was discovered in Kibana, allowing view-only users of alerting to use the run_soon API making the alerting rule run continuously, potentially affecting the system availability if the alerting rule is running complex queries. 2024-06-13 4.3 CVE-2024-37279
bressers@elastic.co Elementor–Elementor Website Builder
  Missing Authorization vulnerability in Elementor Elementor Website Builder.This issue affects Elementor Website Builder: from n/a through 3.13.2. 2024-06-11 4.3 CVE-2023-33922
audit@patchstack.com elespare–Elespare News, Magazine and Blog Elements & Blog Addons for Elementor with Header Footer Builder. One Click Import: No Coding Required!
  The Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Horizontal Nav Menu’ widget in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-13 6.4 CVE-2024-4615
security@wordfence.com
security@wordfence.com emlog — emlog
  Emlog pro2.3 is vulnerable to Cross Site Request Forgery (CSRF) via twitter.php which can be used with a XSS vulnerability to access administrator information. 2024-06-10 6.5 CVE-2024-31612
cve@mitre.org ExpressTech–Quiz And Survey Master
  Missing Authorization vulnerability in ExpressTech Quiz And Survey Master.This issue affects Quiz And Survey Master: from n/a through 8.1.16. 2024-06-14 5.3 CVE-2023-51507
audit@patchstack.com Fastly–Fastly
  Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25. 2024-06-11 5.3 CVE-2024-34768
audit@patchstack.com Fat Rat–Fat Rat Collect
  Missing Authorization vulnerability in Fat Rat Fat Rat Collect.This issue affects Fat Rat Collect: from n/a through 2.6.7. 2024-06-14 4.3 CVE-2023-35045
audit@patchstack.com Fortinet–FortiOS
  A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.12 and 6.4.6 through 6.4.15 and 6.2.9 through 6.2.16 and 6.0.13 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted CLI commands. 2024-06-11 6.7 CVE-2023-46720
psirt@fortinet.com Fortinet–FortiOS
  A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file. 2024-06-11 6.8 CVE-2024-23111
psirt@fortinet.com Fortinet–FortiPortal
  A improper neutralization of special elements used in an sql command (‘sql injection’) in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality. 2024-06-11 4.3 CVE-2024-31495
psirt@fortinet.com Fortinet–FortiSOAR
  Multiple improper neutralization of special elements used in SQL commands (‘SQL Injection’) vulnerabilities [CWE-89] in FortiSOAR 7.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters. 2024-06-11 6.5 CVE-2023-23775
psirt@fortinet.com FunnelKit–FunnelKit Checkout
  Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3. 2024-06-12 5.4 CVE-2023-51671
audit@patchstack.com FunnelKit–FunnelKit Checkout
  Missing Authorization vulnerability in FunnelKit FunnelKit Checkout.This issue affects FunnelKit Checkout: from n/a through 3.10.3. 2024-06-12 4.3 CVE-2023-51670
audit@patchstack.com futuriowp–Futurio Extra
  The Futurio Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘header_size’ attribute within the Advanced Text Block widget in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-5646
security@wordfence.com
security@wordfence.com
security@wordfence.com galdub–Folders Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
  The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders Pro via the ‘handle_folders_file_upload’ function. This makes it possible for authenticated attackers, with author access and above, to upload files to arbitrary locations on the server. 2024-06-14 4.3 CVE-2024-2023
security@wordfence.com
security@wordfence.com
security@wordfence.com Gangesh Matta–Simple Org Chart
  Missing Authorization vulnerability in Gangesh Matta Simple Org Chart.This issue affects Simple Org Chart: from n/a through 2.3.4. 2024-06-12 5.3 CVE-2023-40603
audit@patchstack.com GitLab–GitLab
  An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using maliciously crafted file. 2024-06-12 6.5 CVE-2024-1495
cve@gitlab.com
cve@gitlab.com
cve@gitlab.com GitLab–GitLab
  An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab’s CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files. 2024-06-12 6.5 CVE-2024-1736
cve@gitlab.com
cve@gitlab.com
cve@gitlab.com GitLab–GitLab
  An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab’s Asana integration allowed an attacker to potentially cause a regular expression denial of service by sending specially crafted requests. 2024-06-12 6.5 CVE-2024-1963
cve@gitlab.com
cve@gitlab.com
cve@gitlab.com GitLab–GitLab
  A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances. 2024-06-12 4.4 CVE-2024-4201
cve@gitlab.com
cve@gitlab.com
cve@gitlab.com gloriafood–Restaurant Menu Food Ordering System Table Reservation
  The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode(s) in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 6.4 CVE-2024-1399
security@wordfence.com
security@wordfence.com gpriday–SiteOrigin Widgets Bundle
  The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s SiteOrigin Blog Widget in all versions up to, and including, 1.61.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-5090
security@wordfence.com
security@wordfence.com grpc–grpc-node
  @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22. 2024-06-10 5.3 CVE-2024-37168
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com HahnCreativeGroup–WP Translate
  Missing Authorization vulnerability in HahnCreativeGroup WP Translate.This issue affects WP Translate: from n/a through 5.3.0. 2024-06-11 5.4 CVE-2024-35663
audit@patchstack.com Happyforms–Happyforms
  Missing Authorization vulnerability in Happyforms.This issue affects Happyforms: from n/a through 1.25.10. 2024-06-11 5.3 CVE-2024-23521
audit@patchstack.com Harbor–Harbor
  Open Redirect in Harbor  <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site. 2024-06-10 4.3 CVE-2024-22244
security@vmware.com Hardik Chavada–Sticky Social Media Icons
  Missing Authorization vulnerability in Hardik Chavada Sticky Social Media Icons.This issue affects Sticky Social Media Icons: from n/a through 2.1. 2024-06-12 5.4 CVE-2023-40672
audit@patchstack.com Himalaya Saxena–Highcompress Image Compressor
  Missing Authorization vulnerability in Himalaya Saxena Highcompress Image Compressor.This issue affects Highcompress Image Compressor: from n/a through 6.0.0. 2024-06-12 6.5 CVE-2023-40209
audit@patchstack.com hiroaki-miyashita–Custom Field Template
  The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘cpt’ shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2023-6745
security@wordfence.com
security@wordfence.com hiroaki-miyashita–Custom Field Template
  The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-0627
security@wordfence.com
security@wordfence.com hiroaki-miyashita–Custom Field Template
  The Custom Field Template plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 via the ‘cft’ shortcode. This makes it possible for authenticated attackers with contributor access and above, to extract sensitive data including arbitrary post metadata. 2024-06-11 4.3 CVE-2023-6748
security@wordfence.com
security@wordfence.com hiroaki-miyashita–Custom Field Template
  The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. 2024-06-11 4.4 CVE-2024-0653
security@wordfence.com
security@wordfence.com Hitachi Energy–FOXMAN-UN
  A vulnerability exists in the FOXMAN-UN/UNEM server / APIGateway that if exploited allows a malicious user to perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account. 2024-06-11 6.5 CVE-2024-28022
cybersecurity@hitachienergy.com
cybersecurity@hitachienergy.com Hitachi Energy–FOXMAN-UN
  A vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even execute arbitrary code. 2024-06-11 5.7 CVE-2024-28023
cybersecurity@hitachienergy.com Huawei–HarmonyOS
  Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2024-06-14 6.8 CVE-2024-36499
psirt@huawei.com Huawei–HarmonyOS
  Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect integrity. 2024-06-14 5.6 CVE-2024-36501
psirt@huawei.com Huawei–HarmonyOS
  Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availability. 2024-06-14 5.9 CVE-2024-5465
psirt@huawei.com Huawei–HarmonyOS
  Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vulnerability may affect service confidentiality. 2024-06-14 4 CVE-2024-5464
psirt@huawei.com ibericode–MC4WP
  Missing Authorization vulnerability in ibericode MC4WP.This issue affects MC4WP: from n/a through 4.9.9. 2024-06-11 5.3 CVE-2023-51682
audit@patchstack.com IBM–Db2 for Linux, UNIX and Windows
  IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables by an authenticated user. IBM X-Force ID: 287613. 2024-06-12 6.5 CVE-2024-31881
psirt@us.ibm.com
psirt@us.ibm.com IBM–Db2 for Linux, UNIX and Windows
  IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-Force ID: 287612. 2024-06-12 5.3 CVE-2023-29267
psirt@us.ibm.com
psirt@us.ibm.com IBM–Db2 for Linux, UNIX and Windows
  IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 285246. 2024-06-12 5.3 CVE-2024-28762
psirt@us.ibm.com
psirt@us.ibm.com IBM–Jazz Reporting Service
  IBM Jazz Reporting Service 7.0.3 stores user credentials in plain clear text which can be read by an admin user. IBM X-Force ID: 283363. 2024-06-13 4.4 CVE-2024-25052
psirt@us.ibm.com
psirt@us.ibm.com IBM–Maximo Application Suite
  IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 279973. 2024-06-13 4 CVE-2024-22333
psirt@us.ibm.com
psirt@us.ibm.com
psirt@us.ibm.com ideaboxcreations–PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
  The PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute within the plugin’s Link Effects widget in all versions up to, and including, 2.7.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-13 6.4 CVE-2024-5787
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com If So Plugin–If-So Dynamic Content Personalization
  Missing Authorization vulnerability in If So Plugin If-So Dynamic Content Personalization.This issue affects If-So Dynamic Content Personalization: from n/a through 1.7.1. 2024-06-11 6.5 CVE-2024-34820
audit@patchstack.com itsourcecode–Document Management System
  A vulnerability classified as critical has been found in itsourcecode Document Management System 1.0. Affected is an unknown function of the file edithis.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268722 is the identifier assigned to this vulnerability. 2024-06-15 6.3 CVE-2024-6014
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com itsourcecode–Event Calendar
  A vulnerability has been found in itsourcecode Event Calendar 1.0 and classified as critical. Affected by this vulnerability is the function regConfirm/regDelete of the file process.php. The manipulation of the argument userId leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268699. 2024-06-15 6.3 CVE-2024-6009
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com itsourcecode–Online Book Store
  A vulnerability, which was classified as critical, was found in itsourcecode Online Book Store up to 1.0. Affected is an unknown function of the file /edit_book.php. The manipulation of the argument image leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268698 is the identifier assigned to this vulnerability. 2024-06-15 6.3 CVE-2024-6008
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com itsourcecode–Online Book Store
  A vulnerability was found in itsourcecode Online Book Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin_delete.php. The manipulation of the argument bookisbn leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268721 was assigned to this vulnerability. 2024-06-15 6.3 CVE-2024-6013
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com itsourcecode–Online House Rental System
  A vulnerability was found in itsourcecode Online House Rental System 1.0. It has been classified as critical. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-268458 is the identifier assigned to this vulnerability. 2024-06-14 6.3 CVE-2024-5981
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com itsourcecode–Online House Rental System
  A vulnerability classified as critical was found in itsourcecode Online House Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_user.php. The manipulation of the argument month_of leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268723. 2024-06-15 6.3 CVE-2024-6015
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com itsourcecode–Online Laundry Management System
  A vulnerability, which was classified as critical, has been found in itsourcecode Online Laundry Management System 1.0. Affected by this issue is some unknown functionality of the file admin_class.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268724. 2024-06-15 6.3 CVE-2024-6016
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com itsourcecode–Payroll Management System
  A vulnerability was found in itsourcecode Payroll Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file print_payroll.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-268142 is the identifier assigned to this vulnerability. 2024-06-12 6.3 CVE-2024-5898
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com jasonraimondi–url-to-png
  @jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright’s screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input URLs to be of protocol `http` or `https`. No known workarounds are available aside from upgrading. 2024-06-10 5.3 CVE-2024-37169
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com jegtheme–Jeg Elementor Kit
  The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sg_general_toggle_tab_enable and sg_accordion_style attributes within the plugin’s JKit – Tabs and JKit – Accordion widget, respectively, in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 6.4 CVE-2024-4479
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com jetmonsters–Stratum Elementor Widgets
  The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘label_years’ attribute within the Countdown widget in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 6.4 CVE-2024-5611
security@wordfence.com
security@wordfence.com
security@wordfence.com ladela–WordPress Online Booking and Scheduling Plugin Bookly
  The WordPress Online Booking and Scheduling Plugin – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Color Profile parameter in all versions up to, and including, 23.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with the staff member role and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-5584
security@wordfence.com
security@wordfence.com leap13–Premium Addons for Elementor
  The Premium Addons for Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via several parameters in all versions up to, and including, 4.10.33 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses and edits an injected element, and subsequently clicks the element with the mouse scroll wheel. 2024-06-12 4.4 CVE-2024-5553
security@wordfence.com
security@wordfence.com
security@wordfence.com Lim Kai Yang–Grab & Save
  Cross-Site Request Forgery (CSRF) vulnerability in Lim Kai Yang Grab & Save.This issue affects Grab & Save: from n/a through 1.0.4. 2024-06-12 4.3 CVE-2023-47845
audit@patchstack.com LINE Corporation–LINE client for iOS
  The in-app browser of LINE client for iOS versions below 14.9.0 contains a Universal XSS (UXSS) vulnerability. This vulnerability allows for cross-site scripting (XSS) where arbitrary JavaScript can be executed in the top frame from an embedded iframe on any displayed web site within the in-app browser. The in-app browser is usually opened by tapping on URLs contained in chat messages, and for the attack to be successful, the victim must trigger a click event on a malicious iframe. If an iframe embedded in any website can be controlled by an attacker, this vulnerability could be exploited to capture or alter content displayed in the top frame, as well as user session information. This vulnerability affects LINE client for iOS versions below 14.9.0 and does not affect other LINE clients such as LINE client for Android. Please update LINE client for iOS to version 14.9.0 or higher. 2024-06-12 6.1 CVE-2024-5739
dl_cve@linecorp.com MailerLite–MailerLite WooCommerce integration
  Missing Authorization vulnerability in MailerLite MailerLite – WooCommerce integration.This issue affects MailerLite – WooCommerce integration: from n/a through 2.0.8. 2024-06-11 4.3 CVE-2023-52227
audit@patchstack.com Mandrill–wpMandrill
  Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33. 2024-06-12 4.3 CVE-2023-47828
audit@patchstack.com Mattermost–Mattermost
  Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim’s system via custom URI schemes. 2024-06-14 4.7 CVE-2024-37182
responsibledisclosure@mattermost.com Matthias Pfefferle & Automattic–ActivityPub
  Missing Authorization vulnerability in Matthias Pfefferle & Automattic ActivityPub.This issue affects ActivityPub: from n/a through 1.0.5. 2024-06-11 6.5 CVE-2023-52199
audit@patchstack.com Maxime Schoeni–Sublanguage
  Missing Authorization vulnerability in Maxime Schoeni Sublanguage.This issue affects Sublanguage: from n/a through 2.9. 2024-06-14 5.4 CVE-2023-36695
audit@patchstack.com meowapps — database_cleaner
  Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Jordy Meow Database Cleaner allows Relative Path Traversal.This issue affects Database Cleaner: from n/a through 1.0.5. 2024-06-10 4.9 CVE-2024-35712
audit@patchstack.com Metagauss–ProfileGrid
  Missing Authorization vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid: from n/a through 5.6.6. 2024-06-12 4.3 CVE-2023-52117
audit@patchstack.com metersphere–metersphere
  MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system’s step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue. 2024-06-11 4 CVE-2024-37161
security-advisories@github.com mgibbs189–Custom Field Suite
  The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the ‘cfs[post_content]’ parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 6.4 CVE-2024-3559
security@wordfence.com
security@wordfence.com
security@wordfence.com Microsoft–Azure File Sync
  Microsoft Azure File Sync Elevation of Privilege Vulnerability 2024-06-11 4.4 CVE-2024-35253
secure@microsoft.com Microsoft–Azure Identity Library for .NET
  Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability 2024-06-11 5.5 CVE-2024-35255
secure@microsoft.com Microsoft–Microsoft Dynamics 365 (on-premises) version 9.1
  Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability 2024-06-11 5.7 CVE-2024-35263
secure@microsoft.com Microsoft–Microsoft Edge (Chromium-based)
  Microsoft Edge (Chromium-based) Spoofing Vulnerability 2024-06-13 5.4 CVE-2024-30058
secure@microsoft.com Microsoft–Microsoft Edge for iOS
  Microsoft Edge for iOS Spoofing Vulnerability 2024-06-13 5.4 CVE-2024-30057
secure@microsoft.com Microsoft–Microsoft Edge for iOS
  Microsoft Edge (Chromium-based) Spoofing Vulnerability 2024-06-13 4.3 CVE-2024-38083
secure@microsoft.com Microsoft–Microsoft Visual Studio 2017 version 15.9 (includes 15.0 – 15.8)
  Visual Studio Remote Code Execution Vulnerability 2024-06-11 4.7 CVE-2024-30052
secure@microsoft.com Microsoft–Microsoft Visual Studio 2022 version 17.10
  Visual Studio Elevation of Privilege Vulnerability 2024-06-11 6.7 CVE-2024-29060
secure@microsoft.com Microsoft–Windows 10 Version 1809
  Windows Distributed File System (DFS) Remote Code Execution Vulnerability 2024-06-11 6.7 CVE-2024-30063
secure@microsoft.com Microsoft–Windows 10 Version 1809
  Windows Container Manager Service Elevation of Privilege Vulnerability 2024-06-11 6.8 CVE-2024-30076
secure@microsoft.com Microsoft–Windows 10 Version 1809
  Windows Themes Denial of Service Vulnerability 2024-06-11 5.5 CVE-2024-30065
secure@microsoft.com Microsoft–Windows 10 Version 1809
  Winlogon Elevation of Privilege Vulnerability 2024-06-11 5.5 CVE-2024-30066
secure@microsoft.com Microsoft–Windows 10 Version 1809
  Winlogon Elevation of Privilege Vulnerability 2024-06-11 5.5 CVE-2024-30067
secure@microsoft.com Microsoft–Windows 10 Version 1809
  Windows Cryptographic Services Information Disclosure Vulnerability 2024-06-11 5.5 CVE-2024-30096
secure@microsoft.com Microsoft–Windows 10 Version 1809
  Windows Remote Access Connection Manager Information Disclosure Vulnerability 2024-06-11 4.7 CVE-2024-30069
secure@microsoft.com Minoji–MJ Update History
  Missing Authorization vulnerability in Minoji MJ Update History.This issue affects MJ Update History: from n/a through 1.0.4. 2024-06-11 4.3 CVE-2024-35671
audit@patchstack.com mlewand–ckeditor-plugin-openlink
  The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execute JavaScript code by abusing link href attribute. It affects all users using the Open Link plugin at version < **1.0.5**. 2024-06-14 6.1 CVE-2024-37888
security-advisories@github.com MoreConvert–MC Woocommerce Wishlist
  Missing Authorization vulnerability in MoreConvert MC Woocommerce Wishlist.This issue affects MC Woocommerce Wishlist: from n/a through 1.7.8. 2024-06-11 5.3 CVE-2024-34813
audit@patchstack.com MoreConvert–MC Woocommerce Wishlist
  Missing Authorization vulnerability in MoreConvert MC Woocommerce Wishlist.This issue affects MC Woocommerce Wishlist: from n/a through 1.7.2. 2024-06-11 5.3 CVE-2024-34819
audit@patchstack.com n/a–n/a
  A Directory Traversal vulnerability in iceice666 ResourcePack Server before v1.0.8 allows a remote attacker to disclose files on the server, via setPath in ResourcePackFileServer.kt. 2024-06-10 6.5 CVE-2024-35474
cve@mitre.org n/a–Newspaper – News & WooCommerce WordPress Theme
  The Newspaper theme for WordPress is vulnerable to Stored Cross-Site Scripting via attachment meta in the archive page in all versions up to, and including, 12.6.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 5.5 CVE-2024-3815
security@wordfence.com
security@wordfence.com N/A–Piotnet Forms
  Missing Authorization vulnerability in Piotnet Forms.This issue affects Piotnet Forms: from n/a through 1.0.29. 2024-06-12 5.3 CVE-2023-51413
audit@patchstack.com namithjawahar–Insert Post Ads
  Missing Authorization vulnerability in namithjawahar Insert Post Ads.This issue affects Insert Post Ads: from n/a through 1.3.2. 2024-06-11 5.3 CVE-2024-35665
audit@patchstack.com Navneil Naicker–ACF Photo Gallery Field
  Missing Authorization vulnerability in Navneil Naicker ACF Photo Gallery Field.This issue affects ACF Photo Gallery Field: from n/a through 2.6. 2024-06-11 4.3 CVE-2024-23518
audit@patchstack.com NervyThemes–SKU Label Changer For WooCommerce
  Missing Authorization vulnerability in NervyThemes SKU Label Changer For WooCommerce.This issue affects SKU Label Changer For WooCommerce: from n/a through 3.0. 2024-06-14 6.5 CVE-2023-29174
audit@patchstack.com NetApp–StorageGRID (formerly StorageGRID Webscale)
  StorageGRID (formerly StorageGRID Webscale) versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vulnerability in the SSH cryptographic implementation. 2024-06-14 5.3 CVE-2024-21988
security-alert@netapp.com Netentsec–NS-ASG Application Security Gateway
  A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /protocol/iscgwtunnel/deleteiscgwrouteconf.php. The manipulation of the argument messagecontent leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268695. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2024-06-15 6.3 CVE-2024-6007
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com netgsm — netgsm
  Missing Authorization vulnerability in Netgsm.This issue affects Netgsm: from n/a through 2.9.16. 2024-06-10 6.3 CVE-2024-4746
audit@patchstack.com netweblogic–Events Manager Calendar, Bookings, Tickets, and more!
  The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘event’, ‘location’, and ‘event_category’ shortcodes in all versions up to, and including, 6.4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 6.4 CVE-2024-3492
security@wordfence.com
security@wordfence.com nextcloud–security-advisories
  user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28). 2024-06-14 6.3 CVE-2024-37312
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com nextcloud–security-advisories
  user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0. 2024-06-14 5.4 CVE-2024-37886
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com nextcloud–security-advisories
  Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2. 2024-06-14 4.6 CVE-2024-37316
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com nextcloud–security-advisories
  The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3. 2024-06-14 4.6 CVE-2024-37317
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com nextcloud–security-advisories
  Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. A user with access to a deck board was able to access comments and attachments of already deleted cards. It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1. 2024-06-14 4.3 CVE-2024-37883
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com nicheaddons–Events Addon for Elementor
  The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Basic Slider, Upcoming Events, and Schedule widgets in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-4669
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com NuGet–NuGetGallery
  NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. When a user inputs a Markdown autolink such as `<javascript:alert(1)>`, the link is rendered without proper sanitization. This means that the JavaScript code within the autolink can be executed by the browser, leading to an XSS attack. Version 2024.05.28 contains a patch for this issue. 2024-06-12 6.1 CVE-2024-37304
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com nvidia–GPU display driver, vGPU software, and Cloud Gaming
  NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper handling of exception conditions might lead to denial of service. 2024-06-13 5.5 CVE-2024-0092
psirt@nvidia.com nvidia–NVIDIA Triton Inference Server
  NVIDIA Triton Inference Server for Linux contains a vulnerability where a user may cause an incorrect Initialization of resource by network issue. A successful exploit of this vulnerability may lead to information disclosure. 2024-06-13 5.4 CVE-2024-0103
psirt@nvidia.com nvidia–vGPU software and Cloud Gaming
  NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful exploit of this vulnerability might lead to data tampering, escalation of privileges, and denial of service. 2024-06-13 6.3 CVE-2024-0085
psirt@nvidia.com nvidia–vGPU software and Cloud Gaming
  NVIDIA GPU software for Linux contains a vulnerability where it can expose sensitive information to an actor that is not explicitly authorized to have access to that information. A successful exploit of this vulnerability might lead to information disclosure. 2024-06-13 6.5 CVE-2024-0093
psirt@nvidia.com nvidia–vGPU software and Cloud Gaming
  NVIDIA vGPU software for Linux contains a vulnerability where the software can dereference a NULL pointer. A successful exploit of this vulnerability might lead to denial of service and undefined behavior in the vGPU plugin. 2024-06-13 5.5 CVE-2024-0086
psirt@nvidia.com nvidia–vGPU software and Cloud Gaming
  NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where an untrusted guest VM can cause improper control of the interaction frequency in the host. A successful exploit of this vulnerability might lead to denial of service. 2024-06-13 5.5 CVE-2024-0094
psirt@nvidia.com oceanwp–Ocean Extra
  The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-5531
security@wordfence.com
security@wordfence.com ONTRAPORT Inc.–PilotPress
  Missing Authorization vulnerability in ONTRAPORT Inc. PilotPress.This issue affects PilotPress: from n/a through 2.0.30. 2024-06-10 5.3 CVE-2024-23524
audit@patchstack.com open-quantum-safe–liboqs
  liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for `-Os`, `-O1`, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable. 2024-06-10 5.9 CVE-2024-36405
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com OpenPrinting–cups
  OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. Given the aforementioned Ubuntu AppArmor context, on such systems this vulnerability is limited to those files modifiable by the cupsd process. In that specific case it was found to be possible to turn the configuration of the Listen argument into full control over the cupsd.conf and cups-files.conf configuration files. By later setting the User and Group arguments in cups-files.conf, and printing with a printer configured by PPD with a `FoomaticRIPCommandLine` argument, arbitrary user and group (not root) command execution could be achieved, which can further be used on Ubuntu systems to achieve full root command execution. Commit ff1f8a623e090dee8a8aadf12a6a4b25efac143d contains a patch for the issue. 2024-06-11 4.4 CVE-2024-35235
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com OpenText–NetIQ Access Manager
  This allows the information exposure to unauthorized users. This issue affects NetIQ Access Manager using version 4.5 or before 2024-06-11 6.5 CVE-2020-11843
security@opentext.com
security@opentext.com ovic_importer_project — ovic_importer
  Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3. 2024-06-10 6.5 CVE-2024-35754
audit@patchstack.com Photo Gallery Team–Photo Gallery by 10Web
  Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.24. 2024-06-11 4.3 CVE-2024-35628
audit@patchstack.com Podlove–Podlove Podcast Publisher
  Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0. 2024-06-11 4.3 CVE-2024-32143
audit@patchstack.com quantumcloud–AI Infographic Maker
  The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcld_openai_title_generate_desc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post titles. 2024-06-15 4.3 CVE-2024-5858
security@wordfence.com
security@wordfence.com
security@wordfence.com RabbitLoader–RabbitLoader
  Missing Authorization vulnerability in RabbitLoader.This issue affects RabbitLoader: from n/a through 2.19.13. 2024-06-10 5.4 CVE-2024-21751
audit@patchstack.com Red Hat–Red Hat Enterprise Linux 6
  A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink. 2024-06-12 4.7 CVE-2024-5742
secalert@redhat.com
secalert@redhat.com
secalert@redhat.com Red Hat–Red Hat Quay 3
  A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, in configurations where endpoints rely only on authentication, a user may authenticate to applications they otherwise have no access to. 2024-06-12 4.2 CVE-2024-5891
secalert@redhat.com
secalert@redhat.com Repute Infosystems–BookingPress
  Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82. 2024-06-11 6.5 CVE-2024-34799
audit@patchstack.com Revolut–Revolut Gateway for WooCommerce
  Missing Authorization vulnerability in Revolut Revolut Gateway for WooCommerce.This issue affects Revolut Gateway for WooCommerce: from n/a through 4.9.7. 2024-06-11 4.3 CVE-2023-52224
audit@patchstack.com salesagility — suitecrm
  SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset from an unauthenticated attacker. The attacker does not get access to the new password. But this can be annoying for the user. This attack is also dependent on some password reset functionalities being enabled. It also requires the system using php 7, which is not an officially supported version. Versions 7.14.4 and 8.6.1 contain a fix for this issue. 2024-06-10 6.5 CVE-2024-36407
security-advisories@github.com salesagility — suitecrm
  SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors file verification allows for a server-side request forgery attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. 2024-06-10 6.5 CVE-2024-36414
security-advisories@github.com salesagility — suitecrm
  SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. 2024-06-10 5.4 CVE-2024-36413
security-advisories@github.com salesagility–SuiteCRM
  SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue. 2024-06-10 5.4 CVE-2024-36406
security-advisories@github.com salesagility–SuiteCRM-Core
  SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue. 2024-06-10 4.3 CVE-2024-36419
security-advisories@github.com Salesforce–Pardot
  Missing Authorization vulnerability in Salesforce Pardot.This issue affects Pardot: from n/a through 2.1.0. 2024-06-11 4.3 CVE-2024-32148
audit@patchstack.com SAP_SE–SAP BW/4HANA Transformation and Data Transfer Process
  SAP BW/4HANA Transformation and Data Transfer Process (DTP) allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks. This results in escalation of privileges. It has no impact on the confidentiality of data but may have low impacts on the integrity and availability of the application. 2024-06-11 5.5 CVE-2024-37176
cna@sap.com
cna@sap.com SAP_SE–SAP CRM WebClient UI
  Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim’s browser giving the attacker the ability to access and/or modify information with no effect on availability of the application. 2024-06-11 6.1 CVE-2024-34686
cna@sap.com
cna@sap.com SAP_SE–SAP Document Builder
  An authenticated attacker can upload malicious file to SAP Document Builder service. When the victim accesses this file, the attacker is allowed to access, modify, or make the related information unavailable in the victim’s browser. 2024-06-11 6.5 CVE-2024-34683
cna@sap.com
cna@sap.com SAP_SE–SAP Financial Consolidation
  SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. These endpoints are exposed over the network. The vulnerability can exploit resources beyond the vulnerable component. On successful exploitation, an attacker can cause limited impact to confidentiality of the application. 2024-06-11 5 CVE-2024-37178
cna@sap.com
cna@sap.com SAP_SE–SAP NetWeaver and ABAP platform
  SAP NetWeaver and ABAP platform allows an attacker to impede performance for legitimate users by crashing or flooding the service. An impact of this Denial of Service vulnerability might be long response delays and service interruptions, thus degrading the service quality experienced by legitimate users causing high impact on availability of the application. 2024-06-11 6.5 CVE-2024-33001
cna@sap.com
cna@sap.com SAP_SE–SAP NetWeaver AS Java
  SAP NetWeaver AS Java (CAF – Guided Procedures) allows an unauthenticated user to access non-sensitive information about the server which would otherwise be restricted causing low impact on confidentiality of the application. 2024-06-11 5.3 CVE-2024-28164
cna@sap.com
cna@sap.com SAP_SE–SAP S/4HANA (Manage Incoming Payment Files)
  Manage Incoming Payment Files (F1680) of SAP S/4HANA does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. As a result, it has high impact on integrity and no impact on the confidentiality and availability of the system. 2024-06-11 6.5 CVE-2024-34691
cna@sap.com
cna@sap.com SAP_SE–SAP Student Life Cycle Management
  SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privileges. On successful exploitation it could allow an attacker to access and edit non-sensitive report variants that are typically restricted, causing minimal impact on the confidentiality and integrity of the application. 2024-06-11 5.4 CVE-2024-34690
cna@sap.com
cna@sap.com sc_filechecker_project — sc_filechecker
  Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Siteclean SC filechecker allows Path Traversal, File Manipulation.This issue affects SC filechecker: from n/a through 0.6. 2024-06-10 6.5 CVE-2024-35743
audit@patchstack.com Schneider Electric–EVlink Home Smart
  CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH interface over the product network interface. This does not allow to directly exploit the product or make any unintended operation as the SSH interface access is protected by an authentication mechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts to perform a potential denial of service attack on the exposed SSH interface. 2024-06-12 6.5 CVE-2024-5313
cybersecurity@se.com Schneider Electric–Modicon M340
  CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem. 2024-06-12 6.5 CVE-2024-5056
cybersecurity@se.com Schneider Electric–PowerLogic P5
  CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full control of the relay when a specially crafted reset token is entered into the front panel of the device. 2024-06-12 6.1 CVE-2024-5559
cybersecurity@se.com Schneider Electric–Sage 1410
  CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request. 2024-06-12 5.9 CVE-2024-37039
cybersecurity@se.com Schneider Electric–Sage 1410
  CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request. 2024-06-12 5.4 CVE-2024-37040
cybersecurity@se.com Schneider Electric–Sage 1410
  CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a specially crafted HTTP request. 2024-06-12 5.3 CVE-2024-5560
cybersecurity@se.com Schneider Electric–SpaceLogic AS-P
  CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited admin account. 2024-06-12 6.4 CVE-2024-5558
cybersecurity@se.com Schneider Electric–SpaceLogic AS-P
  CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the controller logs. 2024-06-12 4.5 CVE-2024-5557
cybersecurity@se.com seedprod — rafflepress
  Missing Authorization vulnerability in RafflePress Giveaways and Contests by RafflePress.This issue affects Giveaways and Contests by RafflePress: from n/a through 1.12.4. 2024-06-10 6.3 CVE-2024-4745
audit@patchstack.com SendPress–SendPress Newsletters
  Missing Authorization vulnerability in SendPress SendPress Newsletters.This issue affects SendPress Newsletters: from n/a through 1.23.11.6. 2024-06-14 5.3 CVE-2023-35040
audit@patchstack.com Siemens–Mendix Applications using Mendix 10
  A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.11.0), Mendix Applications using Mendix 10 (V10.6) (All versions < V10.6.9), Mendix Applications using Mendix 9 (All versions >= V9.3.0 < V9.24.22). Affected applications could allow users with the capability to manage a role to elevate the access rights of users with that role. Successful exploitation requires to guess the id of a target role which contains the elevated access rights. 2024-06-11 5.9 CVE-2024-33500
productcert@siemens.com Siemens–SIMATIC CP 1542SP-1
  A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of affected products, if configured to allow the import of PKCS12 containers, could end up in an infinite loop when processing incomplete certificate chains. This could allow an authenticated remote attacker to create a denial of service condition by importing specially crafted PKCS12 containers. 2024-06-11 4.9 CVE-2023-50763
productcert@siemens.com
productcert@siemens.com
productcert@siemens.com Siemens–SINEC Traffic Analyzer
  A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server stored the password in cleartext. This could allow attacker in a privileged position to obtain access passwords. 2024-06-11 6.3 CVE-2024-35208
productcert@siemens.com Siemens–SINEC Traffic Analyzer
  A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information. 2024-06-11 6.5 CVE-2024-35210
productcert@siemens.com Siemens–SINEC Traffic Analyzer
  A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, sets the session cookie on the browser, without applying any security attributes (such as “Secure”, “HttpOnly”, or “SameSite”). 2024-06-11 6.5 CVE-2024-35211
productcert@siemens.com SoftLab–Integrate Google Drive
  Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.3. 2024-06-12 5.4 CVE-2023-52177
audit@patchstack.com SoftLab–Radio Player
  Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73. 2024-06-11 5.3 CVE-2024-34753
audit@patchstack.com Soliloquy Team–Slider by Soliloquy
  Missing Authorization vulnerability in Soliloquy Team Slider by Soliloquy.This issue affects Slider by Soliloquy: from n/a through 2.7.2. 2024-06-11 4.3 CVE-2023-51519
audit@patchstack.com SourceCodester–Best Online News Portal
  A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. This affects an unknown part of the file /admin/index.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268461 was assigned to this vulnerability. 2024-06-14 6.3 CVE-2024-5985
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com SourceCodester–Cab Management System
  A vulnerability classified as critical has been found in SourceCodester Cab Management System 1.0. This affects an unknown part of the file /cms/classes/Users.php?f=delete_client. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268137 was assigned to this vulnerability. 2024-06-12 6.3 CVE-2024-5893
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com SourceCodester–Employee and Visitor Gate Pass Logging System
  A vulnerability, which was classified as critical, has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. This issue affects the function delete_users of the file /classes/Users.php?f=delete. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268139. 2024-06-12 6.3 CVE-2024-5895
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com SourceCodester–Employee and Visitor Gate Pass Logging System
  A vulnerability has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=log_visitor. The manipulation of the argument name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-268141 was assigned to this vulnerability. 2024-06-12 4.3 CVE-2024-5897
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com
cna@vuldb.com specialk–Dashboard Widgets Suite
  The Dashboard Widgets Suite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in all versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. 2024-06-13 6.1 CVE-2024-0979
security@wordfence.com
security@wordfence.com strapi–strapi
  Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it’s manually restarted. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. Users should upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch. 2024-06-12 5.3 CVE-2024-31217
security-advisories@github.com
security-advisories@github.com stylemix–WordPress Header Builder Plugin Pearl
  The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability checks on the stm_hb_delete() function in all versions up to, and including, 1.3.7. This makes it possible for unauthenticated attackers to delete arbitrary options that can be used to perform a denial of service attack on a site. 2024-06-12 6.5 CVE-2024-5468
security@wordfence.com
security@wordfence.com tabrisrp–WPS Hide Login
  The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the ‘action=postpass’ parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin. 2024-06-11 5.3 CVE-2024-2473
security@wordfence.com
security@wordfence.com tagDiv–tagDiv Composer
  The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘single’ module in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 5.5 CVE-2024-3814
security@wordfence.com
security@wordfence.com Tagembed–Tagembed
  Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.5. 2024-06-11 5.4 CVE-2024-34804
audit@patchstack.com TechnoVama–Quotes for WooCommerce
  Missing Authorization vulnerability in TechnoVama Quotes for WooCommerce.This issue affects Quotes for WooCommerce: from n/a through 2.0.1. 2024-06-12 4.3 CVE-2023-51680
audit@patchstack.com Tenable–Security Center
  An improper privilege management vulnerability exists in Tenable Security Center where an authenticated, remote attacker could view unauthorized objects and launch scans without having the required privileges 2024-06-12 5.4 CVE-2024-5759
vulnreport@tenable.com Teplitsa of social technologies–Leyka
  Missing Authorization vulnerability in Teplitsa of social technologies Leyka.This issue affects Leyka: from n/a through 3.31.1. 2024-06-11 5.3 CVE-2024-35683
audit@patchstack.com Termly–Cookie Consent
  Missing Authorization vulnerability in Termly Cookie Consent.This issue affects Cookie Consent: from n/a through 3.2. 2024-06-11 5.3 CVE-2024-35692
audit@patchstack.com The Newsletter Team–Newsletter – API v1 and v2 addon for Newsletter
  The Newsletter – API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0 2024-06-12 6.5 CVE-2024-5674
security@wordfence.com
security@wordfence.com ThemeBoy–SportsPress Sports Club & League Manager
  Missing Authorization vulnerability in ThemeBoy SportsPress – Sports Club & League Manager.This issue affects SportsPress – Sports Club & League Manager: from n/a through 2.7.20. 2024-06-11 4.3 CVE-2024-34824
audit@patchstack.com themeisle — product_addons_&_fields_for_woocommerce
  Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) vulnerability in Themeisle PPOM for WooCommerce allows Code Inclusion.This issue affects PPOM for WooCommerce: from n/a through 32.0.20. 2024-06-10 5.3 CVE-2024-35728
audit@patchstack.com TMS–Amelia
  Missing Authorization vulnerability in TMS Amelia ameliabooking.This issue affects Amelia: from n/a through 1.0.98. 2024-06-10 5.3 CVE-2024-22298
audit@patchstack.com Tobias Conrad–Builder for WooCommerce reviews shortcodes ReviewShort
  Missing Authorization vulnerability in Tobias Conrad Builder for WooCommerce reviews shortcodes – ReviewShort.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through 1.01.5. 2024-06-11 5.3 CVE-2024-34763
audit@patchstack.com Tobias Conrad–Design for Contact Form 7 Style WordPress Plugin CF7 WOW Styler
  Missing Authorization vulnerability in Tobias Conrad Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler.This issue affects Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler: from n/a through 1.6.4. 2024-06-11 6.3 CVE-2024-34826
audit@patchstack.com Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL. 2024-06-14 6.7 CVE-2024-27146
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL. 2024-06-14 6.2 CVE-2024-27154
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL. 2024-06-14 6.8 CVE-2024-27156
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL. 2024-06-14 6.8 CVE-2024-27157
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the “Base Score” of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL. 2024-06-14 6.2 CVE-2024-27159
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the “Base Score” of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL. 2024-06-14 6.2 CVE-2024-27160
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the “Base Score” of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL. 2024-06-14 6.2 CVE-2024-27161
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the reference URL. 2024-06-14 6.1 CVE-2024-27162
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password in clear-text and compromise the printer. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the “Base Score” of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL. 2024-06-14 6.5 CVE-2024-27163
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL. 2024-06-14 6.7 CVE-2024-27180
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL. 2024-06-14 5.9 CVE-2024-27141
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL. 2024-06-14 5.9 CVE-2024-27142
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL. 2024-06-14 4.4 CVE-2024-27175
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Toshiba Tec Corporation–Toshiba Tec e-Studio multi-function peripheral (MFP)
  Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL. 2024-06-14 4.7 CVE-2024-27179
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0
ecc0f906-8666-484c-bcf8-c3b7520a72f0 Trellix–Intrusion Prevention System (IPS) Manager
  A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveraging sensitive information. 2024-06-14 6.8 CVE-2024-5731
trellixpsirt@trellix.com Trellix–Trellix EDR UI (XConsole)
  An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command line variables. A malicious threat actor could execute commands on the victim’s browser for sending carefully crafted malicious links to the EDR XConsole end user. 2024-06-13 4.1 CVE-2024-4176
trellixpsirt@trellix.com Trend Micro, Inc.–Trend Micro Apex One
  A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to create a denial-of-service condition on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2024-06-10 6.1 CVE-2024-36306
security@trendmicro.com
security@trendmicro.com Trend Micro, Inc.–Trend Micro Apex One
  A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information about the agent on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2024-06-10 4.7 CVE-2024-36307
security@trendmicro.com
security@trendmicro.com Trend Micro, Inc.–Trend Micro InterScan Web Security Virtual Appliance
  A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2024-06-10 5.4 CVE-2024-36359
security@trendmicro.com
security@trendmicro.com Trend Micro, Inc.–Trend Micro VPN Proxy One Pro
  Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack but is limited to local Denial of Service (DoS) and under specific conditions can lead to elevation of privileges. 2024-06-10 5.3 CVE-2024-36473
security@trendmicro.com
security@trendmicro.com TreyWW–MyFinances
  MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6. 2024-06-14 6.5 CVE-2024-37889
security-advisories@github.com
security-advisories@github.com uniview — nvr301-04s2-p4_firmware
  Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained. 2024-06-10 5.4 CVE-2024-3850
ics-cert@hq.dhs.gov upunzipper_project — upunzipper
  Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Ravidhu Dissanayake Upunzipper allows Path Traversal, File Manipulation.This issue affects Upunzipper: from n/a through 1.0.0. 2024-06-10 6.5 CVE-2024-35744
audit@patchstack.com Vark–Pricing Deals for WooCommerce
  Missing Authorization vulnerability in Vark Pricing Deals for WooCommerce.This issue affects Pricing Deals for WooCommerce: from n/a through 2.0.3.2. 2024-06-12 5.3 CVE-2023-41240
audit@patchstack.com vberkel–Schema App Structured Data
  The Schema App Structured Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the MarkUpdate function. This makes it possible for unauthenticated attackers to update and delete post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2024-06-14 4.3 CVE-2024-0892
security@wordfence.com
security@wordfence.com Verint–WFO
  Verint – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 2024-06-13 6.1 CVE-2024-36395
cna@cyber.gov.il vsourz1td–Advanced Contact form 7 DB
  The Advanced Contact form 7 DB plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.2 via the wp-content/uploads/advanced-cf7-upload directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via this plugin through a form. 2024-06-11 5.3 CVE-2024-3723
security@wordfence.com
security@wordfence.com vsourz1td–Advanced Contact form 7 DB
  The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ‘vsz_cf7_export_to_excel’ function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms. 2024-06-11 5.3 CVE-2024-4319
security@wordfence.com
security@wordfence.com WebCodingPlace–Product Expiry for WooCommerce
  Missing Authorization vulnerability in WebCodingPlace Product Expiry for WooCommerce.This issue affects Product Expiry for WooCommerce: from n/a through 2.5. 2024-06-11 5.4 CVE-2023-52179
audit@patchstack.com webtechstreet–Elementor Addon Elements
  The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s Twitter Widget in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-12 5.4 CVE-2024-2092
security@wordfence.com
security@wordfence.com
security@wordfence.com WebToffee–WordPress Backup & Migration
  Missing Authorization vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.3. 2024-06-11 5.4 CVE-2023-52183
audit@patchstack.com weDevs–weDocs
  Missing Authorization vulnerability in weDevs weDocs.This issue affects weDocs: from n/a through 2.1.4. 2024-06-11 5.3 CVE-2024-34442
audit@patchstack.com weDevs–weMail
  Missing Authorization vulnerability in weDevs weMail.This issue affects weMail: from n/a through 1.14.2. 2024-06-11 5.3 CVE-2024-34822
audit@patchstack.com weDevs–WooCommerce Conversion Tracking
  Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11. 2024-06-11 4.3 CVE-2023-52217
audit@patchstack.com weForms–weForms
  Missing Authorization vulnerability in weForms.This issue affects weForms: from n/a through 1.6.18. 2024-06-12 4.3 CVE-2023-51524
audit@patchstack.com Welcart Inc.–Welcart e-Commerce
  Missing Authorization vulnerability in Welcart Inc. Welcart e-Commerce.This issue affects Welcart e-Commerce: from n/a through 2.9.14. 2024-06-11 5.4 CVE-2024-32144
audit@patchstack.com Woo–WooCommerce Canada Post Shipping
  Missing Authorization vulnerability in Woo WooCommerce Canada Post Shipping.This issue affects WooCommerce Canada Post Shipping: from n/a through 2.8.3. 2024-06-11 5.3 CVE-2023-51498
audit@patchstack.com Woo–WooCommerce Product Vendors
  Missing Authorization vulnerability in Woo WooCommerce Product Vendors.This issue affects WooCommerce Product Vendors: from n/a through 2.2.2. 2024-06-11 5.3 CVE-2023-52186
audit@patchstack.com Woo–WooCommerce Ship to Multiple Addresses
  Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.9. 2024-06-14 5.4 CVE-2023-51497
audit@patchstack.com Woo–WooCommerce Warranty Requests
  Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7. 2024-06-14 6.5 CVE-2023-51495
audit@patchstack.com Woo–WooCommerce Warranty Requests
  Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.2.7. 2024-06-14 5.3 CVE-2023-51496
audit@patchstack.com woocommerce–woocommerce
  WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature. 2024-06-12 5.4 CVE-2024-37297
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com
security-advisories@github.com WP EasyCart–WP EasyCart
  Missing Authorization vulnerability in WP EasyCart.This issue affects WP EasyCart: from n/a through 5.5.19. 2024-06-11 5.3 CVE-2024-35667
audit@patchstack.com WP OnlineSupport, Essential Plugin–Preloader for Website
  Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Preloader for Website.This issue affects Preloader for Website: from n/a through 1.2.2. 2024-06-11 5.3 CVE-2023-48273
audit@patchstack.com wpbakery–WPBakery Visual Composer
  The WPBakery Visual Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link attribute within the vc_single_image shortcode in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-13 6.4 CVE-2024-5265
security@wordfence.com
security@wordfence.com wpdevteam–EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor
  The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the PDF Widget URL in all versions up to, and including, 3.9.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-13 6.4 CVE-2024-1565
security@wordfence.com
security@wordfence.com
security@wordfence.com wpdevteam–Essential Addons for Elementor Best Elementor Templates, Widgets, Kits & WooCommerce Builders
  The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_js’ parameter in all versions up to, and including, 5.9.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-11 6.4 CVE-2024-5189
security@wordfence.com
security@wordfence.com
security@wordfence.com WPEverest–Everest Forms
  Missing Authorization vulnerability in WPEverest Everest Forms.This issue affects Everest Forms: from n/a through 2.0.3. 2024-06-14 5.3 CVE-2023-51377
audit@patchstack.com wpgmaps–WP Go Maps (formerly WP Google Maps)
  The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and including, 9.0.38. This makes it possible for authenticated attackers that have been explicitly granted permissions by an administrator, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Version 9.0.39 adds a caution to make administrators aware of the possibility for abuse if permissions are granted to lower-level users. 2024-06-14 6.4 CVE-2024-5994
security@wordfence.com
security@wordfence.com
security@wordfence.com WPManageNinja LLC–Ninja Tables
  Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5. 2024-06-14 5.3 CVE-2024-23504
audit@patchstack.com WPManageNinja LLC–Ninja Tables
  Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.6. 2024-06-11 4.3 CVE-2024-23503
audit@patchstack.com wpmet–ElementsKit Pro
  The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s Motion Text and Table widgets in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. 2024-06-15 6.4 CVE-2024-5263
security@wordfence.com
security@wordfence.com Wpmet–WP Fundraising Donation and Crowdfunding Platform
  Missing Authorization vulnerability in Wpmet WP Fundraising Donation and Crowdfunding Platform.This issue affects WP Fundraising Donation and Crowdfunding Platform: from n/a through 1.6.4. 2024-06-11 5.3 CVE-2024-34758
audit@patchstack.com WPWeb–WooCommerce – Social Login
  The WooCommerce – Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification. 2024-06-15 6.5 CVE-2024-5868
security@wordfence.com
security@wordfence.com WriterSystem–WooCommerce Easy Duplicate Product
  Missing Authorization vulnerability in WriterSystem WooCommerce Easy Duplicate Product.This issue affects WooCommerce Easy Duplicate Product: from n/a through 0.3.0.7. 2024-06-14 4.3 CVE-2023-51523
audit@patchstack.com XjSv–Cooked
  The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0. 2024-06-13 5.4 CVE-2024-37308
security-advisories@github.com
security-advisories@github.com xpeedstudio–MetForm Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.8.8 via the ‘handle_file’ function. This can allow unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users. 2024-06-11 5.3 CVE-2024-4266
security@wordfence.com
security@wordfence.com
security@wordfence.com yithemes — yith_woocommerce_product_add-ons
  Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) vulnerability in YITH YITH WooCommerce Product Add-Ons allows Code Injection.This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.9.2. 2024-06-10 5.3 CVE-2024-35680
audit@patchstack.com Yoast–Yoast SEO Premium
  Missing Authorization vulnerability in Yoast Yoast SEO Premium.This issue affects Yoast SEO Premium: from n/a through 20.4. 2024-06-11 5.3 CVE-2023-28775
audit@patchstack.com yotuwp–Video Gallery YouTube Playlist, Channel Gallery by YotuWP
  The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the display function. This makes it possible for authenticated attackers, with contributor access and higher, to include and execute arbitrary php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. 2024-06-15 6.4 CVE-2024-4551
security@wordfence.com
security@wordfence.com
security@wordfence.com