Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2024

180 records · 13 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2024-36042
    39Monitor

    Silverpeas before 6.3.5 allows authentication bypass by omitting the Password field to AuthenticationServlet, often providing an unauthentic

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    silverpeas · silverpeasJun 3, 2024

  • CVE-2024-3829
    36Monitor

    Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    qdrant · qdrantJun 3, 2024

  • CVE-2021-3899
    31Monitor

    There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute ar

    HighCVSS 7.8Proof of conceptEPSS 0%

    canonical · apportJun 3, 2024

  • CVE-2024-34051
    22Monitor

    A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote atta

    MediumCVSS 4.6No exploitEPSS 11%

    Jun 3, 2024

  • CVE-2024-29972
    66This week

    ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions b

    CriticalCVSS 9.8Proof of conceptEPSS 89%

    zyxel · nas326 firmwareJun 3, 2024

  • CVE-2024-29973
    65This week

    ** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5

    CriticalCVSS 9.8Proof of conceptEPSS 86%

    zyxel · nas326 firmwareJun 3, 2024

  • CVE-2024-29974
    46Plan

    ** UNSUPPORTED WHEN ASSIGNED ** The remote code execution vulnerability in the CGI program “file_upload-cgi” in Zyxel NAS326 firmware versio

    CriticalCVSS 9.8No exploitEPSS 22%

    zyxel · nas326 firmwareJun 3, 2024

  • CVE-2024-0757
    21Monitor

    Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCE

    MediumCVSS 5.4Proof of conceptEPSS 0%

    elearningfreak · insert or embed articulate contentJun 4, 2024

  • CVE-2024-4180
    37Monitor

    The Events Calendar < 6.4.0.1 - Reflected XSS

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    stellarwp · the events calendarJun 4, 2024

  • CVE-2024-36104
    62This week

    Apache OFBiz: Path traversal leading to a RCE

    CriticalCVSS 9.1Proof of conceptEPSS 87%

    apache · ofbizJun 4, 2024

  • CVE-2024-4253
    37Monitor

    Command Injection in gradio-app/gradio

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    gradio project · gradioJun 4, 2024

  • CVE-2024-5420
    35Monitor

    Stored Cross-Site Scripting in SEH Computertechnik utnserver Pro

    HighCVSS 8.3Proof of conceptEPSS 5%

    seh computertechnik · utnserver proJun 4, 2024

  • CVE-2024-5421
    35Monitor

    Authenticated Command Injection

    HighCVSS 8.7Proof of conceptEPSS 3%

    seh computertechnik · utnserver proJun 4, 2024

  • CVE-2024-37054
    35Monitor

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously upload

    HighCVSS 8.8Proof of conceptEPSS 0%

    lfprojects · mlflowJun 4, 2024

  • CVE-2024-4254
    28Monitor

    Secrets Exfiltration in gradio-app/gradio

    HighCVSS 7.1Proof of conceptEPSS 0%

    gradio project · gradioJun 4, 2024

  • CVE-2023-51511
    26Monitor

    WordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification Vulnerability

    MediumCVSS 6.5No exploitEPSS 0%

    booster · booster for woocommerceJun 4, 2024

  • CVE-2024-25600
    66This week

    WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability

    CriticalCVSS 10.0WeaponizedEPSS 88%

    codeer limited · bricks builderJun 4, 2024

  • CVE-2024-28999
    34Monitor

    SolarWinds Platform Race Condition Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 13%

    solarwinds · solarwinds platformJun 4, 2024

  • CVE-2024-36857
    31Monitor

    Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

    HighCVSS 7.5Proof of conceptEPSS 2%

    homebrew · janJun 4, 2024

  • CVE-2024-36858
    40Plan

    An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    homebrew · janJun 4, 2024

  • CVE-2024-36675
    36Monitor

    LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    lylme · lylme spageJun 4, 2024

  • CVE-2024-5483
    21Monitor

    LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API

    MediumCVSS 5.3Proof of conceptEPSS 1%

    thimpress · learnpressJun 4, 2024

  • CVE-2024-4295
    42Plan

    Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    icegram · email subscribers \& newslettersJun 5, 2024

  • CVE-2024-3469
    24Monitor

    GP Premium <= 2.4.0 - Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 0%

    generatepress · generatepressJun 5, 2024

  • CVE-2024-36837
    32Monitor

    SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the

    HighCVSS 7.5Proof of conceptEPSS 8%

    crmeb · crmebJun 5, 2024

  • CVE-2024-20404
    28Monitor

    A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct an SSRF at

    MediumCVSS 5.3Proof of conceptEPSS 22%

    cisco · finesseJun 5, 2024

  • CVE-2024-20405
    24Monitor

    A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored X

    MediumCVSS 6.1Proof of conceptEPSS 0%

    cisco · finesseJun 5, 2024

  • CVE-2024-5324
    35Monitor

    XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

    HighCVSS 8.8Proof of conceptEPSS 1%

    xootix · login\/signup popupJun 5, 2024

  • CVE-2024-5153
    39Monitor

    Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    web-shop-host · startklar elmentor addonsJun 6, 2024

  • CVE-2024-28995
    90Now

    SolarWinds Serv-U L Directory Transversal Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    solarwinds · serv-uJun 6, 2024

  • CVE-2024-34832
    41Plan

    Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a crafted file uploaded to

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    cubecart · cubecartJun 6, 2024

  • CVE-2024-37152
    31Monitor

    Unauthenticated Access to sensitive settings in Argo CD

    HighCVSS 7.5Proof of conceptEPSS 2%

    argoproj · argo cdJun 6, 2024

  • CVE-2024-4325
    45Plan

    Server-Side Request Forgery (SSRF) in gradio-app/gradio

    HighCVSS 8.6Proof of conceptEPSS 37%

    gradio project · gradioJun 6, 2024

  • CVE-2024-5452
    47Plan

    RCE via Property/Class Pollution in lightning-ai/pytorch-lightning

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    lightningai · pytorch lightningJun 6, 2024

  • CVE-2024-5505
    49Plan

    NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 46%

    netgear · prosafe network management systemJun 6, 2024

  • CVE-2024-0520
    36Monitor

    Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

    HighCVSS 8.8Proof of conceptEPSS 2%

    lfprojects · mlflowJun 6, 2024

  • CVE-2024-1873
    40Plan

    Path Traversal and Denial of Service in parisneo/lollms-webui

    CriticalCVSS 9.1No exploitEPSS 13%

    lollms · lollms web uiJun 6, 2024

  • CVE-2024-2928
    37Monitor

    Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

    HighCVSS 7.5Proof of conceptEPSS 21%

    lfprojects · mlflowJun 6, 2024

  • CVE-2024-3234
    40Plan

    Path Traversal in gaizhenbiao/chuanhuchatgpt

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    gaizhenbiao · chuanhuchatgptJun 6, 2024

  • CVE-2024-3408
    62This week

    Authentication Bypass and RCE in man-group/dtale

    CriticalCVSS 9.8WeaponizedEPSS 77%

    man · d-taleJun 6, 2024

  • CVE-2024-3429
    47Plan

    Path Traversal in parisneo/lollms

    CriticalCVSS 9.8No exploitEPSS 28%

    lollms · lollmsJun 6, 2024

  • CVE-2024-4320
    49Plan

    Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    lollms · lollms web uiJun 6, 2024

  • CVE-2024-4890
    19Monitor

    Blind SQL Injection in berriai/litellm

    MediumCVSS 4.9Proof of conceptEPSS 0%

    litellm · litellmJun 6, 2024

  • CVE-2024-5124
    30Monitor

    Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt

    HighCVSS 7.5Proof of conceptEPSS 1%

    gaizhenbiao · chuanhuchatgptJun 6, 2024

  • CVE-2024-5328
    37Monitor

    SSRF Vulnerability in lunary-ai/lunary

    CriticalCVSS 9.3No exploitEPSS 0%

    lunary · lunaryJun 6, 2024

  • CVE-2024-36774
    28Monitor

    An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.

    HighCVSS 7.2Proof of conceptEPSS 0%

    monstra · monstraJun 6, 2024

  • CVE-2024-36823
    30Monitor

    The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive

    HighCVSS 7.5Proof of conceptEPSS 0%

    ninjaframework · ninjaJun 6, 2024

  • CVE-2024-37383
    76This week

    Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

    MediumCVSS 6.1KEVWeaponizedEPSS 73%

    roundcube · webmailJun 7, 2024

  • CVE-2024-4620
    40Plan

    ArForms < 6.6 - Unauthenticated RCE

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    reputeinfosystems · arformsJun 7, 2024

  • CVE-2024-4610
    61This week

    Mali GPU Kernel Driver allows improper GPU memory processing operations

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    arm · bifrost gpu kernel driverJun 7, 2024

  • CVE-2024-30163
    42Plan

    Invision Community before 4.7.16 allow SQL injection via the applications/nexus/modules/front/store/store.php IPS\nexus\modules\front\store\

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    invisioncommunity · invisioncommunityJun 7, 2024

  • CVE-2023-7261
    31Monitor

    Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · updaterJun 7, 2024

  • CVE-2024-35693
    24Monitor

    WordPress 12 Step Meeting List plugin <= 3.14.33 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code4recovery · 12 step meeting listJun 8, 2024

  • CVE-2024-35694
    24Monitor

    WordPress WPMobile.App plugin <= 11.41 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 0%

    amauri · wpmobile.appJun 8, 2024

  • CVE-2024-4146
    39Monitor

    Incorrect Authorization in lunary-ai/lunary

    CriticalCVSS 9.8No exploitEPSS 0%

    lunary · lunaryJun 8, 2024

  • CVE-2024-30539
    39Monitor

    WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    getawesomesupport · awesome supportJun 9, 2024

  • CVE-2024-25092
    35Monitor

    WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    xlplugins · nextmoveJun 9, 2024

  • CVE-2024-30464
    35Monitor

    WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    wpzoom · social icons widgetJun 9, 2024

  • CVE-2024-30485
    35Monitor

    WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    xlplugins · finaleJun 9, 2024

  • CVE-2024-5458
    25Monitor

    Filter bypass in filter_var (FILTER_VALIDATE_URL)

    MediumCVSS 5.3No exploitEPSS 12%

    php · phpJun 9, 2024

  • CVE-2024-5585
    44Plan

    Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

    HighCVSS 8.8No exploitEPSS 28%

    php · phpJun 9, 2024

  • CVE-2024-4577
    99Now

    Argument Injection in PHP-CGI

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    php · phpJun 9, 2024

  • CVE-2024-36971
    62This week

    net: fix __dst_negative_advice() race

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    linux · linux kernelJun 10, 2024

  • CVE-2024-37051
    31Monitor

    GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023

    HighCVSS 7.5Proof of conceptEPSS 4%

    jetbrains · aquaJun 10, 2024

  • CVE-2024-3850
    19Monitor

    Uniview NVR301-04S2-P4 Cross-site Scripting

    MediumCVSS 4.8Proof of conceptEPSS 0%

    uniview · nvr301-04s2-p4 firmwareJun 10, 2024

  • CVE-2024-36412
    41Plan

    SuiteCRM unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    salesagility · suitecrmJun 10, 2024

  • CVE-2024-36416
    31Monitor

    SuiteCRM v4 API Excessive log data DOS

    HighCVSS 7.5Proof of conceptEPSS 1%

    salesagility · suitecrmJun 10, 2024

  • CVE-2024-37014
    58Plan

    Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and p

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    langflow · langflowJun 10, 2024

  • CVE-2024-37393
    31Monitor

    Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input.

    HighCVSS 7.5Proof of conceptEPSS 3%

    securenvoy · multi-factor authentication solutionsJun 10, 2024

  • CVE-2024-27815
    32Monitor

    An out-of-bounds write issue was addressed with improved input validation.

    HighCVSS 7.8Proof of conceptEPSS 2%

    apple · ipadosJun 10, 2024

  • CVE-2024-35242
    36Monitor

    Composer vulnerable to command injection via malicious git/hg branch names

    HighCVSS 8.8Proof of conceptEPSS 3%

    composer · composerJun 10, 2024

  • CVE-2024-2473
    21Monitor

    WPS Hide Login <= 1.9.15.2 - Login Page Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 1%

    wpserveur · wps hide loginJun 10, 2024

  • CVE-2024-29855
    42Plan

    Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

    CriticalCVSS 9.0Proof of conceptEPSS 21%

    veeam · recovery orchestratorJun 11, 2024

  • CVE-2024-21754
    18Monitor

    A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all ver

    MediumCVSS 4.4Proof of conceptEPSS 3%

    fortinet · fortiproxyJun 11, 2024

  • CVE-2024-30052
    18Monitor

    Visual Studio Remote Code Execution Vulnerability

    MediumCVSS 4.7Proof of conceptEPSS 1%

    microsoft · visual studio 2019Jun 11, 2024

  • CVE-2024-30080
    52Plan

    Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 43%

    microsoft · windows 10 1507Jun 11, 2024

  • CVE-2024-30085
    40Plan

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8WeaponizedEPSS 14%

    microsoft · windows 10 1809Jun 11, 2024

  • CVE-2024-30088
    78This week

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 68%

    microsoft · windows 10 1507Jun 11, 2024

  • CVE-2024-30090
    29Monitor

    Microsoft Streaming Service Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 1%

    microsoft · windows 10 1507Jun 11, 2024

  • CVE-2024-35250
    69This week

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 25%

    microsoft · windows 10 1507Jun 11, 2024

  • CVE-2024-36821
    28Monitor

    Insecure permissions in Linksys Velop WiFi 5 (WHW01v1) 1.1.13.202617 allows attackers to escalate privileges from Guest to root.

    MediumCVSS 6.8Proof of conceptEPSS 2%

    linksys · velop whw0101 firmwareJun 11, 2024

  • CVE-2024-3183
    33Monitor

    Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

    HighCVSS 8.1Proof of conceptEPSS 2%

    redhat · enterprise linuxJun 12, 2024

  • CVE-2024-4898
    40Plan

    InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User C

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    instawp · instawp connectJun 12, 2024

  • CVE-2024-36840
    37Monitor

    SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    Jun 12, 2024

  • CVE-2024-5909
    27Monitor

    Cortex XDR Agent: Local Windows User Can Disable the Agent

    MediumCVSS 6.8Proof of conceptEPSS 0%

    paloaltonetworks · cortex xdr agentJun 12, 2024

  • CVE-2024-3922
    55Plan

    Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    dokan · dokanJun 12, 2024

  • CVE-2024-3032
    24Monitor

    Themify Builder < 7.5.8 - Open Redirect

    MediumCVSS 6.1Proof of conceptEPSS 0%

    themify · builderJun 13, 2024

  • CVE-2024-3552
    59Plan

    Web Directory Free < 1.7.0 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 67%

    salephpscripts · web directory freeJun 13, 2024

  • CVE-2024-34102
    99Now

    XXE can expose crypt key and other secrets granting full admin access

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · commerceJun 13, 2024

  • CVE-2024-34112
    37Monitor

    ColdFusion CFDOCUMENT file retrieval / access control bypass

    HighCVSS 7.5No exploitEPSS 23%

    adobe · coldfusionJun 13, 2024

  • CVE-2024-36587
    31Monitor

    Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting

    HighCVSS 7.8Proof of conceptEPSS 0%

    Jun 13, 2024

  • CVE-2024-5947
    27Monitor

    Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 2%

    deepseaelectronics · dse855 firmwareJun 13, 2024

  • CVE-2024-32896
    62This week

    there is a possible way to bypass due to a logic error in the code.

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    google · androidJun 13, 2024

  • CVE-2024-31777
    40Plan

    File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.p

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    openeclass · openeclassJun 13, 2024

  • CVE-2024-3080
    52Plan

    ASUS Router - Improper Authentication

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    asus · zenwifi xt8Jun 13, 2024

  • CVE-2024-27162
    30Monitor

    Toshiba printers provide a web interface that will load the JavaScript file.

    MediumCVSS 6.1No exploitEPSS 21%

    toshiba tec corporation · toshiba tec e-studio multi-function peripheral (mfp)Jun 14, 2024

  • CVE-2024-27172
    47Plan

    Remote Code Execution

    CriticalCVSS 9.8No exploitEPSS 26%

    toshiba tec corporation · toshiba tec e-studio multi-function peripheral (mfp)Jun 14, 2024

  • CVE-2024-27173
    40Plan

    Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code.

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    toshiba tec corporation · toshiba tec e-studio multi-function peripheral (mfp)Jun 14, 2024

  • CVE-2024-5961
    21Monitor

    Reflected XSS in 2ClickPortal

    MediumCVSS 5.3Proof of conceptEPSS 1%

    trol intermedia sp. z o.o. sp. k. · 2clickportalJun 14, 2024

  • CVE-2024-3912
    39Monitor

    ASUS Router - Upload arbitrary firmware

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    asus · dsl-n17uJun 14, 2024