Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2024

180 records · 13 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2024-37642
    39Monitor

    TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /fo

    CriticalCVSS 9.1No exploitEPSS 11%

    trendnet · tew-814dap firmwareJun 14, 2024

  • CVE-2024-37888
    24Monitor

    The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality

    MediumCVSS 6.1Proof of conceptEPSS 0%

    mlewand · open linkJun 14, 2024

  • CVE-2024-3105
    40Plan

    Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution

    CriticalCVSS 9.9Proof of conceptEPSS 2%

    themeisle · woody code snippets – insert php, css, js, and header/footer scriptsJun 15, 2024

  • CVE-2023-27636
    21Monitor

    Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.

    MediumCVSS 5.4Proof of conceptEPSS 1%

    progress · sitefinityJun 16, 2024

  • CVE-2024-38396
    40Plan

    An issue was discovered in iTerm2 3.5.x before 3.5.2.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    iterm2 · iterm2Jun 16, 2024

  • CVE-2024-6039
    21Monitor

    Feng Office Workspaces sql injection

    MediumCVSS 5.3Proof of conceptEPSS 0%

    fengoffice · feng officeJun 16, 2024

  • CVE-2024-6043
    28Monitor

    SourceCodester Best House Rental Management System admin_class.php login sql injection

    MediumCVSS 6.9Proof of conceptEPSS 1%

    mayurik · best house rental management systemJun 16, 2024

  • CVE-2024-6047
    72This week

    GeoVision EOL device - OS Command Injection

    CriticalCVSS 9.8KEVWeaponizedEPSS 10%

    geovision · gv-dsp lpr firmwareJun 17, 2024

  • CVE-2024-36527
    27Monitor

    puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal.

    MediumCVSS 6.5Proof of conceptEPSS 2%

    Jun 17, 2024

  • CVE-2024-34833
    40Plan

    Sourcecodester Payroll Management System v1.0 is vulnerable to File Upload.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    oretnom23 · payroll management systemJun 17, 2024

  • CVE-2024-37079
    76This week

    vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

    CriticalCVSS 9.8KEVWeaponizedEPSS 22%

    vmware · cloud foundationJun 18, 2024

  • CVE-2024-37080
    43Plan

    vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.

    CriticalCVSS 9.8No exploitEPSS 12%

    vmware · vcenter serverJun 18, 2024

  • CVE-2024-37081
    40Plan

    The vCenter Server contains multiple local privilege escalation vulnerabilities due to misconfiguration of sudo.

    HighCVSS 7.8WeaponizedEPSS 4%

    vmware · vcenter serverJun 18, 2024

  • CVE-2024-22002
    31Monitor

    CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the insta

    HighCVSS 7.8Proof of conceptEPSS 0%

    Jun 18, 2024

  • CVE-2024-37791
    24Monitor

    DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id.

    MediumCVSS 6.0Proof of conceptEPSS 0%

    Jun 18, 2024

  • CVE-2024-6132
    35Monitor

    Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 1%

    raajtram · pexels: free stock photosJun 19, 2024

  • CVE-2024-37881
    21Monitor

    SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirect

    MediumCVSS 5.3Proof of conceptEPSS 1%

    eg secure solutions inc. · siteguard wp pluginJun 19, 2024

  • CVE-2023-40004
    32Monitor

    Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins

    HighCVSS 7.3No exploitEPSS 10%

    servmask · all-in-one wp migration box extensionJun 19, 2024

  • CVE-2023-41805
    26Monitor

    Broken Access Control vulnerability in multiple Brainstorm Force plugins

    MediumCVSS 6.5No exploitEPSS 0%

    brainstormforce · starter templatesJun 19, 2024

  • CVE-2024-23443
    20Monitor

    A high-privileged user, allowed to create custom osquery packs 17 could affect the availability of Kibana by uploading a maliciously crafted

    MediumCVSS 4.9Proof of conceptEPSS 1%

    elastic · kibanaJun 19, 2024

  • CVE-2024-22263
    40Plan

    Arbitrary File Write Vulnerability in Spring Cloud Data Flow

    HighCVSS 8.8Proof of conceptEPSS 17%

    spring by vmware tanzu · spring cloud skipperJun 19, 2024

  • CVE-2024-34444
    35Monitor

    WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    themepunch · slider revolutionJun 19, 2024

  • CVE-2024-32030
    47Plan

    Remote code execution via JNDI resolution in JMX metrics collection in Kafka UI

    HighCVSS 8.1Proof of conceptEPSS 51%

    provectus · kafka-uiJun 19, 2024

  • CVE-2024-36117
    31Monitor

    Path traversal while serving Reposilite javadoc expanded files

    HighCVSS 7.5Proof of conceptEPSS 3%

    reposilite · reposiliteJun 19, 2024

  • CVE-2024-38355
    29Monitor

    Unhandled 'error' event in socket.io

    HighCVSS 7.3Proof of conceptEPSS 0%

    socketio · socket.ioJun 19, 2024

  • CVE-2024-36680
    33Monitor

    In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection.

    HighCVSS 7.5No exploitEPSS 10%

    Jun 19, 2024

  • CVE-2024-5182
    44Plan

    Path Traversal in mudler/localai

    CriticalCVSS 9.1No exploitEPSS 25%

    mudler · localaiJun 19, 2024

  • CVE-2024-3605
    40Plan

    WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    thimpress · wp hotel bookingJun 19, 2024

  • CVE-2024-5522
    27Monitor

    HTML5 Video Player < 2.5.27 - Unauthenticated SQLi

    MediumCVSS 6.5Proof of conceptEPSS 2%

    bplugins · html5 video playerJun 20, 2024

  • CVE-2024-34693
    21Monitor

    Apache Superset: Server arbitrary file read

    MediumCVSS 5.3Proof of conceptEPSS 1%

    apache · supersetJun 20, 2024

  • CVE-2024-6188
    28Monitor

    Parsec Automation TrackSYS pagedefinition direct request

    MediumCVSS 6.9Proof of conceptEPSS 2%

    parsec automation · tracksysJun 20, 2024

  • CVE-2024-28397
    40Plan

    An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

    MediumCVSS 5.3WeaponizedEPSS 4%

    Jun 20, 2024

  • CVE-2012-6664
    60This week

    Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read

    CriticalCVSS 9.1WeaponizedEPSS 29%

    Jun 21, 2024

  • CVE-2014-5470
    60This week

    Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data

    CriticalCVSS 9.8WeaponizedEPSS 10%

    Jun 21, 2024

  • CVE-2024-34452
    24Monitor

    CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    cmsimple-xh · cmsimple xhJun 21, 2024

  • CVE-2024-21514
    38Monitor

    This affects versions of the package opencart/opencart from 0.0.0.

    HighCVSS 8.1Proof of conceptEPSS 19%

    opencart · opencartJun 22, 2024

  • CVE-2024-21518
    32Monitor

    This affects versions of the package opencart/opencart from 4.0.0.0.

    HighCVSS 7.2No exploitEPSS 14%

    opencart · opencartJun 22, 2024

  • CVE-2024-4940
    24Monitor

    Open Redirect in gradio-app/gradio

    MediumCVSS 6.1Proof of conceptEPSS 1%

    gradio project · gradioJun 22, 2024

  • CVE-2024-6269
    26Monitor

    Ruijie RG-UAC HTTP POST Request sxh_vpnlic.php get_ip.addr_details command injection

    MediumCVSS 5.1No exploitEPSS 20%

    ruijie · rg-uac firmwareJun 23, 2024

  • CVE-2024-4841
    13Monitor

    Path Traversal in parisneo/lollms-webui

    LowCVSS 3.3Proof of conceptEPSS 0%

    lollms · lollms-webuiJun 23, 2024

  • CVE-2024-3121
    13Monitor

    Remote Code Execution in create_conda_env function in parisneo/lollms

    LowCVSS 3.3Proof of conceptEPSS 0%

    lollms · lollmsJun 23, 2024

  • CVE-2024-27136
    42Plan

    Apache JSPWiki: Cross-site scripting vulnerability on upload page

    MediumCVSS 6.1No exploitEPSS 60%

    apache · jspwikiJun 24, 2024

  • CVE-2024-29868
    38Monitor

    Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

    CriticalCVSS 9.1Proof of conceptEPSS 5%

    apache · streampipesJun 24, 2024

  • CVE-2024-37732
    29Monitor

    Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.

    MediumCVSS 6.1No exploitEPSS 16%

    anchorcms · anchor cmsJun 24, 2024

  • CVE-2024-34312
    24Monitor

    Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplid

    MediumCVSS 6.1Proof of conceptEPSS 0%

    moodle · virtual programming labJun 24, 2024

  • CVE-2024-34313
    39Monitor

    An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Jun 24, 2024

  • CVE-2024-37759
    40Plan

    DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Vi

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    datagear · datagearJun 24, 2024

  • CVE-2023-50029
    40Plan

    PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    Jun 24, 2024

  • CVE-2024-36683
    29Monitor

    SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers t

    HighCVSS 7.3Proof of conceptEPSS 0%

    Jun 24, 2024

  • CVE-2024-6297
    40Plan

    Several WordPress.org Plugins <= Various Versions - Injected Backdoor

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    warfareplugins · social sharing plugin – social warfareJun 25, 2024

  • CVE-2024-6028
    43Plan

    Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    ays-pro · quiz makerJun 25, 2024

  • CVE-2024-37085
    66This week

    VMware ESXi contains an authentication bypass vulnerability.

    HighCVSS 7.2KEVWeaponizedEPSS 26%

    vmware · cloud foundationJun 25, 2024

  • CVE-2024-5806
    63This week

    MOVEit Transfer Authentication Bypass Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 81%

    progress · moveit transferJun 25, 2024

  • CVE-2024-4883
    58Plan

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-4884
    46Plan

    WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 24%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-4885
    99Now

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-5008
    40Plan

    WhatsUp Gold APM Unrestricted File Upload Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 17%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-5009
    38Monitor

    WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability

    HighCVSS 8.4Proof of conceptEPSS 17%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-5010
    51Plan

    WhatsUp Gold TestController multiple information disclosure vulnerabilities

    HighCVSS 7.5No exploitEPSS 69%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-5011
    44Plan

    WhatsUp Gold TestController Chart denial of service vulnerability

    HighCVSS 7.5No exploitEPSS 47%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-5276
    63This week

    SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

    CriticalCVSS 9.1WeaponizedEPSS 90%

    fortra · filecatalyst workflowJun 25, 2024

  • CVE-2024-37843
    55Plan

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    craftcms · craft cmsJun 25, 2024

  • CVE-2024-5016
    35Monitor

    WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 22%

    progress · whatsup goldJun 25, 2024

  • CVE-2024-37742
    32Monitor

    Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows.

    HighCVSS 8.2Proof of conceptEPSS 0%

    Jun 25, 2024

  • CVE-2024-38526
    29Monitor

    pdoc embeds link to malicious CDN if math mode is enabled

    HighCVSS 7.2Proof of conceptEPSS 3%

    mitmproxy · pdocJun 25, 2024

  • CVE-2024-21520
    8Monitor

    Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template f

    LowCVSS 2.1Proof of conceptEPSS 1%

    Jun 26, 2024

  • CVE-2024-33326
    24Monitor

    A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to e

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Jun 26, 2024

  • CVE-2024-4901
    31Monitor

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    MediumCVSS 5.4No exploitEPSS 33%

    gitlab · gitlabJun 26, 2024

  • CVE-2024-5535
    38Monitor

    SSL_select_next_proto buffer overread

    CriticalCVSS 9.1Proof of conceptEPSS 5%

    openssl · opensslJun 27, 2024

  • CVE-2024-5334
    31Monitor

    Local File Read in stitionai/devika

    HighCVSS 7.5Proof of conceptEPSS 2%

    stitionai · devikaJun 27, 2024

  • CVE-2024-5936
    33Monitor

    Open Redirect in imartinez/privategpt

    MediumCVSS 6.1Proof of conceptEPSS 30%

    pribai · privategptJun 27, 2024

  • CVE-2024-6250
    31Monitor

    Absolute Path Traversal in parisneo/lollms-webui

    HighCVSS 7.5Proof of conceptEPSS 1%

    lollms · lollms web uiJun 27, 2024

  • CVE-2024-6127
    60This week

    BC Security Empire Path Traversal RCE

    CriticalCVSS 9.8WeaponizedEPSS 10%

    bc security · empireJun 27, 2024

  • CVE-2024-5735
    25Monitor

    Full Path Disclosure in AdmirorFrames Joomla! Extension

    MediumCVSS 6.3Proof of conceptEPSS 1%

    admiror-design-studio · admirorframesJun 28, 2024

  • CVE-2024-5736
    32Monitor

    SSRF in AdmirorFrames Joomla! Extension

    HighCVSS 8.2Proof of conceptEPSS 1%

    admiror-design-studio · admirorframesJun 28, 2024

  • CVE-2024-5737
    25Monitor

    HTML Injection in AdmirorFrames Joomla! Extension

    MediumCVSS 6.3Proof of conceptEPSS 1%

    admiror-design-studio · admirorframesJun 28, 2024

  • CVE-2024-38514
    30Monitor

    NextChat Server-Side Request Forgery (SSRF)

    HighCVSS 7.4Proof of conceptEPSS 2%

    chatgptnextweb · chatgpt-next-webJun 28, 2024

  • CVE-2024-5827
    40Plan

    Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    vanna-ai · vanna-ai/vannaJun 28, 2024

  • CVE-2024-6265
    40Plan

    UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    ayecode · userswpJun 29, 2024

  • CVE-2024-39840
    35Monitor

    Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain

    HighCVSS 8.8Proof of conceptEPSS 0%

    Jun 29, 2024