June 2024
3,333 CVEs published, −38% on May 2024 and +36% on June 2023. CISA added 9 to KEV.
2024 month by month
- Critical
- 31310% of the 3,093 with a CVSS score
- Added to CISA KEV
- 913 of this month's CVEs are in KEV, listed a median 58 days after publication
- Vendors
- 1,4694,485 products
- Top weakness
- XSSCWE-79 · 643 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Webkitgtk360162new
- 2Ооо «ред Софт»Ред Ос286112new
- 3LinuxLinux, Linux Kernel28551new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»227131new
- 5Ао "нппкт"Осон Основа Оnyx21112nonenew
- 6AdobeExperience Manager, Adobe Experience Manager, Commerce Webhooks16741new
- 7PackagistTypo3/cms, Zendframework/zendframework1, Zendframework/zendframework16521new
- 8Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 91205nonenew
- 9CanonicalUbuntu, Ubuntu Linux, Apport9441new
- 10MicrosoftMicrosoft Edge, Windows Server 2019, Windows Server 2019 (Server Core Installation)8523new
- 11PyPIMlflow, Lollms, Zenml8315nonenew
- 12GoogleAndroid, Google Chrome, Chrome8261new
- 13UnknownArforms - Premium WordPress Form Builder Plugin, Widget Bundle, Wp Logs Book823nonenew
- 14Ао «ивк»Альт Сп 10, Альт 8 Сп5371new
- 15IBMInfosphere Information Server, Security Access Manager, Security Access Manager Docker510nonenew
- 16Ао «нтц Ит Роса»Rosa Virtualization 3.0, Rosa Virtualization, Роса Хром4561new
- 17ItsourcecodePool of Bethesda Online Reservation System, Tailoring Management System, Bakery Online Ordering System442nonenew
- 18Toshiba Tec CorporationToshiba Tec E-studio Multi-function Peripheral (Mfp), Toshiba E-studio 5008lp Series, Toshiba E-studio 5018a Series436nonenew
- 19ApplemacOS, iOS and iPadOS, iPhone OS410nonenew
- 20SamsungExynos 1330 Firmware, Exynos 1280 Firmware, Exynos 1380 Firmware400nonenew
- 21DellPowerprotect Dd, Data Domain Operating System, Cpg Bios340nonenew
- 22GoGithub.com/evmos/evmos/v14, Github.com/evmos/evmos/v16, Github.com/evmos/evmos/v17333nonenew
- 23npm@janhq/core, Lunary, Tinymce336nonenew
- 24MavenCom.reposilite:reposilite-backend, Org.keycloak:keycloak-services, Org.apache.submarine:submarine-server-core318nonenew
- 25FedoraprojectFedora3011new
Severity
How this month's CVEs score on CVSS; 240 have no score yet. Severity is not exploitation.
- Critical313
- High942
- Medium1,727
- Low111
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS643
- CWE-862Missing Authorization311
- CWE-89SQL Injection164
- CWE-787Out-of-bounds Write118
- CWE-22Path Traversal104
- CWE-352CSRF77
- CWE-476NULL Pointer Dereference72
- CWE-125Out-of-bounds Read70
- CWE-416Use After Free69
- CWE-94Code Injection58
- CWE-200Information Exposure57
- CWE-284Improper Access Control53
- CWE-434Unrestricted File Upload47
- CWE-20Improper Input Validation46
- CWE-287Improper Authentication46
- CWE-78OS Command Injection38
- CWE-918SSRF37
- CWE-12135
- CWE-502Deserialization35
- CWE-863Incorrect Authorization35
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins95225% of sector-tagged CVEs
- Operating Systems59115% of sector-tagged CVEs
- OSS Libraries43711% of sector-tagged CVEs
- Enterprise Software41411% of sector-tagged CVEs
- Consumer Software2527% of sector-tagged CVEs
- Mobile Apps1775% of sector-tagged CVEs
- AI / ML1714% of sector-tagged CVEs
- 8 smaller sectors644
- Not yet classified214
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 787Out-of-bounds Write | 22Path Traversal | 352CSRF | 476NULL Pointer Dereference | 125Out-of-bounds Read | 416Use After Free | 94Code Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 4 | 2 | 18 | 3 | 60 | 22 | 38 | 5 | ||
| Ооо «ред Софт» | 3 | 1 | 15 | 3 | 1 | 44 | 16 | 38 | 1 | |
| Linux | 12 | 60 | 18 | 29 | ||||||
| Ооо «русбитех-астра» | 1 | 13 | 2 | 33 | 14 | 31 | 1 | |||
| Ао «нппкт» | 13 | 32 | 14 | 30 | 2 | |||||
| Adobe | 142 | 1 | 1 | 1 | 3 | |||||
| Adobe Systems Inc. | 142 | 1 | 1 | 1 | 3 | |||||
| Packagist | 40 | 2 | 8 | 3 | 6 | 4 | ||||
| Red Hat Inc. | 5 | 17 | 6 | 14 | 1 | |||||
| Canonical Ltd. | 3 | 8 | 14 | 6 | 8 | |||||
| PyPI | 9 | 3 | 2 | 14 | 1 | 8 | ||||
| Microsoft Corp | 5 | 3 | 19 | 1 |
CVEs published in June 2024
51 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2024-34102XXE can expose crypt key and other secrets granting full admin accessKEV9.8
- CVE-2024-37079vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending...KEV9.8
- CVE-2024-4577Argument Injection in PHP-CGIKEV9.8
- CVE-2024-4885WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution VulnerabilityKEV9.8
- CVE-2024-6047GeoVision EOL device - OS Command InjectionKEV9.8
- CVE-2024-28995SolarWinds Serv-U L Directory Transversal VulnerabilityKEV8.6
- CVE-2024-32896there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for ...KEV7.8
- CVE-2024-35250Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-36971net: fix __dst_negative_advice() raceKEV7.8
- CVE-2024-4610Mali GPU Kernel Driver allows improper GPU memory processing operationsKEV7.8
- CVE-2024-30088Windows Kernel Elevation of Privilege VulnerabilityKEV7.0
- CVE-2024-37085VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configure...KEV6.8
- CVE-2024-37383Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.KEV6.1
- CVE-2024-3105Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution9.9
- CVE-2024-3552Web Directory Free < 1.7.0 - Unauthenticated SQL Injection9.8
- CVE-2024-5261TLS certificate are not properly verified when utilizing LibreOfficeKit9.8
- CVE-2024-23668An improper authorization in Fortinet FortiWebManager 7.2.0, FortiWebManager 7.0.0 through 7.0.4, FortiWebManager 6.3.0, FortiWebManager 6.2.3 through 6.2.4, FortiWebManager 6.0.2 allows attacker t...8.8
- CVE-2024-3150Privilege Escalation in mintplex-labs/anything-llm8.8
- CVE-2024-32030Remote code execution via JNDI resolution in JMX metrics collection in Kafka UI8.1
- CVE-2024-35260Microsoft Dataverse Remote Code Execution Vulnerability8.0
- CVE-2024-0084CVE7.8
- CVE-2024-32703WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerability7.7
- CVE-2024-2178Path Traversal Vulnerability in parisneo/lollms-webui7.5
- CVE-2024-36760A stack overflow vulnerability was found in version 1.18.0 of rhai. The flaw position is: (/ SRC/rhai/SRC/eval/STMT. Rs in rhai: : eval: : STMT: : _ $LT $impl $u20 $rhai.. engine.. Engine$GT$::eval...7.5
- CVE-2024-5334Local File Read in stitionai/devika7.5
- CVE-2024-21514This affects versions of the package opencart/opencart from 0.0.0. An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3....7.4
- CVE-2024-21740Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control.7.4
- CVE-2024-38514NextChat Server-Side Request Forgery (SSRF)7.4
- CVE-2024-1094Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation7.3
- CVE-2024-38355Unhandled 'error' event in socket.io7.3
- CVE-2024-6192itsourcecode Loan Management System Login Page login.php sql injection7.3
- CVE-2024-34055Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many LITERALs in a single command.6.5
- CVE-2024-5588itsourcecode Learning Management System processscore.php sql injection6.3
- CVE-2024-34385WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability5.9
- CVE-2024-32824WordPress Evergreen Content Poster plugin <= 1.4.2 - Broken Access Control vulnerability5.4
- CVE-2024-35657WordPress WP-Recall plugin <= 16.26.6 - Cross Site Request Forgery (CSRF) vulnerability5.4
- CVE-2024-37673Cross Site Scripting vulnerability in Tessi Docubase Document Management product 5.x allows a remote attacker to execute arbitrary code via the filename parameter.5.4
- CVE-2024-22298WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability5.3
- CVE-2024-28397An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.5.3
- CVE-2024-34763WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.5 - Broken Access Control vulnerability5.3
- CVE-2024-34821WordPress Contact List plugin <= 2.9.87 - Broken Access Control vulnerability5.3
- CVE-2024-35650WordPress MelaPress Login Security plugin <= 1.3.0 - Remote File Inclusion vulnerability4.9
- CVE-2024-38379Apache Allura: Stored authenticated XSS4.8
- CVE-2024-4664WP Chat App < 3.6.5 - Admin+ Stored XSS4.8
- CVE-2024-5557CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause exposure of SNMP credentials when an attacker has access to the controller logs.4.5
- CVE-2024-35633WordPress Blocksy Companion plugin <= 2.0.42 - Server Side Request Forgery (SSRF) vulnerability4.4
- CVE-2024-22244Harbor Open Redirect URL4.3
- CVE-2024-35723WordPress Dashboard To-Do List plugin <= 1.2.0 - Broken Access Control vulnerability4.3
- CVE-2024-20875Improper caller verification vulnerability in SemClipboard prior to SMR June-2024 Release 1 allows local attackers to access arbitrary files.4.0
- CVE-2024-26127Adobe Experience Manager | Improper Input Validation (CWE-20)3.5
- CVE-2024-6252Zorlan SkyCaiji Task cross site scripting2.4