Total
396035 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-38861 | 1 Tomtretbar | 1 Mikrotik | 2026-06-17 | N/A | 7.4 HIGH |
| Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4a_mk through 2.0a. | |||||
| CVE-2024-38860 | 1 Checkmk | 1 Checkmk | 2026-06-17 | N/A | 6.1 MEDIUM |
| Improper neutralization of input in Checkmk before versions 2.3.0p16 and 2.2.0p34 allows attackers to craft malicious links that can facilitate phishing attacks. | |||||
| CVE-2024-38859 | 1 Checkmk | 1 Checkmk | 2026-06-17 | N/A | 6.1 MEDIUM |
| XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 (EOL) allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by other users. | |||||
| CVE-2024-38858 | 1 Checkmk | 1 Checkmk | 2026-06-17 | N/A | 6.1 MEDIUM |
| Improper neutralization of input in Checkmk before version 2.3.0p14 allows attackers to inject and run malicious scripts in the Robotmk logs view. | |||||
| CVE-2024-38857 | 1 Checkmk | 1 Checkmk | 2026-06-17 | N/A | 4.3 MEDIUM |
| Improper neutralization of input in Checkmk before versions 2.3.0p8, 2.2.0p28, 2.1.0p45, and 2.0.0 (EOL) allows attackers to craft malicious links that can facilitate phishing attacks. | |||||
| CVE-2024-38856 | 1 Apache | 1 Ofbiz | 2026-06-17 | N/A | 9.8 CRITICAL |
| Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints). | |||||
| CVE-2024-38834 | 1 Vmware | 2 Aria Operations, Cloud Foundation | 2026-06-17 | N/A | 6.5 MEDIUM |
| VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | |||||
| CVE-2024-38833 | 1 Vmware | 2 Aria Operations, Cloud Foundation | 2026-06-17 | N/A | 6.8 MEDIUM |
| VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | |||||
| CVE-2024-38832 | 1 Vmware | 2 Aria Operations, Cloud Foundation | 2026-06-17 | N/A | 7.1 HIGH |
| VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations. | |||||
| CVE-2024-38831 | 1 Vmware | 2 Aria Operations, Cloud Foundation | 2026-06-17 | N/A | 7.8 HIGH |
| VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root user on the appliance running VMware Aria Operations. | |||||
| CVE-2024-38830 | 1 Vmware | 2 Aria Operations, Cloud Foundation | 2026-06-17 | N/A | 7.8 HIGH |
| VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance running VMware Aria Operations. | |||||
| CVE-2024-38829 | 2026-06-17 | N/A | 3.7 LOW | ||
| A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried Related to CVE-2024-38820 https://spring.io/security/cve-2024-38820 | |||||
| CVE-2024-38828 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack. | |||||
| CVE-2024-38827 | 2026-06-17 | N/A | 4.8 MEDIUM | ||
| The usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in authorization rules not working properly. | |||||
| CVE-2024-38826 | 2026-06-17 | N/A | N/A | ||
| Authenticated users can upload specifically crafted files to leak server resources. This behavior can potentially be used to run a denial of service attack against Cloud Controller. The Cloud Foundry project recommends upgrading the following releases: * Upgrade capi release version to 1.194.0 or greater * Upgrade cf-deployment version to v44.1.0 or greater. This includes a patched capi release | |||||
| CVE-2024-38825 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted. | |||||
| CVE-2024-38824 | 1 Saltstack | 1 Salt | 2026-06-17 | N/A | 9.6 CRITICAL |
| Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory. | |||||
| CVE-2024-38823 | 2026-06-17 | N/A | 2.7 LOW | ||
| Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport. | |||||
| CVE-2024-38822 | 2026-06-17 | N/A | 2.7 LOW | ||
| Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion. | |||||
| CVE-2024-38821 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be using Spring's static resources support * It must have a non-permitAll authorization rule applied to the static resources support | |||||