CVEs published May 6, 2024
151 CVEs were published on May 6, 2024: 11 critical, 54 high.
- Published
- 151
- Critical
- 11
- High
- 54
- Medium
- 69
- Low
- 17
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Qualcomm Snapdragon
- 18
- Campcodes Complete Web-Based School Management System
- 14
- Open-Xchange OX App Suite
- 4
- The GNU C Library glibc
- 4
- Delta Electronics DIAEnergie
- 3
- pywasm3
- 3
- Ruijie RG-UAC
- 3
- AddonMaster Post Grid Master
- 2
- AF themes WP Post Author
- 2
- CODESYS Development System
- 2
Critical 11
- CVE-2024-4548Delta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie
- CVE-2024-4547Delta Electronics DIAEnergie Unauthenticated SQL InjectionDelta Electronics DIAEnergie
- CVE-2024-33110D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Permission Bypass via the getcfg.php component.
- CVE-2024-33294An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable
- CVE-2024-33403A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execu
- CVE-2024-33408A SQL injection vulnerability in /model/get_classroom.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to ex
- CVE-2024-33409SQL injection vulnerability in index.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary S
- CVE-2024-33411A SQL injection vulnerability in /model/get_admin_profile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker t
- CVE-2024-33749DedeCMS V5.7.114 is vulnerable to deletion of any file via mail_file_manage.php.
- CVE-2024-34249wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/spywasm3
- CVE-2024-34532A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker
High 54
- CVE-2024-29941Credential CloningIntegrated Control Technology TSEC
- CVE-2024-33602nscd: netgroup cache assumes NSS callback uses in-buffer stringsThe GNU C Library glibc
- CVE-2024-33601nscd: netgroup cache may terminate daemon on memory allocation failureThe GNU C Library glibc
- CVE-2024-33599nscd: Stack-based buffer overflow in netgroup cacheThe GNU C Library glibc
- CVE-2024-33912WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerabilityAcademy LMS
- CVE-2024-34378WordPress LeadConnector plugin <= 1.7 - API Broken Access Control vulnerabilityLeadConnector
- CVE-2024-34369WordPress Web Push Notifications – Webpushr plugin <= 4.35.0 - Cross Site Scripting (XSS) vulnerabilityWebpushr Web Push Notifications Webpushr
- CVE-2024-3661DHCP routing options can manipulate interface-based VPN trafficIETF DHCP
- CVE-2024-34367WordPress Popup Box plugin <= 4.1.2 - CSRF to XSS vulnerabilityPopup Box Team Popup box
- CVE-2024-34386WordPress Auto Affiliate Links plugin <= 6.4.3.1 - SQL Injection vulnerabilityLucian Apostol Auto Affiliate Links
- CVE-2024-34412WordPress ParcelPanel plugin <= 3.8.1 - Auth. SQL Injection vulnerabilityParcel Panel ParcelPanel
- CVE-2024-34388WordPress GDPR Compliance plugin <= 1.2.5 - Sensitive Data Exposure vulnerabilityScribit GDPR Compliance
- CVE-2024-32807WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerabilityBrevo Sendinblue for WooCommerce
- CVE-2024-34069Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command executionpallets werkzeug · werkzeug
- CVE-2024-32982Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')litestar-org litestar · starlite +1
- CVE-2024-23354Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2024-23351Improper Access Control in Graphics LinuxQualcomm Snapdragon
- CVE-2024-21480Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in AudioQualcomm Snapdragon
- CVE-2024-21477Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2024-21476Improper Input Validation in Secure ProcessorQualcomm Snapdragon
- CVE-2024-21475Use of Out-of-range Pointer Offset in VideoQualcomm Snapdragon
- CVE-2024-21474Stack-based Buffer Overflow in PMICQualcomm Snapdragon
- CVE-2024-21471Use After Free in Graphics LinuxQualcomm Snapdragon
- CVE-2023-43531Access of Uninitialized Pointer in SPS ApplicationsQualcomm Snapdragon
- CVE-2023-43529Reachable Assertion in Data ModemQualcomm Snapdragon
- CVE-2023-33119Time-of-check Time-of-use (TOCTOU) Race Condition in HypervisorQualcomm Snapdragon
- CVE-2024-32972go-ethereum denial of service via malicious p2p messagego-ethereum · github.com/ethereum/go-ethereum
- CVE-2024-4549Delta Electronics DIAEnergie SQL Injection Delta Electronics DIAEnergie
- CVE-2024-3576NPort 5100A Series Store XSS VulnerabilityMoxa NPort 5100A Series
- CVE-2023-49675CODESYS: Out-of-bounds write through corrupted project filesCODESYS Development System
- CVE-2024-3756MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRFMF Gig Calendar
- CVE-2024-20064In wlan service, there is a possible out of bounds write due to improper input validation.MediaTek MT6580, MT6761, MT6762, MT6768, MT6781, MT6789, MT…
- CVE-2024-20057In keyInstall, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…
- CVE-2024-28725Cross Site Scripting (XSS) vulnerability in YzmCMS 7.0 allows attackers to run arbitrary code via Ads Management, Carousel Management, and S
- CVE-2024-30973An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitiv
- CVE-2024-33112D-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func.
- CVE-2024-33118LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary read vulnerability via the fileDownload method in class com.luckyframe.project.c
- CVE-2024-33404A SQL injection vulnerability in /model/add_student_first_payment.php in campcodes Complete Web-Based School Management System 1.0 allows at
- CVE-2024-33405SQL injection vulnerability in add_friends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbit
- CVE-2024-33406SQL injection vulnerability in /model/delete_student_grade_subject.php in campcodes Complete Web-Based School Management System 1.0 allows a
- CVE-2024-33410SQL injection vulnerability in /model/delete_range_grade.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to
- CVE-2024-33753Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed
- CVE-2024-33788Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the PinCode parameter at /API/info form endpoint.
- CVE-2024-33830idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=clearWebCache.
- CVE-2024-34089An issue was discovered in Archer Platform 6 before 2024.04.
- CVE-2024-34090An issue was discovered in Archer Platform 6 before 2024.04.
- CVE-2024-34091An issue was discovered in Archer Platform 6 before 2024.04.
- CVE-2024-34246wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platfopywasm3
- CVE-2024-34251An out-of-bound memory read vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to ca
- CVE-2024-34252wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupipywasm3
- CVE-2024-34470An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18.
- CVE-2024-34533A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a
- CVE-2024-34534A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote at
- CVE-2024-34538Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography.
Medium, low and unrated 86
- CVE-2024-2913Race Condition Vulnerability in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-1695A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which mighHP Application Enabling Software Driver
- CVE-2024-34413WordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilitySliceWP
- CVE-2024-4568Stack overflow in Xpdf 4.05 due to object loop in PDF resourcesXpdf
- CVE-2024-33570WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerabilityRoxnor Metform
- CVE-2024-33576WordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerabilityOllybach WPPizza
- CVE-2024-33600nscd: Null pointer crashes after notfound responseThe GNU C Library glibc
- CVE-2024-33907WordPress Print My Blog plugin <= 3.26.2 - Broken Access Control vulnerabilityMichael Nelson Print My Blog
- CVE-2024-33908WordPress WidgetKit plugin <= 2.5.0 - Broken Access Control vulnerabilityThemesgrove WidgetKit
- CVE-2024-33910WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Broken Access Control vulnerabilityDigital Publications by Supsystic
- CVE-2024-34371WordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerabilityHamid Alinia Login with phone number
- CVE-2024-34372WordPress Post Grid Master plugin <= 3.4.7 - Broken Access Control vulnerabilityAddonMaster Post Grid Master
- CVE-2024-34377WordPress Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control vulnerabilityA WP Life Video Gallery – Api Gallery, YouTube and Vimeo, L…
- CVE-2024-34387WordPress WP Post Author plugin <= 3.6.4 - Rating Value Manipulation vulnerabilityAF themes WP Post Author
- CVE-2024-34389WordPress WP Post Author plugin <= 3.6.4 - Broken Access Control vulnerabilityAF themes WP Post Author
- CVE-2024-34366WordPress AltText.ai plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilityAltText.ai Download Alt Text AI
- CVE-2024-34373WordPress The Plus Addons for Elementor plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerabilityPOSIMYTH The Plus Addons for Elementor Page Builder Lite
- CVE-2024-34374WordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerabilityQuomodoSoft ElementsReady Addons for Elementor
- CVE-2024-34375WordPress Sheets to WP Table Live Sync plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerabilityWPPOOL Sheets To WP Table Live Sync
- CVE-2024-34376WordPress Edge theme <= 2.0.9 - Cross Site Scripting (XSS) vulnerabilityTheme Freesia Edge
- CVE-2024-34380WordPress ChatBot Conversational Forms plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityQuantumCloud Conversational Forms for ChatBot
- CVE-2024-34381WordPress PropertyHive plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerabilityPropertyHive
- CVE-2024-34390WordPress Post Grid Master plugin <= 3.4.8 - Auth. Cross Site Scripting (XSS) vulnerabilityAddonMaster Post Grid Master
- CVE-2024-34379WordPress Restaurant and Cafe theme <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityRara Theme Restaurant and Cafe
- CVE-2024-34368WordPress Mooberry Book Manager plugin <= 4.15.12 - Sensitive Data Exposure vulnerabilityMooberry Dreams Mooberry Book Manager
- CVE-2024-34382WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.18 - Sensitive Data Exposure vulnerabilityRoboSoft Robo Gallery
- CVE-2024-34383WordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerabilityThe SEO Guys at SEOPress SEOPress
- CVE-2024-34078html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalizationmatthiask html-sanitizer · html-sanitizer
- CVE-2024-34064Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filterpallets jinja · jinja2
- CVE-2023-43530Integer Overflow or Wraparound in HLOSQualcomm Snapdragon
- CVE-2023-43528Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2023-43527Buffer Over-read in VideoQualcomm Snapdragon
- CVE-2023-43526Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in AudioQualcomm Snapdragon
- CVE-2023-43525Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in AudioQualcomm Snapdragon
- CVE-2023-43524Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in AudioQualcomm Snapdragon
- CVE-2023-43521Use After Free in HLOSQualcomm Snapdragon
- CVE-2023-49676CODESYS: Use after free vulnerability through corrupted project filesCODESYS Development System
- CVE-2023-6854Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmetaBreakdance
- CVE-2024-23193E-Mails exported as PDF were stored in a cache that did not consider specific session information for the related user account.Open-Xchange OX App Suite
- CVE-2024-23188Maliciously crafted E-Mail attachment names could be used to temporarily execute script code in the context of the users browser session.Open-Xchange OX App Suite
- CVE-2024-23187Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option.Open-Xchange OX App Suite
- CVE-2024-23186E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices.Open-Xchange OX App Suite
- CVE-2024-4528SourceCodester Prison Management System user-record.php cross site scriptingSourceCodester Prison Management System
- CVE-2024-4527Campcodes Complete Web-Based School Management System student_payment_details2.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4526Campcodes Complete Web-Based School Management System student_payment_details3.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-3755MF Gig Calendar <= 1.2.1 - Editor+ Stored XSSMF Gig Calendar
- CVE-2024-3752Crelly Slider <= 1.4.5 - Admin+ Stored XSSCrelly Slider
- CVE-2024-0904Fancy Product Designer < 6.1.81 - Admin+ Cross Site ScriptingFancy Product Designer
- CVE-2024-4525Campcodes Complete Web-Based School Management System student_payment_details4.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4524Campcodes Complete Web-Based School Management System student_payment_invoice.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4523Campcodes Complete Web-Based School Management System teacher_attendance_history1.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4522Campcodes Complete Web-Based School Management System teacher_salary_details.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4521Campcodes Complete Web-Based School Management System teacher_salary_details2.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4519Campcodes Complete Web-Based School Management System teacher_salary_details3.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4518Campcodes Complete Web-Based School Management System teacher_salary_invoice.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4517Campcodes Complete Web-Based School Management System teacher_salary_invoice1.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-20021In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error.MediaTek MT6768, MT6781, MT6785, MT6833, MT6853, MT6873, MT…
- CVE-2024-20060In da, there is a possible escalation of privilege due to an incorrect status check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2024-20059In da, there is a possible escalation of privilege due to an incorrect status check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6781, MT…
- CVE-2024-20058In keyInstall, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6765, MT6768, MT6785, MT6833, MT6853, MT6855, MT…
- CVE-2023-32871In DA, there is a possible permission bypass due to an incorrect status check.MediaTek MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT…
- CVE-2023-32873In keyInstall, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6833, MT6853, MT6855, MT…
- CVE-2024-20056In preloader, there is a possible escalation of privilege due to an insecure default value.MediaTek MT6739, MT6761, MT6765, MT6768, MT6781, MT6785, MT…
- CVE-2024-4516Campcodes Complete Web-Based School Management System timetable.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4515Campcodes Complete Web-Based School Management System timetable_grade_wise.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4514Campcodes Complete Web-Based School Management System timetable_insert_form.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4513Campcodes Complete Web-Based School Management System timetable_update_form.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4512SourceCodester Prison Management System edit-profile.php cross site scriptingSourceCodester Prison Management System
- CVE-2024-4511Shanghai Sunfull Automation BACnet Server HMI1002-ARM Message buffer overflowShanghai Sunfull Automation BACnet Server HMI1002-ARM
- CVE-2024-4510Ruijie RG-UAC arp_add_commit.php os command injectionRuijie RG-UAC
- CVE-2024-4509Ruijie RG-UAC add_commit.php os command injectionRuijie RG-UAC
- CVE-2024-4508Ruijie RG-UAC static_route_edit_ipv6.php os command injectionRuijie RG-UAC
- CVE-2023-33548Cross Site Scripting (XSS) vulnerability in ASUS RT-AC51U with firmware versions up to and including 3.0.0.4.380.8591 allows attackers to ru
- CVE-2024-26312Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability.
- CVE-2024-33111D-Link DIR-845L router <=v1.01KRb03 is vulnerable to Cross Site Scripting (XSS) via /htdocs/webinc/js/bsc_sms_inbox.php.
- CVE-2024-33113D-LINK DIR-845L <=v1.01KRb03 is vulnerable to Information disclosurey via bsc_sms_inbox.php.
- CVE-2024-33117crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageM
- CVE-2024-33121Roothub v2.6 was discovered to contain a SQL injection vulnerability via the 's' parameter in the search() function.
- CVE-2024-33407SQL injection vulnerability in /model/delete_record.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to exec
- CVE-2024-33752An arbitrary file upload vulnerability exists in emlog pro 2.3.0 and pro 2.3.2 at admin/views/plugin.php that could be exploited by a remote
- CVE-2024-33829idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/readDeal.php?mudi=updateWebCache.
- CVE-2024-34092An issue was discovered in Archer Platform 6 before 2024.04.
- CVE-2024-34093An issue was discovered in Archer Platform 6 before 2024.03.
- CVE-2024-34250A heap buffer overflow vulnerability was discovered in Bytecode Alliance wasm-micro-runtime v2.0.0 which allows a remote attacker to cause a
- CVE-2024-34471An issue was discovered in HSC Mailinspector 5.2.17-3.
- CVE-2024-34472An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18.