CVEs published May 8, 2024
114 CVEs were published on May 8, 2024: 23 critical, 25 high. 1 is now in CISA KEV.
- Published
- 114
- Critical
- 23
- High
- 25
- Medium
- 56
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 29
Most affected products
- Campcodes Complete Web-Based School Management System
- 7
- F5 BIG-IP
- 7
- F5 BIG-IP Next Central Manager
- 4
- Fedora dnf5daemon-server
- 3
- BlueNet Technology Clinical Browsing System
- 2
- Dell Data Manager Appliance Software
- 2
- etcd · Red Hat OpenStack Platform
- 2
- SourceCodester Prison Management System
- 2
- VMware Avi Load Balancer
- 2
- AIpost AI WP Writer
- 1
Critical 23
- CVE-2024-26517SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to t
- CVE-2024-27280A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.stringio
- CVE-2024-26579Apache Inlong JDBC VulnerabilityApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2024-32113Apache OFBiz: Path traversal leading to RCEApache Software Foundation Apache OFBiz
- CVE-2024-32980Spin contains a potential network sandbox escape for specifically configured Spin applicationsfermyon spin · spin-sdk
- CVE-2024-4393Social Connect <= 1.2 - Authentication Bypassthenbrent Social Connect
- CVE-2024-25517RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx.
- CVE-2024-25518RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_a
- CVE-2024-25519RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx.
- CVE-2024-25520RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.as
- CVE-2024-25521RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx.
- CVE-2024-25522RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_f
- CVE-2024-25523RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx.
- CVE-2024-25524RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPla
- CVE-2024-25525RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload
- CVE-2024-25527RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_s
- CVE-2024-25529RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_s
- CVE-2024-25530RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condictio
- CVE-2024-25531RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.a
- CVE-2024-25532RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/get_dict.aspx.
- CVE-2024-25533Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFileUpdate.aspx).
- CVE-2024-31961A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands vi
- CVE-2024-34257TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrar
High 25
- CVE-2024-34196Totolink AC1200 Wireless Dual Band Gigabit Router A3002RU_V3 Firmware V3.0.0-B20230809.1615 is vulnerable to Buffer Overflow.
- CVE-2024-34308TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode.
- CVE-2024-26026BIG-IP Central Manager SQL InjectionF5 BIG-IP Next Central Manager
- CVE-2024-21793BIG-IP Central Manager OData Injection VulnerabilityF5 BIG-IP Next Central Manager
- CVE-2024-31156BIG-IP Configuration utility XSS vulnerabilityF5 BIG-IP
- CVE-2024-32049BIG-IP Next Central Manager vulnerabilityF5 BIG-IP Next Central Manager
- CVE-2024-25560TMM VulnerabilityF5 BIG-IP
- CVE-2024-33608BIG-IP IPsec vulnerabilityF5 BIG-IP
- CVE-2024-28883BIG-IP APM browser network access VPN client vulnerabilityF5 BIG-IP Edge Client · F5 BIG-IP
- CVE-2024-3951Cross-site Scripting in PTC CodebeamerPTC Codebeamer
- CVE-2024-34347@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCEhoppscotch · @hoppscotch/cli
- CVE-2024-31270WordPress ARForms Form Builder plugin <= 1.6.1 - Broken Access Control vulnerabilityRepute InfoSystems ARForms Form Builder
- CVE-2024-1438WordPress Rolo Slider plugin <= 1.0.9 - Broken Access Control vulnerabilityPressFore Rolo Slider
- CVE-2024-34553WordPress Stockholm Core plugin <= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilitySelect-Themes Stockholm Core
- CVE-2024-3507Privilege escalation vulnerability in LunarLunar
- CVE-2024-4438Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platformetcd · Red Hat OpenStack Platform
- CVE-2024-4437Etcd: incomplete fix for cve-2021-44716 in openstack platformetcd · Red Hat OpenStack Platform
- CVE-2024-4436Etcd: incomplete fix for cve-2022-41723 in openstack platformetcd as shipped in Red Hat Openstack · Red Hat OpenStack Pl…
- CVE-2024-22264VMware Avi Load Balancer updates address multiple vulnerabilitiesVMware Avi Load Balancer
- CVE-2024-2746Incomplete fix for CVE-2024-1929Fedora dnf5daemon-server
- CVE-2024-1929Local Root Exploit via Configuration Dictionary Fedora dnf5daemon-server
- CVE-2024-2860The PostgreSQL implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication flaw.Brocade SAnnav
- CVE-2024-25515RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work
- CVE-2024-25526RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc
- CVE-2024-34244libmodbus v3.1.10 is vulnerable to Buffer Overflow via the modbus_write_bits function.
Medium, low and unrated 66
- CVE-2024-27793The issue was addressed with improved checks.Apple iTunes for Windows
- CVE-2024-27281An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.rdoc
- CVE-2024-27282An issue was discovered in Ruby 3.x through 3.3.0.
- CVE-2024-28759A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09.
- CVE-2024-22460Dell PowerProtect DM5500 version 5.15.0.0 and prior contains an insecure deserialization Vulnerability.Dell Data Manager Appliance Software
- CVE-2024-24908Dell PowerProtect DM5500 version 5.15.0.0 and prior contain an Arbitrary File Delete via Path Traversal vulnerability.Dell Data Manager Appliance Software
- CVE-2024-28971Dell Update Manager Plugin, versions 1.4.0 through 1.5.0, contains a Plain-text Password Storage Vulnerability in Log file.Dell Update Manager Plugin
- CVE-2024-24787Arbitrary code execution during build on Darwin in cmd/goGo toolchain cmd/go · toolchain
- CVE-2024-24788Malformed DNS message can cause infinite loop in netGo standard library net · stdlib
- CVE-2024-32761BIG-IP TMM tenants on VELOS and rSeries vulnerabilityF5 BIG-IP
- CVE-2024-33612BIG-IP Next Central Manager vulnerabilityF5 BIG-IP Next Central Manager
- CVE-2024-33604BIG-IP Configuration utility XSS vulnerability F5 BIG-IP
- CVE-2024-28132BIG-IP NEXT CNF vulnerability F5 BIG-IP Next CNF
- CVE-2024-28889 BIG-IP SSL vulnerabilityF5 BIG-IP
- CVE-2024-27202BIG-IP TMUI XSS vulnerabilityF5 BIG-IP
- CVE-2024-4654BlueNet Technology Clinical Browsing System cloudInterface.php sql injectionBlueNet Technology Clinical Browsing System
- CVE-2024-4653BlueNet Technology Clinical Browsing System outIndex.php sql injectionBlueNet Technology Clinical Browsing System
- CVE-2024-32886Vitess vulnerable to infinite memory consumption and vtgate crashvitessio vitess · vitess.io/vitess +1
- CVE-2024-4652Campcodes Complete Web-Based School Management System show_teacher2.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4651Campcodes Complete Web-Based School Management System student_attendance_history1.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-33573WordPress EPROLO Dropshipping plugin <= 1.7.1 - Broken Access Control vulnerabilityEPROLO Dropshipping
- CVE-2024-33574WordPress Vitepos plugin <= 3.0.1 - Broken Access Control vulnerabilityappsbd Vitepos
- CVE-2024-4650Campcodes Complete Web-Based School Management System student_due_payment.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4649Campcodes Complete Web-Based School Management System student_exam_mark_insert_form1.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-24833WordPress Happy Addons for Elementor plugin <= 3.10.1 - Broken Access Control on Post Clone vulnerabilityHappyMonster Happy Addons for Elementor
- CVE-2024-30459WordPress AI WP Writer plugin <= 3.6.5 - Broken Access Control vulnerabilityAIpost AI WP Writer
- CVE-2024-4233Broken Access Control vulnerability in multiple WordPress plugins by Tyche SoftwaresTyche Softwares Print Invoice & Delivery Notes for WooCo… +1
- CVE-2024-4648Campcodes Complete Web-Based School Management System student_exam_mark_update_form.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4647Campcodes Complete Web-Based School Management System student_first_payment.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4646Campcodes Complete Web-Based School Management System student_payment_details.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4645SourceCodester Prison Management System changepassword.php cross site scriptingSourceCodester Prison Management System
- CVE-2022-40218WordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerabilityThemeHunk Advance WordPress Search Plugin
- CVE-2024-34414WordPress Raindrops theme <= 1.600 - Cross Site Scripting (XSS) vulnerabilityNobita raindrops
- CVE-2024-34546WordPress Sticky Social Link plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityHabibur Rahman Sticky Social Link
- CVE-2024-34547WordPress Magical Addons For Elementor plugin <= 1.1.34 - Cross Site Scripting (XSS) vulnerabilityNoor alam Magical Addons For Elementor
- CVE-2024-4644SourceCodester Prison Management System changepassword.php cross site scriptingSourceCodester Prison Management System
- CVE-2024-34548WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerabilityThemesgrove WidgetKit
- CVE-2024-34558WordPress WOLF plugin <= 1.0.8.2 - Cross Site Scripting (XSS) vulnerabilityrealmag777 WOLF
- CVE-2024-34560WordPress gee Search Plus plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerabilityGOMO gee Search Plus
- CVE-2024-34561WordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerabilityCreative interactive media 3D FlipBook, PDF Viewer, PDF Emb…
- CVE-2024-34562WordPress Move Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityMoveaddons Move Addons for Elementor
- CVE-2024-34563WordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityGoldAddons Gold Addons for Elementor
- CVE-2024-34564WordPress Counter Up plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerabilityLogicHunt Counter Up
- CVE-2024-34565WordPress Debug Info plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerabilityAMP-MODE Debug Info
- CVE-2024-34566WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerabilityJohan van der Wijk Content Blocks
- CVE-2024-34568WordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerabilityThemeqx LetterPress
- CVE-2024-34569WordPress Zotpress plugin <= 7.3.9 - Cross Site Scripting (XSS) vulnerabilityKatie Zotpress
- CVE-2024-34570WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityXpro Elementor Addons
- CVE-2024-34571WordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityThemeGrill Himalayas
- CVE-2024-4135WP Latest Posts <= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Executionjoomunited WP Latest Posts
- CVE-2024-4281Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcodejackdewey Link Library
- CVE-2024-34572WordPress Fancy Elementor Flipbox plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerabilityThemePrix Fancy Elementor Flipbox
- CVE-2024-34573WordPress Pootle Pagebuilder plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerabilityPootlepress Pootle Pagebuilder – WordPress Page builder
- CVE-2024-34574WordPress Table Maker plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerabilityWpsoul Table Maker
- CVE-2023-41651WordPress Multi-column Tag Map plugin <= 17.0.26 - Broken Access Control vulnerabilityMulti-column Tag Map
- CVE-2024-1076SSL Zen <= 4.5.3 - Unauthenticated Private Keys AccessSSL Zen
- CVE-2024-3494Mesmerize Companion <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcodehorearadu Mesmerize Companion
- CVE-2024-22266VMware Avi Load Balancer updates address multiple vulnerabilitiesVMware Avi Load Balancer
- CVE-2024-32674Heateor Social Login WordPress prior to 1.1.32 contains a cross-site scripting vulnerability.Heateor Social Login WordPress
- CVE-2024-4418Libvirt: stack use-after-free in virnetclientioeventloop()libvirt · Red Hat Enterprise Linux
- CVE-2024-4162KW Watcher Vulnerability ALlows Malicious Read Access to MemoryPanasonic Holdings KW Watcher
- CVE-2024-1930No Limit on Number of Open Sessions / Bad Session Close BehaviourFedora dnf5daemon-server
- CVE-2024-4456In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page.Octopus Deploy Octopus Server
- CVE-2024-25528RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_s
- CVE-2024-33382An issue in Open5GS v.2.7.0 allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration
- CVE-2024-34255jizhicms v2.5.1 contains a Cross-Site Scripting(XSS) vulnerability in the message function.