CVEs published May 10, 2024
104 CVEs were published on May 10, 2024: 10 critical, 18 high.
- Published
- 104
- Critical
- 10
- High
- 18
- Medium
- 75
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Campcodes Legal Case Management System
- 14
- Campcodes Complete Web-Based School Management System
- 10
- Digisol Router DG-GR1321
- 3
- IBM TXSeries for Multiplatforms
- 3
- thimpress LearnPress – WordPress LMS Plugin for Create and…
- 3
- unitecms Unlimited Elements For Elementor
- 3
- wpdevteam Essential Addons for Elementor – Popular Elemento…
- 3
- reCAPTCHA Jetpack
- 2
- VikBooking Hotel Booking Engine & PMS
- 2
- abetlen llama-cpp-python · llama-cpp-python
- 1
Critical 10
- CVE-2024-4413Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injectionjetmonsters MotoPress Hotel Booking
- CVE-2024-4701Path Traversal vulnerability via File Uploads in GenieNetflix Genie · com.netflix.genie:genie-web
- CVE-2024-34359llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadataabetlen llama-cpp-python · llama-cpp-python
- CVE-2024-34070Froxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromiseFroxlor · froxlor/froxlor
- CVE-2024-32964lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerabilitylobehub lobe-chat · @lobehub/chat
- CVE-2024-2257Password Policy Bypass Vulnerability in Digisol RouterDigisol Router DG-GR1321
- CVE-2024-34943Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/Nat
- CVE-2024-34945Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the PPW parameter at ip/goform/Wiza
- CVE-2024-4434LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injectionthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-30802An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html component.
High 18
- CVE-2024-3055Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Contributor+) SQL Injectionunitecms Unlimited Elements For Elementor
- CVE-2024-34310Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter.
- CVE-2024-33818Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference (IDOR) via the userID parameter.
- CVE-2024-34199TinyWeb 1.94 and below allows unauthenticated remote attackers to cause a denial of service (Buffer Overflow) when sending excessively large
- CVE-2023-26566Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attacke
- CVE-2024-34360Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATXspacemeshos go-spacemesh · github.com/spacemeshos/api/re… +2
- CVE-2024-4044Deserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudioNI FlexLogger · NI InstrumentStudio
- CVE-2024-31441Arbitrary File Reading in DataEasedataease
- CVE-2024-34942Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/gofor
- CVE-2024-34944Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the list1 parameter at ip/goform/Dh
- CVE-2024-34974Tenda AC18 v15.03.05.19 is vulnerable to Buffer Overflow in the formSetPPTPServer function via the endIp parameter.
- CVE-2024-22064Configuration error Vulnerability in ZTE ZXUN-ePDGZTE ZXUN-ePDG
- CVE-2024-34818WordPress Webinar plugin <= 1.33.17 - Cross Site Request Forgery (CSRF) vulnerabilityWebinarPress
- CVE-2024-2662Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Authenticated (Admin+) Command Injectionunitecms Unlimited Elements For Elementor
- CVE-2024-4129Authentication bypass in Snow License ManagerSnow Software AB Snow License Manager
- CVE-2024-3828Spectra Pro <= 1.1.5 - Authenticated (Author+) Privilege EscalationBrainstorm Force Spectra Pro
- CVE-2024-3940reCAPTCHA Jetpack <= 0.2.2 - Settings Update via CSRFreCAPTCHA Jetpack
- CVE-2024-2441VikBooking < 1.6.8 - Insecure Direct Object ReferencesVikBooking Hotel Booking Engine & PMS
Medium, low and unrated 76
- CVE-2024-4574Graphina – Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsiqonicdesign Graphina – Charts and Graphs For Elementor
- CVE-2024-4430Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attributebeaverbuilder Beaver Builder Page Builder – Drag and Drop W…
- CVE-2024-4417Falang multilanguage for WordPress <= 1.3.49 - Authenticated (Administrator+) Stored Cross-Site Scriptingsbouey Falang multilanguage for WordPress
- CVE-2024-4213Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposurelevelfourstorefront Shopping Cart & eCommerce Store
- CVE-2024-4738Campcodes Legal Case Management System cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4737Campcodes Legal Case Management System vendor cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4736Campcodes Legal Case Management System tax cross site scriptingCampcodes Legal Case Management System
- CVE-2024-27460A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.HP Plantronics Hub
- CVE-2024-4735Campcodes Legal Case Management System tasks cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4732Campcodes Legal Case Management System service cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4731Campcodes Legal Case Management System role cross site scriptingCampcodes Legal Case Management System
- CVE-2024-34079octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usageocto-sts app · github.com/octo-sts/app
- CVE-2024-4730Campcodes Legal Case Management System judge cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4729Campcodes Legal Case Management System expense-type cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4728Campcodes Legal Case Management System court cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4727Campcodes Legal Case Management System court-type cross site scriptingCampcodes Legal Case Management System
- CVE-2024-22345IBM TXSeries for Multiplatforms information disclosureIBM TXSeries for Multiplatforms
- CVE-2024-22344IBM TXSeries for Multiplatforms information disclosureIBM TXSeries for Multiplatforms
- CVE-2024-30055Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-4726Campcodes Legal Case Management System clients cross site scriptingCampcodes Legal Case Management System
- CVE-2024-22343IBM TXSeries for Multiplatforms information disclosureIBM TXSeries for Multiplatforms
- CVE-2023-38264IBM SDK, Java Technology Edition denial of serviceIBM SDK, Java Technology Edition
- CVE-2023-37526HCL DRYiCE Lucy v9 (now AEX) is affected by a Cross Origin Resource Sharing (CORS) VulnerabilityHCL Software DRYiCE Lucy
- CVE-2024-33819Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Save Query function.
- CVE-2024-4725Campcodes Legal Case Management System client_user cross site scriptingCampcodes Legal Case Management System
- CVE-2024-27269IBM QRadar SIEM information disclosureIBM QRadar SIEM
- CVE-2024-4724Campcodes Legal Case Management System case-type cross site scriptingCampcodes Legal Case Management System
- CVE-2024-4723Campcodes Legal Case Management System case-status cross site scriptingCampcodes Legal Case Management System
- CVE-2024-34245An arbitrary file read vulnerability in DedeCMS v5.7.114 allows authenticated attackers to read arbitrary files by specifying any path in ma
- CVE-2024-4722Campcodes Complete Web-Based School Management System index.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-34695WOWS Karma vulnerable to a post submission bounce/timing attackSakuraIsayeki WOWS-Karma
- CVE-2024-28781IBM UrbanCode Deploy cross-site scriptingIBM UrbanCode Deploy
- CVE-2024-4721Campcodes Complete Web-Based School Management System add_student_subject.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-34349Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin PanelSylius · sylius/sylius
- CVE-2024-30801SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code vi
- CVE-2024-4720Campcodes Complete Web-Based School Management System approve_petty_cash.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4719Campcodes Complete Web-Based School Management System delete_record.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-33774A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanSetup_Wizard allows remote authenticated users to tr
- CVE-2024-33773A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanGuestSetup allows remote authenticated users to trig
- CVE-2024-33772A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formTcpipSetup allows remote authenticated users to trigger
- CVE-2024-33771A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via goform/formWPS, allows remote authenticated users to trigger
- CVE-2024-4718Campcodes Complete Web-Based School Management System delete_student_grade_subject.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4717Campcodes Complete Web-Based School Management System update_classroom.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4232Password Storage in Plaintext Vulnerability in Digisol RouterDigisol Router DG-GR1321
- CVE-2024-4231Incorrect Access Control Vulnerability in Digisol RouterDigisol Router DG-GR1321
- CVE-2024-4716Campcodes Complete Web-Based School Management System update_exam.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4693Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crashqemu · Red Hat Enterprise Linux
- CVE-2024-34946Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the page parameter at ip/goform/Dhc
- CVE-2024-4715Campcodes Complete Web-Based School Management System update_grade.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4490Elegant Themes Divi Theme, Extra Theme, Divi Page Builder <= 4.25.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site ScriptingElegant Themes Divi Builder · Elegant Themes Divi
- CVE-2024-4714Campcodes Complete Web-Based School Management System update_subject.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4713Campcodes Complete Web-Based School Management System all_teacher.php cross site scriptingCampcodes Complete Web-Based School Management System
- CVE-2024-4039Orders Tracking for WooCommerce <= 1.2.10 - Unauthenticated Arbitrary Shortcode Executionvillatheme Orders Tracking for WooCommerce
- CVE-2024-4277LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-32776WordPress AppPresser plugin <= 4.3.0 - Broken Access Control vulnerabilityAppPresser Team AppPresser
- CVE-2024-34814WordPress Unyson plugin <=2.7.29 - Cross Site Request Forgery (CSRF) vulnerabilityUnyson
- CVE-2024-34816WordPress WPCal.io plugin <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerabilityRevmakx WPCal.io – Easy Meeting Scheduler
- CVE-2024-34817WordPress Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityCRM Perks Integration for Pipedrive and Contact Form 7, WPF…
- CVE-2024-31113WordPress Easy Digital Downloads plugin <= 3.2.11 - Cross Site Request Forgery (CSRF) vulnerabilityEasy Digital Downloads
- CVE-2024-4444LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registrationthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-3956Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URLsc0ttkclark Pods – Custom Content Types and Fields
- CVE-2024-4689WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerabilityShortPixel Adaptive Images
- CVE-2024-34823WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityKiboko Labs Arigato Autoresponder and Newsletter
- CVE-2024-34825WordPress Social Warfare plugin <= 4.4.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityWarfare Plugins Social Warfare
- CVE-2024-34827WordPress Translate Multilingual sites – TranslatePress plugin <= 2.7.5 - Cross Site Request Forgery (CSRF) vulnerabilityCozmoslabs, Razvan Mocanu, Madalin Ungureanu, Cristophor Hu…
- CVE-2024-34828WordPress Church Admin plugin <= 4.1.32 - Cross Site Request Forgery (CSRF) vulnerabilityandy_moyle Church Admin
- CVE-2024-3547Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.102 - Reflected Cross-Site Scriptingunitecms Unlimited Elements For Elementor
- CVE-2024-4398HTML5 Audio Player- Best WordPress Audio Player Plugin <= 2.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsbplugins HTML5 Audio Player – The Ultimate No-Code Podcast,…
- CVE-2024-4275Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles'wpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-4449Essential Addons for Elementor <= 5.9.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgetswpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-4448Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table'wpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-4481Gutenberg Blocks with AI by Kadence WP <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Linkstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-3941reCAPTCHA Jetpack <= 0.2.2 - Stored XSS via CSRFreCAPTCHA Jetpack
- CVE-2024-2749VikBooking < 1.6.8 - Broken Access ControlVikBooking Hotel Booking Engine & PMS
- CVE-2024-4280White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Resetvideousermanuals White Label CMS
- CVE-2024-4699D-Link DAR-8000-10 importhtml.php deserializationD-Link DAR-8000-10