CVEs published May 14, 2024
281 CVEs were published on May 14, 2024: 26 critical, 120 high. 3 are now in CISA KEV.
- Published
- 281
- Critical
- 26
- High
- 120
- Medium
- 125
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 179
Most affected products
- Microsoft Windows
- 41
- Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- 18
- Siemens Simcenter Femap
- 12
- Siemens SIMATIC RTLS Locating Manager
- 11
- Mozilla Firefox
- 10
- Siemens RUGGEDCOM CROSSBOW
- 9
- Siemens Solid Edge
- 8
- Dell PowerScale OneFS
- 6
- GE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1
- 5
- git
- 5
Critical 26
- CVE-2024-31473There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code executiHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31472There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code executioHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31471There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code eHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31470There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthentiHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31469There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code exHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31468There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code exHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31467Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31466Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-32002Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Executiongit
- CVE-2024-33485SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain s
- CVE-2024-4778Memory safety bugs present in Firefox 125.Mozilla Firefox
- CVE-2024-4764Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free.Mozilla Firefox
- CVE-2024-27107Weak account password in GE HealthCare EchoPAC productsGE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1
- CVE-2024-32353TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSSer
- CVE-2024-34716PrestaShop vulnerable to XSS via customer contact form in FO, through file uploadPrestaShop · prestashop/prestashop
- CVE-2024-34256OFCMS V1.1.2 is vulnerable to SQL Injection via the new table function.
- CVE-2024-33868An issue was discovered in linqi before 1.4.0.1 on Windows.
- CVE-2024-33863An issue was discovered in linqi before 1.4.0.1 on Windows.
- CVE-2024-22267VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device.VMware Workstation · VMware Fusion
- CVE-2024-33499A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-32741A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0).Siemens SIMATIC CN
- CVE-2024-32740A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0).Siemens SIMATIC CN
- CVE-2024-30209A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-30207A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-27939A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-33006File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server ABAP and ABAP Platf…
High 120
- CVE-2024-31477Multiple authenticated command injection vulnerabilities exist in the command line interface.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31476Multiple authenticated command injection vulnerabilities exist in the command line interface.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31475There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management prHewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31474There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol).Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2023-33327WordPress Leyka plugin <= 3.30.2 - Privilege Escalation vulnerabilityTeplitsa of social technologies Leyka
- CVE-2020-26312GHSL-2020-254: Arbitrary file read and/or write in dotmeshdotmesh-io dotmesh · github.com/dotmesh-io/dotmesh
- CVE-2022-28132The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user.
- CVE-2024-31556An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionireportico-web/reportico
- CVE-2021-22280DLL Hijacking Vulnerability in Automation StudioB&R Industrial Automation Automation Studio
- CVE-2024-32465Git's protections for cloning untrusted repositories can be bypassedgit
- CVE-2024-3676The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unProofpoint Enterprise Protection
- CVE-2024-2637Insecure Loading of Code in B&R ProductsB&R Industrial Automation Scene Viewer · B&R Industrial… +19
- CVE-2024-32004Git vulnerable to Remote Code Execution while cloning special-crafted local repositoriesgit
- CVE-2024-4776A file dialog shown while in full-screen mode could have resulted in the window remaining disabled.Mozilla Firefox
- CVE-2024-4773When a network error occurred during page load, the prior content could have remained in view with a blank URL bar.Mozilla Firefox
- CVE-2024-4771A memory allocation check was missing which would lead to a use-after-free if the allocation failed.Mozilla Firefox
- CVE-2024-4765Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's maMozilla Firefox
- CVE-2024-4777Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-4770When saving a page to PDF, certain font styles could have led to a potential use-after-free crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-27110Elevation of privilege vulnerability in GE HealthCare EchoPAC productsGE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1
- CVE-2024-27109Insufficiently protected credentials in GE HealthCare EchoPAC productsGE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1
- CVE-2024-30051Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30049Windows Win32 Kernel Subsystem Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30048Dynamics 365 Customer Insights Spoofing VulnerabilityMicrosoft Dynamics
- CVE-2024-30047Dynamics 365 Customer Insights Spoofing VulnerabilityMicrosoft Dynamics
- CVE-2024-30042Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office Online Server · Microsoft Office +2
- CVE-2024-30040Windows MSHTML Platform Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-30038Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30035Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30033Windows Search Service Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-30032Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30031Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30030Win32k Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 Service Pack · Microsoft W… +1
- CVE-2024-30029Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30028Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30027NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30025Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30024Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29994Microsoft Windows SCSI Class System File Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-26238Microsoft PLUGScheduler Scheduled Task Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30044Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-30023Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30022Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30020Windows Cryptographic Services Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30018Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30017Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30015Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30014Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30010Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-30009Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30007Microsoft Brokering File System Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-30006Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29996Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-1630Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device componentGE HealthCare Venue · GE HealthCare LOGIQ e +9
- CVE-2024-23105A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allFortinet FortiPortal
- CVE-2024-31491A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2Fortinet FortiSandbox
- CVE-2024-1628OS command injection vulnerabilities in GE HealthCare ultrasound devicesGE HealthCare Venue · GE HealthCare LOGIQ e +11
- CVE-2024-32355TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setS
- CVE-2024-32352TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ips
- CVE-2024-32351TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru
- CVE-2024-32350TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "ips
- CVE-2024-34950D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.
- CVE-2024-1486Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devicesGE HealthCare Venue · GE HealthCare LOGIQ e +6
- CVE-2024-1598Potential buffer overflow when handling UEFI variablesPhoenix SecureCore™ for Intel Gemini Lake
- CVE-2024-0762Potential buffer overflow when handling UEFI variablesPhoenix SecureCore™ for Intel Kaby Lake · Phoenix Secure… +7
- CVE-2023-35841WinFlash Driver Permissions IssuePhoenix WinFlash Driver
- CVE-2024-34714Hoppscotch Extension responds to calls made by origins not in the domain listhoppscotch-extension
- CVE-2024-35010idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataT
- CVE-2024-35009idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&f
- CVE-2024-32977OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabledOctoPrint
- CVE-2024-33865An issue was discovered in linqi before 1.4.0.1 on Windows.
- CVE-2024-3372MongoDB Server may have unexpected application behaviour due to invalid BSONMongoDB Server
- CVE-2024-1913 An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or execABB RobotWare
- CVE-2024-22270VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality.VMware Workstation · VMware Fusion
- CVE-2024-22269VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device.VMware Workstation · VMware Fusion
- CVE-2024-22268VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality.VMware Workstation · VMware Fusion
- CVE-2024-34773A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2).Siemens Solid Edge
- CVE-2024-34772A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 4).Siemens Solid Edge
- CVE-2024-34771A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2).Siemens Solid Edge
- CVE-2024-34086A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2024-34085A vulnerability has been identified in JT2Go (All versions < V2312.0001), Teamcenter Visualization V14.1 (All versions < V14.1.0.13), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2024-33577A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-33493A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).Siemens Solid Edge
- CVE-2024-33492A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).Siemens Solid Edge
- CVE-2024-33491A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).Siemens Solid Edge
- CVE-2024-33490A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).Siemens Solid Edge
- CVE-2024-33489A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 5).Siemens Solid Edge
- CVE-2024-32742A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0).Siemens SIMATIC CN
- CVE-2024-32639A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0011).Siemens Tecnomatix Plant Simulation
- CVE-2024-32636A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2024-32635A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2024-32066A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32065A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32064A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32063A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32062A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32061A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32060A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32059A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32058A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32057A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-32055A vulnerability has been identified in Simcenter Femap (All versions < V2406).Siemens Simcenter Femap
- CVE-2024-31980A vulnerability has been identified in Parasolid V35.1 (All versions < V35.1.256), Parasolid V36.0 (All versions < V36.0.210), Parasolid V36Siemens Parasolid
- CVE-2024-31485A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1Siemens CPCI85 Central Processing/Communication · Siemens S…
- CVE-2024-31484A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/CommunicatiSiemens CPC80 Central Processing/Communication · Siemens… +4
- CVE-2024-30206A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-27945A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-27944A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-27943A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-27942A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-27941A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-27940A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-28137PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2
- CVE-2024-28136PHOENIX CONTACT: command injection gains root privileges using the OCPP remote servicePHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2
- CVE-2024-28134PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2
- CVE-2024-28133PHOENIX CONTACT: Privilege escalation in CHARX Series PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2
- CVE-2024-28165Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-4761Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a Google Chrome
- CVE-2024-4712Arbitrary File Creation in PaperCut NG/MF Web Print Image HandlerPaperCut NG, PaperCut MF
- CVE-2024-3037Arbitrary File Deletion in PaperCut NG/MF Web PrintPaperCut NG, PaperCut MF
Medium, low and unrated 135
- CVE-2024-0437Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposuresaadiqbal Password Protected — Lock Entire Site, Pages, Pos…
- CVE-2024-4370WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box WidgetWPZOOM Addons for Elementor – Starter Templates & Widgets
- CVE-2024-4363Visual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameternko Visual Portfolio, Photo Gallery & Post Grid
- CVE-2024-31483An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31482An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31481Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31480Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31479Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-31478Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol.Hewlett Packard Enterprise (HPE) AOS-8 Instant and AOS-10 AP
- CVE-2024-4666Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetsvisualmodo Borderless – Addons and Templates for Elementor
- CVE-2024-35175sshpiper's Enabling of Proxy Protocol without proper feature flagging allows faking source addresstg123 sshpiper · github.com/tg123/sshpiper
- CVE-2024-4562WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettingsProgress Software WhatsUp Gold
- CVE-2024-4561WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconControllerProgress Software WhatsUp Gold
- CVE-2024-3044Graphic on-click binding allows unchecked script executionThe Document Foundation LibreOffice
- CVE-2024-32021Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directorygit
- CVE-2024-0862The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains a Server-Side Request Forgery vulnerability that allows an aProofpoint Enterprise Protection
- CVE-2024-32020Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at willgit
- CVE-2024-4775An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and unMozilla Firefox
- CVE-2024-4774The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data memMozilla Firefox
- CVE-2024-4772An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values.Mozilla Firefox
- CVE-2024-4766Different techniques existed to obscure the fullscreen notification in Firefox for Android.Mozilla Firefox
- CVE-2024-4769When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and nMozilla Firefox · Mozilla Thunderbird
- CVE-2024-4768A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-4767If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-4367A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.Mozilla Firefox · Mozilla Thunderbird +1
- CVE-2024-27108Non privileged access to critical file vulnerability in GE HealthCare EchoPAC productsGE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1
- CVE-2024-27106Vulnerable data in transit in GE HealthCare EchoPAC productsGE HealthCare EchoPAC Software Only · GE HealthCare Imag… +1
- CVE-2024-30054Microsoft Power BI Client JavaScript SDK Information Disclosure VulnerabilityMicrosoft PowerBI-client JS SDK · Microsoft.PowerBI.JavaScr…
- CVE-2024-30046Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft Visual Studio +12
- CVE-2024-30045.NET and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft Visual Studio +13
- CVE-2024-30043Microsoft SharePoint Server Information Disclosure VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-30041Microsoft Bing Search Spoofing VulnerabilityMicrosoft Bing Search for iOS
- CVE-2024-30039Windows Remote Access Connection Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-30037Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-30036Windows Deployment Services Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2024-30034Windows Cloud Files Mini Filter Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-30059Microsoft Intune for Android Mobile Application Management Tampering VulnerabilityMicrosoft Intune Mobile Application Management
- CVE-2024-30053Azure Migrate Cross-Site Scripting VulnerabilityMicrosoft Azure Migrate
- CVE-2024-30050Windows Mark of the Web Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-30021Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30019DHCP Server Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-30016Windows Cryptographic Services Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-30012Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30011Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2024-30008Windows DWM Core Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-30005Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30004Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30003Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30002Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30001Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-30000Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29999Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29998Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-29997Windows Mobile Broadband Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-1629Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device componentGE HealthCare Venue · GE HealthCare LOGIQ e +10
- CVE-2023-24204SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code
- CVE-2023-36640A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,Fortinet FortiOS · Fortinet FortiPAM +1
- CVE-2023-45583A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions,Fortinet FortiOS · Fortinet FortiProxy +2
- CVE-2023-50180An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, vFortinet FortiADC
- CVE-2023-46714A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allowsFortinet FortiOS
- CVE-2023-44247A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or Fortinet FortiOS
- CVE-2023-40720An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6Fortinet FortiVoice
- CVE-2023-45586An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.Fortinet FortiProxy · Fortinet FortiOS
- CVE-2024-26007An improper check or handling of exceptional conditions vulnerability [CWE-703] in Fortinet FortiOS version 7.4.1 allows an unauthenticated Fortinet FortiOS
- CVE-2024-31488An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 througFortinet FortiNAC
- CVE-2023-24203Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary
- CVE-2024-26367Cross Site Scripting vulnerability in Evertz microsystems MViP-II Firmware 8.6.5, XPS-EDGE-* Build 1467, evEDGE-EO-* Build 0029, MMA10G-* Bu
- CVE-2024-32354TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSS
- CVE-2024-32349TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu
- CVE-2024-34717Anonymous PrestaShop customer can download other customers' invoicesPrestaShop · prestashop/prestashop
- CVE-2024-34191htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the delete_post() function at admin.php.
- CVE-2024-34243Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.kongadmin
- CVE-2024-34914php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value.php-censor/php-censor
- CVE-2024-34713sshproxy vulnerable to SSH option injectioncea-hpc sshproxy · github.com/cea-hpc/sshproxy
- CVE-2024-34712Oceanic allows unsanitized user input to lead to path traversal in URLsOceanicJS Oceanic · oceanic.js
- CVE-2024-4871Foreman: host ssh key not being checked in remote executionforeman · Red Hat Satellite 6.15 for RHEL
- CVE-2024-34358TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllertypo3 · typo3/cms-core
- CVE-2024-34357TYPO3 vulnerable to Cross-Site Scripting in ShowImageControllertypo3 · typo3/cms-core
- CVE-2024-34356TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Moduletypo3 · typo3/cms-core
- CVE-2024-34355TYPO3 vulnerable to an HTML Injection in the History Moduletypo3 · typo3/cms-core
- CVE-2024-35012idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=clo
- CVE-2024-35011idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=clo
- CVE-2024-1914An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible.ABB RobotWare
- CVE-2024-33867An issue was discovered in linqi before 1.4.0.1 on Windows.
- CVE-2024-33866An issue was discovered in linqi before 1.4.0.1 on Windows.
- CVE-2024-33864An issue was discovered in linqi before 1.4.0.1 on Windows.
- CVE-2024-3374MongoDB Server (mongod) may crash when generating ftdcMongoDB Server
- CVE-2024-4333Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scriptingshaonsina Sina Extension for Elementor
- CVE-2024-4473Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widgetsmub Sydney Toolbox
- CVE-2024-4624Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-32077Apache Airflow: XSS vulnerability in Task Instance Log/Log DetailsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-33647A vulnerability has been identified in Polarion ALM (All versions < V2404.0).Siemens Polarion ALM
- CVE-2024-33583A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-33498A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-33497A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-33496A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-33495A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-33494A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-32637A vulnerability has been identified in JT2Go (All versions < V2312.0005), Teamcenter Visualization V14.2 (All versions < V14.2.0.12), TeamceSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2024-31486A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30).Siemens OPUPI0 AMQP/MQTT
- CVE-2024-30208A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating ManageSiemens SIMATIC RTLS Locating Manager
- CVE-2024-27947A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2024-27946A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5).Siemens RUGGEDCOM CROSSBOW
- CVE-2023-46280A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), Siemens Security Configuration Tool · Siemens SIMATIC A… +17
- CVE-2024-4440140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsXpro Addons — 140+ Widgets for Elementor
- CVE-2024-4860The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lacwp-rss-aggregator
- CVE-2024-4859Solidus <= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL.solidus
- CVE-2024-3579XSS in Online Shopping System AdvancedPuneeth Reddy Online Shopping System Advanced
- CVE-2024-4392Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcodeautomattic Jetpack – WP Security, Backup, Speed, & Growth
- CVE-2024-28135PHOENIX CONTACT: command injection vulnerability in the API of the CHARX SeriesPHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2
- CVE-2024-25969Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability.Dell PowerScale OneFS
- CVE-2024-25965Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability.Dell PowerScale OneFS
- CVE-2024-25966Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability.Dell PowerScale OneFS
- CVE-2024-25970Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability.Dell PowerScale OneFS
- CVE-2024-25967Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability.Dell PowerScale OneFS
- CVE-2024-25968Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability.Dell PowerScale OneFS
- CVE-2024-3241Ultimate Blocks < 3.1.7 - Contributor+ Stored XSSUltimate Blocks
- CVE-2024-4144Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Executionwpkube Simple Basic Contact Form
- CVE-2024-4445WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Missing Authorizationaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2024-33004Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices)SAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2024-33009SQL injection vulnerability in SAP Global Label Management (GLM)SAP_SE SAP Global Label Management
- CVE-2024-34687Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application server for ABAP and ABAP P…
- CVE-2024-4138Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)SAP_SE SAP S/4 HANA
- CVE-2024-4139Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules)SAP_SE SAP S/4 HANA
- CVE-2024-33002Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)SAP_SE SAP S/4HANA
- CVE-2024-33000Missing Authorization check in SAP Bank Account ManagementSAP_SE SAP Bank Account Management
- CVE-2024-33008Memory Corruption vulnerability in SAP Replication ServerSAP_SE SAP Replication Server
- CVE-2024-33007Client-side script execution vulnerability in SAP UI5(PDFViewer)SAP_SE SAPUI5
- CVE-2024-32733Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server ABAP and ABAP Platf…
- CVE-2024-32731Missing Authorization check in SAP My Travel RequestsSAP_SE SAP My Travel Requests
- CVE-2024-0870YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Updateyithemes YITH WooCommerce Gift Cards
- CVE-2023-6812WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via cssaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2024-4855Use After Free in editcapWireshark Foundation editcap
- CVE-2024-4854Loop with Unreachable Exit Condition ('Infinite Loop') in WiresharkWireshark Foundation Wireshark
- CVE-2024-4853Mismatched Memory Management Routines in editcapWireshark Foundation editcap