CVEs published May 15, 2024
133 CVEs were published on May 15, 2024: 11 critical, 42 high. 1 is now in CISA KEV.
- Published
- 133
- Critical
- 11
- High
- 42
- Medium
- 75
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 40
Most affected products
- Adobe Acrobat Reader
- 12
- CyberPower PowerPanel business
- 9
- OpenText iManager
- 9
- Campcodes Online Examination System
- 8
- Campcodes Complete Web-Based School Management System
- 6
- Google Chrome
- 4
- Nozomi Networks Arc
- 4
- Base64 Encoder/Decoder
- 3
- Cisco Secure Email
- 3
- HL Twitter
- 3
Critical 11
- CVE-2024-4949Use after free in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2024-4947Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2024-32047CyberPower PowerPanel business Active Debug CodeCyberPower PowerPanel business
- CVE-2024-32053CyberPower PowerPanel business Use of Hard-coded CredentialsCyberPower PowerPanel business
- CVE-2024-34909An arbitrary file upload vulnerability in KYKMS v1.0.1 and below allows attackers to execute arbitrary code via uploading a crafted PDF file
- CVE-2024-33625CyberPower PowerPanel business Use of Hard-coded PasswordCyberPower PowerPanel business
- CVE-2024-34025CyberPower PowerPanel business Use of Hard-coded PasswordCyberPower PowerPanel business
- CVE-2024-3319Security implication in SailPoint Identity Security Cloud IdentityProfile API EndpointsSailPoint Identity Security Cloud
- CVE-2024-34955Code-projects Budget Management 1.0 is vulnerable to SQL Injection via the delete parameter.
- CVE-2024-4893DigiWin EasyFlow .NET - SQL InjectionDigiWin EasyFlow .NET
- CVE-2024-32888Amazon JDBC Driver for Redshift SQL Injection via line comment generationaws amazon-redshift-jdbc-driver · com.amazon.redshift:redsh…
High 42
- CVE-2024-4948Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2023-40297Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.github.com/stakater/Forecastle
- CVE-2024-31410CyberPower PowerPanel business Use of Hard-coded Cryptographic KeyCyberPower PowerPanel business
- CVE-2024-31856CyberPower PowerPanel business SQL InjectionCyberPower PowerPanel business
- CVE-2024-33615CyberPower PowerPanel business Relative Path TraversalCyberPower PowerPanel business
- CVE-2024-35102Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a c
- CVE-2024-25743In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIG
- CVE-2024-20366A vulnerability in the Tail-f High Availability Cluster Communications (HCC) function pack of Cisco Crosswork Network Services Orchestrator Cisco Network Services Orchestrator
- CVE-2024-4200Progress Telerik Reporting Local Deserialization VulnerabilityProgress Software Telerik Reporting
- CVE-2024-4622alpitronic Hypercharger EV Charger Use of Default Credentialsalpitronic Hypercharger EV Charger
- CVE-2024-4202Progress Telerik Reporting Local Instantiation VulnerabilityProgress Software Telerik Reporting
- CVE-2024-3486 XML External Entity injection vulnerability in iManagerOpenText iManager
- CVE-2024-28042SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy ComponentSUBNET PowerSYSTEM Center
- CVE-2024-3483Remote Code Execution vulnerability in the iManagerOpenText iManager
- CVE-2024-3892Local code execution vulnerability in Telerik UI for WinFormsProgress Software Telerik UI for WinForms
- CVE-2024-34082Grav Arbitrary File Read to Account Takeovergetgrav grav · getgrav/grav
- CVE-2024-3967Remote Code Execution vulnerability in the iManagerOpenText iManager
- CVE-2024-3968Remote Code Execution vulnerability in the iManagerOpenText iManager
- CVE-2023-5938Path traversal via 'zip slip' in Arc before v1.6.0Nozomi Networks Arc
- CVE-2023-5936Unsafe temporary data privileges on Unix systems in Arc before v1.6.0Nozomi Networks Arc
- CVE-2023-5935Missing authentication for local web interface in Arc before v1.6.0Nozomi Networks Arc
- CVE-2024-25079A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 befo
- CVE-2024-27353A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kern
- CVE-2024-25078A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB
- CVE-2024-4670All-in-One Video Gallery <= 3.6.5 - Authenticated (Contributor+) Local File Inclusion via aiovg_search_form Shortcodeplugins360 All-in-One Video Gallery
- CVE-2023-6324ThroughTek Kalay SDK error in handling the PSK identityThroughTek Kalay SDK
- CVE-2023-6322Stack-based buffer overflow in message parser functionalityRoku Indoor Camera SE · Wyze Cam
- CVE-2023-6321Owlet Camera OS command injectionOwlet Cam
- CVE-2024-34100Use-After-Free vulnerability in the latest Adobe Acrobat Reader DC when open malicious PDF fileAdobe Acrobat Reader
- CVE-2024-30284ZDI-CAN-23466: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-34098ZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 1 of 2Adobe Acrobat Reader
- CVE-2024-34095ZDI-CAN-23475: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-34099ZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 2 of 2Adobe Acrobat Reader
- CVE-2024-34096ZDI-CAN-23472: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-34097ZDI-CAN-23473: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-34094ZDI-CAN-23474: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-30310ZDI-CAN-23327: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-4010Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_requesticegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2024-3406WP Prayer <= 2.0.9 - Email Settings Update via CSRFWP Prayer
- CVE-2024-3405WP Prayer <= 2.0.9 - Settings Update via CSRFWP Prayer
- CVE-2024-35108idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&data
- CVE-2024-4847Alt Text AI – Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injectionalttextai Alt Text AI – Automatically generate image alt te…
Medium, low and unrated 80
- CVE-2024-4919Campcodes Online Examination System addCourseExe.php sql injectionCampcodes Online Examination System
- CVE-2024-4918Campcodes Online Examination System updateQuestion.php sql injectionCampcodes Online Examination System
- CVE-2024-4917Campcodes Online Examination System submitAnswerExe.php sql injectionCampcodes Online Examination System
- CVE-2024-4916Campcodes Online Examination System selExamAttemptExe.php sql injectionCampcodes Online Examination System
- CVE-2024-4915Campcodes Online Examination System result.php sql injectionCampcodes Online Examination System
- CVE-2024-4914Campcodes Online Examination System ranking-exam.php sql injectionCampcodes Online Examination System
- CVE-2024-35184paperless-ngx's remote user auth via header works even when disabling it for APIpaperless-ngx
- CVE-2024-35183wolfictl leaks GitHub tokens to remote non-GitHub git serverswolfi-dev wolfictl · github.com/wolfi-dev/wolfictl
- CVE-2024-4913Campcodes Online Examination System exam.php sql injectionCampcodes Online Examination System
- CVE-2024-27244Zoom Workplace VDI App for Windows - Insufficient Verification of Data AuthenticityZoom Video Communications Zoom Workplace VDI App for Windows
- CVE-2024-4950Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage iGoogle Chrome
- CVE-2024-27243Zoom Apps - Buffer OverflowZoom Video Communications see references
- CVE-2024-4976Out-of-bounds array write in Xpdf 4.05 due to missing object type checkXpdf
- CVE-2024-4912Campcodes Online Examination System addExamExe.php sql injectionCampcodes Online Examination System
- CVE-2024-4911Campcodes Complete Web-Based School Management System student_exam_mark_update_form.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-31409CyberPower PowerPanel business Incorrect AuthorizationCyberPower PowerPanel business
- CVE-2024-4910Campcodes Complete Web-Based School Management System student_exam_mark_insert_form1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-32042CyberPower PowerPanel business Storing Passwords in a Recoverable FormatCyberPower PowerPanel business
- CVE-2024-4904Byzoro Smart S200 Management Platform userattestation.php unrestricted uploadByzoro Smart S200 Management Platform
- CVE-2024-34913An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafte
- CVE-2024-34906An arbitrary file upload vulnerability in dootask v0.30.13 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- CVE-2024-4909Campcodes Complete Web-Based School Management System student_due_payment.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-4908Campcodes Complete Web-Based School Management System student_attendance_history1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-4907Campcodes Complete Web-Based School Management System show_student2.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-4906Campcodes Complete Web-Based School Management System show_student1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-3182Install-type password disclosure vulnerability in Universal Installer including the Silent Installer in TIBCO Hawk versions 6.2.0, 6.2.1, 6.TIBCO Hawk
- CVE-2024-20383Cisco Secure Email and Web Manager Stored Cross-Site Scripting VulnerabilityCisco Secure Email and Web Manager
- CVE-2024-20257A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated,Cisco Secure Email
- CVE-2024-20256A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web AppliaCisco Secure Web Appliance · Cisco Secure Email and Web Man…
- CVE-2024-20258A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email GateCisco Secure Email
- CVE-2024-4905Kashipara College Management System view_students_each_detail.php sql injectionKashipara College Management System
- CVE-2024-20391A vulnerability in the Network Access Manager (NAM) module of Cisco Secure Client could allow an unauthenticated attacker with physical acceCisco Secure Client
- CVE-2024-20369A vulnerability in the web-based management interface of Cisco Crosswork Network Services Orchestrator (NSO) could allow an unauthenticated,Cisco Network Services Orchestrator
- CVE-2024-20392A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remCisco Secure Email
- CVE-2024-20394A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DCisco AppDynamics
- CVE-2024-4837Trust Boundary Violation VulnerabilityProgress Software Telerik Report Server
- CVE-2024-4357XML External Entity Processing Information DisclosureProgress Software Telerik Report Server
- CVE-2024-3488File Upload vulnerability in unauthenticated session found in iManager.OpenText iManager
- CVE-2024-3487Broken Authentication vulnerability in iManagerOpenText iManager
- CVE-2024-3485Server-Side Request Forgery vulnerability in iManagerOpenText iManager
- CVE-2024-3484Path Traversal vulnerability found in iManagerOpenText iManager
- CVE-2024-3970Server-Side Request Forgery vulnerability in iManagerOpenText iManager
- CVE-2024-27593A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated att
- CVE-2023-7258Denial-of-Service in GvisorGoogle Gvisor
- CVE-2023-5937Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0Nozomi Networks Arc
- CVE-2024-35179Unprivileged Stalwart Mail Server user can read files as rootstalwartlabs mail-server
- CVE-2024-3317SailPoint Identity Security Cloud Improper Access ControlSailPoint Identity Security Cloud
- CVE-2024-31216source-controller leaks theAzure Storage SAS token into logs on connection errorsfluxcd source-controller · github.com/fluxcd/source-control…
- CVE-2024-3318SailPoint Identity Security Cloud Connector File Path Traversal VulnerabilitySailPoint Identity Security Cloud
- CVE-2024-4903Tongda OA delete.php sql injectionTongda OA
- CVE-2024-34954Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter.
- CVE-2024-2248JFrog Artifactory Header InjectionJFrog Artifactory
- CVE-2023-6323ThroughTek Kalay SDK insufficient verification of message authenticityThroughTek Kalay SDK
- CVE-2024-4702Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widgetkraftplugins Mega Elements – Addons for Elementor
- CVE-2024-34101ZDI-CAN-23614: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2024-30312TALOS-2024-1952 - Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerabilityAdobe Acrobat Reader
- CVE-2024-30311TALOS-2024-1946 - Adobe Acrobat Reader Font gvar GlyphVariationData out-of-bounds read vulnerabilityAdobe Acrobat Reader
- CVE-2024-4636Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadOptimole – Optimize Images in Real Time
- CVE-2024-3824Base64 Encoder/Decoder <= 0.9.2 - Settings Reset via CSRFBase64 Encoder/Decoder
- CVE-2024-3823Base64 Encoder/Decoder <= 0.9.2 - Stored XSS via CSRFBase64 Encoder/Decoder
- CVE-2024-3822Base64 Encoder/Decoder <= 0.9.2 - Reflected XSSBase64 Encoder/Decoder
- CVE-2024-3749SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDORSP Project & Document Manager
- CVE-2024-3748SP Project & Document Manager <= 4.71 - Data Update via IDORSP Project & Document Manager
- CVE-2024-3634month name translation benaceur < 2.3.8 - Admin+ Stored XSSmonth name translation benaceur
- CVE-2024-3631HL Twitter <= 2014.1.18 - Unlink Twitter Account via CSRFHL Twitter
- CVE-2024-3630HL Twitter <= 2014.1.18 - Admin+ Stored XSS via WidgetHL Twitter
- CVE-2024-3629HL Twitter <= 2014.1.18 - Settings Update via CSRFHL Twitter
- CVE-2024-3548Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSSWP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-3407WP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRFWP Prayer
- CVE-2024-4894ITPison OMICARD EDM - Server-Side Request ForgeryITPison OMICARD EDM
- CVE-2024-4208Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effectstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-3189Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scriptingstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2024-35109idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close.
- CVE-2024-4373Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer'shaonsina Sina Extension for Elementor
- CVE-2024-4656Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingcarazo Import and export users and customers
- CVE-2024-4199Bulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorizationithemelandco WPBULKiT – Bulk Edit WordPress Posts & Pages
- CVE-2024-4618Exclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widgettimstrifler Exclusive Addons for Elementor
- CVE-2024-4734Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingcarazo Import and export users and customers
- CVE-2024-3744Kubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logsKubernetes azure-file-csi-driver · sigs.k8s.io/azurefile-cs…
- CVE-2024-28087In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability.org.bonitasoft.engine:bonita-server