CVEs published May 17, 2024
321 CVEs were published on May 17, 2024: 30 critical, 127 high.
- Published
- 321
- Critical
- 30
- High
- 127
- Medium
- 98
- Low
- 4
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 54
Most affected products
- Linux
- 135
- PHPGurukul Online Course Registration System
- 4
- HCL Software BigFix Platform
- 3
- 8theme XStore Core
- 2
- Brainstorm Force Ultimate Addons for Beaver Builder
- 2
- CodePeople CP Polls
- 2
- Emlog Pro
- 2
- Popup4Phone
- 2
- Sizam Design Rehub
- 2
- smp7, wp.insider Simple Membership
- 2
Critical 30
- CVE-2024-35845wifi: iwlwifi: dbg-tlv: ensure NUL terminationLinux
- CVE-2023-52687crypto: safexcel - Add error handling for dma_map_sg() callsLinux
- CVE-2024-34919An arbitrary file upload vulnerability in the component \modstudent\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 al
- CVE-2024-34982An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code v
- CVE-2024-22120Time Based SQL Injection in Zabbix Server Audit LogZabbix
- CVE-2024-32809WordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerabilityJumpDEMAND ActiveDEMAND
- CVE-2024-32511WordPress Simple Registration for WooCommerce plugin <= 1.5.6 - Unauthenticated Privilege Escalation vulnerabilityAstoundify Simple Registration for WooCommerce
- CVE-2024-31290WordPress Demo My WordPress plugin <= 1.0.9.1 - Unauthenticated Privilege Escalation vulnerabilityCodeRevolution Demo My WordPress
- CVE-2024-31231WordPress Rehub theme <= 19.6.1 - Unauthenticated Local File Inclusion vulnerabilitySizam Design Rehub
- CVE-2024-30542WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated Privilege Escalation vulnerabilityWholesaleX
- CVE-2024-27954WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerabilityWP Automatic Automatic
- CVE-2024-24882WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerabilityMasteriyo - LMS
- CVE-2024-22157WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Privilege Escalation vulnerabilityWebWizards SalesKing
- CVE-2023-51483WordPress WP Frontend Profile plugin <= 1.3.1 - Unauthenticated Privilege Escalation vulnerabilityGlowlogix WP Frontend Profile
- CVE-2023-51481WordPress Local Delivery Drivers for WooCommerce plugin <= 1.9.0 - Unauthenticated Account Takeover vulnerabilitypowerfulwp Local Delivery Drivers for WooCommerce
- CVE-2023-51476WordPress WP MLM Unilevel plugin <= 4.0 - Unauthenticated Account Takeover vulnerabilityIOSS WP MLM Unilevel
- CVE-2023-51424WordPress WebinarIgnition plugin <= 3.05.0 - Unauthenticated Privilege Escalation vulnerabilitySaleswonder Team WebinarIgnition
- CVE-2024-33552WordPress XStore Core plugin <= 5.3.8 - Unauthenticated Account Takeover vulnerability8theme XStore Core
- CVE-2024-33567WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.3 - Unauthenticated Privilege Escalation vulnerabilityUkrSolution Barcode Scanner with Inventory & Order Manager
- CVE-2024-33644WordPress Customify Site Library plugin <= 0.0.9 - Remote Code Execution (RCE) vulnerabilityWPCustomify Customify Site Library
- CVE-2023-37999WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerabilityHasThemes HT Mega
- CVE-2023-32297WordPress LWS Affiliation plugin <= 2.2.6 - Local File Inclusion vulnerabilityLWS Affiliation
- CVE-2023-32244WordPress Woodmart Core plugin <= 1.0.36 - Privilege Escalationxtemos Woodmart Core
- CVE-2023-26540WordPress Houzez theme <= 2.7.1 - Privilege EscalationFavethemes Houzez
- CVE-2023-26009WordPress Houzez Login Register plugin <= 2.6.3 - Privilege EscalationFavethemes Houzez Login Register
- CVE-2023-25701WordPress WatchTowerHQ plugin <= 3.6.16 - Privilege EscalationWhatArmy WatchTowerHQ
- CVE-2023-25444WordPress JS Help Desk – Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload vulnerabilityJS Help Desk – Best Help Desk & Support Plugin
- CVE-2023-23645WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 - Subscriber+ Arbitrary PHP Code Injection/Execution VulnerabilityMainWP Code Snippets Extension
- CVE-2024-31351WordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerabilityCopymatic – AI Content Writer & Generator
- CVE-2024-3551Penci Soledad Data Migrator <= 1.3.0 - Unauthenticated Local File Inclusionpencidesign Penci Soledad Data Migrator
High 127
- CVE-2024-35313In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.tor-circmgr · arti
- CVE-2023-52424The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WE
- CVE-2021-22508Potential SQL injection in OpenText Operations Bridge ReporterOpenText Operations Bridge Reporter
- CVE-2024-3292Race ConditionTenable Nessus Agent
- CVE-2024-3291Privilege EscalationTenable Nessus Agent
- CVE-2024-3290Race ConditionTenable Nessus
- CVE-2024-3289When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce secTenable Nessus
- CVE-2024-22429Dell BIOS contains an Improper Input Validation vulnerability.Dell CPG BIOS
- CVE-2024-35858net: bcmasp: fix memory leak when bringing down interfaceLinux
- CVE-2024-35857icmp: prevent possible NULL dereferences from icmp_build_probe()Linux
- CVE-2024-35856Bluetooth: btusb: mediatek: Fix double free of skb in coredumpLinux
- CVE-2024-35855mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity updateLinux
- CVE-2024-35854mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehashLinux
- CVE-2024-35848eeprom: at24: fix memory corruption race conditionLinux
- CVE-2024-35847irqchip/gic-v3-its: Prevent double free on errorLinux
- CVE-2024-35843iommu/vt-d: Use device rbtree in iopf reporting pathLinux
- CVE-2024-35839netfilter: bridge: replace physindev with physinif in nf_bridge_infoLinux
- CVE-2023-52696powerpc/powernv: Add a null pointer check in opal_powercap_init()Linux
- CVE-2023-52691drm/amd/pm: fix a double-free in si_dpm_initLinux
- CVE-2023-52688wifi: ath12k: fix the error handler of rfkill configLinux
- CVE-2023-52679of: Fix double free in of_parse_phandle_with_args_mapLinux
- CVE-2023-52678drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.cLinux
- CVE-2023-52676bpf: Guard stack limits against 32bit overflowLinux
- CVE-2024-35835net/mlx5e: fix a double-free in arfs_create_groupsLinux
- CVE-2024-35834xsk: recycle buffer in case Rx queue was fullLinux
- CVE-2023-52672pipe: wakeup wr_wait after setting max_usageLinux
- CVE-2023-52669crypto: s390/aes - Fix buffer overread in CTR modeLinux
- CVE-2023-52667net/mlx5e: fix a potential double-free in fs_any_create_groupsLinux
- CVE-2023-52664net: atlantic: eliminate double free in error handling logicLinux
- CVE-2024-35830media: tc358743: register v4l2 async device only after successful setupLinux
- CVE-2024-35827io_uring/net: fix overflow check in io_recvmsg_mshot_prep()Linux
- CVE-2023-52662drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_nodeLinux
- CVE-2024-35821ubifs: Set page uptodate in the correct placeLinux
- CVE-2024-35817drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flagLinux
- CVE-2024-35814swiotlb: Fix double-allocation of slots due to broken alignment handlingLinux
- CVE-2024-35813mmc: core: Avoid negative index with array accessLinux
- CVE-2024-35811wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detachLinux
- CVE-2024-35810drm/vmwgfx: Fix the lifetime of the bo cursor memoryLinux
- CVE-2024-35808md/dm-raid: don't call md_reap_sync_thread() directlyLinux
- CVE-2024-35804KVM: x86: Mark target gfn of emulated atomic instruction as dirtyLinux
- CVE-2024-35801x86/fpu: Keep xfd_state in sync with MSR_IA32_XFDLinux
- CVE-2024-35798btrfs: fix race in read_extent_buffer_pages()Linux
- CVE-2024-35797mm: cachestat: fix two shmem bugsLinux
- CVE-2024-35793debugfs: fix wait/cancellation handling during removeLinux
- CVE-2024-35792crypto: rk3288 - Fix use after free in unprepareLinux
- CVE-2024-35791KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()Linux
- CVE-2024-35789wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changesLinux
- CVE-2024-35787md/md-bitmap: fix incorrect usage for sb_indexLinux
- CVE-2024-35785tee: optee: Fix kernel panic caused by incorrect error handlingLinux
- CVE-2024-27435nvme: fix reconnection fail due to reserved tag allocationLinux
- CVE-2024-27434wifi: iwlwifi: mvm: don't set the MFP flag for the GTKLinux
- CVE-2024-5055Vulnerability of uncontrolled resource consumption in XAMPPApache Friends XAMPP
- CVE-2024-27431cpumap: Zero-initialise xdp_rxq_info struct before running XDP programLinux
- CVE-2024-27416Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUESTLinux
- CVE-2024-27415netfilter: bridge: confirm multicast packets before passing them up the stackLinux
- CVE-2024-27414rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing backLinux
- CVE-2024-27411drm/nouveau: keep DMA buffers required for suspend/resumeLinux
- CVE-2024-27410wifi: nl80211: reject iftype change with mesh ID changeLinux
- CVE-2024-27409dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setupLinux
- CVE-2024-27408dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setupLinux
- CVE-2024-27407fs/ntfs3: Fixed overflow check in mi_enum_attr()Linux
- CVE-2024-27405usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBsLinux
- CVE-2024-27404mptcp: fix data races on remote_idLinux
- CVE-2024-27403netfilter: nft_flow_offload: reset dst in route object after setting up flowLinux
- CVE-2024-32960WordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerabilityBooking Ultra Pro
- CVE-2024-32959WordPress Sirv plugin <= 7.2.2 - Arbitrary Option Update to Privilege Escalation vulnerabilitySirv CDN and Image Hosting Sirv
- CVE-2024-32830WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerabilityThemeKraft BuddyForms
- CVE-2024-5052Resource consumption vulnerability in Cerberus FTP EnterpriseCerberus FTP Enterprise
- CVE-2024-32692WordPress Chauffeur Taxi Booking System for WordPress plugin <= 6.9 - Broken Authentication vulnerabilityQuanticaLabs Chauffeur Taxi Booking System for WordPress
- CVE-2024-32680WordPress HUSKY plugin <= 1.3.5.2 - Remote Code Execution (RCE) vulnerabilityPluginUS HUSKY – Products Filter for WooCommerce
- CVE-2024-32523WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerabilityEverPress Mailster
- CVE-2024-32507WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerabilityHamid Alinia Login with phone number
- CVE-2024-31300WordPress Easy Social Share Buttons plugin <= 9.4 - Local File Inclusion vulnerabilityappscreo Easy Social Share Buttons
- CVE-2024-31237WordPress s2Member plugin <= 240315 - Privilege Escalation vulnerabilityWP Sharks s2Member Pro
- CVE-2024-31232WordPress Rehub theme <= 19.6.1 - Local File Inclusion vulnerabilitySizam Design Rehub
- CVE-2024-27971WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerabilityPremmerce Permalink Manager for WooCommerce
- CVE-2024-27955WordPress Automatic plugin <= 3.92.0 - CSRF to Privilege Escalation vulnerabilityWP Automatic Automatic
- CVE-2024-24934WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerabilityElementor Website Builder
- CVE-2024-24869WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerabilityBoldGrid Total Upkeep
- CVE-2024-22145WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerabilityInstaWP Connect
- CVE-2023-51546WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerabilityWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2023-51479WordPress Build App Online plugin <= 1.0.19 - Authenticated Privilege Escalation vulnerabilityAbdul Hakeem Build App Online
- CVE-2023-51398WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.14 - Privilege Escalation vulnerabilityBrainstorm Force Ultimate Addons for Beaver Builder
- CVE-2023-51356WordPress ARMember plugin <= 4.0.10 - Privilege Escalation vulnerabilityRepute Infosystems ARMember
- CVE-2023-50890WordPress Ultimate Addons for Elementor plugin <= 1.36.20 - Privilege Escalation vulnerabilityBrainstorm Force Ultimate Addons for Elementor
- CVE-2023-49753WordPress Adifier System plugin < 3.1.4 - Local File Inclusion vulnerabilityspoonthemes Adifier System
- CVE-2023-48757WordPress JetEngine plugin <= 3.2.4 - Privilege Escalation vulnerabilityCrocoblock JetEngine
- CVE-2023-47868WordPress wpForo plugin <= 2.2.3 - Privilege Escalation vulnerabilitywpForo Forum
- CVE-2023-47782WordPress Thrive Theme Builder theme < 3.24.0 - Authenticated Privilege Escalation vulnerabilityThrive Themes Thrive Theme Builder
- CVE-2023-47683WordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerabilityminiOrange WordPress Social Login and Register
- CVE-2023-47682WordPress WP User Frontend plugin <= 3.6.5 - Authenticated Privilege Escalation vulnerabilityweDevs WP User Frontend
- CVE-2023-47178WordPress The Plus Addons for Elementor Pro plugin <= 5.2.8 - Unauthenticated Local File Inclusion vulnerabilityPOSIMYTH Innovation The Plus Addons for Elementor Pro
- CVE-2023-46784WordPress ICS Calendar plugin <= 10.12.0.3 - SSRF and Arbitrary File Read vulnerabilityRoom 34 Creative Services ICS Calendar
- CVE-2023-46205WordPress Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 - Local File Inclusion vulnerabilityBrainstorm Force Ultimate Addons for WPBakery Page Builder
- CVE-2023-46145WordPress Themify Ultra theme <= 7.3.5 - Authenticated Privilege Escalation vulnerabilityThemify Ultra
- CVE-2023-44478WordPress Events Rich Snippets for Google plugin <= 1.8 - CSRF Leading to Privilege Escalation vulnerabilityWP Hive Events Rich Snippets for Google
- CVE-2024-30527WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerabilityTips and Tricks HQ WP Express Checkout
- CVE-2024-33549WordPress WZone plugin <= 14.0.10 - Privilege Escalation vulnerabilityAA-Team WZone
- CVE-2024-33550WordPress WP Masquerade plugin <= 1.1.0 - Authenticated Account Takeover vulnerabilityJR King/Eran Schoellhorn WP Masquerade
- CVE-2024-33569WordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerabilityDarren Cooney Instant Images
- CVE-2024-34370WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerabilityWPFactory EAN for WooCommerce
- CVE-2023-41957WordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerabilitysmp7, wp.insider Simple Membership
- CVE-2023-41956WordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerabilitysmp7, wp.insider Simple Membership
- CVE-2023-41955WordPress Essential Addons for Elementor plugin <= 5.8.8 - Contributor+ Privilege Escalation vulnerabilityWPDeveloper Essential Addons for Elementor
- CVE-2023-41954WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerabilityProfilePress Membership Team ProfilePress
- CVE-2023-41665WordPress GiveWP plugin <= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerabilityGiveWP
- CVE-2023-41243WordPress WPvivid Backup Plugin plugin <= 0.9.90 - Privilege Escalation on Staging Environment vulnerabilityWPvivid Team WPvivid Backup and Migration
- CVE-2023-39163WordPress Phlox Shop plugin <= 2.0.0 - Unauthenticated Local File Inclusion vulnerabilityAverta Phlox Shop
- CVE-2023-38399WordPress Phlox Portfolio plugin <= 2.3.1 - Unauthenticated Local File Inclusion vulnerabilityAverta Phlox Portfolio
- CVE-2023-37888WordPress Phlox Core Elements plugin <= 2.14.0 - Unauthenticated Local File Inclusion vulnerabilityBy Averta Shortcodes and extra features for Phlox theme
- CVE-2023-37866WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerabilityCrocoblock JetFormBuilder
- CVE-2023-37389WordPress Booking Package SAASPROJECT plugin <= 1.5.98 - Unauthenticated Privilege Escalation vulnerabilitySAASPROJECT Booking Package Booking Package
- CVE-2023-37385WordPress Consulting theme <= 6.5.6 - Local File InclusionStylemixThemes Consulting
- CVE-2023-35881WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerabilityWooCommerce One Page Checkout
- CVE-2023-32110WordPress JupiterX theme <= 3.0.0 - Auth. Local File Inclusion vulnerabilityartbees JupiterX
- CVE-2023-26526WordPress Bookly plugin <= 21.7.1 - Authenticated Arbitrary File Deletion vulnerabilityNota-Info Bookly
- CVE-2023-25050WordPress Shortcodes Ultimate plugin <= 5.12.6 - Arbitrary File Download vulnerabilityVova Anokhin Shortcodes Ultimate
- CVE-2023-23990WordPress Redirection for Contact Form 7 plugin <= 2.7.0 - Privilege Escalation vulnerabilityQube One Redirection for Contact Form
- CVE-2023-23988WordPress My Tickets plugin <= 1.9.11 - Payment Bypass VulnerabilityJoseph C Dolson My Tickets
- CVE-2023-23888WordPress Rank Math SEO plugin <= 1.0.107.2 - Local File Inclusion vulnerabilityRank Math SEO
- CVE-2023-23700WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerabilityOceanWP
- CVE-2022-45374WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.4 - Local File InclusionYARPP
- CVE-2022-45368WordPress 1003 Mortgage Application plugin <= 1.75 - Local File InclusionLenderd 1003 Mortgage Application
- CVE-2024-33556WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability8theme XStore Core
- CVE-2024-34752WordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerabilityPluginOps Landing Page Builder
- CVE-2024-34058The WebTop package for NethServer 7 and 8 allows stored XSS (for example, via the Subject field if an e-mail message).
- CVE-2024-34997joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_arra
Medium, low and unrated 164
- CVE-2024-23556HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiationHCL Software BigFix Platform
- CVE-2024-23554HCL BigFix Platform is susceptible to Cross-Site Request Forgery HCL Software BigFix Platform
- CVE-2024-23583HCL BigFix Platform is susceptible to insufficiently protected credentialsHCL Software BigFix Platform
- CVE-2024-35312In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.tor-circmgr · arti
- CVE-2024-25742In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handl
- CVE-2024-5069SourceCodester Simple Online Mens Salon Management System view_service.php sql injectionSourceCodester Simple Online Mens Salon Management System
- CVE-2024-5066PHPGurukul Online Course Registration System pincode-verification.php sql injectionPHPGurukul Online Course Registration System
- CVE-2024-5065PHPGurukul Online Course Registration System sql injectionPHPGurukul Online Course Registration System
- CVE-2024-34959DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys_data_replace.php.
- CVE-2024-5022The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affecMozilla Focus for iOS
- CVE-2024-5064PHPGurukul Online Course Registration System news-details.php sql injectionPHPGurukul Online Course Registration System
- CVE-2024-5063PHPGurukul Online Course Registration System index.php sql injectionPHPGurukul Online Course Registration System
- CVE-2024-35190Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requestsasterisk
- CVE-2023-5597Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024xDassault Systèmes 3DSwymer
- CVE-2024-31974The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute
- CVE-2024-5072Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with accesDevolutions Server
- CVE-2024-34241A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admi
- CVE-2024-35859block: fix module reference leakage from bdev_open_by_dev error pathLinux
- CVE-2024-35853mlxsw: spectrum_acl_tcam: Fix memory leak during rehashLinux
- CVE-2024-35852mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash workLinux
- CVE-2024-35851Bluetooth: qca: fix NULL-deref on non-serdev suspendLinux
- CVE-2024-35850Bluetooth: qca: fix NULL-deref on non-serdev setupLinux
- CVE-2024-35849btrfs: fix information leak in btrfs_ioctl_logical_to_ino()Linux
- CVE-2024-35846mm: zswap: fix shrinker NULL crash with cgroup_disable=memoryLinux
- CVE-2024-35844f2fs: compress: fix reserve_cblocks counting error when out of spaceLinux
- CVE-2024-5051SourceCodester Gas Agency Management System edituser.php sql injectionSourceCodester Gas Agency Management System
- CVE-2024-35842ASoC: mediatek: sof-common: Add NULL check for normal_link stringLinux
- CVE-2024-35841net: tls, fix WARNIING in __sk_msg_freeLinux
- CVE-2024-35840mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()Linux
- CVE-2023-52698calipso: fix memory leak in netlbl_calipso_add_pass()Linux
- CVE-2023-52697ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULLLinux
- CVE-2023-52695drm/amd/display: Check writeback connectors in create_validate_stream_for_sinkLinux
- CVE-2023-52694drm/bridge: tpd12s015: Drop buggy __exit annotation for remove functionLinux
- CVE-2023-52693ACPI: video: check for error while searching for backlight device parentLinux
- CVE-2023-52692ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()Linux
- CVE-2023-52690powerpc/powernv: Add a null pointer check to scom_debug_init_one()Linux
- CVE-2023-52689ALSA: scarlett2: Add missing mutex lock around get meter levelsLinux
- CVE-2023-52686powerpc/powernv: Add a null pointer check in opal_event_init()Linux
- CVE-2023-52684firmware: qcom: qseecom: fix memory leaks in error pathsLinux
- CVE-2023-52683ACPI: LPIT: Avoid u32 multiplication overflowLinux
- CVE-2023-52682f2fs: fix to wait on block writeback for post_read caseLinux
- CVE-2023-52681efivarfs: Free s_fs_info on unmountLinux
- CVE-2023-52680ALSA: scarlett2: Add missing error checks to *_ctl_get()Linux
- CVE-2023-52677riscv: Check if the code to patch lies in the exit sectionLinux
- CVE-2023-52675powerpc/imc-pmu: Add a null pointer check in update_events_in_group()Linux
- CVE-2023-52674ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()Linux
- CVE-2024-35838wifi: mac80211: fix potential sta-link leakLinux
- CVE-2024-35837net: mvpp2: clear BM pool before initializationLinux
- CVE-2024-35836dpll: fix pin dump crash for rebound moduleLinux
- CVE-2023-52673drm/amd/display: Fix a debugfs null pointer errorLinux
- CVE-2023-52671drm/amd/display: Fix hang/underflow when transitioning to ODM4:1Linux
- CVE-2023-52670rpmsg: virtio: Free driver_override when rpmsg_remove()Linux
- CVE-2023-52668btrfs: zoned: fix lock ordering in btrfs_zone_activate()Linux
- CVE-2024-5050Wangshen SecGate 3600 ?g=log_import_save unrestricted uploadWangshen SecGate
- CVE-2024-5049Codezips E-Commerce Site editproduct.php unrestricted uploadCodezips E-Commerce Site
- CVE-2024-35833dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMALinux
- CVE-2024-35832bcachefs: kvfree bch_fs::snapshots in bch2_fs_snapshots_exitLinux
- CVE-2024-35831io_uring: Fix release of pinned pages when __io_uaddr_map failsLinux
- CVE-2024-35829drm/lima: fix a memleak in lima_heap_allocLinux
- CVE-2024-35828wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()Linux
- CVE-2023-52663ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe()Linux
- CVE-2023-52661drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe()Linux
- CVE-2024-5048code-projects Budget Management index.php sql injectioncode-projects Budget Management
- CVE-2024-5047SourceCodester Student Management System controller.php unrestricted uploadSourceCodester Student Management System
- CVE-2024-35826block: Fix page refcounts for unaligned buffers in __bio_release_pages()Linux
- CVE-2024-35825usb: gadget: ncm: Fix handling of zero block length packetsLinux
- CVE-2024-35824misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resumeLinux
- CVE-2024-35823vt: fix unicode buffer corruption when deleting charactersLinux
- CVE-2024-35822usb: udc: remove warning when queue disabled epLinux
- CVE-2024-35819soc: fsl: qbman: Use raw spinlock for cgr_lockLinux
- CVE-2024-35818LoongArch: Define the __io_aw() hook as mmiowb()Linux
- CVE-2024-35816firewire: ohci: prevent leak of left-over IRQ on unbindLinux
- CVE-2024-35815fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversionLinux
- CVE-2024-35809PCI/PM: Drain runtime-idle callbacks before driver removalLinux
- CVE-2024-35807ext4: fix corruption during on-line resizeLinux
- CVE-2024-35806soc: fsl: qbman: Always disable interrupts when taking cgr_lockLinux
- CVE-2024-35805dm snapshot: fix lockup in dm_exception_table_exitLinux
- CVE-2024-35803x86/efistub: Call mixed mode boot services on the firmware's stackLinux
- CVE-2024-35800efi: fix panic in kdump kernelLinux
- CVE-2024-35799drm/amd/display: Prevent crash when disable streamLinux
- CVE-2024-35796net: ll_temac: platform_get_resource replaced by wrong functionLinux
- CVE-2024-35795drm/amdgpu: fix deadlock while reading mqd from debugfsLinux
- CVE-2024-5042Submariner-operator: rbac permissions can allow for the spread of node compromisessubmariner-operator · Red Hat RHODF-4.16-RHEL-9 +3
- CVE-2024-5046SourceCodester Online Examination System registeracc.php sql injectionSourceCodester Online Examination System
- CVE-2024-5045SourceCodester Online Birth Certificate Management System admin file accessSourceCodester Online Birth Certificate Management System
- CVE-2024-35794dm-raid: really frozen sync_thread during suspendLinux
- CVE-2024-35790usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute groupLinux
- CVE-2024-35786drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbufLinux
- CVE-2024-35784btrfs: fix deadlock with fiemap and extent lockingLinux
- CVE-2024-27436ALSA: usb-audio: Stop parsing channels bits when all channels are found.Linux
- CVE-2024-27433clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe()Linux
- CVE-2024-27432net: ethernet: mtk_eth_soc: fix PPE hanging issueLinux
- CVE-2023-52660media: rkisp1: Fix IRQ handling due to shared interruptsLinux
- CVE-2023-52659x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit typeLinux
- CVE-2024-27419netrom: Fix data-races around sysctl_net_busy_readLinux
- CVE-2023-52658Revert "net/mlx5: Block entering switchdev mode with ns inconsistency"Linux
- CVE-2024-27418net: mctp: take ownership of skb in mctp_local_outputLinux
- CVE-2024-27417ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()Linux
- CVE-2024-27413efi/capsule-loader: fix incorrect allocation sizeLinux
- CVE-2024-27412power: supply: bq27xxx-i2c: Do not free non existing IRQLinux
- CVE-2023-52657Revert "drm/amd/pm: resolve reboot exception for si oland"Linux
- CVE-2024-27406lib/Kconfig.debug: TEST_IOV_ITER depends on MMULinux
- CVE-2024-27402phonet/pep: fix racy skb_queue_empty() useLinux
- CVE-2024-5044Emlog Pro Cookie improper authenticationEmlog Pro
- CVE-2024-5043Emlog Pro setting.php unrestricted uploadEmlog Pro
- CVE-2024-35174WordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerabilityFlothemes Flo Forms
- CVE-2024-34755WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerabilityCRM Perks Integration for Contact Form 7 and Salesforce
- CVE-2024-34756WordPress Integration for HubSpot and Contact Form 7 plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityCRM Perks Integration for Contact Form 7 HubSpot
- CVE-2024-34806WordPress Clearfy Cache plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityCreative Motion Clearfy Cache
- CVE-2024-34807WordPress Fast Custom Social Share by CodeBard plugin <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerabilityFast Custom Social Share by CodeBard
- CVE-2024-34809WordPress EmpowerWP theme <= 1.0.21 - Cross Site Request Forgery (CSRF) vulnerabilityExtend Themes EmpowerWP
- CVE-2024-32827WordPress Giveaways and Contests by RafflePress plugin <= 1.12.7 - IP Restriction Bypass vulnerabilityRafflePress Giveaways and Contests
- CVE-2024-32802WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerabilityWordPlus BP Better Messages
- CVE-2024-32786WordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerabilityWP Royal Royal Elementor Addons
- CVE-2024-32774WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerabilityMetagauss ProfileGrid
- CVE-2024-32720WordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerabilityCodePeople Appointment Hour Booking
- CVE-2024-32708WordPress Maintenance Mode plugin <= 3.0.1 - IP Bypass vulnerabilityhelderk Maintenance Mode
- CVE-2024-32685WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerabilityWpmet Wp Ultimate Review
- CVE-2024-32521WordPress Zero Spam for WordPress plugin <= 5.5.6 - Bypass Spam Protection vulnerabilityHighfivery Zero Spam
- CVE-2024-32512WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerabilityweForms
- CVE-2024-31281WordPress Church Admin plugin <= 4.1.6 - Broken Access Control vulnerabilityandy_moyle Church Admin
- CVE-2024-30509WordPress SellKit plugin <= 1.8.1 - Arbitrary File Download vulnerabilityArtbees SellKit
- CVE-2024-24715WordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerabilityThe Events Calendar BookIt
- CVE-2024-23522WordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerabilityStrategy11 Form Builder Team Formidable Forms
- CVE-2024-22139WordPress WordPress Manutenção plugin <= 1.0.6 - Bypass vulnerabilityFilipe Seabra WordPress Manutenção
- CVE-2024-21746WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerabilityRoxnor Wp Ultimate Review
- CVE-2024-4214WordPress cardealer plugin <= 4.15 - Content Injection vulnerabilityBill Minozzi Car Dealer
- CVE-2023-51401WordPress Ultimate Addons for Beaver Builder Premium plugin <= 1.35.13 - Limited Arbitrary File Download vulnerabilityBrainstorm Force Ultimate Addons for Beaver Builder
- CVE-2023-48319WordPress Salon booking system plugin < 8.7 - Editor+ Privilege Escalation vulnerabilitySalon booking system
- CVE-2023-47679WordPress Qi Addons For Elementor plugin <= 1.6.3 - Local File Inclusion vulnerabilityQODE Interactive Qi Addons For Elementor
- CVE-2023-46197WordPress Popup by Supsystic plugin <= 1.10.19 - Unauthenticated Subscriber Email Addresses Disclosuresupsystic.com Popup by Supsystic
- CVE-2023-45652WordPress Remote Content Shortcode plugin <= 1.5 - Local File Inclusion vulnerabilityJustin Silver Remote Content Shortcode
- CVE-2024-4789Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request ForgeryStylemixThemes Cost Calculator Builder PRO
- CVE-2024-24873WordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerabilityCodePeople CP Polls
- CVE-2024-24874WordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerabilityCodePeople CP Polls
- CVE-2024-25595WordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerabilityWPMU DEV Defender Security
- CVE-2024-25906WordPress Comments Like Dislike plugin <= 1.2.2 - IP Restriction Bypass Vulnerability vulnerabilityWP Happy Coders Comments Like Dislike
- CVE-2024-30479WordPress LionScripts: IP Blocker Lite plugin <= 11.1.1 - Bypass vulnerabilityLionScripts IP Blocker Lite
- CVE-2024-30480WordPress CGC Maintenance Mode plugin <= 1.2 - IP Filtering Bypass vulnerabilityPippin Williamson CGC Maintenance Mode
- CVE-2024-30522WordPress Newsletter plugin <= 8.2.0 - IP Blacklist Bypass vulnerabilityStefano Lissa & The Newsletter Team Newsletter
- CVE-2024-30540WordPress VS Contact Form plugin <= 14.7 - Sum Captcha Bypass vulnerabilityGuido VS Contact Form
- CVE-2024-31295WordPress Captcha by BestWebSoft plugin <= 5.2.0 - Captcha Bypass vulnerabilityCaptcha by BestWebSoft
- CVE-2024-31341WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerabilityCozmoslabs Profile Builder
- CVE-2024-32131WordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerabilityW3 Eden Download Manager
- CVE-2024-32790WordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerabilityPricing Table by Supsystic
- CVE-2024-33917WordPress WTI Like Post plugin <= 1.4.6 - IP Restriction Bypass Vulnerability vulnerabilitywebtechideas WTI Like Post
- CVE-2024-34434WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.2 - Arbitrary Shortcode Execution vulnerabilityrealmag777 WordPress Meta Data and Taxonomies Filter
- CVE-2024-35110A reflected XSS vulnerability has been found in YzmCMS 7.1.
- CVE-2023-34186WordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerabilityImran Sayed Headless CMS
- CVE-2023-33321WordPress EventPrime plugin <= 2.8.6 - Sensitive Data ExposureMetagauss EventPrime
- CVE-2023-33310WordPress Unite Gallery Lite plugin <= 1.7.59 - Local File Inclusion vulnerabilityValiano Unite Gallery Lite
- CVE-2023-32129WordPress Editorialmag theme <= 1.1.9 - Authenticated Arbitrary Plugin ActivationSparkle WP Editorialmag
- CVE-2023-24379WordPress Landing Page Builder – Free Landing Page Templates plugin <= 3.1.9.9 - Local File Inclusion vulnerabilityWeb-Settler Landing Page Builder – Free Landing Page Templa…
- CVE-2023-23872WordPress GMAce plugin <= 1.5.2 - Arbitrary File Download vulnerabilityGerman Mesky GMAce
- CVE-2022-45070WordPress Conditional Checkout Fields for WooCommerce plugin <= 1.2.3 - Broken Authentication vulnerabilityFmeAddons Conditional Checkout Fields for WooCommerce
- CVE-2022-44581WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerabilityWPMU DEV Defender Security
- CVE-2024-32800WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerabilityFelix Moira Popup More Popups
- CVE-2024-34567WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Popup Builder
- CVE-2024-34575WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerabilityDethemeKit For Elementor
- CVE-2024-3580Popup4Phone <= 1.3.2 - Editor+ Stored XSSPopup4Phone
- CVE-2024-3231Popup4Phone <= 1.3.2 - Unauthenticated Stored XSSPopup4Phone
- CVE-2024-2744Nextgen Gallery < 3.59.1 - Admin+ Stored XSSNextGEN Gallery
- CVE-2024-2697Swift Framework < 2024.0.0 - Contributor+ Stored XSS via Shortcodesocialdriver-framework
- CVE-2024-34757WordPress Borderless plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilityVisualmodo Borderless