CVEs published May 18, 2024
26 CVEs were published on May 18, 2024: 4 critical, 5 high.
- Published
- 26
- Critical
- 4
- High
- 5
- Medium
- 17
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- techjewel Fluent Forms – Customizable Contact Forms, Survey…
- 4
- SourceCodester Best House Rental Management System
- 2
- thehappymonster Happy Addons for Elementor
- 2
- ThemeNectar Salient Shortcodes
- 2
- aio-libs aiosmtpd · aiosmtpd
- 1
- berriai/litellm · litellm
- 1
- DethemeKit for Elementor
- 1
- IBM i
- 1
- MSI Afterburner
- 1
- piotnetdotcom Piotnet Addons For Elementor
- 1
Critical 4
- CVE-2024-28064Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated fil
- CVE-2024-2771Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalationtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-4264Remote Code Execution in berriai/litellmberriai/litellm · litellm
- CVE-2024-36048QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.6, and 6.6.x through 6.7.
High 5
- CVE-2024-31879IBM i denial of serviceIBM i
- CVE-2024-3745MSI Afterburner v4.6.6.16381 Beta 3 - ACL BypassMSI Afterburner
- CVE-2024-2782Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulationtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-3812Salient Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion via ShortcodeThemeNectar Salient Core
- CVE-2024-3810Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Local File Inclusion via ShortcodeThemeNectar Salient Shortcodes
Medium, low and unrated 17
- CVE-2024-28063Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS.
- CVE-2024-36050Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker
- CVE-2024-5094SourceCodester Best House Rental Management System view_payment.php sql injectionSourceCodester Best House Rental Management System
- CVE-2024-36043question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.
- CVE-2024-5093SourceCodester Best House Rental Management System login.php sql injectionSourceCodester Best House Rental Management System
- CVE-2024-34083STARTTLS unencrypted commands injectionaio-libs aiosmtpd · aiosmtpd
- CVE-2024-5088Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingthehappymonster Happy Addons for Elementor
- CVE-2024-4432Piotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgetspiotnetdotcom Piotnet Addons For Elementor
- CVE-2024-4709Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scriptingtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-4698Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scriptinguapp Testimonial Carousel For Elementor
- CVE-2024-2772Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scriptingtechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-3811Salient Shortcodes <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThemeNectar Salient Shortcodes
- CVE-2024-4849WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay ParameterValvePress WordPress Automatic Plugin
- CVE-2024-4891Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2024-3714GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2024-4374DethemeKit For Elementor <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple WidgetsDethemeKit for Elementor
- CVE-2024-4865Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameterthehappymonster Happy Addons for Elementor