CVEs published May 19, 2024
101 CVEs were published on May 19, 2024: 12 critical, 34 high.
- Published
- 101
- Critical
- 12
- High
- 34
- Medium
- 20
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- Linux
- 82
- Campcodes Complete Web-Based School Management System
- 5
- SourceCodester Simple Inventory System
- 5
- Hipcam Device
- 1
- mintplex-labs/anything-llm
- 1
- Victor Zsviot Camera
- 1
Critical 12
- CVE-2024-36080Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed.
- CVE-2024-36081Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password.
- CVE-2024-36053In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in chec
- CVE-2024-35939dma-direct: Leak pages on dma_set_decrypted() failureLinux
- CVE-2024-35884udp: do not accept non-tunnel GSO skbs landing in a tunnelLinux
- CVE-2024-35870smb: client: fix UAF in smb2_reconnect_server()Linux
- CVE-2024-35869smb: client: guarantee refcounted children from parent sessionLinux
- CVE-2024-35865smb: client: fix potential UAF in smb2_is_valid_oplock_break()Linux
- CVE-2024-35864smb: client: fix potential UAF in smb2_is_valid_lease_break()Linux
- CVE-2024-35863smb: client: fix potential UAF in is_valid_oplock_break()Linux
- CVE-2024-35862smb: client: fix potential UAF in smb2_is_network_name_deleted()Linux
- CVE-2024-35861smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect()Linux
High 34
- CVE-2024-36076Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensi
- CVE-2024-36070tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via se
- CVE-2024-35937wifi: cfg80211: check A-MSDU format more carefullyLinux
- CVE-2024-35932drm/vc4: don't check if plane->state->fb == state->fbLinux
- CVE-2024-35931drm/amdgpu: Skip do PCI error slot reset during RAS recoveryLinux
- CVE-2024-35924usb: typec: ucsi: Limit read size on v1.2Linux
- CVE-2024-35921media: mediatek: vcodec: Fix oops when HEVC init failsLinux
- CVE-2024-35920media: mediatek: vcodec: adding lock to protect decoder context listLinux
- CVE-2024-35919media: mediatek: vcodec: adding lock to protect encoder context listLinux
- CVE-2024-35915nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packetLinux
- CVE-2024-35914nfsd: Fix error cleanup path in nfsd_rename()Linux
- CVE-2024-35913wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIFLinux
- CVE-2024-35910tcp: properly terminate timers for kernel socketsLinux
- CVE-2024-35905bpf: Protect against int overflow for stack access sizeLinux
- CVE-2024-35901net: mana: Fix Rx DMA datasize and skb_over_panicLinux
- CVE-2024-35899netfilter: nf_tables: flush pending destroy work before exit_net releaseLinux
- CVE-2024-35898netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()Linux
- CVE-2024-35897netfilter: nf_tables: discard table flag update with pending basechain deletionLinux
- CVE-2024-35896netfilter: validate user input for expected lengthLinux
- CVE-2024-35894mptcp: prevent BPF accessing lowat from a subflow socket.Linux
- CVE-2024-35891net: phy: micrel: Fix potential null pointer dereferenceLinux
- CVE-2024-35890gro: fix ownership transferLinux
- CVE-2024-35889idpf: fix kernel panic on unknown packet typesLinux
- CVE-2024-35888erspan: make sure erspan_base_hdr is present in skb->headLinux
- CVE-2024-35887ax25: fix use-after-free bugs caused by ax25_ds_del_timerLinux
- CVE-2024-35882SUNRPC: Fix a slow server-side memory leak with RPC-over-TCPLinux
- CVE-2024-35880io_uring/kbuf: hold io_buffer_list reference over mmapLinux
- CVE-2024-35879of: dynamic: Synchronize of_changeset_destroy() with the devlink removalsLinux
- CVE-2024-35875x86/coco: Require seeding RNG with RDRAND on CoCo systemsLinux
- CVE-2024-35874aio: Fix null ptr deref in aio_complete() wakeupLinux
- CVE-2024-35872mm/secretmem: fix GUP-fast succeeding on secretmem foliosLinux
- CVE-2024-35867smb: client: fix potential UAF in cifs_stats_proc_show()Linux
- CVE-2024-35860bpf: support deferring bpf_link dealloc to after RCU grace periodLinux
- CVE-2024-5095Victor Zsviot Camera MQTT Packet denial of serviceVictor Zsviot Camera
Medium, low and unrated 55
- CVE-2024-5107Campcodes Complete Web-Based School Management System student_payment_details2.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5106Campcodes Complete Web-Based School Management System student_payment_details3.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5105Campcodes Complete Web-Based School Management System student_payment_details.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-4284Denial of Service in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2024-5104Campcodes Complete Web-Based School Management System student_grade_wise.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5103Campcodes Complete Web-Based School Management System student_first_payment.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-36078In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions.
- CVE-2024-5101SourceCodester Simple Inventory System updateproduct.php sql injectionSourceCodester Simple Inventory System
- CVE-2024-5100SourceCodester Simple Inventory System tableedit.php sql injectionSourceCodester Simple Inventory System
- CVE-2024-35947dyndbg: fix old BUG_ON in >control parserLinux
- CVE-2024-35946wifi: rtw89: fix null pointer access when abort scanLinux
- CVE-2024-35945net: phy: phy_device: Prevent nullptr exceptions on ISRLinux
- CVE-2024-35944VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()Linux
- CVE-2024-35943pmdomain: ti: Add a null pointer check to the omap_prm_domain_initLinux
- CVE-2024-35942pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domainLinux
- CVE-2024-35940pstore/zone: Add a null pointer check to the psz_kmsg_readLinux
- CVE-2024-35938wifi: ath11k: decrease MHI channel buffer length to 8KBLinux
- CVE-2024-35936btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()Linux
- CVE-2024-35935btrfs: send: handle path ref underflow in header iterate_inode_ref()Linux
- CVE-2024-35934net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()Linux
- CVE-2024-35933Bluetooth: btintel: Fix null ptr deref in btintel_read_versionLinux
- CVE-2024-35930scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()Linux
- CVE-2024-35929rcu/nocb: Fix WARN_ON_ONCE() in the rcu_nocb_bypass_lock()Linux
- CVE-2024-35927drm: Check output polling initialized before disablingLinux
- CVE-2024-35926crypto: iaa - Fix async_disable descriptor leakLinux
- CVE-2024-35925block: prevent division by zero in blk_rq_stat_sum()Linux
- CVE-2024-35922fbmon: prevent division by zero in fb_videomode_from_videomode()Linux
- CVE-2023-52699sysv: don't call sb_bread() with pointers_lock heldLinux
- CVE-2024-35917s390/bpf: Fix bpf_plt pointer arithmeticLinux
- CVE-2024-35916dma-buf: Fix NULL pointer dereference in sanitycheck()Linux
- CVE-2024-35912wifi: iwlwifi: mvm: rfi: fix potential response leaksLinux
- CVE-2024-35911ice: fix memory corruption bug with suspend and rebuildLinux
- CVE-2024-35909net: wwan: t7xx: Split 64bit accesses to fix alignment issuesLinux
- CVE-2024-35908tls: get psock ref after taking rxlock to avoid leakLinux
- CVE-2024-35907mlxbf_gige: call request_irq() after NAPI initializedLinux
- CVE-2024-35904selinux: avoid dereference of garbage after mount failureLinux
- CVE-2024-35903x86/bpf: Fix IP after emitting call depth accountingLinux
- CVE-2024-35902net/rds: fix possible cp null dereferenceLinux
- CVE-2024-35900netfilter: nf_tables: reject new basechain after table flag updateLinux
- CVE-2024-35895bpf, sockmap: Prevent lock inversion deadlock in map delete elemLinux
- CVE-2024-35893net/sched: act_skbmod: prevent kernel-infoleakLinux
- CVE-2024-35892net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()Linux
- CVE-2024-35886ipv6: Fix infinite recursion in fib6_dump_done().Linux
- CVE-2024-35885mlxbf_gige: stop interface during shutdownLinux
- CVE-2024-35883spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probeLinux
- CVE-2024-35878of: module: prevent NULL pointer dereference in vsnprintf()Linux
- CVE-2024-35877x86/mm/pat: fix VM_PAT handling in COW mappingsLinux
- CVE-2024-35873riscv: Fix vector state restore in rt_sigreturn()Linux
- CVE-2024-35871riscv: process: Fix kernel gp leakageLinux
- CVE-2024-35868smb: client: fix potential UAF in cifs_stats_proc_write()Linux
- CVE-2024-35866smb: client: fix potential UAF in cifs_dump_full_key()Linux
- CVE-2024-5099SourceCodester Simple Inventory System updateprice.php sql injectionSourceCodester Simple Inventory System
- CVE-2024-5098SourceCodester Simple Inventory System login.php sql injectionSourceCodester Simple Inventory System
- CVE-2024-5097SourceCodester Simple Inventory System tableedit.php#page=editprice cross-site request forgerySourceCodester Simple Inventory System
- CVE-2024-5096Hipcam Device MAC Address wifi.mac information disclosureHipcam Device