# CVEs published 2024-05-19

101 CVEs were published on May 19, 2024: 12 critical, 34 high. Days are UTC.

- [CVE-2024-5107](https://cve.now/CVE-2024-5107.md): Campcodes Complete Web-Based School Management System student\_payment\_details2.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5106](https://cve.now/CVE-2024-5106.md): Campcodes Complete Web-Based School Management System student\_payment\_details3.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5105](https://cve.now/CVE-2024-5105.md): Campcodes Complete Web-Based School Management System student\_payment\_details.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4284](https://cve.now/CVE-2024-4284.md): Denial of Service in mintplex-labs/anything-llm (CVSS 4.9, mintplex-labs/anything-llm)
- [CVE-2024-5104](https://cve.now/CVE-2024-5104.md): Campcodes Complete Web-Based School Management System student\_grade\_wise.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-5103](https://cve.now/CVE-2024-5103.md): Campcodes Complete Web-Based School Management System student\_first\_payment.php sql injection (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-36080](https://cve.now/CVE-2024-36080.md): Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed. (CVSS 9.8)
- [CVE-2024-36081](https://cve.now/CVE-2024-36081.md): Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password. (CVSS 9.8)
- [CVE-2024-36078](https://cve.now/CVE-2024-36078.md): In Zammad before 6.3.1, a Ruby gem bundled by Zammad is installed with world-writable file permissions. (CVSS 6.7)
- [CVE-2024-36076](https://cve.now/CVE-2024-36076.md): Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensi (CVSS 8.8)
- [CVE-2024-36070](https://cve.now/CVE-2024-36070.md): tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via se (CVSS 7.5)
- [CVE-2024-36053](https://cve.now/CVE-2024-36053.md): In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in chec (CVSS 9.0)
- [CVE-2024-5101](https://cve.now/CVE-2024-5101.md): SourceCodester Simple Inventory System updateproduct.php sql injection (CVSS 5.3, SourceCodester Simple Inventory System)
- [CVE-2024-5100](https://cve.now/CVE-2024-5100.md): SourceCodester Simple Inventory System tableedit.php sql injection (CVSS 5.3, SourceCodester Simple Inventory System)
- [CVE-2024-35947](https://cve.now/CVE-2024-35947.md): dyndbg: fix old BUG\_ON in \>control parser (CVSS 5.5, Linux)
- [CVE-2024-35946](https://cve.now/CVE-2024-35946.md): wifi: rtw89: fix null pointer access when abort scan (no CVSS, Linux)
- [CVE-2024-35945](https://cve.now/CVE-2024-35945.md): net: phy: phy\_device: Prevent nullptr exceptions on ISR (no CVSS, Linux)
- [CVE-2024-35944](https://cve.now/CVE-2024-35944.md): VMCI: Fix memcpy() run-time warning in dg\_dispatch\_as\_host() (no CVSS, Linux)
- [CVE-2024-35943](https://cve.now/CVE-2024-35943.md): pmdomain: ti: Add a null pointer check to the omap\_prm\_domain\_init (no CVSS, Linux)
- [CVE-2024-35942](https://cve.now/CVE-2024-35942.md): pmdomain: imx8mp-blk-ctrl: imx8mp\_blk: Add fdcc clock to hdmimix domain (no CVSS, Linux)
- [CVE-2024-35940](https://cve.now/CVE-2024-35940.md): pstore/zone: Add a null pointer check to the psz\_kmsg\_read (CVSS 5.5, Linux)
- [CVE-2024-35939](https://cve.now/CVE-2024-35939.md): dma-direct: Leak pages on dma\_set\_decrypted() failure (CVSS 9.3, Linux)
- [CVE-2024-35938](https://cve.now/CVE-2024-35938.md): wifi: ath11k: decrease MHI channel buffer length to 8KB (no CVSS, Linux)
- [CVE-2024-35937](https://cve.now/CVE-2024-35937.md): wifi: cfg80211: check A-MSDU format more carefully (CVSS 8.1, Linux)
- [CVE-2024-35936](https://cve.now/CVE-2024-35936.md): btrfs: handle chunk tree lookup error in btrfs\_relocate\_sys\_chunks() (no CVSS, Linux)
- [CVE-2024-35935](https://cve.now/CVE-2024-35935.md): btrfs: send: handle path ref underflow in header iterate\_inode\_ref() (no CVSS, Linux)
- [CVE-2024-35934](https://cve.now/CVE-2024-35934.md): net/smc: reduce rtnl pressure in smc\_pnet\_create\_pnetids\_list() (no CVSS, Linux)
- [CVE-2024-35933](https://cve.now/CVE-2024-35933.md): Bluetooth: btintel: Fix null ptr deref in btintel\_read\_version (no CVSS, Linux)
- [CVE-2024-35932](https://cve.now/CVE-2024-35932.md): drm/vc4: don't check if plane-\>state-\>fb == state-\>fb (CVSS 7.8, Linux)
- [CVE-2024-35931](https://cve.now/CVE-2024-35931.md): drm/amdgpu: Skip do PCI error slot reset during RAS recovery (CVSS 7.8, Linux)
- [CVE-2024-35930](https://cve.now/CVE-2024-35930.md): scsi: lpfc: Fix possible memory leak in lpfc\_rcv\_padisc() (no CVSS, Linux)
- [CVE-2024-35929](https://cve.now/CVE-2024-35929.md): rcu/nocb: Fix WARN\_ON\_ONCE() in the rcu\_nocb\_bypass\_lock() (no CVSS, Linux)
- [CVE-2024-35927](https://cve.now/CVE-2024-35927.md): drm: Check output polling initialized before disabling (CVSS 5.5, Linux)
- [CVE-2024-35926](https://cve.now/CVE-2024-35926.md): crypto: iaa - Fix async\_disable descriptor leak (no CVSS, Linux)
- [CVE-2024-35925](https://cve.now/CVE-2024-35925.md): block: prevent division by zero in blk\_rq\_stat\_sum() (no CVSS, Linux)
- [CVE-2024-35924](https://cve.now/CVE-2024-35924.md): usb: typec: ucsi: Limit read size on v1.2 (CVSS 7.1, Linux)
- [CVE-2024-35922](https://cve.now/CVE-2024-35922.md): fbmon: prevent division by zero in fb\_videomode\_from\_videomode() (no CVSS, Linux)
- [CVE-2024-35921](https://cve.now/CVE-2024-35921.md): media: mediatek: vcodec: Fix oops when HEVC init fails (CVSS 7.8, Linux)
- [CVE-2024-35920](https://cve.now/CVE-2024-35920.md): media: mediatek: vcodec: adding lock to protect decoder context list (CVSS 7.8, Linux)
- [CVE-2024-35919](https://cve.now/CVE-2024-35919.md): media: mediatek: vcodec: adding lock to protect encoder context list (CVSS 7.8, Linux)
- [CVE-2023-52699](https://cve.now/CVE-2023-52699.md): sysv: don't call sb\_bread() with pointers\_lock held (CVSS 5.3, Linux)
- [CVE-2024-35917](https://cve.now/CVE-2024-35917.md): s390/bpf: Fix bpf\_plt pointer arithmetic (no CVSS, Linux)
- [CVE-2024-35916](https://cve.now/CVE-2024-35916.md): dma-buf: Fix NULL pointer dereference in sanitycheck() (CVSS 5.3, Linux)
- [CVE-2024-35915](https://cve.now/CVE-2024-35915.md): nfc: nci: Fix uninit-value in nci\_dev\_up and nci\_ntf\_packet (CVSS 8.8, Linux)
- [CVE-2024-35914](https://cve.now/CVE-2024-35914.md): nfsd: Fix error cleanup path in nfsd\_rename() (CVSS 7.5, Linux)
- [CVE-2024-35913](https://cve.now/CVE-2024-35913.md): wifi: iwlwifi: mvm: pick the version of SESSION\_PROTECTION\_NOTIF (CVSS 7.1, Linux)
- [CVE-2024-35912](https://cve.now/CVE-2024-35912.md): wifi: iwlwifi: mvm: rfi: fix potential response leaks (no CVSS, Linux)
- [CVE-2024-35911](https://cve.now/CVE-2024-35911.md): ice: fix memory corruption bug with suspend and rebuild (no CVSS, Linux)
- [CVE-2024-35910](https://cve.now/CVE-2024-35910.md): tcp: properly terminate timers for kernel sockets (CVSS 7.8, Linux)
- [CVE-2024-35909](https://cve.now/CVE-2024-35909.md): net: wwan: t7xx: Split 64bit accesses to fix alignment issues (no CVSS, Linux)
- [CVE-2024-35908](https://cve.now/CVE-2024-35908.md): tls: get psock ref after taking rxlock to avoid leak (no CVSS, Linux)
- [CVE-2024-35907](https://cve.now/CVE-2024-35907.md): mlxbf\_gige: call request\_irq() after NAPI initialized (no CVSS, Linux)
- [CVE-2024-35905](https://cve.now/CVE-2024-35905.md): bpf: Protect against int overflow for stack access size (CVSS 7.8, Linux)
- [CVE-2024-35904](https://cve.now/CVE-2024-35904.md): selinux: avoid dereference of garbage after mount failure (no CVSS, Linux)
- [CVE-2024-35903](https://cve.now/CVE-2024-35903.md): x86/bpf: Fix IP after emitting call depth accounting (CVSS 5.5, Linux)
- [CVE-2024-35902](https://cve.now/CVE-2024-35902.md): net/rds: fix possible cp null dereference (no CVSS, Linux)
- [CVE-2024-35901](https://cve.now/CVE-2024-35901.md): net: mana: Fix Rx DMA datasize and skb\_over\_panic (CVSS 7.5, Linux)
- [CVE-2024-35900](https://cve.now/CVE-2024-35900.md): netfilter: nf\_tables: reject new basechain after table flag update (no CVSS, Linux)
- [CVE-2024-35899](https://cve.now/CVE-2024-35899.md): netfilter: nf\_tables: flush pending destroy work before exit\_net release (CVSS 7.3, Linux)
- [CVE-2024-35898](https://cve.now/CVE-2024-35898.md): netfilter: nf\_tables: Fix potential data-race in \_\_nft\_flowtable\_type\_get() (CVSS 7.0, Linux)
- [CVE-2024-35897](https://cve.now/CVE-2024-35897.md): netfilter: nf\_tables: discard table flag update with pending basechain deletion (CVSS 7.8, Linux)
- [CVE-2024-35896](https://cve.now/CVE-2024-35896.md): netfilter: validate user input for expected length (CVSS 7.1, Linux)
- [CVE-2024-35895](https://cve.now/CVE-2024-35895.md): bpf, sockmap: Prevent lock inversion deadlock in map delete elem (no CVSS, Linux)
- [CVE-2024-35894](https://cve.now/CVE-2024-35894.md): mptcp: prevent BPF accessing lowat from a subflow socket. (CVSS 7.8, Linux)
- [CVE-2024-35893](https://cve.now/CVE-2024-35893.md): net/sched: act\_skbmod: prevent kernel-infoleak (no CVSS, Linux)
- [CVE-2024-35892](https://cve.now/CVE-2024-35892.md): net/sched: fix lockdep splat in qdisc\_tree\_reduce\_backlog() (no CVSS, Linux)
- [CVE-2024-35891](https://cve.now/CVE-2024-35891.md): net: phy: micrel: Fix potential null pointer dereference (CVSS 7.5, Linux)
- [CVE-2024-35890](https://cve.now/CVE-2024-35890.md): gro: fix ownership transfer (CVSS 7.8, Linux)
- [CVE-2024-35889](https://cve.now/CVE-2024-35889.md): idpf: fix kernel panic on unknown packet types (CVSS 8.6, Linux)
- [CVE-2024-35888](https://cve.now/CVE-2024-35888.md): erspan: make sure erspan\_base\_hdr is present in skb-\>head (CVSS 7.3, Linux)
- [CVE-2024-35887](https://cve.now/CVE-2024-35887.md): ax25: fix use-after-free bugs caused by ax25\_ds\_del\_timer (CVSS 8.8, Linux)
- [CVE-2024-35886](https://cve.now/CVE-2024-35886.md): ipv6: Fix infinite recursion in fib6\_dump\_done(). (no CVSS, Linux)
- [CVE-2024-35885](https://cve.now/CVE-2024-35885.md): mlxbf\_gige: stop interface during shutdown (no CVSS, Linux)
- [CVE-2024-35884](https://cve.now/CVE-2024-35884.md): udp: do not accept non-tunnel GSO skbs landing in a tunnel (CVSS 9.8, Linux)
- [CVE-2024-35883](https://cve.now/CVE-2024-35883.md): spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx\_spi\_probe (no CVSS, Linux)
- [CVE-2024-35882](https://cve.now/CVE-2024-35882.md): SUNRPC: Fix a slow server-side memory leak with RPC-over-TCP (CVSS 7.5, Linux)
- [CVE-2024-35880](https://cve.now/CVE-2024-35880.md): io\_uring/kbuf: hold io\_buffer\_list reference over mmap (CVSS 7.8, Linux)
- [CVE-2024-35879](https://cve.now/CVE-2024-35879.md): of: dynamic: Synchronize of\_changeset\_destroy() with the devlink removals (CVSS 7.8, Linux)
- [CVE-2024-35878](https://cve.now/CVE-2024-35878.md): of: module: prevent NULL pointer dereference in vsnprintf() (CVSS 5.3, Linux)
- [CVE-2024-35877](https://cve.now/CVE-2024-35877.md): x86/mm/pat: fix VM\_PAT handling in COW mappings (no CVSS, Linux)
- [CVE-2024-35875](https://cve.now/CVE-2024-35875.md): x86/coco: Require seeding RNG with RDRAND on CoCo systems (CVSS 8.4, Linux)
- [CVE-2024-35874](https://cve.now/CVE-2024-35874.md): aio: Fix null ptr deref in aio\_complete() wakeup (CVSS 7.8, Linux)
- [CVE-2024-35873](https://cve.now/CVE-2024-35873.md): riscv: Fix vector state restore in rt\_sigreturn() (no CVSS, Linux)
- [CVE-2024-35872](https://cve.now/CVE-2024-35872.md): mm/secretmem: fix GUP-fast succeeding on secretmem folios (CVSS 7.8, Linux)
- [CVE-2024-35871](https://cve.now/CVE-2024-35871.md): riscv: process: Fix kernel gp leakage (no CVSS, Linux)
- [CVE-2024-35870](https://cve.now/CVE-2024-35870.md): smb: client: fix UAF in smb2\_reconnect\_server() (CVSS 9.8, Linux)
- [CVE-2024-35869](https://cve.now/CVE-2024-35869.md): smb: client: guarantee refcounted children from parent session (CVSS 9.8, Linux)
- [CVE-2024-35868](https://cve.now/CVE-2024-35868.md): smb: client: fix potential UAF in cifs\_stats\_proc\_write() (no CVSS, Linux)
- [CVE-2024-35867](https://cve.now/CVE-2024-35867.md): smb: client: fix potential UAF in cifs\_stats\_proc\_show() (CVSS 7.8, Linux)
- [CVE-2024-35866](https://cve.now/CVE-2024-35866.md): smb: client: fix potential UAF in cifs\_dump\_full\_key() (no CVSS, Linux)
- [CVE-2024-35865](https://cve.now/CVE-2024-35865.md): smb: client: fix potential UAF in smb2\_is\_valid\_oplock\_break() (CVSS 9.8, Linux)
- [CVE-2024-35864](https://cve.now/CVE-2024-35864.md): smb: client: fix potential UAF in smb2\_is\_valid\_lease\_break() (CVSS 9.8, Linux)
- [CVE-2024-35863](https://cve.now/CVE-2024-35863.md): smb: client: fix potential UAF in is\_valid\_oplock\_break() (CVSS 9.8, Linux)
- [CVE-2024-35862](https://cve.now/CVE-2024-35862.md): smb: client: fix potential UAF in smb2\_is\_network\_name\_deleted() (CVSS 9.8, Linux)
- [CVE-2024-35861](https://cve.now/CVE-2024-35861.md): smb: client: fix potential UAF in cifs\_signal\_cifsd\_for\_reconnect() (CVSS 9.8, Linux)
- [CVE-2024-35860](https://cve.now/CVE-2024-35860.md): bpf: support deferring bpf\_link dealloc to after RCU grace period (CVSS 7.8, Linux)
- [CVE-2024-5099](https://cve.now/CVE-2024-5099.md): SourceCodester Simple Inventory System updateprice.php sql injection (CVSS 5.3, SourceCodester Simple Inventory System)
- [CVE-2024-5098](https://cve.now/CVE-2024-5098.md): SourceCodester Simple Inventory System login.php sql injection (CVSS 5.1, SourceCodester Simple Inventory System)
- [CVE-2024-5097](https://cve.now/CVE-2024-5097.md): SourceCodester Simple Inventory System tableedit.php#page=editprice cross-site request forgery (CVSS 6.9, SourceCodester Simple Inventory System)
- [CVE-2024-5096](https://cve.now/CVE-2024-5096.md): Hipcam Device MAC Address wifi.mac information disclosure (CVSS 6.9, Hipcam Device)
- [CVE-2024-5095](https://cve.now/CVE-2024-5095.md): Victor Zsviot Camera MQTT Packet denial of service (CVSS 7.1, Victor Zsviot Camera)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.