CVEs published May 20, 2024
123 CVEs were published on May 20, 2024: 8 critical, 50 high.
- Published
- 123
- Critical
- 8
- High
- 50
- Medium
- 35
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 57
Most affected products
- Linux
- 62
- Campcodes Complete Web-Based School Management System
- 8
- SourceCodester Event Registration System
- 7
- ManageEngine ADAudit Plus
- 6
- PHPGurukul Directory Management System
- 3
- lunary-ai/lunary
- 2
- OpenText ArcSight Enterprise Security Manager · OpenText Ar…
- 2
- @apidevtools/json-schema-ref-parser
- 1
- @bit/loader
- 1
- @blackprint/engine
- 1
Critical 8
- CVE-2024-4985An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication GitHub Enterprise Server
- CVE-2024-35580Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv.
- CVE-2024-35571Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.
- CVE-2024-24294A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepProp@blackprint/engine
- CVE-2024-34947Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect
- CVE-2024-4323Fluent Bit Memory Corruption VulnerabilityFluent Bit
- CVE-2024-35960net/mlx5: Properly link new fs rules into the treeLinux
- CVE-2024-3761Missing Authorization on Delete Datasets in lunary-ai/lunarylunary-ai/lunary
High 50
- CVE-2024-34710Wiki.js Stored XSS through Client Side Template Injection requarks wiki · github.com/requarks/wiki
- CVE-2024-29000SolarWinds Platform Reflected XSS VulnerabilitySolarWinds Platform
- CVE-2023-49335Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.ManageEngine ADAudit Plus
- CVE-2023-49334Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.ManageEngine ADAudit Plus
- CVE-2023-49333Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.ManageEngine ADAudit Plus
- CVE-2024-34949SQL injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function OrderLogic::getOrderList
- CVE-2023-49332Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.ManageEngine ADAudit Plus
- CVE-2023-49331Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.ManageEngine ADAudit Plus
- CVE-2024-34193smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can
- CVE-2024-35578Tenda AX1806 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv.
- CVE-2024-35579Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv.
- CVE-2024-24293A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argumen@bit/loader
- CVE-2024-31714Buffer Overflow vulnerability in Waxlab wax v.0.9-3 and before allows an attacker to cause a denial of service via the Lua library component
- CVE-2024-29651A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code@apidevtools/json-schema-ref-parser
- CVE-2024-0401ASUS OVPN RCEASUS ExpertWiFi · ASUS RT-AX55 +8
- CVE-2024-34948An issue in Quanxun Huiju Network Technology(Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 allows attackers to cause a Denial of Se
- CVE-2024-4151Improper Access Control in lunary-ai/lunarylunary-ai/lunary
- CVE-2024-2835OpenText ArcSight Enterprise Security Manager and ArcSight Platform Stored XSSOpenText ArcSight Enterprise Security Manager · OpenText Ar…
- CVE-2024-3482OpenText ArcSight Enterprise Security Manager and ArcSight Platform Stored XSSOpenText ArcSight Enterprise Security Manager · OpenText Ar…
- CVE-2024-34953An issue in taurusxin ncmdump v1.3.2 allows attackers to cause a Denial of Service (DoS) via memory exhaustion by supplying a crafted .ncm f
- CVE-2024-27312Authorization vulnerability in PAM360ManageEngine PAM360
- CVE-2024-4287Improper Input Validation in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2023-49330Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.ManageEngine ADAudit Plus
- CVE-2024-36009ax25: Fix netdev refcount issueLinux
- CVE-2024-36007mlxsw: spectrum_acl_tcam: Fix warning during rehashLinux
- CVE-2024-36001netfs: Fix the pre-flush when appending to a file in writethrough modeLinux
- CVE-2024-35999smb3: missing lock when picking channelLinux
- CVE-2024-35998smb3: fix lock ordering potential deadlock in cifs_sync_mid_resultLinux
- CVE-2024-35994firmware: qcom: uefisecapp: Fix memory related IO errors and crashesLinux
- CVE-2024-35993mm: turn folio_test_hugetlb into a PageTypeLinux
- CVE-2024-35990dma: xilinx_dpdma: Fix lockingLinux
- CVE-2024-35987riscv: Fix loading 64-bit NOMMU kernels past the start of RAMLinux
- CVE-2024-35986phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregisteredLinux
- CVE-2024-35980arm64: tlb: Fix TLBI RANGE operandLinux
- CVE-2024-35979raid1: fix use-after-free for original bio in raid1_write_request()Linux
- CVE-2024-35976xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RINGLinux
- CVE-2024-35971net: ks8851: Handle softirqs at the end of IRQ thread to fix hangLinux
- CVE-2024-35969ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addrLinux
- CVE-2024-35968pds_core: Fix pdsc_check_pci_health function to use work threadLinux
- CVE-2024-35967Bluetooth: SCO: Fix not validating setsockopt user inputLinux
- CVE-2024-35963Bluetooth: hci_sock: Fix not validating setsockopt user inputLinux
- CVE-2024-35962netfilter: complete validation of user inputLinux
- CVE-2024-35958net: ena: Fix incorrect descriptor free behaviorLinux
- CVE-2024-35955kprobes: Fix possible use-after-free issue on kprobe registrationLinux
- CVE-2024-35954scsi: sg: Avoid sg device teardown raceLinux
- CVE-2024-35951drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()Linux
- CVE-2024-35950drm/client: Fully protect modes[] with dev->mode_config.mutexLinux
- CVE-2024-35949btrfs: make sure that WRITTEN is set on all metadata blocksLinux
- CVE-2024-35948bcachefs: Check for journal entries overruning end of sb clean sectionLinux
- CVE-2024-1968Authorization Header Leakage in scrapy/scrapy on Scheme Change Redirectsscrapy/scrapy · scrapy
Medium, low and unrated 65
- CVE-2024-5145SourceCodester Vehicle Management System HTTP POST Request newdriver.php unrestricted uploadSourceCodester Vehicle Management System
- CVE-2024-35194Stacklok Minder vulnerable to denial of service from maliciously crafted templatesstacklok minder · github.com/stacklok/minder
- CVE-2024-35192Trivy possibly leaks registry credential when scanning images from malicious registriesaquasecurity trivy · github.com/aquasecurity/trivy
- CVE-2024-33900KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover cleartext credentials via a memory dump.
- CVE-2024-35191verbb/formie Server-Side Template Injection for variable-enabled settingsverbb formie · verbb/formie
- CVE-2024-33901Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in the .kdbx database vi
- CVE-2024-35195Requests `Session` object does not verify requests after making first request with verify=Falsepsf requests · requests
- CVE-2024-35576Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv.
- CVE-2024-34952taurusxin ncmdump v1.3.2 was discovered to contain a segmentation violation via the NeteaseCrypt::FixMetadata() function at /src/ncmcrypt.cp
- CVE-2024-36008ipv4: check for NULL idev in ip_route_use_hint()Linux
- CVE-2024-36006mlxsw: spectrum_acl_tcam: Fix incorrect list API usageLinux
- CVE-2024-36005netfilter: nf_tables: honor table dormant flag from netdev release event pathLinux
- CVE-2024-36004i40e: Do not use WQ_MEM_RECLAIM flag for workqueueLinux
- CVE-2024-36003ice: fix LAG and VF lock dependency in ice_reset_vf()Linux
- CVE-2024-36002dpll: fix dpll_pin_on_pin_register() for multiple parent pinsLinux
- CVE-2024-36000mm/hugetlb: fix missing hugetlb_lock for resv unchargeLinux
- CVE-2024-35997HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-upLinux
- CVE-2024-35996cpu: Re-enable CPU mitigations by default for !X86 architecturesLinux
- CVE-2024-35995ACPI: CPPC: Use access_width over bit_width for system memory accessesLinux
- CVE-2024-35992phy: marvell: a3700-comphy: Fix out of bounds readLinux
- CVE-2024-35991dmaengine: idxd: Convert spinlock to mutex to lock evl workqueueLinux
- CVE-2024-35989dmaengine: idxd: Fix oops during rmmod on single-CPU platformsLinux
- CVE-2024-35988riscv: Fix TASK_SIZE on 64-bit NOMMULinux
- CVE-2024-35985sched/eevdf: Prevent vlag from going out of bounds in reweight_eevdf()Linux
- CVE-2024-35984i2c: smbus: fix NULL function pointer dereferenceLinux
- CVE-2024-35983bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUSLinux
- CVE-2024-35982batman-adv: Avoid infinite loop trying to resize local TTLinux
- CVE-2024-35981virtio_net: Do not send RSS key if it is not supportedLinux
- CVE-2024-35978Bluetooth: Fix memory leak in hci_req_sync_complete()Linux
- CVE-2024-35977platform/chrome: cros_ec_uart: properly fix race conditionLinux
- CVE-2024-35975octeontx2-pf: Fix transmit scheduler resource leakLinux
- CVE-2024-35974block: fix q->blkg_list corruption during disk rebindLinux
- CVE-2024-35973geneve: fix header validation in geneve[6]_xmit_skbLinux
- CVE-2024-35972bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init()Linux
- CVE-2024-35970af_unix: Clear stale u->oob_skb.Linux
- CVE-2024-35966Bluetooth: RFCOMM: Fix not validating setsockopt user inputLinux
- CVE-2024-35965Bluetooth: L2CAP: Fix not validating setsockopt user inputLinux
- CVE-2024-35964Bluetooth: ISO: Fix not validating setsockopt user inputLinux
- CVE-2024-35961net/mlx5: Register devlink first under devlink lockLinux
- CVE-2024-35959net/mlx5e: Fix mlx5e_priv_init() cleanup flowLinux
- CVE-2024-35957iommu/vt-d: Fix WARN_ON in iommu probe pathLinux
- CVE-2024-35956btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operationsLinux
- CVE-2024-35953accel/ivpu: Fix deadlock in context_xaLinux
- CVE-2024-35952drm/ast: Fix soft lockupLinux
- CVE-2024-5137PHPGurukul Directory Management System Searchbar admin-profile.php cross site scriptingPHPGurukul Directory Management System
- CVE-2024-5136PHPGurukul Directory Management System search-directory.php. cross site scriptingPHPGurukul Directory Management System
- CVE-2024-5135PHPGurukul Directory Management System index.php sql injectionPHPGurukul Directory Management System
- CVE-2024-5134SourceCodester Electricity Consumption Monitoring Tool delete-bill.php sql injectionSourceCodester Electricity Consumption Monitoring Tool
- CVE-2024-5123SourceCodester Event Registration System cross site scriptingSourceCodester Event Registration System
- CVE-2024-5122SourceCodester Event Registration System sql injectionSourceCodester Event Registration System
- CVE-2024-5121SourceCodester Event Registration System cross site scriptingSourceCodester Event Registration System
- CVE-2024-5120SourceCodester Event Registration System sql injectionSourceCodester Event Registration System
- CVE-2024-3368All in One SEO < 4.6.1.1 - Contributor+ Stored XSSAll in One SEO
- CVE-2024-5119SourceCodester Event Registration System sql injectionSourceCodester Event Registration System
- CVE-2024-5118SourceCodester Event Registration System login.php sql injectionSourceCodester Event Registration System
- CVE-2024-5117SourceCodester Event Registration System portal.php sql injectionSourceCodester Event Registration System
- CVE-2024-5116SourceCodester Online Examination System save.php sql injectionSourceCodester Online Examination System
- CVE-2024-5115Campcodes Complete Web-Based School Management System teacher_profile.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5114Campcodes Complete Web-Based School Management System teacher_attendance_history1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5113Campcodes Complete Web-Based School Management System student_profile1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5112Campcodes Complete Web-Based School Management System student_profile.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5111Campcodes Complete Web-Based School Management System student_payment_invoice1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5110Campcodes Complete Web-Based School Management System student_payment_invoice.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5109Campcodes Complete Web-Based School Management System student_payment_history.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5108Campcodes Complete Web-Based School Management System student_payment_details4.php sql injectionCampcodes Complete Web-Based School Management System