CVEs published May 22, 2024
174 CVEs were published on May 22, 2024: 10 critical, 55 high.
- Published
- 174
- Critical
- 10
- High
- 55
- Medium
- 77
- Low
- 2
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Linux
- 63
- Google Chrome
- 4
- IBM App Connect Enterprise
- 4
- Veeam Backup & Replication
- 4
- appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- 3
- Arris VAP2500
- 3
- Ivanti EPMM
- 3
- NextScripts: Social Networks Auto-Poster
- 3
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- 3
- theluckywp LuckyWP Table of Contents
- 3
Critical 10
- CVE-2024-29849Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.Veeam Backup & Replication
- CVE-2023-51637Sante PACS Server PG Patient Query SQL Injection Remote Code Execution VulnerabilitySante PACS Server PG
- CVE-2024-25738A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before vufind/vufind
- CVE-2024-33226An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and e
- CVE-2024-35409WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php.
- CVE-2024-3495Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injectiontrustyplugins Country State City Dropdown CF7
- CVE-2021-47496net/tls: Fix flipped sign in tls_err_abort() callsLinux
- CVE-2021-47478isofs: Fix out of bound access for corrupted isofs imageLinux
- CVE-2024-5147WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File InclusionWPZOOM Addons for Elementor – Starter Templates & Widgets
- CVE-2024-4443Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameterstrategy11team Business Directory Plugin – Easy Listing Dir…
High 55
- CVE-2024-29851Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.Veeam Backup & Replication
- CVE-2024-29853An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation.Veeam Agent for Windows
- CVE-2024-29850Veeam Backup Enterprise Manager allows account takeover via NTLM relay.Veeam Backup & Replication
- CVE-2024-4267Remote Code Execution in parisneo/lollms-webuiparisneo/lollms-webui
- CVE-2024-27264IBM Performance Tools for i privilege escalationIBM i
- CVE-2024-4453GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2023-51636Avira Prime Link Following Local Privilege Escalation VulnerabilityAvira Prime
- CVE-2024-4454WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation VulnerabilityWithSecure Elements
- CVE-2024-20360A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remoCisco Firepower Management Center
- CVE-2024-36077Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation.
- CVE-2024-34448Ghost before 5.82.0 allows CSV Injection during a member CSV export.@tryghost/members-csv
- CVE-2024-33228An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges
- CVE-2024-33227An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via
- CVE-2024-33225An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows att
- CVE-2024-33224An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileg
- CVE-2024-5160Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via Google Chrome
- CVE-2024-5159Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via Google Chrome
- CVE-2024-5158Type Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a craGoogle Chrome
- CVE-2024-5157Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2024-33223An issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute
- CVE-2024-33222An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execu
- CVE-2024-33221An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and
- CVE-2024-33220An issue in the component AslO3_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute
- CVE-2024-33219An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and
- CVE-2024-33218An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate priv
- CVE-2024-35559idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=clo
- CVE-2024-35558idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close.
- CVE-2024-35556idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet.
- CVE-2024-35553idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=add&nohrefStr=clo
- CVE-2024-35552idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=del&dataType=logo
- CVE-2024-5031MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file ShortcodeMemberpress
- CVE-2021-47494cfg80211: fix management registrations lockingLinux
- CVE-2021-47493ocfs2: fix race between searching chunks and release journal_head from buffer_headLinux
- CVE-2021-47492mm, thp: bail out early in collapse_file for writeback pageLinux
- CVE-2021-47486riscv, bpf: Fix potential NULL dereferenceLinux
- CVE-2021-47485IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fieldsLinux
- CVE-2021-47483regmap: Fix possible double-free in regcache_rbtree_exit()Linux
- CVE-2024-32988'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT.i-plug 'OfferBox' App for Android · i-plug 'OfferBox' App f…
- CVE-2024-4157Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValuestechjewel Fluent Forms – Customizable Contact Forms, Survey…
- CVE-2024-2088NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information ExposureNextScripts: Social Networks Auto-Poster
- CVE-2021-47465KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()Linux
- CVE-2021-47464audit: fix possible null-pointer dereference in audit_filter_rulesLinux
- CVE-2021-47461userfaultfd: fix a race between writeprotect and exit_mmap()Linux
- CVE-2021-47459can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_privLinux
- CVE-2021-47458ocfs2: mount fails with buffer overflow in strlenLinux
- CVE-2021-47456can: peak_pci: peak_pci_remove(): fix UAFLinux
- CVE-2021-47451netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage valueLinux
- CVE-2021-47450KVM: arm64: Fix host stage-2 PGD refcountLinux
- CVE-2021-47449ice: fix locking for Tx timestamp tracking flushLinux
- CVE-2021-47448mptcp: fix possible stall on recvmsg()Linux
- CVE-2021-47447drm/msm/a3xx: fix error handling in a3xx_gpu_init()Linux
- CVE-2021-47446drm/msm/a4xx: fix error handling in a4xx_gpu_init()Linux
- CVE-2021-47441mlxsw: thermal: Fix out-of-bounds memory accessesLinux
- CVE-2021-47438net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error pathLinux
- CVE-2021-47433btrfs: fix abort logic in btrfs_replace_file_extentsLinux
Medium, low and unrated 109
- CVE-2024-29852Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs.Veeam Backup & Replication
- CVE-2023-46806An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege tIvanti EPMM
- CVE-2023-46807An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access orIvanti EPMM
- CVE-2024-22026A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and executIvanti EPMM
- CVE-2024-31894IBM App Connect Enterprise information disclosureIBM App Connect Enterprise
- CVE-2024-31895IBM App Connect Enterprise information disclosureIBM App Connect Enterprise
- CVE-2024-35627tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
- CVE-2024-25737A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation Vvufind/vufind
- CVE-2024-31893IBM App Connect Enterprise information disclosureIBM App Connect Enterprise
- CVE-2024-31904IBM App Connect Enterprise denial of serviceIBM App Connect Enterprise
- CVE-2024-21791SQL Injection in ADAudit PlusManageEngine ADAudit Plus
- CVE-2024-31617OpenLiteSpeed before 1.8.1 mishandles chunked encoding.
- CVE-2024-29421xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary c
- CVE-2024-4563The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit LengthProgress Software MOVEit Automation
- CVE-2024-20293A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower ThCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20355A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance (Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2024-20361A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allowCisco Firepower Management Center · Cisco Firepower Threat…
- CVE-2024-20261A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software Cisco Firepower Threat Defense Software
- CVE-2024-20363Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unautCisco Firepower Threat Defense Software · Cisco UTD SNORT I…
- CVE-2024-5166Insecure Direct Object Reference In LookerGoogle Cloud Looker
- CVE-2024-29392Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.org.silverpeas.core:silverpeas-core
- CVE-2024-35362Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article_cat.php.
- CVE-2024-3926Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom_attributesbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-35475A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12.
- CVE-2024-35561idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close.
- CVE-2024-35560idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeC
- CVE-2024-35557idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close
- CVE-2024-35555idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=ne
- CVE-2024-35554idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsW
- CVE-2024-35551idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=add.
- CVE-2024-35550idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=rev.
- CVE-2024-4261Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Executionthemehunk Lead Form Builder & Contact Form
- CVE-2024-5196Arris VAP2500 tools_command.php command injectionArris VAP2500
- CVE-2024-36010igb: Fix string truncation warnings in igb_set_fw_versionLinux
- CVE-2024-5195Arris VAP2500 diag_s.php command injectionArris VAP2500
- CVE-2024-5194Arris VAP2500 assoc_table.php command injectionArris VAP2500
- CVE-2024-5193Ritlabs TinyWeb Server Request crlf injectionRitlabs TinyWeb Server
- CVE-2024-4262Piotnet Addons For Elementor <= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributespiotnetdotcom Piotnet Addons For Elementor
- CVE-2024-5025MemberPress <= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist ParameterMemberpress
- CVE-2024-4362SiteOrigin Widgets Bundle <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcodegpriday SiteOrigin Widgets Bundle
- CVE-2024-2036ApplyOnline – Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposurefarhannoor ApplyOnline – Application Form Builder and Manag…
- CVE-2024-4896WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameterwpbean WPB Addons for Elementor – News Ticker, Timeline, Te…
- CVE-2021-47498dm rq: don't queue request to blk-mq during DM suspendLinux
- CVE-2021-47497nvmem: Fix shift-out-of-bound (UBSAN) with byte size cellsLinux
- CVE-2021-47495usbnet: sanity check for maxpacketLinux
- CVE-2021-47491mm: khugepaged: skip huge page collapse for special filesLinux
- CVE-2021-47490drm/ttm: fix memleak in ttm_transfered_destroyLinux
- CVE-2021-47489drm/amdgpu: Fix even more out of bound writes from debugfsLinux
- CVE-2021-47484octeontx2-af: Fix possible null pointer dereference.Linux
- CVE-2021-47482net: batman-adv: fix error handlingLinux
- CVE-2021-47481RDMA/mlx5: Initialize the ODP xarray when creating an ODP MRLinux
- CVE-2021-47480scsi: core: Put LLD module refcnt after SCSI device is releasedLinux
- CVE-2021-47479staging: rtl8712: fix use-after-free in rtl8712_dl_fwLinux
- CVE-2021-47477comedi: dt9812: fix DMA buffers on stackLinux
- CVE-2021-47476comedi: ni_usb6501: fix NULL-deref in command pathsLinux
- CVE-2021-47475comedi: vmk80xx: fix transfer-buffer overflowsLinux
- CVE-2021-47474comedi: vmk80xx: fix bulk-buffer overflowLinux
- CVE-2024-3666Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpopal Opal Estate Pro – Property Management and Submission
- CVE-2024-2953LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingtheluckywp LuckyWP Table of Contents
- CVE-2023-6487LuckyWP Table of Contents <= 2.1.5 - Authenticated (Administrator+) Cross-Site Scriptingtheluckywp LuckyWP Table of Contents
- CVE-2024-2119LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scriptingtheluckywp LuckyWP Table of Contents
- CVE-2024-0632Automatic Translator with Google Translate <= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Fontjuangirini Automatic Translator with Google Translate
- CVE-2024-2163Ninja Beaver Add-ons for Beaver Builder <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgetsnjba Ninja Beaver Add-ons for Beaver Builder
- CVE-2024-3671Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebaden03 Print-O-Matic
- CVE-2024-3198WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodespyrosvl WP Font Awesome Share Icons
- CVE-2024-1762NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User AgentNextScripts: Social Networks Auto-Poster
- CVE-2024-3927Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypassbdthemes Element Pack – Widgets, Templates & Addons for Ele…
- CVE-2024-1446NextScripts: Social Networks Auto-Poster <= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post DeletionNextScripts: Social Networks Auto-Poster
- CVE-2024-3663WP Scraper <= 5.7 - Missing Authorization to Arbitrary Page/Post Creationrico-macchi WP Scraper
- CVE-2021-47473scsi: qla2xxx: Fix a memory leak in an error path of qla2x00_process_els()Linux
- CVE-2021-47471drm: mxsfb: Fix NULL pointer dereference crash on unloadLinux
- CVE-2021-47470mm, slub: fix potential use-after-free in slab_debugfs_fopsLinux
- CVE-2021-47468isdn: mISDN: Fix sleeping function called from invalid contextLinux
- CVE-2021-47467kunit: fix reference count leak in kfree_at_endLinux
- CVE-2021-47466mm, slub: fix potential memoryleak in kmem_cache_open()Linux
- CVE-2021-47463mm/secretmem: fix NULL page->mapping dereference in page_is_secretmem()Linux
- CVE-2021-47462mm/mempolicy: do not allow illegal MPOL_F_NUMA_BALANCING | MPOL_LOCAL in mbind()Linux
- CVE-2021-47460ocfs2: fix data corruption after conversion from inline formatLinux
- CVE-2021-47457can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible()Linux
- CVE-2021-47455ptp: Fix possible memory leak in ptp_clock_register()Linux
- CVE-2021-47454powerpc/smp: do not decrement idle task preempt count in CPU offlineLinux
- CVE-2021-47453ice: Avoid crash from unnecessary IDA freeLinux
- CVE-2021-47452netfilter: nf_tables: skip netdev events generated on netns removalLinux
- CVE-2021-47445drm/msm: Fix null pointer dereference on pointer edpLinux
- CVE-2021-47444drm/edid: In connector_bad_edid() cap num_of_ext by num_blocks readLinux
- CVE-2021-47443NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()Linux
- CVE-2021-47442NFC: digital: fix possible memory leak in digital_in_send_sdd_req()Linux
- CVE-2021-47440net: encx24j600: check error in devm_regmap_init_encx24j600Linux
- CVE-2021-47439net: dsa: microchip: Added the condition for scheduling ksz_mib_read_workLinux
- CVE-2021-47437iio: adis16475: fix deadlock on frequency setLinux
- CVE-2021-47436usb: musb: dsps: Fix the probe error pathLinux
- CVE-2021-47435dm: fix mempool NULL pointer race when completing IOLinux
- CVE-2021-47434xhci: Fix command ring pointer corruption while aborting a commandLinux
- CVE-2020-35165Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable TimDell BSAFE Crypto-C Micro Edition · Dell BSAFE Micro Editio…
- CVE-2024-3066Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tagsaruphash Elegant Addons for elementor
- CVE-2024-5092Elegant Addons for elementor <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgetsaruphash Elegant Addons for elementor
- CVE-2024-3611Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingdaveshine Toolbar Extras for Elementor & More – WordPress A…
- CVE-2024-4971LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2024-35162Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6.WPFactory Download Plugins and Themes from Dashboard
- CVE-2024-31340TP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly validate certificates, which may allow a reTP-Link Tether · TP-Link Tapo
- CVE-2024-31396Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3appleple a-blog cms Ver.3.1.x series · appleple a-blog cms…
- CVE-2024-31395Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Veappleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-31394Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Verappleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-30420Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series verappleple a-blog cms Ver.3.1.x series · appleple a-blog cms…
- CVE-2024-30419Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Veappleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-4980WPKoi Templates for Elementor <= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameterswpkoithemes WPKoi Templates for Elementor
- CVE-2024-0453AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callbackquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2024-0452AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callbackquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2024-0451AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callbackquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…