# CVEs published 2024-05-22

174 CVEs were published on May 22, 2024: 10 critical, 55 high. Days are UTC.

- [CVE-2024-29851](https://cve.now/CVE-2024-29851.md): Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account. (CVSS 7.2, Veeam Backup & Replication)
- [CVE-2024-29853](https://cve.now/CVE-2024-29853.md): An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. (CVSS 7.8, Veeam Agent for Windows)
- [CVE-2024-29852](https://cve.now/CVE-2024-29852.md): Veeam Backup Enterprise Manager allows high-privileged users to read backup session logs. (CVSS 2.7, Veeam Backup & Replication)
- [CVE-2024-29850](https://cve.now/CVE-2024-29850.md): Veeam Backup Enterprise Manager allows account takeover via NTLM relay. (CVSS 8.8, Veeam Backup & Replication)
- [CVE-2024-29849](https://cve.now/CVE-2024-29849.md): Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. (CVSS 9.8, Veeam Backup & Replication)
- [CVE-2023-46806](https://cve.now/CVE-2023-46806.md): An SQL Injection vulnerability in a web component of EPMM versions before 12.1.0.0 allows an authenticated user with appropriate privilege t (CVSS 6.7, Ivanti EPMM)
- [CVE-2023-46807](https://cve.now/CVE-2023-46807.md): An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or (CVSS 6.7, Ivanti EPMM)
- [CVE-2024-22026](https://cve.now/CVE-2024-22026.md): A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execut (CVSS 6.7, Ivanti EPMM)
- [CVE-2024-4267](https://cve.now/CVE-2024-4267.md): Remote Code Execution in parisneo/lollms-webui (CVSS 8.4, parisneo/lollms-webui)
- [CVE-2024-27264](https://cve.now/CVE-2024-27264.md): IBM Performance Tools for i privilege escalation (CVSS 7.4, IBM i)
- [CVE-2024-4453](https://cve.now/CVE-2024-4453.md): GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GStreamer)
- [CVE-2024-31894](https://cve.now/CVE-2024-31894.md): IBM App Connect Enterprise information disclosure (CVSS 4.3, IBM App Connect Enterprise)
- [CVE-2023-51637](https://cve.now/CVE-2023-51637.md): Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability (CVSS 9.8, Sante PACS Server PG)
- [CVE-2023-51636](https://cve.now/CVE-2023-51636.md): Avira Prime Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Avira Prime)
- [CVE-2024-31895](https://cve.now/CVE-2024-31895.md): IBM App Connect Enterprise information disclosure (CVSS 4.3, IBM App Connect Enterprise)
- [CVE-2024-4454](https://cve.now/CVE-2024-4454.md): WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability (CVSS 7.3, WithSecure Elements)
- [CVE-2024-35627](https://cve.now/CVE-2024-35627.md): tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key. (CVSS 6.1)
- [CVE-2024-25737](https://cve.now/CVE-2024-25737.md): A Server-Side Request Forgery (SSRF) vulnerability in the /Cover/Show route (showAction in CoverController.php) in Open Library Foundation V (CVSS 6.1, vufind/vufind)
- [CVE-2024-31893](https://cve.now/CVE-2024-31893.md): IBM App Connect Enterprise information disclosure (CVSS 4.3, IBM App Connect Enterprise)
- [CVE-2024-25738](https://cve.now/CVE-2024-25738.md): A Server-Side Request Forgery (SSRF) vulnerability in the /Upgrade/FixConfig route in Open Library Foundation VuFind 2.0 through 9.1 before (CVSS 9.1, vufind/vufind)
- [CVE-2024-31904](https://cve.now/CVE-2024-31904.md): IBM App Connect Enterprise denial of service (CVSS 6.5, IBM App Connect Enterprise)
- [CVE-2024-21791](https://cve.now/CVE-2024-21791.md): SQL Injection in ADAudit Plus (CVSS 4.7, ManageEngine ADAudit Plus)
- [CVE-2024-20360](https://cve.now/CVE-2024-20360.md): A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remo (CVSS 8.8, Cisco Firepower Management Center)
- [CVE-2024-31617](https://cve.now/CVE-2024-31617.md): OpenLiteSpeed before 1.8.1 mishandles chunked encoding. (CVSS 5.3)
- [CVE-2024-29421](https://cve.now/CVE-2024-29421.md): xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary c (CVSS 6.2)
- [CVE-2024-4563](https://cve.now/CVE-2024-4563.md): The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length (CVSS 6.1, Progress Software MOVEit Automation)
- [CVE-2024-20293](https://cve.now/CVE-2024-20293.md): A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Th (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20355](https://cve.now/CVE-2024-20355.md): A vulnerability in the implementation of SAML 2.0 single sign-on (SSO) for remote access VPN services in Cisco Adaptive Security Appliance ( (CVSS 5.0, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2024-20361](https://cve.now/CVE-2024-20361.md): A vulnerability in the Object Groups for Access Control Lists (ACLs) feature of Cisco Firepower Management Center (FMC) Software could allow (CVSS 5.8, Cisco Firepower Management Center · Cisco Firepower Threat…)
- [CVE-2024-20261](https://cve.now/CVE-2024-20261.md): A vulnerability in the file policy feature that is used to inspect encrypted archive files of Cisco Firepower Threat Defense (FTD) Software (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2024-20363](https://cve.now/CVE-2024-20363.md): Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that could allow an unaut (CVSS 5.8, Cisco Firepower Threat Defense Software · Cisco UTD SNORT I…)
- [CVE-2024-36077](https://cve.now/CVE-2024-36077.md): Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. (CVSS 8.8)
- [CVE-2024-5166](https://cve.now/CVE-2024-5166.md): Insecure Direct Object Reference In Looker (CVSS 6.5, Google Cloud Looker)
- [CVE-2024-34448](https://cve.now/CVE-2024-34448.md): Ghost before 5.82.0 allows CSV Injection during a member CSV export. (CVSS 8.8, @tryghost/members-csv)
- [CVE-2024-29392](https://cve.now/CVE-2024-29392.md): Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController. (CVSS 5.4, org.silverpeas.core:silverpeas-core)
- [CVE-2024-35362](https://cve.now/CVE-2024-35362.md): Ecshop 3.6 is vulnerable to Cross Site Scripting (XSS) via ecshop/article\_cat.php. (CVSS 5.4)
- [CVE-2024-33228](https://cve.now/CVE-2024-33228.md): An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges (CVSS 8.4)
- [CVE-2024-33227](https://cve.now/CVE-2024-33227.md): An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via (CVSS 8.8)
- [CVE-2024-33226](https://cve.now/CVE-2024-33226.md): An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and e (CVSS 9.9)
- [CVE-2024-33225](https://cve.now/CVE-2024-33225.md): An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows att (CVSS 7.8)
- [CVE-2024-33224](https://cve.now/CVE-2024-33224.md): An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileg (CVSS 8.4)
- [CVE-2024-5160](https://cve.now/CVE-2024-5160.md): Heap buffer overflow in Dawn in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory write via (CVSS 8.8, Google Chrome)
- [CVE-2024-5159](https://cve.now/CVE-2024-5159.md): Heap buffer overflow in ANGLE in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to perform an out of bounds memory read via (CVSS 8.8, Google Chrome)
- [CVE-2024-5158](https://cve.now/CVE-2024-5158.md): Type Confusion in V8 in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to potentially perform arbitrary read/write via a cra (CVSS 8.8, Google Chrome)
- [CVE-2024-5157](https://cve.now/CVE-2024-5157.md): Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2024-33223](https://cve.now/CVE-2024-33223.md): An issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute (CVSS 8.8)
- [CVE-2024-33222](https://cve.now/CVE-2024-33222.md): An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execu (CVSS 8.4)
- [CVE-2024-33221](https://cve.now/CVE-2024-33221.md): An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and (CVSS 7.8)
- [CVE-2024-33220](https://cve.now/CVE-2024-33220.md): An issue in the component AslO3\_64.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute (CVSS 8.8)
- [CVE-2024-33219](https://cve.now/CVE-2024-33219.md): An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and (CVSS 7.8)
- [CVE-2024-33218](https://cve.now/CVE-2024-33218.md): An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate priv (CVSS 7.8)
- [CVE-2024-3926](https://cve.now/CVE-2024-3926.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom\_attributes (CVSS 6.4, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-35409](https://cve.now/CVE-2024-35409.md): WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php. (CVSS 9.8)
- [CVE-2024-35475](https://cve.now/CVE-2024-35475.md): A Cross-Site Request Forgery (CSRF) vulnerability was discovered in OpenKM Community Edition on or before version 6.3.12. (CVSS 6.4)
- [CVE-2024-35561](https://cve.now/CVE-2024-35561.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca\_deal.php?mudi=add&nohrefStr=close. (CVSS 5.4)
- [CVE-2024-35560](https://cve.now/CVE-2024-35560.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca\_deal.php?mudi=del&dataType=&dataTypeC (CVSS 4.3)
- [CVE-2024-35559](https://cve.now/CVE-2024-35559.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove\_deal.php?mudi=rev&nohrefStr=clo (CVSS 8.8)
- [CVE-2024-35558](https://cve.now/CVE-2024-35558.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca\_deal.php?mudi=rev&nohrefStr=close. (CVSS 8.8)
- [CVE-2024-35557](https://cve.now/CVE-2024-35557.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi\_deal.php?mudi=rev&nohrefStr=close (CVSS 5.5)
- [CVE-2024-35555](https://cve.now/CVE-2024-35555.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share\_switch.php?mudi=switch&dataType=ne (CVSS 6.3)
- [CVE-2024-35556](https://cve.now/CVE-2024-35556.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys\_deal.php?mudi=infoSet. (CVSS 8.8)
- [CVE-2024-35554](https://cve.now/CVE-2024-35554.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb\_deal.php?mudi=del&dataType=newsW (CVSS 5.4)
- [CVE-2024-35553](https://cve.now/CVE-2024-35553.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove\_deal.php?mudi=add&nohrefStr=clo (CVSS 8.3)
- [CVE-2024-35552](https://cve.now/CVE-2024-35552.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove\_deal.php?mudi=del&dataType=logo (CVSS 8.8)
- [CVE-2024-35551](https://cve.now/CVE-2024-35551.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb\_deal.php?mudi=add. (CVSS 4.3)
- [CVE-2024-35550](https://cve.now/CVE-2024-35550.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb\_deal.php?mudi=rev. (CVSS 6.3)
- [CVE-2024-4261](https://cve.now/CVE-2024-4261.md): Responsive Contact Form Builder & Lead Generation Plugin \<= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, themehunk Lead Form Builder & Contact Form)
- [CVE-2024-5196](https://cve.now/CVE-2024-5196.md): Arris VAP2500 tools\_command.php command injection (CVSS 5.1, Arris VAP2500)
- [CVE-2024-36010](https://cve.now/CVE-2024-36010.md): igb: Fix string truncation warnings in igb\_set\_fw\_version (no CVSS, Linux)
- [CVE-2024-5195](https://cve.now/CVE-2024-5195.md): Arris VAP2500 diag\_s.php command injection (CVSS 5.1, Arris VAP2500)
- [CVE-2024-5194](https://cve.now/CVE-2024-5194.md): Arris VAP2500 assoc\_table.php command injection (CVSS 5.1, Arris VAP2500)
- [CVE-2024-5193](https://cve.now/CVE-2024-5193.md): Ritlabs TinyWeb Server Request crlf injection (CVSS 6.9, Ritlabs TinyWeb Server)
- [CVE-2024-4262](https://cve.now/CVE-2024-4262.md): Piotnet Addons For Elementor \<= 2.4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Attributes (CVSS 6.4, piotnetdotcom Piotnet Addons For Elementor)
- [CVE-2024-5025](https://cve.now/CVE-2024-5025.md): MemberPress \<= 1.11.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter (CVSS 6.4, Memberpress)
- [CVE-2024-4362](https://cve.now/CVE-2024-4362.md): SiteOrigin Widgets Bundle \<= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin\_widget' Shortcode (CVSS 6.4, gpriday SiteOrigin Widgets Bundle)
- [CVE-2024-5031](https://cve.now/CVE-2024-5031.md): MemberPress \<= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode (CVSS 8.5, Memberpress)
- [CVE-2024-2036](https://cve.now/CVE-2024-2036.md): ApplyOnline – Application Form Builder and Manager \<= 2.6.2 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3, farhannoor ApplyOnline – Application Form Builder and Manag…)
- [CVE-2024-3495](https://cve.now/CVE-2024-3495.md): Country State City Dropdown CF7 \<= 2.7.2 - Unauthenticated SQL Injection (CVSS 9.8, trustyplugins Country State City Dropdown CF7)
- [CVE-2024-4896](https://cve.now/CVE-2024-4896.md): WPB Elementor Addons \<= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter (CVSS 6.4, wpbean WPB Addons for Elementor – News Ticker, Timeline, Te…)
- [CVE-2021-47498](https://cve.now/CVE-2021-47498.md): dm rq: don't queue request to blk-mq during DM suspend (CVSS 5.5, Linux)
- [CVE-2021-47497](https://cve.now/CVE-2021-47497.md): nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (no CVSS, Linux)
- [CVE-2021-47496](https://cve.now/CVE-2021-47496.md): net/tls: Fix flipped sign in tls\_err\_abort() calls (CVSS 9.8, Linux)
- [CVE-2021-47495](https://cve.now/CVE-2021-47495.md): usbnet: sanity check for maxpacket (no CVSS, Linux)
- [CVE-2021-47494](https://cve.now/CVE-2021-47494.md): cfg80211: fix management registrations locking (CVSS 7.8, Linux)
- [CVE-2021-47493](https://cve.now/CVE-2021-47493.md): ocfs2: fix race between searching chunks and release journal\_head from buffer\_head (CVSS 7.8, Linux)
- [CVE-2021-47492](https://cve.now/CVE-2021-47492.md): mm, thp: bail out early in collapse\_file for writeback page (CVSS 7.8, Linux)
- [CVE-2021-47491](https://cve.now/CVE-2021-47491.md): mm: khugepaged: skip huge page collapse for special files (no CVSS, Linux)
- [CVE-2021-47490](https://cve.now/CVE-2021-47490.md): drm/ttm: fix memleak in ttm\_transfered\_destroy (no CVSS, Linux)
- [CVE-2021-47489](https://cve.now/CVE-2021-47489.md): drm/amdgpu: Fix even more out of bound writes from debugfs (no CVSS, Linux)
- [CVE-2021-47486](https://cve.now/CVE-2021-47486.md): riscv, bpf: Fix potential NULL dereference (CVSS 7.5, Linux)
- [CVE-2021-47485](https://cve.now/CVE-2021-47485.md): IB/qib: Protect from buffer overflow in struct qib\_user\_sdma\_pkt fields (CVSS 7.8, Linux)
- [CVE-2021-47484](https://cve.now/CVE-2021-47484.md): octeontx2-af: Fix possible null pointer dereference. (CVSS 5.5, Linux)
- [CVE-2021-47483](https://cve.now/CVE-2021-47483.md): regmap: Fix possible double-free in regcache\_rbtree\_exit() (CVSS 7.8, Linux)
- [CVE-2021-47482](https://cve.now/CVE-2021-47482.md): net: batman-adv: fix error handling (CVSS 5.3, Linux)
- [CVE-2021-47481](https://cve.now/CVE-2021-47481.md): RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR (no CVSS, Linux)
- [CVE-2021-47480](https://cve.now/CVE-2021-47480.md): scsi: core: Put LLD module refcnt after SCSI device is released (no CVSS, Linux)
- [CVE-2021-47479](https://cve.now/CVE-2021-47479.md): staging: rtl8712: fix use-after-free in rtl8712\_dl\_fw (no CVSS, Linux)
- [CVE-2021-47478](https://cve.now/CVE-2021-47478.md): isofs: Fix out of bound access for corrupted isofs image (CVSS 9.1, Linux)
- [CVE-2021-47477](https://cve.now/CVE-2021-47477.md): comedi: dt9812: fix DMA buffers on stack (CVSS 5.3, Linux)
- [CVE-2021-47476](https://cve.now/CVE-2021-47476.md): comedi: ni\_usb6501: fix NULL-deref in command paths (CVSS 4.6, Linux)
- [CVE-2021-47475](https://cve.now/CVE-2021-47475.md): comedi: vmk80xx: fix transfer-buffer overflows (no CVSS, Linux)
- [CVE-2021-47474](https://cve.now/CVE-2021-47474.md): comedi: vmk80xx: fix bulk-buffer overflow (no CVSS, Linux)
- [CVE-2024-32988](https://cve.now/CVE-2024-32988.md): 'OfferBox' App for Android versions 2.0.0 to 2.3.17 and 'OfferBox' App for iOS versions 2.1.7 to 2.6.14 use a hard-coded secret key for JWT. (CVSS 7.5, i-plug 'OfferBox' App for Android · i-plug 'OfferBox' App f…)
- [CVE-2024-5147](https://cve.now/CVE-2024-5147.md): WPZOOM Addons for Elementor (Templates, Widgets) \<= 1.1.37 - Unauthenticated Local File Inclusion (CVSS 9.8, WPZOOM Addons for Elementor – Starter Templates & Widgets)
- [CVE-2024-3666](https://cve.now/CVE-2024-3666.md): Opal Estate Pro – Property Management and Submission \<= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpopal Opal Estate Pro – Property Management and Submission)
- [CVE-2024-2953](https://cve.now/CVE-2024-2953.md): LuckyWP Table of Contents \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.5, theluckywp LuckyWP Table of Contents)
- [CVE-2024-4157](https://cve.now/CVE-2024-4157.md): Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder \<= 5.1.15 - PHP Object Injection via extractDynamicValues (CVSS 7.5, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2023-6487](https://cve.now/CVE-2023-6487.md): LuckyWP Table of Contents \<= 2.1.5 - Authenticated (Administrator+) Cross-Site Scripting (CVSS 4.4, theluckywp LuckyWP Table of Contents)
- [CVE-2024-2119](https://cve.now/CVE-2024-2119.md): LuckyWP Table of Contents \<= 2.1.5 - Reflected Cross-Site Scripting (CVSS 6.1, theluckywp LuckyWP Table of Contents)
- [CVE-2024-0632](https://cve.now/CVE-2024-0632.md): Automatic Translator with Google Translate \<= 1.5.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font (CVSS 4.4, juangirini Automatic Translator with Google Translate)
- [CVE-2024-2163](https://cve.now/CVE-2024-2163.md): Ninja Beaver Add-ons for Beaver Builder \<= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets (CVSS 6.4, njba Ninja Beaver Add-ons for Beaver Builder)
- [CVE-2024-3671](https://cve.now/CVE-2024-3671.md): Print-O-Matic \<= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, baden03 Print-O-Matic)
- [CVE-2024-3198](https://cve.now/CVE-2024-3198.md): WP Font Awesome Share Icons \<= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, spyrosvl WP Font Awesome Share Icons)
- [CVE-2024-1762](https://cve.now/CVE-2024-1762.md): NextScripts: Social Networks Auto-Poster \<= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent (CVSS 6.1, NextScripts: Social Networks Auto-Poster)
- [CVE-2024-2088](https://cve.now/CVE-2024-2088.md): NextScripts: Social Networks Auto-Poster \<= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure (CVSS 8.5, NextScripts: Social Networks Auto-Poster)
- [CVE-2024-3927](https://cve.now/CVE-2024-3927.md): Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) \<= 5.6.3 - Form Submission Admin Email Bypass (CVSS 5.3, bdthemes Element Pack – Widgets, Templates & Addons for Ele…)
- [CVE-2024-1446](https://cve.now/CVE-2024-1446.md): NextScripts: Social Networks Auto-Poster \<= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post Deletion (CVSS 5.4, NextScripts: Social Networks Auto-Poster)
- [CVE-2024-3663](https://cve.now/CVE-2024-3663.md): WP Scraper \<= 5.7 - Missing Authorization to Arbitrary Page/Post Creation (CVSS 4.3, rico-macchi WP Scraper)
- [CVE-2021-47473](https://cve.now/CVE-2021-47473.md): scsi: qla2xxx: Fix a memory leak in an error path of qla2x00\_process\_els() (no CVSS, Linux)
- [CVE-2021-47471](https://cve.now/CVE-2021-47471.md): drm: mxsfb: Fix NULL pointer dereference crash on unload (CVSS 5.5, Linux)
- [CVE-2021-47470](https://cve.now/CVE-2021-47470.md): mm, slub: fix potential use-after-free in slab\_debugfs\_fops (no CVSS, Linux)
- [CVE-2021-47468](https://cve.now/CVE-2021-47468.md): isdn: mISDN: Fix sleeping function called from invalid context (no CVSS, Linux)
- [CVE-2021-47467](https://cve.now/CVE-2021-47467.md): kunit: fix reference count leak in kfree\_at\_end (CVSS 5.3, Linux)
- [CVE-2021-47466](https://cve.now/CVE-2021-47466.md): mm, slub: fix potential memoryleak in kmem\_cache\_open() (no CVSS, Linux)
- [CVE-2021-47465](https://cve.now/CVE-2021-47465.md): KVM: PPC: Book3S HV: Fix stack handling in idle\_kvm\_start\_guest() (CVSS 7.1, Linux)
- [CVE-2021-47464](https://cve.now/CVE-2021-47464.md): audit: fix possible null-pointer dereference in audit\_filter\_rules (CVSS 7.4, Linux)
- [CVE-2021-47463](https://cve.now/CVE-2021-47463.md): mm/secretmem: fix NULL page-\>mapping dereference in page\_is\_secretmem() (no CVSS, Linux)
- [CVE-2021-47462](https://cve.now/CVE-2021-47462.md): mm/mempolicy: do not allow illegal MPOL\_F\_NUMA\_BALANCING | MPOL\_LOCAL in mbind() (no CVSS, Linux)
- [CVE-2021-47461](https://cve.now/CVE-2021-47461.md): userfaultfd: fix a race between writeprotect and exit\_mmap() (CVSS 7.8, Linux)
- [CVE-2021-47460](https://cve.now/CVE-2021-47460.md): ocfs2: fix data corruption after conversion from inline format (no CVSS, Linux)
- [CVE-2021-47459](https://cve.now/CVE-2021-47459.md): can: j1939: j1939\_netdev\_start(): fix UAF for rx\_kref of j1939\_priv (CVSS 7.8, Linux)
- [CVE-2021-47458](https://cve.now/CVE-2021-47458.md): ocfs2: mount fails with buffer overflow in strlen (CVSS 7.1, Linux)
- [CVE-2021-47457](https://cve.now/CVE-2021-47457.md): can: isotp: isotp\_sendmsg(): add result check for wait\_event\_interruptible() (no CVSS, Linux)
- [CVE-2021-47456](https://cve.now/CVE-2021-47456.md): can: peak\_pci: peak\_pci\_remove(): fix UAF (CVSS 8.4, Linux)
- [CVE-2021-47455](https://cve.now/CVE-2021-47455.md): ptp: Fix possible memory leak in ptp\_clock\_register() (no CVSS, Linux)
- [CVE-2021-47454](https://cve.now/CVE-2021-47454.md): powerpc/smp: do not decrement idle task preempt count in CPU offline (no CVSS, Linux)
- [CVE-2021-47453](https://cve.now/CVE-2021-47453.md): ice: Avoid crash from unnecessary IDA free (no CVSS, Linux)
- [CVE-2021-47452](https://cve.now/CVE-2021-47452.md): netfilter: nf\_tables: skip netdev events generated on netns removal (no CVSS, Linux)
- [CVE-2021-47451](https://cve.now/CVE-2021-47451.md): netfilter: xt\_IDLETIMER: fix panic that occurs when timer\_type has garbage value (CVSS 7.8, Linux)
- [CVE-2021-47450](https://cve.now/CVE-2021-47450.md): KVM: arm64: Fix host stage-2 PGD refcount (CVSS 8.8, Linux)
- [CVE-2021-47449](https://cve.now/CVE-2021-47449.md): ice: fix locking for Tx timestamp tracking flush (CVSS 7.1, Linux)
- [CVE-2021-47448](https://cve.now/CVE-2021-47448.md): mptcp: fix possible stall on recvmsg() (CVSS 7.5, Linux)
- [CVE-2021-47447](https://cve.now/CVE-2021-47447.md): drm/msm/a3xx: fix error handling in a3xx\_gpu\_init() (CVSS 7.8, Linux)
- [CVE-2021-47446](https://cve.now/CVE-2021-47446.md): drm/msm/a4xx: fix error handling in a4xx\_gpu\_init() (CVSS 7.8, Linux)
- [CVE-2021-47445](https://cve.now/CVE-2021-47445.md): drm/msm: Fix null pointer dereference on pointer edp (no CVSS, Linux)
- [CVE-2021-47444](https://cve.now/CVE-2021-47444.md): drm/edid: In connector\_bad\_edid() cap num\_of\_ext by num\_blocks read (no CVSS, Linux)
- [CVE-2021-47443](https://cve.now/CVE-2021-47443.md): NFC: digital: fix possible memory leak in digital\_tg\_listen\_mdaa() (CVSS 5.5, Linux)
- [CVE-2021-47442](https://cve.now/CVE-2021-47442.md): NFC: digital: fix possible memory leak in digital\_in\_send\_sdd\_req() (no CVSS, Linux)
- [CVE-2021-47441](https://cve.now/CVE-2021-47441.md): mlxsw: thermal: Fix out-of-bounds memory accesses (CVSS 7.3, Linux)
- [CVE-2021-47440](https://cve.now/CVE-2021-47440.md): net: encx24j600: check error in devm\_regmap\_init\_encx24j600 (CVSS 2.3, Linux)
- [CVE-2021-47439](https://cve.now/CVE-2021-47439.md): net: dsa: microchip: Added the condition for scheduling ksz\_mib\_read\_work (CVSS 5.5, Linux)
- [CVE-2021-47438](https://cve.now/CVE-2021-47438.md): net/mlx5e: Fix memory leak in mlx5\_core\_destroy\_cq() error path (CVSS 7.1, Linux)
- [CVE-2021-47437](https://cve.now/CVE-2021-47437.md): iio: adis16475: fix deadlock on frequency set (no CVSS, Linux)
- [CVE-2021-47436](https://cve.now/CVE-2021-47436.md): usb: musb: dsps: Fix the probe error path (no CVSS, Linux)
- [CVE-2021-47435](https://cve.now/CVE-2021-47435.md): dm: fix mempool NULL pointer race when completing IO (no CVSS, Linux)
- [CVE-2021-47434](https://cve.now/CVE-2021-47434.md): xhci: Fix command ring pointer corruption while aborting a command (no CVSS, Linux)
- [CVE-2021-47433](https://cve.now/CVE-2021-47433.md): btrfs: fix abort logic in btrfs\_replace\_file\_extents (CVSS 8.1, Linux)
- [CVE-2020-35165](https://cve.now/CVE-2020-35165.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Tim (CVSS 5.1, Dell BSAFE Crypto-C Micro Edition · Dell BSAFE Micro Editio…)
- [CVE-2024-3066](https://cve.now/CVE-2024-3066.md): Elegant Addons for elementor \<= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags (CVSS 6.4, aruphash Elegant Addons for elementor)
- [CVE-2024-4443](https://cve.now/CVE-2024-4443.md): Business Directory Plugin – Easy Listing Directories for WordPress \<= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter (CVSS 9.8, strategy11team Business Directory Plugin – Easy Listing Dir…)
- [CVE-2024-5092](https://cve.now/CVE-2024-5092.md): Elegant Addons for elementor \<= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets (CVSS 6.4, aruphash Elegant Addons for elementor)
- [CVE-2024-3611](https://cve.now/CVE-2024-3611.md): Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced \<= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, daveshine Toolbar Extras for Elementor & More – WordPress A…)
- [CVE-2024-4971](https://cve.now/CVE-2024-4971.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-35162](https://cve.now/CVE-2024-35162.md): Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. (CVSS 6.5, WPFactory Download Plugins and Themes from Dashboard)
- [CVE-2024-31340](https://cve.now/CVE-2024-31340.md): TP-Link Tether versions prior to 4.5.13 and TP-Link Tapo versions prior to 3.3.6 do not properly validate certificates, which may allow a re (CVSS 4.8, TP-Link Tether · TP-Link Tapo)
- [CVE-2024-31396](https://cve.now/CVE-2024-31396.md): Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3 (CVSS 6.6, appleple a-blog cms Ver.3.1.x series · appleple a-blog cms…)
- [CVE-2024-31395](https://cve.now/CVE-2024-31395.md): Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ve (CVSS 6.1, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-31394](https://cve.now/CVE-2024-31394.md): Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver (CVSS 6.5, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-30420](https://cve.now/CVE-2024-30420.md): Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series ver (CVSS 4.4, appleple a-blog cms Ver.3.1.x series · appleple a-blog cms…)
- [CVE-2024-30419](https://cve.now/CVE-2024-30419.md): Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ve (CVSS 5.4, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-4980](https://cve.now/CVE-2024-4980.md): WPKoi Templates for Elementor \<= 2.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters (CVSS 6.4, wpkoithemes WPKoi Templates for Elementor)
- [CVE-2024-0453](https://cve.now/CVE-2024-0453.md): AI ChatBot \<= 5.3.4 - Missing Authorization via openai\_file\_delete\_callback (CVSS 5.0, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2024-0452](https://cve.now/CVE-2024-0452.md): AI ChatBot \<= 5.3.4 - Missing Authorization via openai\_file\_upload\_callback (CVSS 5.0, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2024-0451](https://cve.now/CVE-2024-0451.md): AI ChatBot \<= 5.3.4 - Missing Authorization via openai\_file\_list\_callback (CVSS 5.0, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.