CVEs published May 23, 2024
118 CVEs were published on May 23, 2024: 17 critical, 40 high. 1 is now in CISA KEV.
- Published
- 118
- Critical
- 17
- High
- 40
- Medium
- 58
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 19
Most affected products
- Campcodes Complete Web-Based School Management System
- 10
- GitLab
- 6
- TP-Link Omada ER605
- 5
- D-Link D-View
- 4
- Linux
- 3
- NETGEAR ProSAFE Network Management System
- 3
- Adobe Acrobat Reader
- 2
- brainstormforce Spectra Gutenberg Blocks – Website Builder…
- 2
- cas
- 2
- hashthemes Hash Form – Drag & Drop Form Builder
- 2
Critical 17
- CVE-2024-5296D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass VulnerabilityD-Link D-View
- CVE-2024-35375There is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS
- CVE-2024-35079An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading
- CVE-2024-35080An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a craft
- CVE-2024-35570An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute
- CVE-2024-35091J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.
- CVE-2024-35086J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .
- CVE-2024-35084J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml.
- CVE-2024-34935A SQL injection vulnerability in /view/conversation_history_admin.php in Campcodes Complete Web-Based School Management System 1.0 allows an
- CVE-2024-34934A SQL injection vulnerability in /view/emarks_range_grade_update_form.php in Campcodes Complete Web-Based School Management System 1.0 allow
- CVE-2024-34932A SQL injection vulnerability in /model/update_exam.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to e
- CVE-2024-34931A SQL injection vulnerability in /model/update_subject.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker t
- CVE-2024-34929A SQL injection vulnerability in /view/find_friends.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to e
- CVE-2024-34927A SQL injection vulnerability in /model/update_classroom.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker
- CVE-2024-5084Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionhashthemes Hash Form – Drag & Drop Form Builder
- CVE-2024-5168Improper access control vulnerability in Prodys Quantum Audio codecProdys Quantum Audio codec
- CVE-2024-4399CAS <= 1.0.0 - Unauthenticated SSRFcas
High 40
- CVE-2024-5247NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2024-5246NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2024-5245NETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation VulnerabilityNETGEAR ProSAFE Network Management System
- CVE-2024-5243TP-Link Omada ER605 Buffer Overflow Remote Code Execution VulnerabilityTP-Link Omada ER605
- CVE-2024-5242TP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution VulnerabilityTP-Link Omada ER605
- CVE-2024-5228TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution VulnerabilityTP-Link Omada ER605
- CVE-2024-5227TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution VulnerabilityTP-Link Omada ER605
- CVE-2024-5299D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution VulnerabilityD-Link D-View
- CVE-2024-5298D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution VulnerabilityD-Link D-View
- CVE-2024-5297D-Link D-View executeWmicCmd Command Injection Remote Code Execution VulnerabilityD-Link D-View
- CVE-2024-5295D-Link G416 flupl self Command Injection Remote Code Execution VulnerabilityD-Link G416
- CVE-2024-5293D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution VulnerabilityD-Link DIR-2640
- CVE-2024-5292D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityD-Link Network Assistant
- CVE-2024-5291D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution VulnerabilityD-Link DIR-2150
- CVE-2024-5201Dimensions RM - Privilege EscalationOpenText Dimensions RM
- CVE-2024-5202Dimensions RM - Arbitrary File ReadOpenText Dimensions RM
- CVE-2024-35081LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload metho
- CVE-2024-2301Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the deCertain HP LaserJet Pro Devices
- CVE-2024-35090J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.
- CVE-2024-35083J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml.
- CVE-2024-34936A SQL injection vulnerability in /view/event1.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute
- CVE-2024-34928A SQL injection vulnerability in /model/update_subject_routing.php in Campcodes Complete Web-Based School Management System 1.0 allows an at
- CVE-2024-5085Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injectionhashthemes Hash Form – Drag & Drop Form Builder
- CVE-2024-35224Stored Cross-Site Scripting (XSS) in OpenProjectopf openproject
- CVE-2024-4471140+ Widgets | Best Addons For Elementor – FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object InjectionXpro Addons — 140+ Widgets for Elementor
- CVE-2024-34060Arbitrary File Write in IRIS EVTX Pipelinedfir-iris iris-evtx-module
- CVE-2024-26139OpenCTI Authenticated Privilege EscalationOpenCTI-Platform opencti · pycti
- CVE-2024-4779Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]unitecms Unlimited Elements For Elementor
- CVE-2024-35186gix traversal outside working tree enables arbitrary code executionByron gitoxide · gix-fs +6
- CVE-2024-30279ZDI-CAN-22887: Adobe Acrobat Reader DC JPEG2000 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-30280ZDI-CAN-22867: Adobe Acrobat Pro DC AcroForm Annotation Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-36013Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()Linux
- CVE-2024-36012Bluetooth: msft: fix slab-use-after-free in msft_do_close()Linux
- CVE-2024-2038Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded Credentialswpfeedback Atarim – Visual Feedback, Review & AI Collaborat…
- CVE-2024-4835Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-4388CAS <= 1.0.0 - Unauthenticated Arbitrary File Accesscas
- CVE-2024-3594IDonate <= 1.9.0 - Admin+ Stored XSSIDonate
- CVE-2024-4347WP Fastest Cache <= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletionemrevona WP Fastest Cache – WordPress Cache Plugin
- CVE-2024-4662Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code ExecutionOxygen Builder
- CVE-2024-4978Malicious Code in Justice AV Solutions (JAVS) ViewerJustice AV Solutions Viewer
Medium, low and unrated 61
- CVE-2024-5279Qiwen Netdisk File Rename cross site scriptingQiwen Netdisk
- CVE-2024-5244TP-Link Omada ER605 Reliance on Security Through Obscurity VulnerabilityTP-Link Omada ER605
- CVE-2024-5294D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service VulnerabilityD-Link DIR-3040
- CVE-2024-31843An issue was discovered in Italtel Embrace 1.6.4.
- CVE-2024-35082J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml.
- CVE-2024-5143A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server Certain HP LaserJet Pro Printers
- CVE-2024-35085J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.
- CVE-2024-34933A SQL injection vulnerability in /model/update_grade.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to
- CVE-2024-4365Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingmdempfle Advanced iFrame
- CVE-2024-34930A SQL injection vulnerability in /model/all_events1.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to exec
- CVE-2024-35222iFrames Bypass Origin Checks for Tauri API Access Controltauri-apps tauri · tauri
- CVE-2024-1803EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usualwpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-35197gix refs and paths with reserved Windows device names access the devicesByron gitoxide · gix-ref +6
- CVE-2024-28188jupyter-scheduler's endpoint is missing authenticationjupyter-server jupyter-scheduler · jupyter-scheduler
- CVE-2024-4378Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Dividerleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-1814Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Blockbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2024-3997Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widgetbdthemes Prime Slider – Addons for Elementor
- CVE-2024-4575LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form ShortcodeLayerSlider
- CVE-2024-1815Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Blockbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2023-6502Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-7045Cross-Site Request Forgery (CSRF) in GitLabGitLab
- CVE-2024-1947Improper Handling of Highly Compressed Data (Data Amplification) in GitLabGitLab
- CVE-2024-5258Authorization Bypass Through User-Controlled Key in GitLabGitLab
- CVE-2024-5165Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of InputEclipse Foundation Eclipse Ditto · org.eclipse.ditto:ditto
- CVE-2024-2861ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widgetproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-35223Dapr API Token Exposuredapr · github.com/dapr/dapr
- CVE-2024-5264Network Key Transfer with AES KHT vulnerability in Luna EFTThales Luna EFT
- CVE-2024-32969vantage6 collaboration admins can extend their influence by expanding the collaborationvantage6
- CVE-2024-4706WordPress + Microsoft Office 365 / Azure AD | LOGIN <= 27.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via pintra ShortcodeWPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
- CVE-2024-36011Bluetooth: HCI: Fix potential null-ptr-derefLinux
- CVE-2024-2874Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-5241Huashi Private Cloud CDN Live Streaming Acceleration Server ipconfig_new.php os command injectionHuashi Private Cloud CDN Live Streaming Acceleration Server
- CVE-2024-4043WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcodebrechtvds WP Ultimate Post Grid
- CVE-2024-3648ShareThis Share Buttons <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via sharethis-inline-buttons ShortcodeShareThis Share Buttons
- CVE-2024-5240Campcodes Complete Web-Based School Management System unread_msg.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5239Campcodes Complete Web-Based School Management System timetable_update_form.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-3920Flattr <= 1.2.2 - Admin+ Stored XSSFlattr
- CVE-2024-3918Pet Manager <= 1.4 - Contributor+ Stored XSSPet Manager
- CVE-2024-3917Pet Manager <= 1.4 - Reflected XSSPet Manager
- CVE-2024-2220Button contact VR <= 4.7 - Admin+ Stored XSSButton contact VR
- CVE-2024-5177Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgetshashthemes Hash Elements
- CVE-2024-3711Brizy – Page Builder <= 2.4.43 - Missing Authorizationthemefusecom Brizy – Page Builder
- CVE-2024-3626Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorizationicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2024-5238Campcodes Complete Web-Based School Management System timetable_insert_form.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5237Campcodes Complete Web-Based School Management System timetable_grade_wise.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5236Campcodes Complete Web-Based School Management System teacher_salary_invoice1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5235Campcodes Complete Web-Based School Management System teacher_salary_invoice.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5234Campcodes Complete Web-Based School Management System teacher_salary_history1.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5233Campcodes Complete Web-Based School Management System teacher_salary_details3.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2023-6325RomethemeForm For Elementor <= 1.1.5 - Missing Authorization via export_entries, rtformnewform, and rtformupdaterometheme RTMForm Builder
- CVE-2024-4431LA-Studio Element Kit for Elementor <= 1.3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterchoijun LA-Studio Element Kit for Elementor
- CVE-2024-5232Campcodes Complete Web-Based School Management System teacher_salary_details2.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-5231Campcodes Complete Web-Based School Management System teacher_salary_details.php sql injectionCampcodes Complete Web-Based School Management System
- CVE-2024-4895wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV ImportwpDataTables – WordPress Data Table, Dynamic Tables & Table…
- CVE-2024-5230EnvaySoft FleetCart information disclosureEnvaySoft FleetCart
- CVE-2024-3201WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelegalweb WP DSGVO Tools
- CVE-2024-3065PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Authenticated (Admin+) Stored Cross-Site Scriptingmohsinrasool PayPal Pay Now, Buy Now, Donation and Cart But…
- CVE-2023-6844iframe <= 5.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodewebvitaly iframe
- CVE-2024-4783jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcodebaden03 jQuery T(-) Countdown Widget
- CVE-2024-1855WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgeryarraytics WPCafe – Restaurant Menu, Online Food Ordering &…
- CVE-2024-4486Awesome Contact Form7 for Elementor <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via AEP Contact Form 7 Widgetrafiul17 Awesome Contact Form7 for Elementor