CVEs published May 24, 2024
129 CVEs were published on May 24, 2024: 14 critical, 29 high.
- Published
- 129
- Critical
- 14
- High
- 29
- Medium
- 40
- Low
- 1
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Linux
- 72
- posimyththemes The Plus Addons for Elementor – Addons for E…
- 4
- Dolibarr ERP CMS · dolibarr/dolibarr
- 2
- Flexense VX Search Enterprise
- 2
- bastho Event post
- 1
- brainstormforce Custom Fonts – Host Your Fonts Locally
- 1
- brainstormforce Spectra Gutenberg Blocks – Website Builder…
- 1
- brainstormforce Ultimate Addons for Elementor
- 1
- FastCMS
- 1
- Flexense VX Search Enterprise · Flexense Disk Pulse Enterpr…
- 1
Critical 14
- CVE-2024-35374Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to mocodo
- CVE-2024-35373Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.
- CVE-2024-35387TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
- CVE-2024-35396TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which all
- CVE-2021-47548ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()Linux
- CVE-2021-47544tcp: fix page frag corruption on page faultLinux
- CVE-2021-47536net/smc: fix wrong list_del in smc_lgr_cleanup_earlyLinux
- CVE-2021-47506nfsd: fix use-after-free due to delegation raceLinux
- CVE-2024-35339Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac.
- CVE-2024-31510An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /
- CVE-2024-35592An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a craf
- CVE-2024-5315Multiple vulnerabilities in DOLIBARR's ERP CMSDolibarr ERP CMS · dolibarr/dolibarr
- CVE-2024-5314Multiple vulnerabilities in DOLIBARR's ERP CMSDolibarr ERP CMS · dolibarr/dolibarr
- CVE-2024-4544Pie Register - Social Sites Login (Add on) <= 1.7.7 - Authentication BypassGenetech Solutions Pie Register - Social Sites Login
High 29
- CVE-2024-33471An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafte
- CVE-2024-35388TOTOLINK NR1800X v9.1.0u.6681_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode
- CVE-2024-35395TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows atta
- CVE-2023-52880tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldiscLinux
- CVE-2021-47561i2c: virtio: disable timeout handlingLinux
- CVE-2021-47559net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()Linux
- CVE-2021-47555net: vlan: fix underflow for the real_dev refcntLinux
- CVE-2021-47552blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()Linux
- CVE-2021-47551drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered againLinux
- CVE-2021-47541net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()Linux
- CVE-2021-47535drm/msm/a6xx: Allocate enough space for GMU registersLinux
- CVE-2021-47533drm/vc4: kms: Clear the HVS FIFO commit pointer once doneLinux
- CVE-2021-47520can: pch_can: pch_can_rx_normal: fix use after freeLinux
- CVE-2021-47519can: m_can: m_can_read_fifo: fix memory leak in error branchLinux
- CVE-2021-47517ethtool: do not perform operations on net devices being unregisteredLinux
- CVE-2021-47515seg6: fix the iif in the IPv6 socket control blockLinux
- CVE-2021-47512net/sched: fq_pie: prevent dismantle issueLinux
- CVE-2021-47505aio: fix use-after-free due to missing POLLFREE handlingLinux
- CVE-2021-47502ASoC: codecs: wcd934x: handle channel mappping list correctlyLinux
- CVE-2021-47500iio: mma8452: Fix trigger reference coutingLinux
- CVE-2024-35340Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeComma
- CVE-2024-35618PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer.
- CVE-2023-49575XSS vulnerability in VX Search EnterpriseFlexense VX Search Enterprise · Flexense Sync Breeze Ent… +1
- CVE-2023-49574XSS vulnerability in VX Search EnterpriseFlexense VX Search Enterprise
- CVE-2023-49573XSS vulnerability in VX Search EnterpriseFlexense VX Search Enterprise
- CVE-2023-49572XSS vulnerability in VX Search EnterpriseFlexense VX Search Enterprise · Flexense Disk Pulse Enterpr…
- CVE-2024-4455YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scriptingyithemes YITH WooCommerce Ajax Search
- CVE-2024-5142XSS in Hubshare's social moduleM-Files Hubshare
- CVE-2024-0867Email Log <= 2.4.8 - Unauthenticated Hook Injectionwebfactory Email Log
Medium, low and unrated 86
- CVE-2024-36079An issue was discovered in Vaultize 21.07.27.
- CVE-2024-35232github.com/huandu/facebook may expose access_token in error messagehuandu facebook · github.com/huandu/facebook/v2 +1
- CVE-2024-36049Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and pas
- CVE-2023-46442An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).org.soot-oss:soot
- CVE-2024-34995svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserC
- CVE-2021-47572net: nexthop: fix null pointer dereference when IPv6 is not enabledLinux
- CVE-2021-47571staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()Linux
- CVE-2021-47570staging: r8188eu: fix a memory leak in rtw_wx_read32()Linux
- CVE-2021-47569io_uring: fail cancellation for EXITING tasksLinux
- CVE-2021-47568ksmbd: fix memleak in get_file_stream_info()Linux
- CVE-2021-47567powerpc/32: Fix hardlockup on vmap stack overflowLinux
- CVE-2021-47566proc/vmcore: fix clearing user buffer by properly using clear_user()Linux
- CVE-2021-47565scsi: mpt3sas: Fix kernel panic during drive powercycle testLinux
- CVE-2021-47564net: marvell: prestera: fix double free issue on err pathLinux
- CVE-2021-47563ice: avoid bpf_prog refcount underflowLinux
- CVE-2021-47562ice: fix vsi->txq_map sizingLinux
- CVE-2021-47560mlxsw: spectrum: Protect driver from buggy firmwareLinux
- CVE-2021-47558net: stmmac: Disable Tx queues when reconfiguring the interfaceLinux
- CVE-2021-47557net/sched: sch_ets: don't peek at classes beyond 'nbands'Linux
- CVE-2021-47556ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()Linux
- CVE-2021-47554vdpa_sim: avoid putting an uninitialized iova_domainLinux
- CVE-2021-47553sched/scs: Reset task stack state in bringup_cpu()Linux
- CVE-2021-47550drm/amd/amdgpu: fix potential memleakLinux
- CVE-2021-47549sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fslLinux
- CVE-2021-47547net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of boundLinux
- CVE-2021-47546ipv6: fix memory leak in fib6_rule_suppressLinux
- CVE-2021-47542net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()Linux
- CVE-2021-47540mt76: mt7915: fix NULL pointer dereference in mt7915_get_phy_modeLinux
- CVE-2021-47539rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()Linux
- CVE-2021-47538rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()Linux
- CVE-2021-47537octeontx2-af: Fix a memleak bug in rvu_mbox_init()Linux
- CVE-2021-47534drm/vc4: kms: Add missing drm_crtc_commit_putLinux
- CVE-2021-47532drm/msm/devfreq: Fix OPP refcnt leakLinux
- CVE-2021-47531drm/msm: Fix mmap to include VM_IO and VM_DONTDUMPLinux
- CVE-2021-47530drm/msm: Fix wait_fence submitqueue leakLinux
- CVE-2021-47529iwlwifi: Fix memory leaks in error handling pathLinux
- CVE-2021-47528usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()Linux
- CVE-2021-47527serial: core: fix transmit-buffer reset and memleakLinux
- CVE-2021-47526serial: liteuart: Fix NULL pointer dereference in ->remove()Linux
- CVE-2021-47525serial: liteuart: fix use-after-free and memleak on unbindLinux
- CVE-2021-47524serial: liteuart: fix minor-number leak on probe errorsLinux
- CVE-2021-47523IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddrLinux
- CVE-2021-47522HID: bigbenff: prevent null pointer dereferenceLinux
- CVE-2021-47521can: sja1000: fix use after free in ems_pcmcia_add_card()Linux
- CVE-2021-47518nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_doneLinux
- CVE-2021-47516nfp: Fix memory leak in nfp_cpp_area_cache_add()Linux
- CVE-2021-47514devlink: fix netns refcount leak in devlink_nl_cmd_reload()Linux
- CVE-2021-47513net: dsa: felix: Fix memory leak in felix_setup_mmio_filteringLinux
- CVE-2021-47511ALSA: pcm: oss: Fix negative period/buffer sizesLinux
- CVE-2021-47510btrfs: fix re-dirty process of tree-log nodesLinux
- CVE-2021-47509ALSA: pcm: oss: Limit the period size to 16MBLinux
- CVE-2024-33470An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passbac
- CVE-2021-47508btrfs: free exchange changeset on failuresLinux
- CVE-2021-47507nfsd: Fix nsfd startup race (again)Linux
- CVE-2021-47503scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()Linux
- CVE-2021-47501i40e: Fix NULL pointer dereference in i40e_dbg_dump_descLinux
- CVE-2021-47499iio: accel: kxcjk-1013: Fix possible memory leak in probe and removeLinux
- CVE-2024-22588Kwik commit 745fd4e2 does not discard unused encryption keys.tech.kwik:kwik
- CVE-2024-33809PingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which could lead to database crashes and denial of service at
- CVE-2024-35591An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file.
- CVE-2024-5273Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing Jenkins Project Jenkins Report Info Plugin · org.jenkins-ci…
- CVE-2024-35593An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uplo
- CVE-2024-35595An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code
- CVE-2024-5318Missing Authorization in GitLabGitLab
- CVE-2023-47710IBM Security Guardium cross-site scriptingIBM Security Guardium
- CVE-2024-5312Cross-Site Scripting vulnerability in PHP Server MonitorPHP Server Monitor · phpservermon/phpservermon
- CVE-2024-5310JFinalCMS content cross site scriptingJFinalCMS
- CVE-2024-4037WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Executionopajaap WP Photo Album Plus
- CVE-2024-4366Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scriptingbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2023-7259zzdevelop lenosp Adduser Page cross site scriptingzzdevelop lenosp
- CVE-2024-4484The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-1332Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scriptingbrainstormforce Custom Fonts – Host Your Fonts Locally
- CVE-2024-1376Event post <= 5.9.4 - Missing Authorizationbastho Event post
- CVE-2024-5060LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingkapasias LottieFiles – JSON Based Animation Lottie & Bodymo…
- CVE-2024-4485The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-0893Schema App Structured Data <= 2.2.0 - Missing Authorizationvberkel Schema App Structured Data
- CVE-2023-1111FastCMS New Article Tab cross site scriptingFastCMS
- CVE-2024-36361Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compipug-code-gen · pug
- CVE-2023-1001xuliangzhan vxe-table vxe-textarea textarea.js export cross site scriptingxuliangzhan vxe-table · vxe-table
- CVE-2024-1134SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingrainbowgeek SEOPress – On-site SEO & Analytics
- CVE-2024-3718The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Boxposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-3557WP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpgmaps WP Go Maps
- CVE-2024-2784The Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Cardposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-2618Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce Ultimate Addons for Elementor
- CVE-2024-5205Videojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcodenaa986 Videojs HTML5 Player
- CVE-2024-4409WP-ViperGB <= 1.6.1 - Cross-Site Request Forgeryjustin_k WP-ViperGB