CVEs published May 27, 2024
56 CVEs were published on May 27, 2024: 3 critical, 16 high.
- Published
- 56
- Critical
- 3
- High
- 16
- Medium
- 36
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- itsourcecode Online Student Enrollment System
- 8
- Business Card
- 4
- KKProgressbar2 Free
- 3
- SaltOS RhinOS
- 3
- esMind MosP kintai kanri
- 2
- ManageEngine ADAudit Plus
- 2
- meshery · github.com/layer5io/meshery
- 2
- Openfind Mail2000
- 2
- Wtriple WinNMP
- 2
- advplyr audiobookshelf
- 1
Critical 3
High 16
- CVE-2024-29078Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unautheesMind MosP kintai kanri
- CVE-2024-36428OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.
- CVE-2024-29415The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, ip
- CVE-2024-35237MIT IdentiBot User-Kerberos Mapping Publicly AvailableZelnickB mit-identibot
- CVE-2024-35231rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameterrack-contrib
- CVE-2024-35219OpenAPI Generator Online - Arbitrary File Read/DeleteOpenAPITools openapi-generator · org.openapitools:openapi-g…
- CVE-2024-34477configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafted NFS share (because
- CVE-2024-5409Cross-site Scripting vulnerability in RhinOS from SaltOSSaltOS RhinOS
- CVE-2024-5408Cross-site Scripting vulnerability in RhinOS from SaltOSSaltOS RhinOS
- CVE-2024-5035TP-Link Archer C5400X - RFTest Unauthenticated Command InjectionTP-Link Archer C4500X
- CVE-2024-5403ASKEY 5G NR Small Cell - Command InjectionASKEY 5G NR Small Cell
- CVE-2024-4535KKProgressbar2 Free <= 1.1.4.2 - Progress Bar Deletion via CSRFKKProgressbar2 Free
- CVE-2024-4531Business Card <= 1.0.0 - Card Edit via CSRFBusiness Card
- CVE-2024-5400Openfind Mail2000 - OS Command InjectionOpenfind Mail2000
- CVE-2024-5399Openfind Mail2000 - OS Command InjectionOpenfind Mail2000
- CVE-2024-36426In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.
Medium, low and unrated 37
- CVE-2024-28880Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensitesMind MosP kintai kanri
- CVE-2024-34923In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there
- CVE-2024-35182GHSL-2024-014 Meshery SQL Injection vulnerabilitymeshery · github.com/layer5io/meshery
- CVE-2024-35181GHSL-2024-013 Meshery SQL Injection vulnerabilitymeshery · github.com/layer5io/meshery
- CVE-2024-36037Insufficient Access Control VulnerabilityManageEngine ADAudit Plus
- CVE-2024-36036Insufficient Access Control VulnerabilityManageEngine ADAudit Plus
- CVE-2024-27310DOS VulnerabilityManageEngine ADSelfService Plus
- CVE-2024-36105dbt allows Binding to an Unrestricted IP Address via socketsocketdbt-labs dbt-core · dbt-core
- CVE-2024-35238Denial of service of Minder Server from maliciously crafted GitHub attestationsstacklok minder · github.com/stacklok/minder
- CVE-2024-35236Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooksadvplyr audiobookshelf
- CVE-2022-4969bwoodsend rockhopper Binary Parser ragged_array.c count_rows buffer overflowbwoodsend rockhopper · rockhopper
- CVE-2024-35229ZKsync Era evaluation order of Yul function argumentsmatter-labs era-compiler-solidity
- CVE-2024-32978Kaminari Insecure File Permissions Vulnerabilitykaminari
- CVE-2024-5406Multiple vulnerabilities in WinNMP from WtripleWtriple WinNMP
- CVE-2024-5405Multiple vulnerabilities in WinNMP from WtripleWtriple WinNMP
- CVE-2023-6349Heap overflow in libvpxChromium libvpx
- CVE-2024-36383An issue was discovered in Logpoint SAML Authentication before 6.0.3.
- CVE-2024-27314Stored XSS VulnerabilityManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, Suppor…
- CVE-2024-3933Eclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a bufferEclipse Foundation Open J9
- CVE-2024-4534KKProgressbar2 Free <= 1.1.4.2 - Stored XSS via CSRFKKProgressbar2 Free
- CVE-2024-4533KKProgressbar2 Free <= 1.1.4.2 - Admin+ SQL InjectionKKProgressbar2 Free
- CVE-2024-4532Business Card <= 1.0.0 - Arbitrary Card Deletion via CSRFBusiness Card
- CVE-2024-4530Business Card <= 1.0.0 - Category Edit via CSRFBusiness Card
- CVE-2024-4529Business Card <= 1.0.0 - Category Deletion via CSRFBusiness Card
- CVE-2024-3939Ditty < 3.1.36 - Author+ Stored XSSDitty
- CVE-2024-35297Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5.aviplugins.com WP Booking
- CVE-2024-35291Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16.Chris Younger Splunk Config Explorer
- CVE-2024-36384Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages.
- CVE-2024-5397itsourcecode Online Student Enrollment System instructorSubjects.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5396itsourcecode Online Student Enrollment System newfaculty.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5395itsourcecode Online Student Enrollment System listofinstructor.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5394itsourcecode Online Student Enrollment System newDept.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5393itsourcecode Online Student Enrollment System listofcourse.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5392itsourcecode Online Student Enrollment System editSubject.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5391itsourcecode Online Student Enrollment System listofsubject.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5390itsourcecode Online Student Enrollment System listofstudent.php sql injectionitsourcecode Online Student Enrollment System
- CVE-2024-5385oretnom23 Online Car Wash Booking System cross site scriptingoretnom23 Online Car Wash Booking System