CVEs published May 28, 2024
132 CVEs were published on May 28, 2024: 20 critical, 66 high. 2 are now in CISA KEV.
- Published
- 132
- Critical
- 20
- High
- 66
- Medium
- 43
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 11
Most affected products
- libigl
- 17
- AutomationDirect P3-550E
- 15
- Huawei CurieM-WFG9B
- 5
- PhpMyBackupPro
- 3
- ameya/ayame UTAU
- 2
- Campbell Scientific CSI Web Server and RTMC
- 2
- HCL Software DRYiCE Optibot Reset Station
- 2
- OpenText iManager
- 2
- ORing IAP-420
- 2
- SourceCodester Simple Online Bidding System
- 2
Critical 20
- CVE-2024-35510An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute arbitrary code via u
- CVE-2023-43845Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged telnet account.
- CVE-2024-35344Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device.
- CVE-2024-35343Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /
- CVE-2024-35563CDG-Server-V5.6.2.126.139 and earlier was discovered to contain a SQL injection vulnerability via the permissionId parameter in CDGTempPermi
- CVE-2024-34854F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`
- CVE-2024-22590The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection.
- CVE-2024-33808A SQL injection vulnerability in /model/get_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to
- CVE-2024-33806A SQL injection vulnerability in /model/get_grade.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to exe
- CVE-2024-33805A SQL injection vulnerability in /model/get_student.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to e
- CVE-2024-33801A SQL injection vulnerability in /model/get_subject_routing.php in campcodes Complete Web-Based School Management System 1.0 allows an attac
- CVE-2024-33800A SQL injection vulnerability in /model/get_student1.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to
- CVE-2024-33799A SQL injection vulnerability in /model/get_teacher.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to e
- CVE-2024-24963A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-55AutomationDirect P3-550E
- CVE-2024-24962A stack-based buffer overflow vulnerability exists in the Programming Software Connection FileSelect functionality of AutomationDirect P3-55AutomationDirect P3-550E
- CVE-2024-22187A write-what-where vulnerability exists in the Programming Software Connection Remote Memory Diagnostics functionality of AutomationDirect PAutomationDirect P3-550E
- CVE-2024-21785A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9.AutomationDirect P3-550E
- CVE-2024-23601A code injection vulnerability exists in the scan_lib.bin functionality of AutomationDirect P3-550E 1.2.10.9.AutomationDirect P3-550E
- CVE-2024-35324Douchat 4.0.5 suffers from an arbitrary file upload vulnerability via Public/Plugins/webuploader/server/preview.php.
- CVE-2024-35398TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setMacFilterRules.
High 66
- CVE-2024-35226PHP Code Injection by malicious attribute in extends-tag in Smartysmarty-php smarty · smarty/smarty
- CVE-2024-22641TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
- CVE-2023-30313An issue discovered in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions which could lead to a denial of service.
- CVE-2024-28060An issue was discovered in Apiris Kafeo 6.4.4.
- CVE-2023-30310An issue discovered in Comfast Comfast CF-616AC routers allows attackers to hijack TCP sessions which could lead to a denial of service.
- CVE-2022-45171An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2023-46694Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands.
- CVE-2023-30305An issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of service.
- CVE-2023-30311An issue discovered in H3C Magic R365 and H3C Magic R100 routers allows attackers to hijack TCP sessions which could lead to a denial of ser
- CVE-2024-33450SQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information
- CVE-2024-36109Cross-site Scripting with Markdown rendering in CoCalcsagemathinc cocalc
- CVE-2024-36110Cross-site scripting in ansibleguy-webuiansibleguy webui · ansibleguy-webui
- CVE-2024-24919Information disclosurecheckpoint Check Point Quantum Gateway, Spark Gateway and C…
- CVE-2023-43848Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated
- CVE-2023-43844Aten PE6208 2.3.228 and 2.4.232 have default credentials for the privileged web interface account.
- CVE-2023-43843Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated
- CVE-2023-43842Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated
- CVE-2024-33402A SQL injection vulnerability in /model/approve_petty_cash.php in campcodes Complete Web-Based School Management System 1.0 allows attacker
- CVE-2024-35341Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFil
- CVE-2024-30165Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands w
- CVE-2024-26024SUBNET Substation Server Reliance on Insufficiently Trustworthy ComponentSUBNET Substation Server
- CVE-2024-30212Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE commandMicrochip MPLAB® Harmony 3 Core Module
- CVE-2024-24851A heap-based buffer overflow vulnerability exists in the Programming Software Connection FiBurn functionality of AutomationDirect P3-550E 1.AutomationDirect P3-550E
- CVE-2024-24947A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1AutomationDirect P3-550E
- CVE-2024-24946A heap-based buffer overflow vulnerability exists in the Programming Software Connection CurrDir functionality of AutomationDirect P3-550E 1AutomationDirect P3-550E
- CVE-2024-24959Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3AutomationDirect P3-550E
- CVE-2024-24958Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3AutomationDirect P3-550E
- CVE-2024-24957Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3AutomationDirect P3-550E
- CVE-2024-24956Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3AutomationDirect P3-550E
- CVE-2024-24955Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3AutomationDirect P3-550E
- CVE-2024-24954Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3AutomationDirect P3-550E
- CVE-2024-23315A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550EAutomationDirect P3-550E
- CVE-2024-5274Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2024-35399TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the password parameter in the function loginAuth
- CVE-2024-3969 XML External Entity injection vulnerability in iManagerOpenText iManager
- CVE-2024-35397TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the
- CVE-2023-35953Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0.libigl
- CVE-2023-35952Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0.libigl
- CVE-2023-35951Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0.libigl
- CVE-2023-35950Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0.libigl
- CVE-2023-35949Multiple stack-based buffer overflow vulnerabilities exist in the readOFF.cpp functionality of libigl v2.4.0.libigl
- CVE-2023-49600An out-of-bounds write vulnerability exists in the PlyFile ply_cast_ascii functionality of libigl v2.5.0.libigl
- CVE-2024-23951Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0.libigl
- CVE-2024-23950Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0.libigl
- CVE-2024-23949Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0.libigl
- CVE-2024-23948Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0.libigl
- CVE-2024-23947Multiple improper array index validation vulnerabilities exist in the readMSH functionality of libigl v2.5.0.libigl
- CVE-2024-24686Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.libigl
- CVE-2024-24685Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.libigl
- CVE-2024-24684Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.libigl
- CVE-2024-22181An out-of-bounds write vulnerability exists in the readNODE functionality of libigl v2.5.0.libigl
- CVE-2024-29072A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138.Foxit Reader
- CVE-2024-3657389-ds-base: potential denial of service via specially crafted kerberos as-req requestRed Hat Directory Server 11.5 E4S for RHEL · Red Hat Dir… +5
- CVE-2024-5415Cross-Site Scripting (XSS) vulnerability on PhpMyBackupProPhpMyBackupPro
- CVE-2024-5414Cross-Site Scripting (XSS) vulnerability on PhpMyBackupProPhpMyBackupPro
- CVE-2024-5413Cross-Site Scripting (XSS) vulnerability on PhpMyBackupProPhpMyBackupPro
- CVE-2024-5411Command InjectionORing IAP-420
- CVE-2024-5410Stored Cross-Site ScriptingORing IAP-420
- CVE-2023-52712Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2.Huawei CurieM-WFG9B
- CVE-2023-52711Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2.Huawei CurieM-WFG9B
- CVE-2023-52710Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26), As the communication buffer size hasn’t been properly validated to be of the expected siHuawei CurieM-WFG9B
- CVE-2023-52548Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26) Arbitrary Memory Corruption in SMI Handler of ThisiServicesSmm SMM module.Huawei CurieM-WFG9B
- CVE-2023-52547Huawei Matebook D16(Model: CREM-WXX9, BIOS: v2.26.Huawei CurieM-WFG9B
- CVE-2022-48681Some Huawei smart speakers have a memory overflow vulnerability.Huawei EGRT-00
- CVE-2024-28886OS command injection vulnerability exists in UTAU versions prior to v0.4.19.ameya/ayame UTAU
- CVE-2023-30312An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to
Medium, low and unrated 46
- CVE-2024-5437SourceCodester Simple Online Bidding System save_category cross site scriptingSourceCodester Simple Online Bidding System
- CVE-2024-36112Nautobot dynamic-group-members doesn't enforce permission restrictions on member objectsnautobot
- CVE-2023-30314An issue discovered in 360 V6G, 360 T5G, 360 T6M, and 360 P1 routers allows attackers to hijack TCP sessions which could lead to a denial of
- CVE-2024-23580HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs)HCL Software DRYiCE Optibot Reset Station
- CVE-2024-23579HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questionsHCL Software DRYiCE Optibot Reset Station
- CVE-2024-35511phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php.
- CVE-2024-35548A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blin
- CVE-2024-35240Stored Cross-site Scripting on Print Functionality in Umbraco CommerceUmbraco.Commerce.Issues · Umbraco.Commerce
- CVE-2024-35239Stored Cross-site Scripting on Components of Umbraco FormsUmbraco.Forms.Issues · Umbraco.Forms
- CVE-2023-30306An issue discovered in Mercury x30g, Mercury YR1800XG routers allows attackers to hijack TCP sessions which could lead to a denial of servic
- CVE-2024-35583A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr
- CVE-2024-35581A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr
- CVE-2023-30309An issue discovered in D-Link DI-7003GV2 routers allows attackers to hijack TCP sessions which could lead to a denial of service.
- CVE-2024-35582A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scr
- CVE-2023-30308An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions whic
- CVE-2024-28061An issue was discovered in Apiris Kafeo 6.4.4.
- CVE-2023-30307An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR1200L, and TP-LINK TL-R
- CVE-2024-36107Information disclosure in miniominio · github.com/minio/minio
- CVE-2024-5434Weak Encoding for Password vulnerability in Campbell Scientific CSI Web Server and RTMCCampbell Scientific CSI Web Server and RTMC
- CVE-2024-5433Path Traversal in Campbell Scientific CSI Web Server and RTMCCampbell Scientific CSI Web Server and RTMC
- CVE-2023-43850Improper input validation in the user management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated us
- CVE-2023-43849Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users
- CVE-2023-43847Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated user
- CVE-2023-43846Incorrect access control in logs management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote attackers to get the
- CVE-2024-35342Certain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume,
- CVE-2024-30164Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissio
- CVE-2024-34852F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/trans
- CVE-2024-35401TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadF
- CVE-2024-35403TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRule
- CVE-2024-36472In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided b
- CVE-2024-33807A SQL injection vulnerability in /model/get_teacher_timetable.php in campcodes Complete Web-Based School Management System 1.0 allows an att
- CVE-2024-33804A SQL injection vulnerability in /model/get_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to e
- CVE-2024-33803A SQL injection vulnerability in /model/get_exam.php in campcodes Complete Web-Based School Management System 1.0 allows an attacker to exec
- CVE-2024-33802A SQL injection vulnerability in /model/get_student_subject.php in campcodes Complete Web-Based School Management System 1.0 allows an attac
- CVE-2024-35621A cross-site scripting (XSS) vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts getformwork/formwork
- CVE-2024-33849ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key.
- CVE-2024-35400TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules
- CVE-2024-4429Cross Site Request Forgery vulnerability in iManagerOpenText iManager
- CVE-2024-2451Improper fingerprint validation in the TeamViewer ClientTeamViewer Remote
- CVE-2024-24584Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0.libigl
- CVE-2024-24583Multiple out-of-bounds read vulnerabilities exist in the readMSH functionality of libigl v2.5.0.libigl
- CVE-2024-5428SourceCodester Simple Online Bidding System HTTP POST Request save_product cross-site request forgerySourceCodester Simple Online Bidding System
- CVE-2023-37411IBM Aspera Faspex cross-site scriptingIBM Aspera Faspex
- CVE-2024-2199389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +4
- CVE-2024-28793IBM Engineering Workflow Management cross-site scriptingIBM Engineering Workflow Management
- CVE-2024-32944Path traversal vulnerability exists in UTAU versions prior to v0.4.19.ameya/ayame UTAU