CVEs published May 29, 2024
60 CVEs were published on May 29, 2024: 5 critical, 16 high. 1 is now in CISA KEV.
- Published
- 60
- Critical
- 5
- High
- 16
- Medium
- 35
- Low
- 2
- Unrated
- 2
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- JetBrains TeamCity
- 18
- F5 NGINX Open Source · F5 NGINX Plus
- 4
- Linux
- 4
- Interaction Design Team at the University of Applied Scienc…
- 3
- airlift aircompressor · io.airlift:aircompressor
- 1
- Checkmk
- 1
- Dell Data Protection Advisor · Dell PowerProtect DP Series…
- 1
- Essential Addons for Elementor Pro
- 1
- ethyca fides · ethyca-fides
- 1
- Gianism
- 1
Critical 5
- CVE-2024-4358Registration Authentication Bypass VulnerabilityProgress Software Telerik Report Server
- CVE-2023-52881tcp: do not accept ACK of bytes we never sentLinux
- CVE-2024-3412WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Uploadrenehermi WP STAGING – WordPress Backup, Restore & Migration
- CVE-2024-3050Site Reviews < 7.0.0 - IP SpoofingSite Reviews
- CVE-2024-5150Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Checkglboy OTP Login With Phone Number, OTP Verification
High 16
- CVE-2024-36114Decompressors can crash the JVM and leak memory content in Aircompressorairlift aircompressor · io.airlift:aircompressor
- CVE-2024-35492Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c.
- CVE-2024-35434Irontec Sngrep v1.8.1 was discovered to contain a heap buffer overflow via the function rtp_check_packet at /sngrep/src/rtp.c.
- CVE-2024-36016tty: n_gsm: fix possible out-of-bounds in gsm0_receive()Linux
- CVE-2024-28974Dell Data Protection Advisor, version(s) 19.9, contain(s) an Inadequate Encryption Strength vulnerability.Dell Data Protection Advisor · Dell PowerProtect DP Series…
- CVE-2024-35333A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3.
- CVE-2024-36470In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge casesJetBrains TeamCity
- CVE-2024-5185Data Poisoning in EmbedAISamurAIGPT EmbedAI
- CVE-2023-42005IBM Db2 on Cloud Pak for Data privilege escalationIBM Db2 on Cloud Pak for Data
- CVE-2024-25977Session FixationInteraction Design Team at the University of Applied Scienc…
- CVE-2024-28826Unrestricted upload and download paths in check_sftpCheckmk
- CVE-2024-21512Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields amysql2 · org.webjars.npm:mysql2
- CVE-2024-4611AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypassscottopolis AppPresser – Mobile App Framework
- CVE-2023-6743Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template importunitecms Unlimited Elements For Elementor
- CVE-2024-5204Swiss Toolkit For WP <= 1.0.7 - Authenticated (Contributor+) Authentication Bypasswpmessiah Swiss Toolkit For WP
- CVE-2024-36427The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to
Medium, low and unrated 39
- CVE-2024-35221Denial of service when publishing a package on rubygems.orgrubygems.org
- CVE-2024-35512hmq v1.5.5 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception.
- CVE-2024-34715Partial Password Exposure Vulnerability in Fides Webserver Logsethyca fides · ethyca-fides
- CVE-2024-34161NGINX HTTP/3 QUIC vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2024-35200NGINX HTTP/3 QUIC vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2024-32760NGINX HTTP/3 QUIC vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2024-31079NGINX HTTP/3 QUIC vulnerabilityF5 NGINX Open Source · F5 NGINX Plus
- CVE-2024-35311Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 hav
- CVE-2024-35284A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to
- CVE-2024-35283A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to condu
- CVE-2023-46297An issue was discovered on Mercusys MW325R EU V3 MW325R(EU)_V3_1.11.0 221019 devices.
- CVE-2024-36378In JetBrains TeamCity before 2024.03.2 server was susceptible to DoS attacks with incorrect auth tokensJetBrains TeamCity
- CVE-2024-36377In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissionsJetBrains TeamCity
- CVE-2024-36376In JetBrains TeamCity before 2024.03.2 users could perform actions that should not be available to them based on their permissionsJetBrains TeamCity
- CVE-2024-36375In JetBrains TeamCity before 2024.03.2 technical information regarding TeamCity server could be exposedJetBrains TeamCity
- CVE-2024-36374In JetBrains TeamCity before 2024.03.2 stored XSS via build step settings was possibleJetBrains TeamCity
- CVE-2024-36373In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possibleJetBrains TeamCity
- CVE-2024-36372In JetBrains TeamCity before 2023.05.6 reflected XSS on the subscriptions page was possibleJetBrains TeamCity
- CVE-2024-36371In JetBrains TeamCity before 2023.05.6, 2023.11.5 stored XSS in Commit status publisher was possibleJetBrains TeamCity
- CVE-2024-36370In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possibleJetBrains TeamCity
- CVE-2024-36369In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via issue tracker integration was possibleJetBrains TeamCity
- CVE-2024-36368In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possibleJetBrains TeamCity
- CVE-2024-36367In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via third-party reports was possibleJetBrains TeamCity
- CVE-2024-36366In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 an XSS could be executed via certain report grouping and filtering oJetBrains TeamCity
- CVE-2024-36365In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agentJetBrains TeamCity
- CVE-2024-36364In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisherJetBrains TeamCity
- CVE-2024-36363In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 several Stored XSS in code inspection reports were possibleJetBrains TeamCity
- CVE-2024-36362In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 path traversal allowing to read files from server was posJetBrains TeamCity
- CVE-2024-25975Arbitrary File OverwriteInteraction Design Team at the University of Applied Scienc…
- CVE-2024-5039HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderealmag777 HUSKY – Products Filter Professional for WooComm…
- CVE-2024-25976Reflected Cross-Site-Scripting (XSS)Interaction Design Team at the University of Applied Scienc…
- CVE-2024-27313XSS VulnerabilityManageEngine PAM360
- CVE-2024-36015ppdev: Add an error check in register_deviceLinux
- CVE-2024-5086Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel WidgetEssential Addons for Elementor Pro
- CVE-2024-36014drm/arm/malidp: fix a possible null pointer dereferenceLinux
- CVE-2024-3937Playlist for Youtube <= 1.32 - Editor+ Stored XSSPlaylist for Youtube
- CVE-2024-3921Gianism <= 5.1.0 - Admin+ Stored XSSGianism
- CVE-2024-4419Fetch JFT <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scriptingpjaudiomv Fetch JFT
- CVE-2024-0434WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_savemagepeopleteam Travelly – Tour & Travel Booking Manager for…