CVEs published May 30, 2024
177 CVEs were published on May 30, 2024: 20 critical, 45 high.
- Published
- 177
- Critical
- 20
- High
- 45
- Medium
- 62
- Low
- 2
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- Linux
- 93
- Google Chrome
- 7
- delower186 WP To Do
- 4
- comparisonslider Comparison Slider
- 3
- IBM Aspera Console
- 3
- LenelS2 NetBox
- 3
- Dassault Systèmes DELMIA Apriso
- 2
- Fuji Electric Monitouch V-SFT
- 2
- itsourcecode Online Blood Bank Management System
- 2
- wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- 2
Critical 20
- CVE-2024-2422LenelS2 NetBox Improper Neutralization of Argumented DelimitersLenelS2 NetBox
- CVE-2024-2421LenelS2 NetBox Improper Neutralization of Special ElementsLenelS2 NetBox
- CVE-2024-35469A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL
- CVE-2024-35349A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35350A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35353A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35354A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35355A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-36958NFSD: Fix nfsd4_encode_fattr4() crasherLinux
- CVE-2024-36913Drivers: hv: vmbus: Leak pages if set_memory_encrypted() failsLinux
- CVE-2024-36912Drivers: hv: vmbus: Track decrypted status in vmbus_gpadlLinux
- CVE-2024-36911hv_netvsc: Don't free decrypted memoryLinux
- CVE-2024-36909Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encryptedLinux
- CVE-2024-36896USB: core: Fix access violation during port device removalLinux
- CVE-2024-36886tipc: fix UAF in error pathLinux
- CVE-2024-36031keys: Fix overwrite of key expiration on instantiationLinux
- CVE-2024-3300Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024Dassault Systèmes DELMIA Apriso
- CVE-2024-3584Path Traversal in qdrant/qdrantqdrant/qdrant · qdrant
- CVE-2024-1100SQLi in Vadi Corporate Information Systems' DIGIKENT GISVadi Corporate Information Systems DIGIKENT GIS
- CVE-2024-5514MinMax CMS - Hidden FunctionalityMinMax Digital Technology MinMax CMS
High 45
- CVE-2024-37017asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h__Reader::MD_to_TimedText_TDesc in AS_DC
- CVE-2024-5499Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sanGoogle Chrome
- CVE-2024-5497Out of bounds memory access in Browser UI in Google Chrome prior to 125.0.6422.141 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2024-5496Use after free in Media Session in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandboGoogle Chrome
- CVE-2024-5495Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-5494Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-5493Heap buffer overflow in WebRTC in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2024-34171Fuji Electric Monitouch V-SFT Stack-Based Buffer OverflowFuji Electric Monitouch V-SFT
- CVE-2024-5271Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')Fuji Electric Monitouch V-SFT
- CVE-2024-2420LenelS2 NetBox Hardcoded CredentialsLenelS2 NetBox
- CVE-2024-35433ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control.
- CVE-2024-35428ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile.
- CVE-2024-35431ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64.
- CVE-2024-35430In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data fro
- CVE-2024-36955ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node()Linux
- CVE-2024-36945net/smc: fix neighbour and rtable leak in smc_ib_find_route()Linux
- CVE-2024-36943fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scanLinux
- CVE-2024-36940pinctrl: core: delete incorrect free in pinctrl_enable()Linux
- CVE-2024-36933nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().Linux
- CVE-2024-36929net: core: reject skb_copy(_expand) for fraglist GSO skbsLinux
- CVE-2024-36928s390/qeth: Fix kernel panic after setting hsuidLinux
- CVE-2024-36922wifi: iwlwifi: read txq->read_ptr under lockLinux
- CVE-2024-36921wifi: iwlwifi: mvm: guard against invalid STA ID on removalLinux
- CVE-2024-36918bpf: Check bloom filter map value sizeLinux
- CVE-2024-36915nfc: llcp: fix nfc_llcp_setsockopt() unsafe copiesLinux
- CVE-2024-36914drm/amd/display: Skip on writeback when it's not applicableLinux
- CVE-2024-36910uio_hv_generic: Don't free decrypted memoryLinux
- CVE-2024-36908blk-iocost: do not WARN if iocg was already offlinedLinux
- CVE-2024-36904tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().Linux
- CVE-2024-36898gpiolib: cdev: fix uninitialised kfifoLinux
- CVE-2024-36894usb: gadget: f_fs: Fix race between aio_cancel() and AIO request completeLinux
- CVE-2024-36890mm/slab: make __free(kfree) accept error pointersLinux
- CVE-2024-36884iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault()Linux
- CVE-2024-36883net: fix out-of-bounds access in ops_initLinux
- CVE-2024-36880Bluetooth: qca: add missing firmware sanity checksLinux
- CVE-2024-36032Bluetooth: qca: fix info leak when fetching fw build idLinux
- CVE-2024-36030octeontx2-af: fix the double free in rvu_npc_freemem()Linux
- CVE-2024-3301Post-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024Dassault Systèmes DELMIA Apriso
- CVE-2024-36027btrfs: zoned: do not flag ZEROOUT on non-dirty extent bufferLinux
- CVE-2024-36020i40e: fix vf may be used uninitialized in this function warningLinux
- CVE-2024-36019regmap: maple: Fix cache corruption in regcache_maple_drop()Linux
- CVE-2024-36018nouveau/uvmm: fix addr/range calcs for remap operationsLinux
- CVE-2024-5326Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Updatewpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- CVE-2024-36267Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4.Kontron Redmine DMSF Plugin
- CVE-2024-5207POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injectionsaadiqbal Post SMTP – Complete Email Deliverability and SMT…
Medium, low and unrated 112
- CVE-2024-5498Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2024-36119Password confirmation stored in plain text via registration form in statamic/cmsstatamic cms · statamic/cms
- CVE-2024-1298Integer Overflow caused by divide by zero during S3 suspensionTianoCore edk2
- CVE-2024-32877Reflected Cross-site Scripting in yiisoft/yii2 Debug modeyiisoft yii2 · yiisoft/yii2
- CVE-2024-35189Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fidesethyca fides · ethyca-fides
- CVE-2024-35228Improper Handling of Insufficient Permissions in Wagtailwagtail
- CVE-2024-35468A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary
- CVE-2024-36118Unauthorized viewing of workspace test cases in MeterSpheremetersphere
- CVE-2024-35429ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.
- CVE-2024-35351A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35359A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35352A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35432ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File.
- CVE-2024-35356A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35357A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-35345A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-5519ItsourceCode Learning Management System Project In PHP login.php sql injectionItsourceCode Learning Management System Project In PHP
- CVE-2024-35358A vulnerability has been discovered in Diño Physics School Assistant version 2.3.
- CVE-2024-36959pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()Linux
- CVE-2024-36957octeontx2-af: avoid off-by-one read from userspaceLinux
- CVE-2024-36956thermal/debugfs: Free all thermal zone debug memory on zone removalLinux
- CVE-2024-36954tipc: fix a possible memleak in tipc_buf_appendLinux
- CVE-2024-36953KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()Linux
- CVE-2024-36952scsi: lpfc: Move NPIV's transport unregistration to after resource clean upLinux
- CVE-2024-36951drm/amdkfd: range check cp bad op exception interruptsLinux
- CVE-2024-36950firewire: ohci: mask bus reset interrupts between ISR and bottom halfLinux
- CVE-2024-36949amd/amdkfd: sync all devices to wait all processes being evictedLinux
- CVE-2024-36948drm/xe/xe_migrate: Cast to output precision before multiplying operandsLinux
- CVE-2024-36947qibfs: fix dentry leakLinux
- CVE-2024-36946phonet: fix rtm_phonet_notify() skb allocationLinux
- CVE-2024-36944Reapply "drm/qxl: simplify qxl_fence_wait"Linux
- CVE-2024-5518itsourcecode Online Discussion Forum change_profile_picture.php unrestricted uploaditsourcecode Online Discussion Forum
- CVE-2024-36941wifi: nl80211: don't free NULL coalescing ruleLinux
- CVE-2024-36939nfs: Handle error of rpc_proc_register() in nfs_net_init().Linux
- CVE-2024-36938bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueueLinux
- CVE-2024-36937xdp: use flags field to disambiguate broadcast redirectLinux
- CVE-2024-36936efi/unaccepted: touch soft lockup during memory acceptLinux
- CVE-2024-36935ice: ensure the copied buf is NUL terminatedLinux
- CVE-2024-36934bna: ensure the copied buf is NUL terminatedLinux
- CVE-2024-36932thermal/debugfs: Prevent use-after-free from occurring after cdev removalLinux
- CVE-2024-36931s390/cio: Ensure the copied buf is NUL terminatedLinux
- CVE-2024-36930spi: fix null pointer dereference within spi_syncLinux
- CVE-2024-36927ipv4: Fix uninit-value access in __ip_make_skb()Linux
- CVE-2024-36926powerpc/pseries/iommu: LPAR panics during boot up with a frozen PELinux
- CVE-2024-36925swiotlb: initialise restricted pool list_head when SWIOTLB_DYNAMIC=yLinux
- CVE-2024-36924scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()Linux
- CVE-2024-36920scsi: mpi3mr: Avoid memcpy field-spanning write WARNINGLinux
- CVE-2024-36919scsi: bnx2fc: Remove spin_lock_bh while releasing resources after uploadLinux
- CVE-2024-36917block: fix overflow in blk_ioctl_discard()Linux
- CVE-2024-36916blk-iocost: avoid out of bounds shiftLinux
- CVE-2024-36906ARM: 9381/1: kasan: clear stale stack poisonLinux
- CVE-2024-36905tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV socketsLinux
- CVE-2024-36903ipv6: Fix potential uninit-value access in __ip6_make_skb()Linux
- CVE-2024-36902ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()Linux
- CVE-2024-36901ipv6: prevent NULL dereference in ip6_output()Linux
- CVE-2024-36900net: hns3: fix kernel crash when devlink reload during initializationLinux
- CVE-2024-36899gpiolib: cdev: Fix use after free in lineinfo_changed_notifyLinux
- CVE-2024-36897drm/amd/display: Atom Integrated System Info v2_2 for DCN35Linux
- CVE-2024-36895usb: gadget: uvc: use correct buffer size when parsing configfs listsLinux
- CVE-2024-36893usb: typec: tcpm: Check for port partner validity before consuming itLinux
- CVE-2024-36892mm/slub: avoid zeroing outside-object freepointer for single freeLinux
- CVE-2024-36891maple_tree: fix mas_empty_area_rev() null pointer dereferenceLinux
- CVE-2024-36889mptcp: ensure snd_nxt is properly initialized on connectLinux
- CVE-2024-36888workqueue: Fix selection of wake_cpu in kick_pool()Linux
- CVE-2024-36887e1000e: change usleep_range to udelay in PHY mdic accessLinux
- CVE-2024-36882mm: use memalloc_nofs_save() in page_cache_ra_order()Linux
- CVE-2024-36881mm/userfaultfd: reset ptes when close() for wr-protected onesLinux
- CVE-2024-36033Bluetooth: qca: fix info leak when fetching board idLinux
- CVE-2023-52882clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate changeLinux
- CVE-2024-36029mmc: sdhci-msm: pervent access to suspended controllerLinux
- CVE-2024-36028mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()Linux
- CVE-2024-36026drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11Linux
- CVE-2024-36025scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()Linux
- CVE-2024-36024drm/amd/display: Disable idle reallow as part of command/gpint executionLinux
- CVE-2024-36023Julia Lawall reported this null pointer dereference, this should fix it.Linux
- CVE-2024-35504A cross-site scripting (XSS) vulnerability in the login page of FineSoft v8.0 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2024-36021net: hns3: fix kernel crash when devlink reload during pf initializationLinux
- CVE-2024-3924Code Injection in huggingface/text-generation-inferencehuggingface/text-generation-inference · text-generation
- CVE-2024-4330Path Traversal in parisneo/lollms-webuiparisneo/lollms-webui · lollms
- CVE-2024-5517itsourcecode Online Blood Bank Management System changepwd.php sql injectionitsourcecode Online Blood Bank Management System
- CVE-2024-5516itsourcecode Online Blood Bank Management System massage.php sql injectionitsourcecode Online Blood Bank Management System
- CVE-2024-5515SourceCodester Stock Management System createBrand.php sql injectionSourceCodester Stock Management System
- CVE-2024-36017rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validationLinux
- CVE-2022-43841IBM Aspera Console information disclosureIBM Aspera Console
- CVE-2022-43575IBM Aspera Console cross-site scriptingIBM Aspera Console
- CVE-2022-43384IBM Aspera Console cross-site scriptingIBM Aspera Console
- CVE-2024-5521Cross-Site Scripting stored in Alkacon OpenCMSAlkacon OpenCMS
- CVE-2024-5520Cross-Site Scripting stored in Alkacon OpenCMSAlkacon OpenCMS · org.opencms:opencms-core
- CVE-2024-3583Simple Like Page Plugin <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetopdevs Simple Like Page Plugin – Fast & Privacy-Friendly P…
- CVE-2024-4668Gum Elementor Addon <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price Table and Post Slider Widgetscelomitan Gum Addon for Elementor
- CVE-2024-4355Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 10.23 - Missing Authorization to Information Expsouresminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spid…
- CVE-2024-4427Comparison Slider <= 1.0.5 - Missing Authorizationcomparisonslider Comparison Slider
- CVE-2024-2089Remote Content Shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingdoublesharp Remote Content Shortcode
- CVE-2024-4426Comparison Slider <= 1.0.5 - Cross-Site Request Forgerycomparisonslider Comparison Slider
- CVE-2024-2657Font Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingkhl32 Font Farsi
- CVE-2024-4422Comparison Slider <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scriptingcomparisonslider Comparison Slider
- CVE-2024-5073Essential Addons for Elementor <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feedwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-5327PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingideaboxcreations PowerPack Addons for Elementor
- CVE-2024-5341The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widgetposimyththemes The Plus Addons for Elementor Page Builder P…
- CVE-2024-3277Yumpu ePaper publishing <= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key ModificationYumpu E-Paper publishing
- CVE-2024-3946WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settingsdelower186 WP To Do
- CVE-2024-3947WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_settingsdelower186 WP To Do
- CVE-2024-4356List categories <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodefernandobt List categories
- CVE-2024-3945WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()delower186 WP To Do
- CVE-2024-3943WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_addcommentdelower186 WP To Do
- CVE-2024-4218AffiEasy <= 1.1.6 - Cross-Site Request Forgery to Various Actionsperrinalexandre05 AffiEasy
- CVE-2024-2253Testimonial Carousel For Elementor <= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinguapp Testimonial Carousel For Elementor
- CVE-2024-3269Download Monitor <= 4.9.13 - Missing Authorizationwpchill Download Monitor
- CVE-2024-3063WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpbean WPB Addons for Elementor – News Ticker, Timeline, Te…
- CVE-2024-3190Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Fieldunitecms Unlimited Elements For Elementor
- CVE-2024-5223Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scriptingwpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…
- CVE-2024-3726Login Logout Register Menu <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcodevinod-dalvi Login Logout Register Menu