# CVEs published 2024-05-30

177 CVEs were published on May 30, 2024: 20 critical, 45 high. Days are UTC.

- [CVE-2024-37017](https://cve.now/CVE-2024-37017.md): asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h\_\_Reader::MD\_to\_TimedText\_TDesc in AS\_DC (CVSS 8.1)
- [CVE-2024-5499](https://cve.now/CVE-2024-5499.md): Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2024-5498](https://cve.now/CVE-2024-5498.md): Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption (CVSS 5.4, Google Chrome)
- [CVE-2024-5497](https://cve.now/CVE-2024-5497.md): Out of bounds memory access in Browser UI in Google Chrome prior to 125.0.6422.141 allowed a remote attacker who convinced a user to engage (CVSS 7.5, Google Chrome)
- [CVE-2024-5496](https://cve.now/CVE-2024-5496.md): Use after free in Media Session in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to execute arbitrary code inside a sandbo (CVSS 7.5, Google Chrome)
- [CVE-2024-5495](https://cve.now/CVE-2024-5495.md): Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 7.5, Google Chrome)
- [CVE-2024-5494](https://cve.now/CVE-2024-5494.md): Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 7.5, Google Chrome)
- [CVE-2024-5493](https://cve.now/CVE-2024-5493.md): Heap buffer overflow in WebRTC in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via (CVSS 7.5, Google Chrome)
- [CVE-2024-36119](https://cve.now/CVE-2024-36119.md): Password confirmation stored in plain text via registration form in statamic/cms (CVSS 1.8, statamic cms · statamic/cms)
- [CVE-2024-1298](https://cve.now/CVE-2024-1298.md): Integer Overflow caused by divide by zero during S3 suspension (CVSS 6.0, TianoCore edk2)
- [CVE-2024-34171](https://cve.now/CVE-2024-34171.md): Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-5271](https://cve.now/CVE-2024-5271.md): Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion') (CVSS 7.8, Fuji Electric Monitouch V-SFT)
- [CVE-2024-32877](https://cve.now/CVE-2024-32877.md): Reflected Cross-site Scripting in yiisoft/yii2 Debug mode (CVSS 4.2, yiisoft yii2 · yiisoft/yii2)
- [CVE-2024-35189](https://cve.now/CVE-2024-35189.md): Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides (CVSS 6.5, ethyca fides · ethyca-fides)
- [CVE-2024-35228](https://cve.now/CVE-2024-35228.md): Improper Handling of Insufficient Permissions in Wagtail (CVSS 5.5, wagtail)
- [CVE-2024-2422](https://cve.now/CVE-2024-2422.md): LenelS2 NetBox Improper Neutralization of Argumented Delimiters (CVSS 9.3, LenelS2 NetBox)
- [CVE-2024-2421](https://cve.now/CVE-2024-2421.md): LenelS2 NetBox Improper Neutralization of Special Elements (CVSS 9.3, LenelS2 NetBox)
- [CVE-2024-2420](https://cve.now/CVE-2024-2420.md): LenelS2 NetBox Hardcoded Credentials (CVSS 8.8, LenelS2 NetBox)
- [CVE-2024-35469](https://cve.now/CVE-2024-35469.md): A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL (CVSS 9.8)
- [CVE-2024-35468](https://cve.now/CVE-2024-35468.md): A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary (CVSS 5.4)
- [CVE-2024-35433](https://cve.now/CVE-2024-35433.md): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. (CVSS 8.1)
- [CVE-2024-35428](https://cve.now/CVE-2024-35428.md): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. (CVSS 7.1)
- [CVE-2024-36118](https://cve.now/CVE-2024-36118.md): Unauthorized viewing of workspace test cases in MeterSphere (CVSS 3.5, metersphere)
- [CVE-2024-35429](https://cve.now/CVE-2024-35429.md): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord. (CVSS 6.5)
- [CVE-2024-35349](https://cve.now/CVE-2024-35349.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 9.8)
- [CVE-2024-35350](https://cve.now/CVE-2024-35350.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 9.8)
- [CVE-2024-35351](https://cve.now/CVE-2024-35351.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 5.4)
- [CVE-2024-35359](https://cve.now/CVE-2024-35359.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 5.4)
- [CVE-2024-35431](https://cve.now/CVE-2024-35431.md): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. (CVSS 7.5)
- [CVE-2024-35352](https://cve.now/CVE-2024-35352.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 6.1)
- [CVE-2024-35353](https://cve.now/CVE-2024-35353.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 9.8)
- [CVE-2024-35432](https://cve.now/CVE-2024-35432.md): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. (CVSS 6.1)
- [CVE-2024-35354](https://cve.now/CVE-2024-35354.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 9.8)
- [CVE-2024-35355](https://cve.now/CVE-2024-35355.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 9.8)
- [CVE-2024-35356](https://cve.now/CVE-2024-35356.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 6.3)
- [CVE-2024-35357](https://cve.now/CVE-2024-35357.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 5.3)
- [CVE-2024-35345](https://cve.now/CVE-2024-35345.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 5.4)
- [CVE-2024-5519](https://cve.now/CVE-2024-5519.md): ItsourceCode Learning Management System Project In PHP login.php sql injection (CVSS 6.9, ItsourceCode Learning Management System Project In PHP)
- [CVE-2024-35358](https://cve.now/CVE-2024-35358.md): A vulnerability has been discovered in Diño Physics School Assistant version 2.3. (CVSS 6.5)
- [CVE-2024-35430](https://cve.now/CVE-2024-35430.md): In ZKTeco ZKBio CVSecurity v6.1.1\_R and earlier (fixed in 6.1.3\_R) an authenticated user can bypass password checks while exporting data fro (CVSS 8.1)
- [CVE-2024-36959](https://cve.now/CVE-2024-36959.md): pinctrl: devicetree: fix refcount leak in pinctrl\_dt\_to\_map() (no CVSS, Linux)
- [CVE-2024-36958](https://cve.now/CVE-2024-36958.md): NFSD: Fix nfsd4\_encode\_fattr4() crasher (CVSS 9.8, Linux)
- [CVE-2024-36957](https://cve.now/CVE-2024-36957.md): octeontx2-af: avoid off-by-one read from userspace (no CVSS, Linux)
- [CVE-2024-36956](https://cve.now/CVE-2024-36956.md): thermal/debugfs: Free all thermal zone debug memory on zone removal (no CVSS, Linux)
- [CVE-2024-36955](https://cve.now/CVE-2024-36955.md): ALSA: hda: intel-sdw-acpi: fix usage of device\_get\_named\_child\_node() (CVSS 7.7, Linux)
- [CVE-2024-36954](https://cve.now/CVE-2024-36954.md): tipc: fix a possible memleak in tipc\_buf\_append (no CVSS, Linux)
- [CVE-2024-36953](https://cve.now/CVE-2024-36953.md): KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic\_v2\_parse\_attr() (CVSS 4.4, Linux)
- [CVE-2024-36952](https://cve.now/CVE-2024-36952.md): scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (no CVSS, Linux)
- [CVE-2024-36951](https://cve.now/CVE-2024-36951.md): drm/amdkfd: range check cp bad op exception interrupts (no CVSS, Linux)
- [CVE-2024-36950](https://cve.now/CVE-2024-36950.md): firewire: ohci: mask bus reset interrupts between ISR and bottom half (CVSS 4.4, Linux)
- [CVE-2024-36949](https://cve.now/CVE-2024-36949.md): amd/amdkfd: sync all devices to wait all processes being evicted (no CVSS, Linux)
- [CVE-2024-36948](https://cve.now/CVE-2024-36948.md): drm/xe/xe\_migrate: Cast to output precision before multiplying operands (no CVSS, Linux)
- [CVE-2024-36947](https://cve.now/CVE-2024-36947.md): qibfs: fix dentry leak (CVSS 5.3, Linux)
- [CVE-2024-36946](https://cve.now/CVE-2024-36946.md): phonet: fix rtm\_phonet\_notify() skb allocation (no CVSS, Linux)
- [CVE-2024-36945](https://cve.now/CVE-2024-36945.md): net/smc: fix neighbour and rtable leak in smc\_ib\_find\_route() (CVSS 7.5, Linux)
- [CVE-2024-36944](https://cve.now/CVE-2024-36944.md): Reapply "drm/qxl: simplify qxl\_fence\_wait" (CVSS 5.5, Linux)
- [CVE-2024-36943](https://cve.now/CVE-2024-36943.md): fs/proc/task\_mmu: fix loss of young/dirty bits during pagemap scan (CVSS 7.3, Linux)
- [CVE-2024-5518](https://cve.now/CVE-2024-5518.md): itsourcecode Online Discussion Forum change\_profile\_picture.php unrestricted upload (CVSS 5.3, itsourcecode Online Discussion Forum)
- [CVE-2024-36941](https://cve.now/CVE-2024-36941.md): wifi: nl80211: don't free NULL coalescing rule (CVSS 5.5, Linux)
- [CVE-2024-36940](https://cve.now/CVE-2024-36940.md): pinctrl: core: delete incorrect free in pinctrl\_enable() (CVSS 7.8, Linux)
- [CVE-2024-36939](https://cve.now/CVE-2024-36939.md): nfs: Handle error of rpc\_proc\_register() in nfs\_net\_init(). (no CVSS, Linux)
- [CVE-2024-36938](https://cve.now/CVE-2024-36938.md): bpf, skmsg: Fix NULL pointer dereference in sk\_psock\_skb\_ingress\_enqueue (no CVSS, Linux)
- [CVE-2024-36937](https://cve.now/CVE-2024-36937.md): xdp: use flags field to disambiguate broadcast redirect (no CVSS, Linux)
- [CVE-2024-36936](https://cve.now/CVE-2024-36936.md): efi/unaccepted: touch soft lockup during memory accept (no CVSS, Linux)
- [CVE-2024-36935](https://cve.now/CVE-2024-36935.md): ice: ensure the copied buf is NUL terminated (no CVSS, Linux)
- [CVE-2024-36934](https://cve.now/CVE-2024-36934.md): bna: ensure the copied buf is NUL terminated (no CVSS, Linux)
- [CVE-2024-36933](https://cve.now/CVE-2024-36933.md): nsh: Restore skb-\>{protocol,data,mac\_header} for outer header in nsh\_gso\_segment(). (CVSS 7.8, Linux)
- [CVE-2024-36932](https://cve.now/CVE-2024-36932.md): thermal/debugfs: Prevent use-after-free from occurring after cdev removal (no CVSS, Linux)
- [CVE-2024-36931](https://cve.now/CVE-2024-36931.md): s390/cio: Ensure the copied buf is NUL terminated (no CVSS, Linux)
- [CVE-2024-36930](https://cve.now/CVE-2024-36930.md): spi: fix null pointer dereference within spi\_sync (no CVSS, Linux)
- [CVE-2024-36929](https://cve.now/CVE-2024-36929.md): net: core: reject skb\_copy(\_expand) for fraglist GSO skbs (CVSS 7.5, Linux)
- [CVE-2024-36928](https://cve.now/CVE-2024-36928.md): s390/qeth: Fix kernel panic after setting hsuid (CVSS 7.8, Linux)
- [CVE-2024-36927](https://cve.now/CVE-2024-36927.md): ipv4: Fix uninit-value access in \_\_ip\_make\_skb() (no CVSS, Linux)
- [CVE-2024-36926](https://cve.now/CVE-2024-36926.md): powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE (CVSS 6.2, Linux)
- [CVE-2024-36925](https://cve.now/CVE-2024-36925.md): swiotlb: initialise restricted pool list\_head when SWIOTLB\_DYNAMIC=y (no CVSS, Linux)
- [CVE-2024-36924](https://cve.now/CVE-2024-36924.md): scsi: lpfc: Release hbalock before calling lpfc\_worker\_wake\_up() (no CVSS, Linux)
- [CVE-2024-36922](https://cve.now/CVE-2024-36922.md): wifi: iwlwifi: read txq-\>read\_ptr under lock (CVSS 8.8, Linux)
- [CVE-2024-36921](https://cve.now/CVE-2024-36921.md): wifi: iwlwifi: mvm: guard against invalid STA ID on removal (CVSS 8.8, Linux)
- [CVE-2024-36920](https://cve.now/CVE-2024-36920.md): scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (no CVSS, Linux)
- [CVE-2024-36919](https://cve.now/CVE-2024-36919.md): scsi: bnx2fc: Remove spin\_lock\_bh while releasing resources after upload (no CVSS, Linux)
- [CVE-2024-36918](https://cve.now/CVE-2024-36918.md): bpf: Check bloom filter map value size (CVSS 7.8, Linux)
- [CVE-2024-36917](https://cve.now/CVE-2024-36917.md): block: fix overflow in blk\_ioctl\_discard() (no CVSS, Linux)
- [CVE-2024-36916](https://cve.now/CVE-2024-36916.md): blk-iocost: avoid out of bounds shift (CVSS 6.5, Linux)
- [CVE-2024-36915](https://cve.now/CVE-2024-36915.md): nfc: llcp: fix nfc\_llcp\_setsockopt() unsafe copies (CVSS 7.1, Linux)
- [CVE-2024-36914](https://cve.now/CVE-2024-36914.md): drm/amd/display: Skip on writeback when it's not applicable (CVSS 7.8, Linux)
- [CVE-2024-36913](https://cve.now/CVE-2024-36913.md): Drivers: hv: vmbus: Leak pages if set\_memory\_encrypted() fails (CVSS 9.3, Linux)
- [CVE-2024-36912](https://cve.now/CVE-2024-36912.md): Drivers: hv: vmbus: Track decrypted status in vmbus\_gpadl (CVSS 9.6, Linux)
- [CVE-2024-36911](https://cve.now/CVE-2024-36911.md): hv\_netvsc: Don't free decrypted memory (CVSS 9.8, Linux)
- [CVE-2024-36910](https://cve.now/CVE-2024-36910.md): uio\_hv\_generic: Don't free decrypted memory (CVSS 8.4, Linux)
- [CVE-2024-36909](https://cve.now/CVE-2024-36909.md): Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted (CVSS 9.3, Linux)
- [CVE-2024-36908](https://cve.now/CVE-2024-36908.md): blk-iocost: do not WARN if iocg was already offlined (CVSS 7.1, Linux)
- [CVE-2024-36906](https://cve.now/CVE-2024-36906.md): ARM: 9381/1: kasan: clear stale stack poison (no CVSS, Linux)
- [CVE-2024-36905](https://cve.now/CVE-2024-36905.md): tcp: defer shutdown(SEND\_SHUTDOWN) for TCP\_SYN\_RECV sockets (no CVSS, Linux)
- [CVE-2024-36904](https://cve.now/CVE-2024-36904.md): tcp: Use refcount\_inc\_not\_zero() in tcp\_twsk\_unique(). (CVSS 7.8, Linux)
- [CVE-2024-36903](https://cve.now/CVE-2024-36903.md): ipv6: Fix potential uninit-value access in \_\_ip6\_make\_skb() (no CVSS, Linux)
- [CVE-2024-36902](https://cve.now/CVE-2024-36902.md): ipv6: fib6\_rules: avoid possible NULL dereference in fib6\_rule\_action() (no CVSS, Linux)
- [CVE-2024-36901](https://cve.now/CVE-2024-36901.md): ipv6: prevent NULL dereference in ip6\_output() (no CVSS, Linux)
- [CVE-2024-36900](https://cve.now/CVE-2024-36900.md): net: hns3: fix kernel crash when devlink reload during initialization (no CVSS, Linux)
- [CVE-2024-36899](https://cve.now/CVE-2024-36899.md): gpiolib: cdev: Fix use after free in lineinfo\_changed\_notify (no CVSS, Linux)
- [CVE-2024-36898](https://cve.now/CVE-2024-36898.md): gpiolib: cdev: fix uninitialised kfifo (CVSS 7.1, Linux)
- [CVE-2024-36897](https://cve.now/CVE-2024-36897.md): drm/amd/display: Atom Integrated System Info v2\_2 for DCN35 (CVSS 5.5, Linux)
- [CVE-2024-36896](https://cve.now/CVE-2024-36896.md): USB: core: Fix access violation during port device removal (CVSS 9.1, Linux)
- [CVE-2024-36895](https://cve.now/CVE-2024-36895.md): usb: gadget: uvc: use correct buffer size when parsing configfs lists (no CVSS, Linux)
- [CVE-2024-36894](https://cve.now/CVE-2024-36894.md): usb: gadget: f\_fs: Fix race between aio\_cancel() and AIO request complete (CVSS 7.8, Linux)
- [CVE-2024-36893](https://cve.now/CVE-2024-36893.md): usb: typec: tcpm: Check for port partner validity before consuming it (no CVSS, Linux)
- [CVE-2024-36892](https://cve.now/CVE-2024-36892.md): mm/slub: avoid zeroing outside-object freepointer for single free (no CVSS, Linux)
- [CVE-2024-36891](https://cve.now/CVE-2024-36891.md): maple\_tree: fix mas\_empty\_area\_rev() null pointer dereference (no CVSS, Linux)
- [CVE-2024-36890](https://cve.now/CVE-2024-36890.md): mm/slab: make \_\_free(kfree) accept error pointers (CVSS 7.8, Linux)
- [CVE-2024-36889](https://cve.now/CVE-2024-36889.md): mptcp: ensure snd\_nxt is properly initialized on connect (no CVSS, Linux)
- [CVE-2024-36888](https://cve.now/CVE-2024-36888.md): workqueue: Fix selection of wake\_cpu in kick\_pool() (CVSS 6.2, Linux)
- [CVE-2024-36887](https://cve.now/CVE-2024-36887.md): e1000e: change usleep\_range to udelay in PHY mdic access (no CVSS, Linux)
- [CVE-2024-36886](https://cve.now/CVE-2024-36886.md): tipc: fix UAF in error path (CVSS 9.8, Linux)
- [CVE-2024-36884](https://cve.now/CVE-2024-36884.md): iommu/arm-smmu: Use the correct type in nvidia\_smmu\_context\_fault() (CVSS 7.8, Linux)
- [CVE-2024-36883](https://cve.now/CVE-2024-36883.md): net: fix out-of-bounds access in ops\_init (CVSS 7.8, Linux)
- [CVE-2024-36882](https://cve.now/CVE-2024-36882.md): mm: use memalloc\_nofs\_save() in page\_cache\_ra\_order() (no CVSS, Linux)
- [CVE-2024-36881](https://cve.now/CVE-2024-36881.md): mm/userfaultfd: reset ptes when close() for wr-protected ones (CVSS 5.5, Linux)
- [CVE-2024-36880](https://cve.now/CVE-2024-36880.md): Bluetooth: qca: add missing firmware sanity checks (CVSS 7.8, Linux)
- [CVE-2024-36033](https://cve.now/CVE-2024-36033.md): Bluetooth: qca: fix info leak when fetching board id (no CVSS, Linux)
- [CVE-2024-36032](https://cve.now/CVE-2024-36032.md): Bluetooth: qca: fix info leak when fetching fw build id (CVSS 8.1, Linux)
- [CVE-2024-36031](https://cve.now/CVE-2024-36031.md): keys: Fix overwrite of key expiration on instantiation (CVSS 9.8, Linux)
- [CVE-2023-52882](https://cve.now/CVE-2023-52882.md): clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (no CVSS, Linux)
- [CVE-2024-36030](https://cve.now/CVE-2024-36030.md): octeontx2-af: fix the double free in rvu\_npc\_freemem() (CVSS 7.1, Linux)
- [CVE-2024-36029](https://cve.now/CVE-2024-36029.md): mmc: sdhci-msm: pervent access to suspended controller (no CVSS, Linux)
- [CVE-2024-36028](https://cve.now/CVE-2024-36028.md): mm/hugetlb: fix DEBUG\_LOCKS\_WARN\_ON(1) when dissolve\_free\_hugetlb\_folio() (no CVSS, Linux)
- [CVE-2024-3300](https://cve.now/CVE-2024-3300.md): Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024 (CVSS 9.0, Dassault Systèmes DELMIA Apriso)
- [CVE-2024-3301](https://cve.now/CVE-2024-3301.md): Post-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024 (CVSS 8.5, Dassault Systèmes DELMIA Apriso)
- [CVE-2024-36027](https://cve.now/CVE-2024-36027.md): btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer (CVSS 7.1, Linux)
- [CVE-2024-36026](https://cve.now/CVE-2024-36026.md): drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (no CVSS, Linux)
- [CVE-2024-36025](https://cve.now/CVE-2024-36025.md): scsi: qla2xxx: Fix off by one in qla\_edif\_app\_getstats() (no CVSS, Linux)
- [CVE-2024-36024](https://cve.now/CVE-2024-36024.md): drm/amd/display: Disable idle reallow as part of command/gpint execution (no CVSS, Linux)
- [CVE-2024-36023](https://cve.now/CVE-2024-36023.md): Julia Lawall reported this null pointer dereference, this should fix it. (no CVSS, Linux)
- [CVE-2024-35504](https://cve.now/CVE-2024-35504.md): A cross-site scripting (XSS) vulnerability in the login page of FineSoft v8.0 allows attackers to execute arbitrary web scripts or HTML via (CVSS 5.4)
- [CVE-2024-36021](https://cve.now/CVE-2024-36021.md): net: hns3: fix kernel crash when devlink reload during pf initialization (no CVSS, Linux)
- [CVE-2024-36020](https://cve.now/CVE-2024-36020.md): i40e: fix vf may be used uninitialized in this function warning (CVSS 7.8, Linux)
- [CVE-2024-3924](https://cve.now/CVE-2024-3924.md): Code Injection in huggingface/text-generation-inference (CVSS 4.4, huggingface/text-generation-inference · text-generation)
- [CVE-2024-36019](https://cve.now/CVE-2024-36019.md): regmap: maple: Fix cache corruption in regcache\_maple\_drop() (CVSS 7.8, Linux)
- [CVE-2024-36018](https://cve.now/CVE-2024-36018.md): nouveau/uvmm: fix addr/range calcs for remap operations (CVSS 7.8, Linux)
- [CVE-2024-4330](https://cve.now/CVE-2024-4330.md): Path Traversal in parisneo/lollms-webui (CVSS 4.0, parisneo/lollms-webui · lollms)
- [CVE-2024-5517](https://cve.now/CVE-2024-5517.md): itsourcecode Online Blood Bank Management System changepwd.php sql injection (CVSS 6.9, itsourcecode Online Blood Bank Management System)
- [CVE-2024-5516](https://cve.now/CVE-2024-5516.md): itsourcecode Online Blood Bank Management System massage.php sql injection (CVSS 5.3, itsourcecode Online Blood Bank Management System)
- [CVE-2024-5515](https://cve.now/CVE-2024-5515.md): SourceCodester Stock Management System createBrand.php sql injection (CVSS 5.3, SourceCodester Stock Management System)
- [CVE-2024-36017](https://cve.now/CVE-2024-36017.md): rtnetlink: Correct nested IFLA\_VF\_VLAN\_LIST attribute validation (no CVSS, Linux)
- [CVE-2024-3584](https://cve.now/CVE-2024-3584.md): Path Traversal in qdrant/qdrant (CVSS 9.8, qdrant/qdrant · qdrant)
- [CVE-2024-1100](https://cve.now/CVE-2024-1100.md): SQLi in Vadi Corporate Information Systems' DIGIKENT GIS (CVSS 10.0, Vadi Corporate Information Systems DIGIKENT GIS)
- [CVE-2022-43841](https://cve.now/CVE-2022-43841.md): IBM Aspera Console information disclosure (CVSS 4.0, IBM Aspera Console)
- [CVE-2022-43575](https://cve.now/CVE-2022-43575.md): IBM Aspera Console cross-site scripting (CVSS 5.4, IBM Aspera Console)
- [CVE-2022-43384](https://cve.now/CVE-2022-43384.md): IBM Aspera Console cross-site scripting (CVSS 4.6, IBM Aspera Console)
- [CVE-2024-5521](https://cve.now/CVE-2024-5521.md): Cross-Site Scripting stored in Alkacon OpenCMS (CVSS 6.4, Alkacon OpenCMS)
- [CVE-2024-5520](https://cve.now/CVE-2024-5520.md): Cross-Site Scripting stored in Alkacon OpenCMS (CVSS 6.4, Alkacon OpenCMS · org.opencms:opencms-core)
- [CVE-2024-5326](https://cve.now/CVE-2024-5326.md): Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \<= 4.1.2 - Missing Authorization to Arbitrary Options Update (CVSS 8.8, wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…)
- [CVE-2024-3583](https://cve.now/CVE-2024-3583.md): Simple Like Page Plugin \<= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, topdevs Simple Like Page Plugin – Fast & Privacy-Friendly P…)
- [CVE-2024-4668](https://cve.now/CVE-2024-4668.md): Gum Elementor Addon \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Price Table and Post Slider Widgets (CVSS 6.4, celomitan Gum Addon for Elementor)
- [CVE-2024-4355](https://cve.now/CVE-2024-4355.md): Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection \<= 10.23 - Missing Authorization to Information Expsoure (CVSS 4.3, sminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spid…)
- [CVE-2024-4427](https://cve.now/CVE-2024-4427.md): Comparison Slider \<= 1.0.5 - Missing Authorization (CVSS 4.3, comparisonslider Comparison Slider)
- [CVE-2024-2089](https://cve.now/CVE-2024-2089.md): Remote Content Shortcode \<= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, doublesharp Remote Content Shortcode)
- [CVE-2024-4426](https://cve.now/CVE-2024-4426.md): Comparison Slider \<= 1.0.5 - Cross-Site Request Forgery (CVSS 4.3, comparisonslider Comparison Slider)
- [CVE-2024-2657](https://cve.now/CVE-2024-2657.md): Font Farsi \<= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, khl32 Font Farsi)
- [CVE-2024-4422](https://cve.now/CVE-2024-4422.md): Comparison Slider \<= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, comparisonslider Comparison Slider)
- [CVE-2024-5073](https://cve.now/CVE-2024-5073.md): Essential Addons for Elementor \<= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-5327](https://cve.now/CVE-2024-5327.md): PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) \<= 2.7.19 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, ideaboxcreations PowerPack Addons for Elementor)
- [CVE-2024-36267](https://cve.now/CVE-2024-36267.md): Path traversal vulnerability exists in Redmine DMSF Plugin versions prior to 3.1.4. (CVSS 8.1, Kontron Redmine DMSF Plugin)
- [CVE-2024-5341](https://cve.now/CVE-2024-5341.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Title Widget (CVSS 6.4, posimyththemes The Plus Addons for Elementor Page Builder P…)
- [CVE-2024-5207](https://cve.now/CVE-2024-5207.md): POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \<= 2.9.3 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2024-3277](https://cve.now/CVE-2024-3277.md): Yumpu ePaper publishing \<= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification (CVSS 5.0, Yumpu E-Paper publishing)
- [CVE-2024-3946](https://cve.now/CVE-2024-3946.md): WP To Do \<= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings (CVSS 4.4, delower186 WP To Do)
- [CVE-2024-3947](https://cve.now/CVE-2024-3947.md): WP To Do \<= 1.3.0 - Cross-Site Request Forgery via wptodo\_settings (CVSS 4.3, delower186 WP To Do)
- [CVE-2024-4356](https://cve.now/CVE-2024-4356.md): List categories \<= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, fernandobt List categories)
- [CVE-2024-3945](https://cve.now/CVE-2024-3945.md): WP To Do \<= 1.3.0 - Cross-Site Request Forgery via wptodo\_manage() (CVSS 4.3, delower186 WP To Do)
- [CVE-2024-3943](https://cve.now/CVE-2024-3943.md): WP To Do \<= 1.3.0 - Cross-Site Request Forgery via wptodo\_addcomment (CVSS 4.3, delower186 WP To Do)
- [CVE-2024-4218](https://cve.now/CVE-2024-4218.md): AffiEasy \<= 1.1.6 - Cross-Site Request Forgery to Various Actions (CVSS 6.5, perrinalexandre05 AffiEasy)
- [CVE-2024-2253](https://cve.now/CVE-2024-2253.md): Testimonial Carousel For Elementor \<= 10.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, uapp Testimonial Carousel For Elementor)
- [CVE-2024-3269](https://cve.now/CVE-2024-3269.md): Download Monitor \<= 4.9.13 - Missing Authorization (CVSS 5.4, wpchill Download Monitor)
- [CVE-2024-3063](https://cve.now/CVE-2024-3063.md): WPB Elementor Addons \<= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpbean WPB Addons for Elementor – News Ticker, Timeline, Te…)
- [CVE-2024-3190](https://cve.now/CVE-2024-3190.md): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) \<= 1.5.107 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Field (CVSS 5.4, unitecms Unlimited Elements For Elementor)
- [CVE-2024-5223](https://cve.now/CVE-2024-5223.md): Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX \<= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, wpxpo Post Grid Gutenberg Blocks for News, Magazines, Blog…)
- [CVE-2024-3726](https://cve.now/CVE-2024-3726.md): Login Logout Register Menu \<= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode (CVSS 6.4, vinod-dalvi Login Logout Register Menu)
- [CVE-2024-5514](https://cve.now/CVE-2024-5514.md): MinMax CMS - Hidden Functionality (CVSS 9.8, MinMax Digital Technology MinMax CMS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.