CVEs published May 31, 2024
76 CVEs were published on May 31, 2024: 15 critical, 32 high. 2 are now in CISA KEV.
- Published
- 76
- Critical
- 15
- High
- 32
- Medium
- 27
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 28
Most affected products
- Moodle · moodle/moodle
- 14
- Ivanti EPM
- 11
- Astrotalks
- 3
- IBM Planning Analytics Local
- 3
- leap13 Premium Addons for Elementor – Powerful Elementor Te…
- 3
- IBM Security Verify Access Docker
- 2
- Ivanti ITSM
- 2
- thehappymonster Happy Addons for Elementor
- 2
- Yokogawa Rental & Lease Unifier
- 2
- @wangeditor/editor
- 1
Critical 15
- CVE-2024-33999moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.phpMoodle · moodle/moodle
- CVE-2024-31030An issue in coap_msg.c in Keith Cullen's FreeCoAP v.0.7 allows remote attackers to cause a Denial of Service or potentially disclose informa
- CVE-2024-29823An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samIvanti EPM
- CVE-2024-29827An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samIvanti EPM
- CVE-2024-29822An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samIvanti EPM
- CVE-2024-29826An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samIvanti EPM
- CVE-2024-29824An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samIvanti EPM
- CVE-2024-29825An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samIvanti EPM
- CVE-2024-5176Vulnerability in Welch Allyn Configuration Tool SoftwareBaxter Welch Allyn Configuration Tool
- CVE-2024-1275Vulnerability in Baxter Welch Allyn Connex Spot MonitorBaxter Welch Allyn Connex Spot Monitor
- CVE-2024-36108Multiple Broken Function-Level Authorization vulnerabilities in casgatecasgate
- CVE-2024-23692Rejetto HTTP File Server 2.3m Unauthenticated RCERejetto HTTP File Server
- CVE-2024-36246Missing authorization vulnerability exists in Unifier and Unifier Cast.Yokogawa Rental & Lease Unifier
- CVE-2024-32850Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver.Seiko Solutions SkyBridge MB-A100/MB-A110 · Seiko Solutions…
- CVE-2024-37018The OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an application can manipulate the path that is taken b
High 32
- CVE-2024-5138The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of Canonical snapd · github.com/snapcore/snapd
- CVE-2024-34009moodle: ReCAPTCHA can be bypassed on the login pageMoodle · moodle/moodle
- CVE-2024-34007moodle: logout CSRF in admin/tool/mfa/auth.phpMoodle · moodle/moodle
- CVE-2024-34001moodle: CSRF risk in admin preset tool management of presetsMoodle · moodle/moodle
- CVE-2024-36844libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer.
- CVE-2024-23316PingAccess HTTP Request Desynchronization WeaknessPing Identity PingAccess
- CVE-2024-5564Libndp: buffer overflow in route information length fieldlibndp · Red Hat Enterprise Linux
- CVE-2023-38042A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEMIvanti Secure Access Client
- CVE-2023-46810A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileged user to execute cIvanti Secure Access Linux
- CVE-2024-22059A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete informatiIvanti ITSM
- CVE-2024-22060An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user tIvanti ITSM
- CVE-2024-29828An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same Ivanti EPM
- CVE-2024-29829An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same Ivanti EPM
- CVE-2024-29848An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execIvanti Avalanche
- CVE-2024-29846An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same Ivanti EPM
- CVE-2023-38551A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code onIvanti Connect Secure
- CVE-2024-29830An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same Ivanti EPM
- CVE-2024-22058A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated Ivanti EPM
- CVE-2024-35142IBM Security Verify Access privilege escalationIBM Security Verify Access Docker
- CVE-2024-35140IBM Security Verify Access privilege escalationIBM Security Verify Access Docker
- CVE-2024-36120javascript-deobfuscator crafted payload can lead to code executionben-sb javascript-deobfuscator · js-deobfuscator
- CVE-2024-28736An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function.
- CVE-2024-5565Prompt Injection in "ask" API with visualization leads to RCEvanna
- CVE-2024-5436Type Confusion in Snapchat LenscoreSnapchat Lenscore
- CVE-2024-5525Improper privilege management vulnerability in AstrotalksAstrotalks
- CVE-2024-5523SQL injection vulnerability in AstrotalksAstrotalks
- CVE-2024-23847Incorrect default permissions issue exists in Unifier and Unifier Cast.Yokogawa Rental & Lease Unifier
- CVE-2024-4469Migration Backup Restore < 3.5.0 - Admin+ SSRFWP STAGING WordPress Backup Plugin
- CVE-2024-2793Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.30 - Unauthenticated Stored Cross-Site Scriptingwpfeedback Atarim – Visual Feedback, Review & AI Collaborat…
- CVE-2024-5345Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusionthenahidul Responsive Owl Carousel for Elementor
- CVE-2024-36843libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function.
- CVE-2024-37032Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandlesgithub.com/ollama/ollama
Medium, low and unrated 29
- CVE-2024-34008moodle: CSRF risk in analytics management of modelsMoodle · moodle/moodle
- CVE-2024-34006moodle: unsanitized HTML in site log for config_log_createdMoodle · moodle/moodle
- CVE-2024-34005moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backupMoodle · moodle/moodle
- CVE-2024-34004moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backupMoodle · moodle/moodle
- CVE-2024-34003moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backupMoodle · moodle/moodle
- CVE-2024-34002moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backupMoodle · moodle/moodle
- CVE-2024-34000moodle: stored XSS in lesson overview report via user ID numberMoodle · moodle/moodle
- CVE-2024-33998moodle: stored XSS via user's name on participants page when opening some optionsMoodle · moodle/moodle
- CVE-2024-33997moodle: stored XSS risk when editing another user's equation in equation editorMoodle · moodle/moodle
- CVE-2024-33996moodle: broken access control when setting calendar event typeMoodle · moodle/moodle
- CVE-2024-36845An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause a Denial of Service (DoS) via a crafted me
- CVE-2021-44534Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive information disclosExpressionEngine
- CVE-2024-35196Slack integration leaks sensitive information in logs in Sentrygetsentry sentry · sentry
- CVE-2022-25037An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting (XSS) vulnerability via the ima@wangeditor/editor
- CVE-2022-25038wanEditor v4.7.11 was discovered to contain a cross-site scripting (XSS) vulnerability via the video upload function.
- CVE-2023-7073Auto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgerythemeisle Auto Featured Image
- CVE-2024-31907IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting.IBM Planning Analytics Local
- CVE-2024-31908IBM Planning Analytics Local cross-site scriptingIBM Planning Analytics Local
- CVE-2024-31889IBM Planning Analytics Local cross-site scriptingIBM Planning Analytics Local
- CVE-2024-22338IBM Security Verify Access OIDC Provider information disclosureIBM Security Verify Access OIDC Provider
- CVE-2024-5041Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordionthehappymonster Happy Addons for Elementor
- CVE-2024-4160Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcodecodename065 Download Manager
- CVE-2024-5347Happy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widgetthehappymonster Happy Addons for Elementor
- CVE-2024-5524Information exposure vulnerability in AstrotalksAstrotalks
- CVE-2024-5427WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcodearraytics WPCafe – Restaurant Menu, Online Food Ordering &…
- CVE-2024-4379Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltipleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-4376Premium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widgetleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-4205Premium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosureleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-5418DethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems AttributeDethemeKit for Elementor