CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- moodle moodle: ReCAPTCHA can be bypassed on the login page 7.5 High
- moodle moodle: CSRF risk in analytics management of models 8.8 High
- moodle moodle: logout CSRF in admin/tool/mfa/auth.php 8.8 High
- moodle, fedoraproject fedora +1 more moodle: unsanitized HTML in site log for config_log_created 4.3 Medium
- moodle moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup 6.5 Medium
- moodle moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup 6.5 Medium
- moodle moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup 5.9 Medium
- moodle moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup 6.5 Medium
- moodle moodle: CSRF risk in admin preset tool management of presets 8.4 High
- moodle moodle: stored XSS in lesson overview report via user ID number 4.3 Medium
- moodle moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php 9.8 Critical
- moodle moodle: stored XSS via user's name on participants page when opening some options 5.4 Medium
- moodle moodle: stored XSS risk when editing another user's equation in equation editor 6.1 Medium
- moodle moodle: broken access control when setting calendar event type 6.2 Medium
- libmodbus An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause... 4.3 Medium
- libmodbus libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This... 7.5 High
- ping identity pingaccess PingAccess HTTP Request Desynchronization Weakness 8.8 High
- red hat enterprise linux 10, enterprise linux 7 extended lifecycle support, enterprise linux 8 +11 more +13 more Libndp: buffer overflow in route information length field 8.1 High
- keith-cullen freecoap An issue in coap_msg.c in Keith Cullen's FreeCoAP v.0.7 allows remote attackers to cause a Denial... 9.1 Critical
- expressionengine Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker,... 6.5 Medium
- ivanti avalanche An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x... 7.2 High
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 8.4 High
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 8.4 High
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 8.4 High
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 8.4 High
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 9.6 Critical
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 9.6 Critical
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 9.6 Critical
- ivanti epm, endpoint manager (epm), endpoint manager +2 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 9.6 Critical
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 9.6 Critical
- ivanti epm, endpoint manager +1 more An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows... 9.6 Critical
- ivanti itsm, neurons for itsm +1 more An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a... 8.7 High
- ivanti itsm, neurons for itsm +1 more A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote... 8.8 High
- ivanti epm, endpoint manager +1 more A buffer overflow allows a low privilege user on the local machine that has the EPM Agent... 7.8 High
- ivanti secure access client, secure access linux +1 more A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1... 7.3 High
- ivanti connect secure A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high... 8.2 High
- ivanti secure access client A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a... 7.8 High
- baxter welch allyn configuration tool Vulnerability in Welch Allyn Configuration Tool Software 9.4 Critical
- getsentry sentry Slack integration leaks sensitive information in logs in Sentry 2.0 Low
- baxter welch allyn connex spot monitor Vulnerability in Baxter Welch Allyn Connex Spot Monitor 9.1 Critical
- ibm security verify access docker IBM Security Verify Access privilege escalation 8.4 High
- ibm security verify access docker IBM Security Verify Access privilege escalation 7.7 High
- ben-sb javascript-deobfuscator, javascript deobfuscator +1 more javascript-deobfuscator crafted payload can lead to code execution 8.2 High
- wangeditor wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function 5.4 Medium
- waneditor wanEditor v4.7.11 was discovered to contain a cross-site scripting (XSS) vulnerability via the... 6.1 Medium
- debezium community project debezium-ui An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary... 7.1 High
- casgate Multiple Broken Function-Level Authorization vulnerabilities in casgate 9.8 Critical
- creative motion auto featured image, themeisle auto featured image (auto post thumbnail) +1 more Auto Featured Image (Auto Post Thumbnail) <= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery 6.4 Medium
- vanna-ai vanna Prompt Injection in "ask" API with visualization leads to RCE 8.1 High
- ibm planning analytics local IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This... 5.4 Medium
- Show olderLoading…