CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- xlang open agentsIn XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by...9.1 Critical
- avantra serverAvantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards,...6.8 Medium
- spatie image optimizerimage-optimizer allows PHAR deserialization8.8 High
- gradio project gradioGradio allows credential leakage on Windows7.5 High
- offis dcmtk, debian linux +1 moredcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.5.3 Medium
- offis dcmtk, debian linux +1 moredcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.4.3 Medium
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7...7.4 High
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1...9.8 Critical
- mediawiki, fedoraproject fedora +1 moreMediaWiki UnlinkedWikibase Cross-site Scripting vulnerability6.1 Medium
- maximaIn Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names...5.1 Medium
- facuet ryuRyu Infinite Loop vulnerability7.5 High
- facuet ryuRyu Infinite Loop vulnerability7.5 High
- facuet ryuRyu Infinite Loop vulnerability7.5 High
- facuet ryuRyu Infinite Loop vulnerability7.5 High
- facuet ryuRyu Infinite Loop vulnerability5.3 Medium
- facuet ryuRyu Infinite Loop vulnerability7.5 High
- btcdbtcd susceptible to consensus failures7.5 High
- clarioClario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to...7.8 High
- tenda i21, i21 firmware +1 moreTenda i21 formGetDiagnoseInfo stack-based overflow8.8 High
- ibm aspera orchestratorIBM Aspera Orchestrator information disclosure5.3 Medium
- carazo import and export users and customersImport and export users and customers <= 1.26.5 - Missing Authorization4.3 Medium
- webguyio stop spammers classicStop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process5.4 Medium
- brainstormforce convertplug, brainstorm force convertplus +1 moreConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection8.8 High
- brainstorm force convertplusConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update5.4 Medium
- galdub folders – unlimited folders to organize media library folder, pages, posts, file managerFolders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name5.4 Medium
libavifOSS-FuzzUse-of-uninitialized-value in avifSequenceHeaderParseNo scoreghostscriptOSS-FuzzUNKNOWN READ in mem_planar_put_image_slowNo score- open5gsOpen5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS...5.3 Medium
- open5gsOpen5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS...7.5 High
- o-ran-sc near-rt ricAn issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an...5.3 Medium
- rukovoditelRukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action...7.1 High
- rukovoditelRukovoditel before 3.5.3 allows XSS via user_photo to My Page.6.1 Medium
- thinkphpThinkPHP Cross-Site Scripting Vulnerability6.1 Medium
- alinto sogoAlinto SOGo through 5.10.0 allows XSS during attachment preview.6.1 Medium
- tribalsystems zenarioZenario uses Twig filters insecurely in the Twig Snippet plugin9.8 Critical
tribalsystems/zenarioPackagistZenario's Tree Explorer tool from Organizer affected by Cross-site Scripting6.5 Medium- simplenetwork project simplenetworkTCPServer.cpp in SimpleNetwork through 29bc615 has an off-by-one error that causes a buffer...7.5 High
- ibm cognos controllerIBM Cognos Controller session fixation6.3 Medium
- ibm cognos controllerIBM Cognos Controller SQL injection6.0 Medium
- ibm cognos controllerIBM Cognos Controller security bypass5.3 Medium
- xiboon kurwovkurwov vulnerable to Denial of Service due to improper data sanitization6.2 Medium
- linux, linux kernel +1 morewifi: mt76: mt7921e: fix crash in chip reset fail5.5 Medium
- linux, linux kernel +1 moredrm/radeon: add a force flush to delay work when radeon5.5 Medium
- linux, linux kernel +1 morescsi: mpt3sas: Fix use-after-free warning7.8 High
- linux, linux kernel +1 moreice: Fix DMA mappings leak5.5 Medium
- pterodactyl wingsArbitrary File Write/Read in Pterodactyl wings8.5 High
- ibm cognos controllerIBM Cognos Controller log injection5.3 Medium
- convoypanel panelMultiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel6.1 Medium
- ibm cognos controllerIBM Cognos Controller SQL injection6.3 Medium
- ibm cognos controllerIBM Cognos Controller information disclosure5.9 Medium
- Show moreLoading…