CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor <= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box6.4 Medium
- codecabin wp go maps, wpgmaps wp go maps (formerly wp google maps) +1 moreWP Go Maps (formerly WP Google Maps) <= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor <= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card6.4 Medium
- brainstorm force ultimate addons for elementor, brainstormforce elementor header \& footer builder +1 moreElementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- genetech solutions pie register - social sites login (add on)Pie Register - Social Sites Login (Add on) <= 1.7.7 - Authentication Bypass9.8 Critical
- naa986 videojs html5 playerVideojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode6.4 Medium
- justin k wp-vipergbWP-ViperGB <= 1.6.1 - Cross-Site Request Forgery4.3 Medium
ghostscriptOSS-FuzzHeap-buffer-overflow in pdf_save_viewer_stateNo score- google chrome, fedoraproject fedora, google chromium v8 +2 morechromium - security update9.6 Critical
- qiwen netdiskQiwen Netdisk File Rename cross site scripting5.3 Medium
- netgear prosafe network management systemNETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability8.8 High
- netgear prosafe network management system, prosafe network management software 300 +1 moreNETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability8.8 High
- netgear prosafe network management systemNETGEAR ProSAFE Network Management System Default Credentials Local Privilege Escalation Vulnerability7.8 High
- tp-link omada er605, omada er605 firmware +1 moreTP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability5.0 Medium
- tp-link omada er605, omada er605 firmware +1 moreTP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability7.5 High
- tp-link omada er605, omada er605 firmware +1 moreTP-Link Omada ER605 Stack-based Buffer Overflow Remote Code Execution Vulnerability7.5 High
- tp-link omada er605, omada er605 firmware +1 moreTP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability7.5 High
- tp-link omada er605, omada er605 firmware +1 moreTP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability7.5 High
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability8.8 High
- d-link d-view, dlink d-view 8, dir-3040 firmware +2 moreD-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability8.8 High
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability8.8 High
- d-link d-view, dlink d-view 8 +1 moreD-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability9.8 Critical
- d-link g416, g416 firmware +1 moreD-Link G416 flupl self Command Injection Remote Code Execution Vulnerability8.8 High
- d-link dir-3040, dlink dir-3040 firmware +1 moreD-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability4.3 Medium
- d-link dir-2640, dlink dir-2640 firmware +1 moreD-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- d-link network assistantD-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability7.3 High
- d-link dir-2150, dlink dir-2150 firmware +1 moreD-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability8.8 High
silverstripe/frameworkPackagistsilverstripe/framework ReadOnly transformation for formfields exploitable6.1 Mediumsilverstripe/frameworkPackagistSilverstripe Cross-site scripting vulnerability in VersionedRequestFilter6.1 Mediumsilverstripe/frameworkPackagistSilverstripe Missing CSRF protection in login form5.4 Mediumsilverstripe/frameworkPackagistSilverstripe Brute force bypass on default admin9.1 Criticalsilverstripe/frameworkPackagistSilverstripe XSS in CMS Edit Page6.1 Mediumsilverstripe/frameworkPackagistSilverstripe Hostname, IP and Protocol Spoofing through HTTP Headers6.5 Mediumsilverstripe/frameworkPackagistSilverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter4.3 Mediumsilverstripe/frameworkPackagistSilverstripe Missing security check on dev/build/defaults6.5 Medium- opentext dimensions rmDimensions RM - Privilege Escalation8.8 High
- opentext dimensions rmDimensions RM - Arbitrary File Read7.7 High
- italtel embraceAn issue was discovered in Italtel Embrace 1.6.4. The Web application does not properly check the parameters sent as input before they are processed on the server side. This allows authenticated users…4.1 Medium
- dedecmsThere is an arbitrary file upload vulnerability on the media add .php page in the backend of the website in version 5.7.114 of DedeCMS9.8 Critical
- inxeduAn arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.9.8 Critical
- inxedu, inexdu +1 moreAn arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.9.8 Critical
- inxeduAn arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.9.8 Critical
silverstripe/frameworkPackagistSilverstripe HtmlEditor embed url sanitisation4.3 Mediumsilverstripe/frameworkPackagistSilverstripe Form field validation message XSS vulnerability6.1 Mediumsilverstripe/frameworkPackagistSilverstripe framework is vulnerable to XSS in install.php6.1 Mediumsilverstripe/frameworkPackagistSilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation6.5 Mediumsilverstripe/frameworkPackagistSilverstripe XSS in dev/build returnURL Parameter4.7 Mediumsilverstripe/frameworkPackagistSilverstripe External redirection risk in Security?ReturnURL5.8 Medium- j2eefastJ2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function...9.8 Critical
- luckyframe luckyframewebLuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the...7.5 High
- Show moreLoading…